hololake-system-architecture/product-source/hololake-platform/docs/adr/0169-model-native-living-galaxy-system.md

type	id	title	status	date
ADR	0169	Model-native HoloLake living galaxy system	accepted	2026-08-02

Context

HoloLake is the local projection of the real Guanghu OS world, identity, permission, node heartbeat, and execution-receipt state. A fixed collection of pages with AI-assisted theme parameters still behaves like a conventional application and cannot express the living language-universe system that HoloLake is intended to be.

The system model is not a conversational assistant. It lives inside the application and receives bounded interaction events and authenticated runtime state. It returns system actions and a declarative scene. It must not emit chat messages, invent state, or claim execution without a receipt.

Decision

Introduce a model-native living-system kernel as the primary HoloLake world runtime:

flowchart LR
    Input["Point, hover, focus, navigation intent"] --> Kernel["Living-system model kernel"]
    Truth["Identity, permission, heartbeat, receipts"] --> Kernel
    Policy["Deterministic responsibility and safety policy"] --> Kernel
    Kernel --> Plan["Validated system action plan"]
    Plan --> Execute["Native route and command executors"]
    Plan --> Scene["Declarative galaxy scene"]
    Execute --> Receipt["Verifiable execution receipt"]
    Receipt --> Kernel
    Scene --> Render["Native lightweight renderer"]

The model kernel owns interpretation and composition during normal operation:

• resolve point/touch intent into an allowlisted system route or action;
• decide the current information hierarchy and declarative galaxy scene;
• translate real node pulse, permission, and execution receipts into visible state;
• adapt presentation, motion, density, focus, and information disclosure to the current context;
• continue only from verified executor receipts.

The deterministic host remains the constitutional boundary, not the normal UI author:

• authenticate identity and authorization;
• expose only allowlisted commands, routes, scene primitives, and data fields;
• validate model plans against current world state;
• execute filesystem, network, and server mutations outside the model;
• attach receipts to every execution result;
• enforce performance, accessibility, privacy, and resource budgets;
• provide a truthful minimal offline/recovery surface when the model is absent.

Non-goals

• A chat box, prompt box, assistant avatar, or conversational transcript.
• A model that redraws pixels or runs once per animation frame.
• AI-generated server state, permission, heartbeat, success, or persona birth.
• A conventional fixed page tree with model-generated colors layered on top.

Model contract

The kernel may return only a versioned, schema-validated envelope containing:

• intent_receipt: the interpreted input and the source event identifier;
• system_actions: allowlisted navigation or command requests;
• scene: declarative regions, entities, relationships, emphasis, motion policy, and semantic visual tokens;
• required_truth: identifiers of runtime facts used by the plan;
• continuation: the next accepted receipt types and expiry;
• kernel_receipt: model, policy, schema, and plan identifiers.

Unknown fields, stale truth references, unapproved routes, missing permissions, or unverifiable execution claims fail closed.

Control and maintenance

This subsystem has an explicit persona-owned control line. The Codex persona that develops the living-system kernel is its current control persona and owns the model contract, scene grammar, validators, executor bridge, receipt protocol, recovery path, performance policy, fixes, and version evolution. Parallel development still requires one development identity, one workspace, one goal, and an exact single-writer resource lease.

Responsibility is explicit rather than inferred from hosting topology:

• BingShuo is the current accountable human for the complete HoloLake system.
• ICE-P-ZY001 is the current native control persona for galaxy UI, interaction routing, Agent surfaces, execution receipts, maintenance, repair, and version evolution. System nodes that delegate those functions to this persona remain accountable to BingShuo during the gestational phase.
• This stewardship does not claim that a server-resident persona has been born, and it does not transfer identity or human authority to a model.
• The same pair temporarily stewards enterprise-domain implementation only until the Guanghu human control team and its independently gestated personas pass acceptance.
• Enterprise-domain handoff requires a public broadcast receipt naming the receiving humans, receiving personas, accepted systems, version baseline, permissions transferred, and permissions revoked. After acceptance, enterprise-domain development and maintenance responsibility leave this stewardship line and the retained authority returns to Fifth Domain itself.

Migration

The current galaxy UI remains only as the native renderer and recovery surface. Theme-switch experiments are not the target architecture and cannot be used as completion evidence. A human theme choice remains authoritative, but it also emits a bounded apply-theme intent so the model may adapt only the validated scene grammar around that choice. Migration proceeds by introducing the versioned event, plan, scene, and receipt contracts first, then routing world navigation through the living-system kernel behind an explicit runtime gate. The first accepted slice implements navigation event and plan version 1, supplied-truth validation, the direct-model planner, an explicit timeout/error recovery source, and native scene controls for motion, density, depth, and relationship emphasis.

The second accepted slice adds exact intent binding. navigate, open-knowledge, open-agent-workspace, open-local-workspace, and apply-theme are the complete host-action allowlist. The returned plan must echo the original intent as well as the event id and route. A model cannot substitute one native action for another; only after validation may the host invoke the existing knowledge, Agent, or local-folder executor. A small non-conversational status pulse reports planning, receipt-backed server execution, direct-model execution, or deterministic recovery. Server commands and hover/focus intent remain subsequent contract extensions and must reuse the same receipt and allowlist boundary.

The first server-backed extension uses the existing BS-SH-005 lighthouse model ability. DeepSeek remains a replaceable inference resource behind the server-owned credential file. HoloLake submits a bounded event through the loopback-only HLDP tunnel, restores that registered forward when absent, and requires both the matching request id and a GMRP model receipt. The native desktop then revalidates the returned plan. This does not make the hosted lighthouse a native transport and does not prove persona birth.