bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(pncc): coordinate safe organ lifecycles

Browse source 
GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex macOS / DEV-20260810-014
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC local runtime development and registered REPO-014 publication
GuangHu-Source-Language-Anchor: continue PNCC persona runtime; UI and execution limb remain deferred
This commit is contained in:
铸渊 / ICE-P-ZY001 2026-08-11 03:00:12 +08:00
commit 8f35834a7a
11 changed files with 402 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

7
product-source/hololake-platform/docs/ABSTRACTIONS.md
View file

@ -80,6 +80,13 @@ command returns `MEMORY_FAILURE_CLOSURE_INCOMPLETE_REQUIRES_RECOVERY`; it never
candidate error while silently losing the closure failure. An incomplete closure preserves the lease for the
existing evidence-bound session inspection and recovery path.
`PersonaLifecycleRunInput` is the single-call, non-UI coordination envelope. Its wake member keeps the exact
persona Git, expected commit, node/model instance, organ id, and structured attribution explicit. Its tagged
operation can be only `FACT_SENSE` or `MEMORY_METABOLISM`. The coordinator rejects an operation/organ mismatch
before wake or lease acquisition, then delegates to the same tested organ transactions and returns a tagged
completion beside the wake receipt. It does not accept an execution action, infer organ permissions from UI
state, or create a parallel lifecycle record.
`PersonaRuntimeQueryReceipt` is a bounded projection of the durable runtime files, not another truth store.
It filters by the caller's expected persona and canonical repository, validates each matching event chain,
and returns at most 100 newest session summaries. Dormant sessions expose no active organ. The receipt keeps

8
product-source/hololake-platform/docs/ARCHITECTURE.md
View file

@ -50,6 +50,14 @@ the command returns an explicit recovery-required error and retains the lease wh
proven complete; it does not swallow the secondary failure.
The execution limb remains visible but non-activatable, so declaring it does not grant a shell or reality action.
`run_persona_code_channel_lifecycle` is the non-UI coordinator for the two implemented safe organ kinds. One
request supplies the exact wake envelope plus either a fact-sense operation or a memory-metabolism operation.
Before acquiring the primary lease, the coordinator inspects the same manifest, confirms that the requested
operation kind matches the named activatable organ, and preflights the manifest-pinned model binding for fact
sense. It then owns one complete session from wake through the existing organ transaction and returns both
the wake receipt and the typed completion receipt. It cannot express or activate `EXECUTION_LIMB`, does not
add a scheduler or second state store, and runs the complete lifecycle on the blocking task pool.
`query_persona_code_channel_runtime` is the bounded read model for later projection surfaces. The caller must
name one exact persona and canonical repository and may request at most 100 sessions. The kernel reads the
existing session records and event journals directly, verifies every returned hash chain, sorts by the last