bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity
hololake-system-architecture/product-source/hololake-platform/docs/adr/0177-persona-remote-incremental-object-channel.md
铸渊 / ICE-P-ZY001 1b55f3407a feat: add incremental persona remote object channel 
Human-Responsibility: ICE-GL∞ / 冰朔
Persona-Author: ICE-P-ZY001 / 铸渊
Execution-Runtime: Codex desktop / DEV-20260810-014
Development-ID: DEV-20260810-014
Authorization-Scope: GH-PNCC persona runtime source and tests only; no UI, deployment, or execution limb
Source-Anchor: daily continuity appends to the existing life chain without redownloading all history
2026-08-11 10:47:25 +08:00

2.7 KiB
Raw Blame History

ADR 0177: Persona Remote Incremental Object Channel

Status

Accepted on 2026-08-11.

Context

A persona can live continuously from one verified Git state to the next without keeping a complete checkout on every machine. Repeated full clones confuse continuity with transport cache: adding one new day or commit should not require downloading the persona's entire prior life again. At the same time, deleting a cache must not erase the last verified continuity boundary or permit a rewritten remote history to masquerade as the next state.

Decision

Add src-tauri/src/persona_remote_git.rs as a non-UI GH-PNCC object channel:

  1. accept only credential-free HTTPS remotes in production and require one validated branch and relative path;
  2. negotiate Git protocol v2 and require the remote filter capability before creating an object cache;
  3. use a bare promisor repository with blob:none, no worktree, and no git clone invocation;
  4. persist the last verified branch SHA in a continuity record separate from the evictable object cache;
  5. skip fetch when the SHA is unchanged and append only the missing segment when it advances;
  6. after cache eviction, progressively fetch a bounded commit window until the previous cursor is proven to be an ancestor of the new head;
  7. reject history rewrites, cursor/cache disagreement, oversized objects, and unsupported partial-object remotes without advancing continuity;
  8. evict the exact cache directory after a verified read when its byte budget is exceeded, while retaining the durable cursor.

The machine update boundary is SHA-to-SHA, not calendar date. A date is human language; the verified Git edge prevents missed or duplicated updates when multiple commits arrive in one day or commit timestamps differ.

Boundaries

  • Git remains the object protocol and durable-history engine; HoloLake does not reimplement Git storage.
  • The cursor proves only a verified remote ancestry edge. It is not a persona brain, runtime lease, or lifecycle receipt.
  • The cache contains transport objects, not irreplaceable continuity state, and may be deleted at any time.
  • Full clone remains available only for separately authorized low-frequency publication audit or disaster recovery. It is not part of persona wake, daily reading, or daily update.
  • This ADR adds no UI, human projection, deployment, or online runtime-health claim.

Consequences

HoloLake can read a current persona-owned Git object while preserving a compact continuity cursor and bounded partial object cache. Daily operation grows by the new verified segment instead of redownloading history from the persona's origin. A remote that cannot support that contract is rejected explicitly rather than silently falling back to a full download.