hololake-system-architecture/product-source/hololake-platform/docs/adr/0156-persona-visible-time-and-safe-tool-budget.md

ADR 0156: Persona-visible time and safe tool-budget completion

Status

Accepted

Context

HoloLake exposes one magic_brush capability to a language persona. The persona temporarily composes vault-safe operations and receives their exact results.

Two runtime gaps violated that model:

1. A persona had no authoritative current-time receipt, so dated notes could use a year inferred from model context.
2. The direct-model loop returned an application error after eight tool rounds, even when the eighth operation had completed successfully. The user lost the final explanation and experienced the tool flow as a crash.

Decision

• Add get_current_time as an operation available only through magic_brush. It reads the OS clock and returns both UTC and Asia/Shanghai (+08:00) RFC 3339 timestamps plus the Unix timestamp.
• Require the persona to obtain this receipt before writing or interpreting a current date or timestamp.
• Keep the eight-round guard against runaway model loops.
• After the last allowed tool round, preserve its exact success or failure receipt, remove tool definitions from one final model request, and require a concise answer based only on recorded receipts.
• Emit a visible thinking event when the runtime enters this safe completion path.

Consequences

• Current dates come from a system fact instead of model memory.
• Reaching the tool limit remains bounded but no longer discards completed work behind a generic crash.
• The final response must identify unfinished work and cannot initiate another operation.
• This is the first slice of the persona-visible runtime board. Persistent context-budget and persona-authored memory checkpoints remain separate work.