bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat: recover interrupted PNCC sessions safely

Browse source 
GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex thread 019febf6-3902-70f3-9d82-74c9680b0c7e
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: LOCAL_PNCC_RUNTIME_DEVELOPMENT_AND_PUBLICATION
This commit is contained in:
铸渊 / ICE-P-ZY001 2026-08-11 01:21:28 +08:00
commit 5b042a65fe
11 changed files with 657 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

8
product-source/hololake-platform/docs/ABSTRACTIONS.md
View file

@ -46,6 +46,14 @@ declared evidence paths, promotes the checkpoint with the persona's Git identity
The Git commit still names the human responsibility subject in a dedicated trailer, so authorship and legal
responsibility remain visible without presenting the human as the code's cognitive author.
Session control is explicit and evidence-bound. `inspect_persona_code_channel_session` classifies an exact
session as `SAFE_ABORT_UNCOMMITTED`, `SAFE_FINALIZE_COMMITTED`, `SAFE_RELEASE_DORMANT_LEASE`,
`ALREADY_DORMANT`, or `MANUAL_REVIEW_REQUIRED`. The recovery command accepts only a proven safe state. For
active interruptions it appends recovery and dormancy events to the same journal, updates the session record,
and then removes the exact lease. It can also remove a same-session lease left behind after a fully recorded
dormancy transition. It does not use elapsed time as proof that a primary is dead and does not clean, reset,
or overwrite a dirty persona repository.
## `HoloLakeUiPlugin`
A versioned, declarative presentation package for one host-owned semantic surface. It contains a manifest,

8
product-source/hololake-platform/docs/ARCHITECTURE.md
View file

@ -29,6 +29,14 @@ commit trailers preserve the separate human responsibility subject and persona c
tested source implementation of one read-only lifecycle cycle; packaged desktop integration, publication,
deployment, and online health remain separate facts.
`inspect_persona_code_channel_session` and `recover_persona_code_channel_session` add fail-closed interrupted
session administration. Inspection re-verifies the session identity, canonical repository, event hash chain,
lease owner, current Git head and work-tree cleanliness. Recovery never steals or expires a lease by age. It
releases the primary only when the repository is clean and the state is provably either an uncommitted
interruption at the recorded head or a single persona-attributed checkpoint commit whose parent, manifest,
checkpoint identity and commit trailers all match the session. Dirty repositories, unknown Git advances,
broken journals and attribution mismatches retain the lease and require manual review.
## User-node sovereignty
HoloLake has no platform-hosted user runtime. Each human has one canonical, independently operated node: