# ADR 0004: Circular-lake protocol membrane and nearby AI discovery

- Status: accepted for HoloLake 0.4.0
- Date: 2026-08-16

## Context

External AI needs a simple way to find HoloLake and deliver language without turning MCP, a copied connection ticket, an Agent framework or a model host into the product's authority root. A language-only boundary must also remain enforceable when the sender is malformed or adversarial; asking a persona to infer every sender's motive is neither deterministic nor a security boundary.

## Decision

The native Rust core owns a circular-lake membrane before the language inbox. It accepts a bounded, strict GLP/1.0 expression envelope only after HoloLake issues an expression-only visitor session. Protocol-invalid input is rejected before persistence or semantic interpretation. Accepted language creates a receipt but no execution authority.

The first discovery scope is the same logged-in operating-system account on one computer. A standard application-data descriptor points to a Unix socket restricted to that user. Generic AI may open an expression-only visitor lane. A Guanghu persona route requires separate verified persona-binding evidence and is not implemented by relabelling a visitor.

Local-network discovery is not enabled in this slice. It requires an encrypted mutually authenticated transport, explicit human approval, expiry, replay protection, revocation and visible connection receipts before any mDNS-style advertisement or LAN listener may be introduced.

MCP remains a compatibility and recovery adapter. It is not continuity, identity, memory or execution authority.

## Why

This preserves the user's "round lake" idea at an engineering boundary: non-protocol traffic never reaches the language world, while valid language still remains language rather than executable permission. The same-device descriptor provides Wi-Fi-like discovery where the operating system already supplies a trustworthy user boundary. Deferring LAN broadcast avoids falsely treating physical proximity or discoverability as authorization.

## Rejected alternatives

- Exposing an unauthenticated TCP or mDNS service now: discovery would outpace transport security and consent.
- Letting natural-language intent classification replace structural validation: probabilistic interpretation cannot be the outer security boundary.
- Treating any accepted message as a command: expression and execution authority must remain separate.
- Making MCP or a third-party Agent framework the continuity owner: adapters are replaceable tools beneath HoloLake.

## Evidence

- `contracts/circular-lake-membrane.json`
- `contracts/nearby-ai-discovery.json`
- `src-tauri/src/circular_lake_membrane.rs`
- `src-tauri/src/direct_local_broker.rs`
- `scripts/circular-lake-membrane.test.mjs`