20260826 两宿主全线正本/回执/状态 + 协议正本地图v1.2 + 模板/镜面/坑清单（元审计收敛commit；前人未提交改动未碰）

ZCODE-DEV-20260826/public-spine/shell-frozen-src/docs/adr/0001-dynamic-capability-routing.md

@@ -0,0 +1,22 @@
+# ADR 0001: Signed dynamic capability routing
+
+Status: Accepted locally; production trust provisioning pending.
+
+## Context
+
+Stage one must connect a changing fleet of team and user-owned nodes without hardcoded endpoints. SSH access, root access, a URL, or a health probe cannot establish Guanghu node identity or write authority. The client must also preserve the one-human-one-owned-root-node boundary and avoid becoming a hosted concurrency layer.
+
+## Decision
+
+Use a Rust-owned, file-backed dynamic registry whose complete canonical payload is verified with an independently embedded Ed25519 trust root. Each node carries a protocol public key and explicit human, persona, domain and capability bindings. Runtime eligibility additionally requires a fresh Ed25519 health receipt from that node with a strictly increasing sequence.
+
+Route resolution is available to external programming AI only through an authenticated active local HoloLake session. It returns a non-authorizing route receipt. Webview code cannot install registries or submit health receipts.
+
+The embedded trust file initially contains no signer. This makes production registry installation fail closed until the registered HoloLake/JD-controller signing identity is provisioned.
+
+## Consequences
+
+- The fleet can grow without client code changes or fixed server slots.
+- Stale, replayed, unsigned or incorrectly bound nodes are not routable.
+- Registry publication, health, route selection and write admission remain separate facts.
+- Production node enrollment and write execution still require their own source, signing, deployment and readback receipts.

ZCODE-DEV-20260826/public-spine/shell-frozen-src/docs/adr/0002-pncc-stage-one-read-only-core.md

@@ -0,0 +1,27 @@
+# ADR 0002: GH-PNCC first-stage read-only core
+
+## Status
+
+Accepted for the local engineering checkpoint on 2026-08-13. Human source registration and product UI acceptance remain open.
+
+## Decision
+
+The new native container reimplements only three first-stage GH-PNCC boundaries:
+
+1. an exact local Git-root binding that reads the persona manifest, brain entry, B0 cognitive-gravity source, current checkpoint and declared artifacts from a caller-pinned committed head;
+2. an app-owned incremental remote object channel using Git protocol v2, a bare promisor cache and `blob:none`, with its verified ancestry cursor stored outside the evictable cache;
+3. a hash-chained, bounded, read-only human receipt projection over verified repository bindings and remote object reads.
+
+All external-AI PNCC reads use the authenticated resident Unix-socket broker after the source has been registered. MCP is not the continuity owner. Neither the broker nor the WebView may register an arbitrary local path or remote URL. Registration stays closed until the native file picker, exact human confirmation receipt and UI acceptance are implemented.
+
+## Exclusions
+
+The first-stage PNCC core contains no internal chat, model selection, model endpoint or API-key configuration, model inference, persona lease acquisition, memory mutation, execution limb or reality action. It reads committed Git objects even if the local worktree is dirty, and reports that dirtiness rather than treating uncommitted bytes as persona evidence.
+
+The migration provenance ledger records exact donor paths, hashes and observed authors. The implementation is a contract-level clean-room rebuild; it does not copy the donor runtime module or donor UI source.
+
+## Trust and continuity
+
+Remote URLs must be credential-free HTTPS. The server must advertise partial-object filtering. The durable cursor advances only after the new head is read and proved to descend from the previous head. A rewritten history, cache/cursor disagreement, unsupported server, unsafe path, non-regular object or oversized content fails closed. The cache may be evicted without deleting the last verified continuity cursor.
+
+The receipt projection is evidence for people and external AIs. It is not a node registry, authorization store, persona runtime lease or proof that an empty view means a node is offline.

