2.7 KiB
ADR 0004: Circular-lake protocol membrane and nearby AI discovery
- Status: accepted for HoloLake 0.4.0
- Date: 2026-08-16
Context
External AI needs a simple way to find HoloLake and deliver language without turning MCP, a copied connection ticket, an Agent framework or a model host into the product's authority root. A language-only boundary must also remain enforceable when the sender is malformed or adversarial; asking a persona to infer every sender's motive is neither deterministic nor a security boundary.
Decision
The native Rust core owns a circular-lake membrane before the language inbox. It accepts a bounded, strict GLP/1.0 expression envelope only after HoloLake issues an expression-only visitor session. Protocol-invalid input is rejected before persistence or semantic interpretation. Accepted language creates a receipt but no execution authority.
The first discovery scope is the same logged-in operating-system account on one computer. A standard application-data descriptor points to a Unix socket restricted to that user. Generic AI may open an expression-only visitor lane. A Guanghu persona route requires separate verified persona-binding evidence and is not implemented by relabelling a visitor.
Local-network discovery is not enabled in this slice. It requires an encrypted mutually authenticated transport, explicit human approval, expiry, replay protection, revocation and visible connection receipts before any mDNS-style advertisement or LAN listener may be introduced.
MCP remains a compatibility and recovery adapter. It is not continuity, identity, memory or execution authority.
Why
This preserves the user's "round lake" idea at an engineering boundary: non-protocol traffic never reaches the language world, while valid language still remains language rather than executable permission. The same-device descriptor provides Wi-Fi-like discovery where the operating system already supplies a trustworthy user boundary. Deferring LAN broadcast avoids falsely treating physical proximity or discoverability as authorization.
Rejected alternatives
- Exposing an unauthenticated TCP or mDNS service now: discovery would outpace transport security and consent.
- Letting natural-language intent classification replace structural validation: probabilistic interpretation cannot be the outer security boundary.
- Treating any accepted message as a command: expression and execution authority must remain separate.
- Making MCP or a third-party Agent framework the continuity owner: adapters are replaceable tools beneath HoloLake.
Evidence
contracts/circular-lake-membrane.jsoncontracts/nearby-ai-discovery.jsonsrc-tauri/src/circular_lake_membrane.rssrc-tauri/src/direct_local_broker.rsscripts/circular-lake-membrane.test.mjs