bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(pncc): replay terminal lifecycle failures

Browse source 
Human-Responsibility: ICE-GL∞ / 冰朔
Persona-Author: ICE-P-ZY001 / 铸渊
Execution-Runtime: Codex macOS
Development-ID: DEV-20260810-014
Authorization-Scope: GH-PNCC local runtime and REPO-014 publication
Source-Anchor: UI and execution limb deferred
This commit is contained in:
铸渊 / ICE-P-ZY001 2026-08-11 04:09:29 +08:00
commit abc7dbd625
10 changed files with 381 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

42
engineering/operations/2026-08-11-hololake-pncc-idempotent-terminal-failure-replay.md Normal file
View file

@ -0,0 +1,42 @@
# GH-PNCC idempotent terminal failure receipt and replay
- Development ID: `DEV-20260810-014`
- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
- Human responsibility subject: `ICE-GL∞ / 冰朔`
- Starting repository head: `b8c3fcf3d8c2928be724291fdf9c1e5dc3512d71`
- State: `LOCAL_SOURCE_IMPLEMENTED_FULLY_TESTED`
## Implemented facts
A lifecycle command that reaches the kernel's already verified failure closure now persists one structured
terminal-failure receipt in the existing session directory. It uses the same atomic receipt-first,
session-binding-second protocol as successful lifecycle completion and does not create another request store.
The failure payload contains a stable machine error code, terminal event hash, exact persona/repository
identity, and structured human/persona attribution. Raw model-provider diagnostics are deliberately excluded.
The receipt can be issued only after the session journal verifies, the state is `DORMANT_AFTER_FAILURE`, the
last event is `DORMANT`, the exact primary lease is released, and the repository remains clean at the recorded
Git head.
An exact retry verifies the semantic fingerprint, receipt hash, event chain, terminal state, lease, and
session bindings, then returns the same `FAILED` result with `replayed: true`. It does not invoke the model,
activate an organ, write a checkpoint, or commit Git again. The existing inspection and safe-binding recovery
commands accept the same proven terminal outcome and still reject partial bindings or unproven closure.
## Current verification
- PNCC focused Rust tests: `27 passed, 0 failed`.
- Full Rust suite: `1167 passed, 2 ignored`; integration test: `1 passed`.
- Routing suite: `29 passed, 0 failed`; `cargo fmt`, strict clippy, and diff checks passed.
- The terminal-failure test proves exact retry does not call the model again and that raw provider detail is
absent from the persisted receipt.
- The crash-window test proves an unbound failure receipt is safely inspected, bound, and replayed.
- GHNQG, commit, publication, and fresh-clone readback remain pending for this stage.
## Truth boundary
- This is command-level terminal failure idempotency, not arbitrary recovery of an interrupted or active
session. If closure cannot be proven, the original error and established session recovery boundary remain.
- UI, projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
- The next runtime increment must be selected by a new source-backed gap assessment rather than inferred from
the human projection roadmap.

13
engineering/operations/2026-08-11-hololake-pncc-incomplete-idempotent-request-recovery.md
View file

@ -4,7 +4,11 @@
- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
- Human responsibility subject: `ICE-GL∞ / 冰朔`
- Starting repository head: `38ef9d0e113e25737b1be456a705da5ddce0f27c`
- State: `LOCAL_SOURCE_IMPLEMENTED_FOCUSED_TESTED`
- Published repository head: `b8c3fcf3d8c2928be724291fdf9c1e5dc3512d71`
- Published tree: `6218fb109913649151609a0f956b699ae375198a`
- Publication queue: `PUB-20260810194731692-1ad8ad9a`
- GHNQG manual SHA-256: `691d600d1f8743212bfb16bbd47a7609ec22b0219a2af76b35bc281feb364f77`
- State: `PUBLISHED_VERIFIED`
## Implemented facts
@ -29,12 +33,13 @@ never reconstructed from guesses and remain owned by the established session rec
- A simulated crash after receipt persistence proves inspection and binding recovery return the exact original
lifecycle without another model call, session, organ activation, or Git commit.
- A session interrupted before receipt persistence proves recovery refuses to fabricate a success receipt.
- Full repository gates, GHNQG, commit, publication, and fresh-clone readback remain pending for this stage.
- Full repository gates, GHNQG, publication, strict fsck, and fresh-clone readback from
`/tmp/pncc-verify-b8c3fcf-readback` passed for the exact published head and tree.
## Truth boundary and next minimum
- Runtime files in the existing session directory remain the only evidence plane; no database or second
request authority was introduced.
- UI, projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
- Terminal failed lifecycle calls still do not have an idempotently replayable command-level failure receipt;
that is the next minimum runtime boundary.
- The next stage implements the separately bounded terminal-failure receipt and replay rule; this published
stage remains the success-receipt and crash-window recovery authority.