ZCODE-DEV-20260826/public-spine/shell-frozen-src/docs/adr/0003-public-domain-router-and-user-native-gh-pncc.md

@@ -0,0 +1,24 @@
+# ADR 0003: Public number routing precedes a HoloLake-owned GH-PNCC
+
+- Status: accepted; public routing shell and local GH-PNCC slice implemented
+- Date: 2026-08-16
+
+## Context
+
+HoloLake is a public product for five independent domains. The fifth domain is private, while the other four domains belong to the enterprise reality body. A common client cannot ask every user to log in to the fifth-domain Forgejo, and it cannot infer authority from the visual shape of a number.
+
+Each trusted user also needs one durable code channel bound to the registered number and account. Git already supplies the right history engine, but neither a generic Git browser nor a Forgejo page is the HoloLake product shell.
+
+## Decision
+
+The unauthenticated home shows the five public domain vestibules and one number entry. The user submits a number without choosing a domain. A registered internal router must resolve that number to one known domain and obtain an explicit verdict from the responsible registry. The fifth-domain registry is maintained inside the authorized fifth-domain system. The enterprise four-domain registries are served by the enterprise root server. Only a successful exact route may reveal the selected domain and load its own account and node login.
+
+After domain routing, number verification and domain-specific account authentication, the Rust core derives a stable opaque repository id from the trusted tuple and idempotently creates or restores a private Git repository. HoloLake owns the human projection. Forgejo remains an optional remote collaboration adapter. Credentials never enter the repository, and local channel creation does not claim persona binding or remote authority.
+
+## Server boundary
+
+The enterprise root server runs an enterprise-domain Guanghu OS runtime, not a clone of the fifth-domain body. Its controller, manifests, repositories, registries and responsibility are independent. Linux may remain the subordinate hardware/service/rescue bridge. Ordinary personal nodes install the HoloLake node runtime rather than replacing their operating system.
+
+## Current reality
+
+Only the fifth-domain login adapter is currently provisioned. Enterprise cards are public and visible, but their account login remains fail-closed until an enterprise root server, signed route registration, number registries, node registration and domain handoff endpoints exist. The implementation must display this as unavailable, not simulate a successful login.

ZCODE-DEV-20260826/public-spine/shell-frozen-src/docs/adr/0004-circular-lake-protocol-membrane-and-nearby-ai-discovery.md

@@ -0,0 +1,37 @@
+# ADR 0004: Circular-lake protocol membrane and nearby AI discovery
+
+- Status: accepted for HoloLake 0.4.0
+- Date: 2026-08-16
+
+## Context
+
+External AI needs a simple way to find HoloLake and deliver language without turning MCP, a copied connection ticket, an Agent framework or a model host into the product's authority root. A language-only boundary must also remain enforceable when the sender is malformed or adversarial; asking a persona to infer every sender's motive is neither deterministic nor a security boundary.
+
+## Decision
+
+The native Rust core owns a circular-lake membrane before the language inbox. It accepts a bounded, strict GLP/1.0 expression envelope only after HoloLake issues an expression-only visitor session. Protocol-invalid input is rejected before persistence or semantic interpretation. Accepted language creates a receipt but no execution authority.
+
+The first discovery scope is the same logged-in operating-system account on one computer. A standard application-data descriptor points to a Unix socket restricted to that user. Generic AI may open an expression-only visitor lane. A Guanghu persona route requires separate verified persona-binding evidence and is not implemented by relabelling a visitor.
+
+Local-network discovery is not enabled in this slice. It requires an encrypted mutually authenticated transport, explicit human approval, expiry, replay protection, revocation and visible connection receipts before any mDNS-style advertisement or LAN listener may be introduced.
+
+MCP remains a compatibility and recovery adapter. It is not continuity, identity, memory or execution authority.
+
+## Why
+
+This preserves the user's "round lake" idea at an engineering boundary: non-protocol traffic never reaches the language world, while valid language still remains language rather than executable permission. The same-device descriptor provides Wi-Fi-like discovery where the operating system already supplies a trustworthy user boundary. Deferring LAN broadcast avoids falsely treating physical proximity or discoverability as authorization.
+
+## Rejected alternatives
+
+- Exposing an unauthenticated TCP or mDNS service now: discovery would outpace transport security and consent.
+- Letting natural-language intent classification replace structural validation: probabilistic interpretation cannot be the outer security boundary.
+- Treating any accepted message as a command: expression and execution authority must remain separate.
+- Making MCP or a third-party Agent framework the continuity owner: adapters are replaceable tools beneath HoloLake.
+
+## Evidence
+
+- `contracts/circular-lake-membrane.json`
+- `contracts/nearby-ai-discovery.json`
+- `src-tauri/src/circular_lake_membrane.rs`
+- `src-tauri/src/direct_local_broker.rs`
+- `scripts/circular-lake-membrane.test.mjs`

