bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(pncc): make lifecycle retries idempotent

Browse source 
GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex macOS / DEV-20260810-014
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC local runtime development and registered REPO-014 publication
GuangHu-Source-Language-Anchor: continue PNCC persona runtime; UI and execution limb remain deferred
This commit is contained in:
铸渊 / ICE-P-ZY001 2026-08-11 03:21:15 +08:00
commit 38ef9d0e11
10 changed files with 427 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

44
engineering/operations/2026-08-11-hololake-pncc-idempotent-lifecycle-replay.md Normal file
View file

@ -0,0 +1,44 @@
# GH-PNCC idempotent lifecycle request and receipt replay
- Development ID: `DEV-20260810-014`
- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
- Human responsibility subject: `ICE-GL∞ / 冰朔`
- Starting repository head: `8f35834a7abc9546b717da0b513b6e8ac1684815`
- State: `LOCAL_SOURCE_IMPLEMENTED_FOCUSED_TESTED`
## Implemented facts
The non-UI lifecycle command now requires a stable `requestId`. Persona id and request id derive one
deterministic session id. A SHA-256 fingerprint binds the canonical repository, expected Git head, wake
identity, structured attribution, organ, and semantic operation. API keys and provider headers are excluded
from both the fingerprint and the persisted receipt.
After one successful lifecycle, the existing session record stores the request id, request fingerprint, and
lifecycle receipt hash. The typed lifecycle value is stored once in the same session directory. An identical
retry verifies those bindings, the event chain, dormant state, released primary lease, and receipt hash, then
returns the same lifecycle with `replayed: true`. It does not run the model, activate an organ, create another
session, or commit another checkpoint.
The same request id with different semantics returns `PERSONA_LIFECYCLE_REQUEST_CONFLICT`. A missing receipt
for an existing deterministic session returns recovery-required rather than launching a duplicate. A changed
persisted lifecycle fails its receipt hash check.
## Current verification
- PNCC focused Rust tests: `23 passed, 0 failed`.
- Full Rust suite: `1163 passed, 0 failed, 2 ignored`; integration test: `1 passed`.
- HoloLake architecture routing: `29 passed, 0 failed`.
- Identical retry proves the same request fingerprint and lifecycle value are returned while Git head and
session count stay unchanged.
- Conflict retry proves changed semantics never invoke the organ.
- Tamper test proves a modified persisted lifecycle is rejected.
- Rust formatting and clippy for all targets: `PASS` with `-D warnings`.
- GHNQG, commit, publication, and fresh-clone gates remain pending for this stage.
## Truth boundary and next minimum
- The existing runtime session directory remains the only lifecycle evidence plane; no database or second
request authority was introduced.
- UI, human projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
- The next minimum is evidence-bound inspection and safe receipt recovery for an idempotent request that was
interrupted after lifecycle progress but before its replay receipt became complete.

6
engineering/operations/2026-08-11-hololake-pncc-safe-organ-lifecycle-coordinator.md
View file

@ -4,7 +4,8 @@
- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
- Human responsibility subject: `ICE-GL∞ / 冰朔`
- Starting repository head: `18944f536261a4184570074a09fc43a09f5f31bb`
- State: `LOCAL_SOURCE_IMPLEMENTED_FOCUSED_TESTED`
- Published repository head: `8f35834a7abc9546b717da0b513b6e8ac1684815`
- State: `PUBLISHED_GHNQG_AND_FRESH_CLONE_VERIFIED`
## Implemented facts
@ -34,7 +35,8 @@ wake receipt beside a typed completion receipt. Runtime files and persona Git re
- This is source implementation, not a packaged desktop, installed runtime, deployment, or online-health
claim.
- GHNQG, commit, publication, and independent fresh-clone readback remain pending for this stage.
- GHNQG, persona-authored commit, publication, independent fresh-clone readback, clean tree, and strict Git
fsck passed.
- UI, human projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
- The next minimum is an idempotent lifecycle request identity and receipt replay rule so a caller retry
cannot accidentally create a second lifecycle or duplicate a checkpoint commit.