bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(pncc): replay terminal lifecycle failures

Browse source 
Human-Responsibility: ICE-GL∞ / 冰朔
Persona-Author: ICE-P-ZY001 / 铸渊
Execution-Runtime: Codex macOS
Development-ID: DEV-20260810-014
Authorization-Scope: GH-PNCC local runtime and REPO-014 publication
Source-Anchor: UI and execution limb deferred
This commit is contained in:
铸渊 / ICE-P-ZY001 2026-08-11 04:09:29 +08:00
commit abc7dbd625
10 changed files with 381 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

7
product-source/hololake-platform/docs/ABSTRACTIONS.md
View file

@ -103,6 +103,13 @@ receipt beside a verified dormant session with no lease and all three binding fi
verifier. Missing receipts, partial bindings, active leases, damaged chains, or changed semantics remain
recovery/manual-review states and cannot be converted into a successful receipt.
The same persisted receipt envelope also represents a verified terminal failure. Its `outcome` is `FAILED`,
its successful lifecycle payload is null, and `failure` carries only the stable error code, terminal event
hash, identity, repository, and attribution. The runtime hashes that structured failure payload, never the
raw provider diagnostic. Replay and safe binding recovery require `DORMANT_AFTER_FAILURE`, a final `DORMANT`
event, a released lease, and an unchanged clean Git head. A failure that cannot prove those conditions is not
terminal and remains recovery-required.
`PersonaRuntimeQueryReceipt` is a bounded projection of the durable runtime files, not another truth store.
It filters by the caller's expected persona and canonical repository, validates each matching event chain,
and returns at most 100 newest session summaries. Dormant sessions expose no active organ. The receipt keeps

8
product-source/hololake-platform/docs/ARCHITECTURE.md
View file

@ -73,6 +73,14 @@ but unbound, and session-recovery states from the same session evidence. The rec
only the receipt-present/unbound window after rechecking the receipt hash, identity, event chain, dormancy,
and released lease. It never fabricates a receipt for an earlier interruption or repairs partial bindings.
A lifecycle that reaches the kernel's verified terminal failure closure now uses that same receipt file and
two-write binding protocol. The persisted value contains only a stable machine error code, terminal event
hash, repository/persona identity, and structured attribution; raw provider or model error detail is not
stored. Exact retries verify `DORMANT_AFTER_FAILURE`, the final `DORMANT` event, released lease, unchanged
clean Git head, semantic fingerprint, receipt hash, and session bindings before returning the same failure
with `replayed: true`. Active, dirty, partially closed, or otherwise unproven failures retain the original
recovery path and cannot be converted into a terminal receipt.
`query_persona_code_channel_runtime` is the bounded read model for later projection surfaces. The caller must
name one exact persona and canonical repository and may request at most 100 sessions. The kernel reads the
existing session records and event journals directly, verifies every returned hash chain, sorts by the last