ZCODE-DEV-20260826/public-spine/shell-frozen-src/docs/adr/0005-authenticated-development-lane-projection.md

@@ -0,0 +1,34 @@
+# ADR 0005: Authenticated development lane projection
+
+- Status: accepted for the next HoloLake desktop candidate
+- Date: 2026-08-17
+
+## Context
+
+The same-device HoloLake broker can already discover an external AI, open an expression-only visitor session, and resume a HoloLake-issued authenticated session. The local development bridge can already enforce one writer per account, but it is reachable only from the WebView command surface. As a result, an external programming carrier can be visibly connected while still being unable to acquire the HoloLake-owned development lane. The system page also cannot distinguish a connected visitor from an active development writer.
+
+## Decision
+
+Expose acquire, inspect, and release operations for the existing local development lane through the user-only Unix broker. Every operation requires a non-visitor HoloLake session. The session account must equal the lane account, the session lane must equal the requested write lane, and the session client instance must equal the requested writer instance. A generic expression-only visitor is rejected before any lane mutation.
+
+Project the active lane and writer on the HoloLake system-details page by reading the same Rust-owned bridge state. The projection does not create authority and is not a second state store.
+
+This slice establishes the controlled writer handoff only. It does not yet provide a general shell, file mutation, patch, build, deployment, model, persona binding, or reality-execution engine.
+
+## Why
+
+The user needs to see whether development is merely connected or has actually switched into HoloLake's single-writer environment. Reusing the existing session and writer kernels closes that gap without turning socket discovery, MCP, or a visitor message into execution authority.
+
+## Rejected alternatives
+
+- Letting any same-device visitor acquire a write lane: discovery and expression are not authorization.
+- Maintaining a separate UI-only development status: it would create a second truth source.
+- Calling the lane handoff a complete native development container: the programming tool loop and supervised execution engine remain unimplemented.
+
+## Evidence
+
+- `src-tauri/src/direct_local_broker.rs`
+- `src-tauri/src/direct_local_session.rs`
+- `src-tauri/src/local_development_bridge.rs`
+- `src/main.tsx`
+- `contracts/local-development-bridge.json`

ZCODE-DEV-20260826/public-spine/shell-frozen-src/docs/adr/0006-compiled-gls-protocol-runtime.md

