3.3 KiB
ADR 0006: Compiled GLS protocol runtime
- Status: accepted for the next HoloLake desktop candidate
- Date: 2026-08-17
Context
REPO-012 contains dozens of numbered GLS protocol sources. Human-readable source is necessary for authorship, review and causal meaning, but asking a model to reread protocol prose for every operation does not make the software obey the protocol. It also creates non-deterministic behavior and makes it impossible to distinguish a protocol that is merely present from one that is enforced by the running product.
Decision
Compile the current numbered GLS sources into a deterministic v2 runtime manifest pinned to an exact REPO-012 commit. Every selected source records its stable GLS number, path and SHA-256. Duplicate historical source locations are resolved by a deterministic source preference, while alternate-source counts remain visible. The compiler also reconciles the protocol registry, GLS entry, source manifest, architecture catalog and routing references, preserving their independent source hashes and rejecting registration conflicts.
Legacy depends arrays are not silently interpreted as runtime edges. They remain LEGACY_UNTYPED_REFERENCE audit edges and block new activation until their meaning is classified. Only dependencies declared by an explicit executable projection enter the runtime graph as RUNTIME_REQUIRES; that graph must be acyclic and dependency-closed.
An executable projection requires an explicit native adapter, event kinds, dependency list and fail-closed behavior. The compiler rejects missing executable dependencies and dependency cycles. The native runtime revalidates schema, source commit, counts, hashes, adapters and dependency closure before returning a protocol set to an organ.
Protocol prose is never evaluated as code. A protocol without an explicit projection remains INVENTORIED_NOT_EXECUTABLE. The initial executable set is GLS-0250, GLS-0253, GLS-0262 and GLS-0263. The zero-core numbering adapter requires their dependency-closed set before it can route a human number to an authoritative registry.
Why
This creates the same hard boundary that a real API presents: a caller must satisfy the machine contract whether or not it has read the explanatory documentation. It also preserves factual honesty. HoloLake can report that 75 protocol sources are compiled while separately reporting that only four currently have native enforcement projections.
Rejected alternatives
- Injecting all GLS prose into every model call: behavior would remain prompt-dependent and context growth would be unbounded.
- Treating every inventoried source as automatically active: source presence is not runtime enforcement.
- Executing scripts embedded in protocol documents: it would turn the authority source into an arbitrary-code supply chain.
- Hand-copying protocol decisions into unrelated organs: duplicated rules would drift and no common protocol set could be written into receipts.
- Blocking the product until all protocols are executable: incremental dependency-closed projections can be verified without overstating the remaining surface.
Evidence
scripts/compile-gls-runtime-registry.mjscontracts/gls-executable-projections.jsoncontracts/gls-runtime-registry.jsonsrc-tauri/src/gls_protocol_runtime.rssrc-tauri/src/zero_core_numbering.rsscripts/gls-protocol-runtime.test.mjs