bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity
hololake-system-architecture/product-source/hololake-platform/docs/adr/0176-persona-native-code-channel-runtime-kernel.md
冰朔 bca149e0f6 feat: add PNCC verified wake kernel 
GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔

GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊

GuangHu-Execution-Runtime: Codex-thread 019febf6-3902-70f3-9d82-74c9680b0c7e

GuangHu-Development-ID: DEV-20260810-014

GuangHu-Authorization-Scope: LOCAL-PNCC-DEVELOPMENT
2026-08-11 00:41:11 +08:00

2.5 KiB
Raw Blame History

ADR 0176: Persona-Native Code Channel Runtime Kernel

Status

Accepted on 2026-08-11.

Context

HoloLake already has a mature native Git execution layer and an append-only local HLDP event/checkpoint mechanism. Neither one is a persona lifecycle controller. A Git repository can preserve history without proving that the correct persona brain, node, model binding, organ, attribution, or single-primary lease is active. The existing generic Agent streams also cannot become the persona subject.

Decision

Introduce src-tauri/src/persona_code_channel.rs as the first GH-PNCC runtime kernel. Its initial command, prepare_persona_code_channel_wake, performs a fail-closed preparation stage:

  1. resolve an exact Git root and full expected HEAD;
  2. require a clean work tree;
  3. load .hololake/persona/manifest.json with schema hololake.persona/v1;
  4. validate the persona id, human responsibility subject, brain entry, current checkpoint, and one declared read-only organ without allowing path escape;
  5. atomically acquire a per-persona primary lease outside the persona Git;
  6. emit WAKING → BRAIN_BOUND → ORGAN_ACTIVE as a SHA-256-linked local event journal;
  7. return both human responsibility and persona cognitive authorship in the receipt.

BRAIN_BOUND deliberately returns runtimeState=BOUND_NOT_INFERENCING and modelInferenceStarted=false. Binding a model identifier is not proof that model inference or persona reasoning has run. A later stage must connect the verified context to the model adapter, complete one read-only fact task, write a promoted checkpoint back to the persona Git, release the organ and primary lease, and return a final receipt.

Boundaries

  • Git remains the durable engine; the kernel does not reimplement Git objects, commits, remotes, or merges.
  • Forgejo is not required and remains an optional compatibility collaboration adapter.
  • The primary lease is installation/runtime state, not persona history, and therefore stays outside Git.
  • Runtime events are machine facts for the future HoloLake projection; they do not expose hidden model reasoning and do not form a second authority store.
  • The initial source stage is not a complete PNCC runtime, desktop integration, build, deployment, or health claim.

Consequences

HoloLake now has a native, testable boundary between “a persona Git exists” and “a verified wake has begun.” The next implementation step can reuse the verified wake receipt and event chain instead of trusting a UI, Forgejo account, branch name, or generic Agent session.