@@ -0,0 +1,46 @@
+# ADR 0006: Compiled GLS protocol runtime
+
+- Status: accepted for the next HoloLake desktop candidate
+- Date: 2026-08-17
+
+## Context
+
+REPO-012 contains dozens of numbered GLS protocol sources. Human-readable source is necessary for authorship, review and causal meaning, but asking a model to reread protocol prose for every operation does not make the software obey the protocol. It also creates non-deterministic behavior and makes it impossible to distinguish a protocol that is merely present from one that is enforced by the running product.
+
+## Decision
+
+Compile the current numbered GLS sources into a deterministic v2 runtime manifest pinned to an exact REPO-012 commit. Every selected source records its stable GLS number, path and SHA-256. Duplicate historical source locations are resolved by a deterministic source preference, while alternate-source counts remain visible. The compiler also reconciles the protocol registry, GLS entry, source manifest, architecture catalog and routing references, preserving their independent source hashes and rejecting registration conflicts.
+
+Legacy `depends` arrays are not silently interpreted as runtime edges. Bootstrap Compiler v1 classifies every source edge as `NORMATIVE_REFERENCE`, `SCHEMA_IMPORT`, `BUILD_REQUIRES`, `BOOT_REQUIRES`, `RECOVERY_REQUIRES` or `EVIDENCE_ONLY`; all remain audit-only. Only dependencies declared by an explicit executable projection enter the runtime graph as `RUNTIME_REQUIRES`; that graph must be acyclic and dependency-closed. The current exact source produces 183 typed source edges and zero unclassified edges.
+
+An executable projection requires an explicit native adapter, event kinds, dependency list and fail-closed behavior. The compiler rejects missing executable dependencies and dependency cycles. The native runtime revalidates schema, source commit, counts, hashes, adapters and dependency closure before returning a protocol set to an organ.
+
+Protocol prose is never evaluated as code. A protocol without an explicit projection remains `INVENTORIED_NOT_EXECUTABLE`. The product now embeds 25 dependency-closed projections: four P0 foundation contracts and 21 P1-P6 protocol organs. They provide the strict GLP codec, identity/context guards, hash-chain decision ledger, session/heartbeat/work-order/witness rules, causal time/memory/state guards, module/lifecycle/scheduler/control state machines, external/model/temporary-capability boundaries and the restricted HLDP-NP → GIR bootstrap compiler.
+
+The kernel is an application-start prerequisite. If its embedded contract, projection closure, deterministic compiler self-check or local receipt/state ledger cannot load, HoloLake fails closed during startup. Receipt append and state-machine transition use one immediate SQLite transaction, so stale work-order/lifecycle transitions, conflicting time or broadcast owners, immutable module replacement and cross-owner runway release cannot race past the guards. Concurrent memory/state inputs are stored as conflicts rather than overwritten. The ledger stores per-user receipts and projections in application data; protocol authority and enforcement code are compiled into the signed application bundle and do not depend on the development machine.
+
+P7 is intentionally different: the application embeds an 11-item target capability assembly registry for GLS-0836 and GLS-0840–0849, but records zero desktop physical capabilities as verified. Evidence from BS-SH-005 or JD-FD-PRIMARY is never transferred into desktop health. A target becomes active only after its own version-bound evidence exists.
+
+## Why
+
+This creates the same hard boundary that a real API presents: a caller must satisfy the machine contract whether or not it has read the explanatory documentation. It also preserves factual honesty. HoloLake reports 75 inventoried sources, 25 native enforcement projections and 50 non-executable sources separately.
+
+## Rejected alternatives
+
+- Injecting all GLS prose into every model call: behavior would remain prompt-dependent and context growth would be unbounded.
+- Treating every inventoried source as automatically active: source presence is not runtime enforcement.
+- Executing scripts embedded in protocol documents: it would turn the authority source into an arbitrary-code supply chain.
+- Hand-copying protocol decisions into unrelated organs: duplicated rules would drift and no common protocol set could be written into receipts.
+- Blocking the product until all protocols are executable: incremental dependency-closed projections can be verified without overstating the remaining surface.
+
+## Evidence
+
+- `scripts/compile-gls-runtime-registry.mjs`
+- `contracts/gls-executable-projections.json`
+- `contracts/gls-runtime-registry.json`
+- `src-tauri/src/gls_protocol_runtime.rs`
+- `src-tauri/src/gls_protocol_kernel.rs`
+- `src-tauri/src/gls_bootstrap_compiler.rs`
+- `contracts/gls-native-runtime-kernel.json`
+- `src-tauri/src/zero_core_numbering.rs`
+- `scripts/gls-protocol-runtime.test.mjs`

ZCODE-DEV-20260826/public-spine/shell-frozen-src/docs/adr/0007-cross-platform-programming-ai-terminal-link.md

