bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

fix(pncc): revalidate Git state before replay

Browse source 
Human-Responsibility: ICE-GL∞ / 冰朔
Persona-Author: ICE-P-ZY001 / 铸渊
Execution-Runtime: Codex macOS
Development-ID: DEV-20260810-014
Authorization-Scope: GH-PNCC local runtime and REPO-014 publication
Source-Anchor: UI and execution limb deferred
This commit is contained in:
铸渊 / ICE-P-ZY001 2026-08-11 04:30:02 +08:00
commit b067c7bcaa
10 changed files with 143 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
product-source/hololake-platform/docs/ABSTRACTIONS.md
View file

@ -110,6 +110,10 @@ raw provider diagnostic. Replay and safe binding recovery require `DORMANT_AFTER
event, a released lease, and an unchanged clean Git head. A failure that cannot prove those conditions is not
terminal and remains recovery-required.
Repository state is revalidated at replay time for both successful and failed receipts. The current canonical
repository must still be clean and its head must equal the session record; otherwise inspection returns
`MANUAL_REVIEW_REQUIRED` and ordinary replay fails without invoking the organ.
`PersonaRuntimeQueryReceipt` is a bounded projection of the durable runtime files, not another truth store.
It filters by the caller's expected persona and canonical repository, validates each matching event chain,
and returns at most 100 newest session summaries. Dormant sessions expose no active organ. The receipt keeps

5
product-source/hololake-platform/docs/ARCHITECTURE.md
View file

@ -81,6 +81,11 @@ clean Git head, semantic fingerprint, receipt hash, and session bindings before
with `replayed: true`. Active, dirty, partially closed, or otherwise unproven failures retain the original
recovery path and cannot be converted into a terminal receipt.
The unchanged-clean-repository condition is enforced again on every successful or failed receipt replay,
not only when the receipt is first persisted. If the current head differs from the session's recorded head,
or the worktree has become dirty, replay fails closed and request inspection reports manual review instead
of restarting the organ or treating stale evidence as current.
`query_persona_code_channel_runtime` is the bounded read model for later projection surfaces. The caller must
name one exact persona and canonical repository and may request at most 100 sessions. The kernel reads the
existing session records and event journals directly, verifies every returned hash chain, sorts by the last