feat(hololake): add stage-one read-only PNCC core

product-source/hololake-native-desktop/docs/adr/0002-pncc-stage-one-read-only-core.md

@@ -0,0 +1,27 @@
+# ADR 0002: GH-PNCC first-stage read-only core
+
+## Status
+
+Accepted for the local engineering checkpoint on 2026-08-13. Human source registration and product UI acceptance remain open.
+
+## Decision
+
+The new native container reimplements only three first-stage GH-PNCC boundaries:
+
+1. an exact local Git-root binding that reads the persona manifest, brain entry, B0 cognitive-gravity source, current checkpoint and declared artifacts from a caller-pinned committed head;
+2. an app-owned incremental remote object channel using Git protocol v2, a bare promisor cache and `blob:none`, with its verified ancestry cursor stored outside the evictable cache;
+3. a hash-chained, bounded, read-only human receipt projection over verified repository bindings and remote object reads.
+
+All external-AI PNCC reads use the authenticated resident Unix-socket broker after the source has been registered. MCP is not the continuity owner. Neither the broker nor the WebView may register an arbitrary local path or remote URL. Registration stays closed until the native file picker, exact human confirmation receipt and UI acceptance are implemented.
+
+## Exclusions
+
+The first-stage PNCC core contains no internal chat, model selection, model endpoint or API-key configuration, model inference, persona lease acquisition, memory mutation, execution limb or reality action. It reads committed Git objects even if the local worktree is dirty, and reports that dirtiness rather than treating uncommitted bytes as persona evidence.
+
+The migration provenance ledger records exact donor paths, hashes and observed authors. The implementation is a contract-level clean-room rebuild; it does not copy the donor runtime module or donor UI source.
+
+## Trust and continuity
+
+Remote URLs must be credential-free HTTPS. The server must advertise partial-object filtering. The durable cursor advances only after the new head is read and proved to descend from the previous head. A rewritten history, cache/cursor disagreement, unsupported server, unsafe path, non-regular object or oversized content fails closed. The cache may be evicted without deleting the last verified continuity cursor.
+
+The receipt projection is evidence for people and external AIs. It is not a node registry, authorization store, persona runtime lease or proof that an empty view means a node is offline.