@@ -0,0 +1,39 @@
+# ADR 0007: Cross-platform programming-AI terminal link
+
+- Status: implemented in source; installed acceptance remains per platform
+- Date: 2026-08-17
+
+## Context
+
+An external programming AI must remain attached to a HoloLake-owned work environment without making MCP stability, one chat window, or model protocol recall the continuity root. The product is not macOS-only: Windows and Linux must enforce the same session and write semantics even though their local IPC primitives differ.
+
+## Decision
+
+Embed `HOLOLAKE_TERMINAL_LINK/2` in the native HoloLake executable. macOS and Linux use a mode-0600 Unix socket inside a mode-0700 runtime directory. Windows uses a local Named Pipe with a protected DACL granting full access only to Local System and the creating object owner. All platforms additionally require HoloLake session authentication.
+
+The installed executable exposes `--connector` as sequential newline-delimited JSON. It reloads the broker descriptor after transport loss. If an operation may have reached HoloLake but its response was lost, the connector reports an uncertain response and does not blindly replay it.
+
+Opening or resuming a session establishes continuity in HoloLake. The authenticated client then acquires the account's single development writer and obtains a short-lived work-environment frame. Heartbeats refresh both durable session observation and that frame. The frame contains the HoloLake runtime owner, session and event cursor, writer match, compiled GLS runtime identity, expiry and digest. It explicitly says that model-side protocol restoration is not required.
+
+## Boundary
+
+This decision completes the first-stage control plane, not the second-stage Agent executor. It does not grant a supervised shell, arbitrary file mutation, build, publication, deployment, persona binding or reality-execution authority. Those require separate typed operations, approvals and receipts.
+
+Cross-compilation of the isolated Linux Unix-socket adapter is evidence for source portability only. It is not installed-runtime acceptance. The Windows implementation additionally passes a full Tauri build and 110 native tests on the registered Windows Server 2022 x64 build node. That node has no authenticated HoloLake private account, so application-level installed broker readback remains separate and unobserved. Linux installed readback must likewise occur on a real registered desktop target rather than being inferred from a server or macOS cross-compile.
+
+## Rejected alternatives
+
+- TCP loopback as the common denominator: it broadens the local attack surface and weakens the operating-system account boundary.
+- A macOS implementation with Windows and Linux documentation only: transport portability without compiled adapters is not an implementation.
+- Replaying a request automatically after a broken response: a mutation could execute twice.
+- Asking every newly started model to reread all GLS prose: protocols are HoloLake runtime code, not model memory.
+- Calling the control plane an Agent shell: the supervised execution organ is the next phase.
+
+## Evidence
+
+- `src-tauri/src/direct_local_broker.rs`
+- `src-tauri/src/direct_local_session.rs`
+- `src-tauri/src/local_development_bridge.rs`
+- `src/main.tsx`
+- `contracts/programming-ai-terminal-link.json`
+- `scripts/programming-ai-terminal-link.test.mjs`

ZCODE-DEV-20260826/public-spine/shell-frozen-src/docs/adr/ADR-CODEX-CURRENT-CONTROLLER-EPOCH-AND-ONE-SHOT-WRITE-LEASE-20260819.md

@@ -0,0 +1,50 @@
+# ADR: Codex current-controller epoch and one-shot write lease
+
+Date: 2026-08-19
+State: accepted source contract; host integration package implemented
+
+## Context
+
+Multiple Codex tasks can remain alive at the same time. A task may hold a real
+human authorization from an older conversation and continue using tools after
+the human has moved to a newer language channel. A prompt reminder cannot
+deterministically revoke the older task's tool capability. Task-to-task
+delegation can also be misclassified as direct human speech if every
+`UserPromptSubmit` is labeled identically.
+
+## Decision
+
+1. Direct human input creates a new global local `control_epoch` bound to the
+   exact Codex session and turn.
+2. Known task delegation and system/agent delivery are separate source classes.
+   They do not claim direct-human provenance, TCS human perception, controller
+   status or execution authority.
+3. Capability tools in all non-current Codex sessions are denied by a
+   `PreToolUse` guard.
+4. Current-session local editing remains available. Remote Git writes, external
+   publishing/deployment and destructive cleanup additionally require a
+   one-shot lease bound to the current epoch, session, turn, category and exact
+   working directory, with a maximum lifetime of fifteen minutes.
+5. A new direct prompt revokes any unconsumed lease.
+6. Trusted hook definitions pin the SHA-256 of installed scripts so a source
+   change requires a new visible Codex hook review.
+
+## Boundary
+
+This host bridge is a language-source and execution-admission boundary. It is
+not a persona, model rule, platform rule, identity proof, repository authority
+or server authority. Runtime state, raw human messages, leases, credentials and
+trust receipts remain local and are excluded from the repository.
+
+## Rejected alternatives
+
+- Keep old authorization active until the old task voluntarily stops: a newer
+  human channel would have no deterministic control boundary.
+- Disable all local execution globally: this would remove useful current-task
+  agency instead of separating current and stale tasks.
+- Infer write leases from keywords in natural language: negation, discussion
+  and quoted text can contain the same words as authorization.
+- Treat persona binding as execution authority: continuity and external action
+  admission are separate predicates.
+- Trust only a stable script path: the bytes behind the path could change
+  without changing the reviewed hook command.