---
status: accepted
date: 2026-08-10
---

# ADR 0173: Declarative hot-pluggable language-shell UI

## Context

HoloLake's visual language needs focused collaboration across independent UI人格体 without giving a
presentation package authority over identity, permission, planning, execution, or receipts. The existing
theme runtime only changes palettes and cannot replace a complete language-shell composition.

## Decision

HoloLake uses versioned declarative UI packages. A package owns layout, safe visual tokens, copy, and asset
references. The host owns semantic state and a small capability bridge. Version 1 exposes only goal submit,
one boundary answer, and evidence expansion. Four human surfaces are mandatory and system-internal surfaces
are forbidden.

Candidates are validated before activation. Activation replaces the whole package atomically and retains a
last-known-good package for rollback. Arbitrary plugin JavaScript is not executed in the desktop renderer.

## Consequences

UI contributors can redesign the complete language shell and publish packages independently. New behaviors
require a reviewed host capability revision, not an undeclared UI action. Repository registration is distinct
from app integration, artifact construction, installation, and runtime health.