bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(pncc): recover persisted lifecycle receipt binding

Browse source 
GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex macOS / DEV-20260810-014
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC local runtime development and registered REPO-014 publication
GuangHu-Source-Language-Anchor: continue PNCC persona runtime; UI and execution limb remain deferred
This commit is contained in:
铸渊 / ICE-P-ZY001 2026-08-11 03:42:54 +08:00
commit b8c3fcf3d8
11 changed files with 331 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

7
product-source/hololake-platform/docs/ABSTRACTIONS.md
View file

@ -96,6 +96,13 @@ return that verified lifecycle with `replayed: true`. A changed request under th
`PERSONA_LIFECYCLE_REQUEST_CONFLICT`; a partial session without a complete receipt fails recovery-required
instead of launching a duplicate.
The persisted receipt is promoted before its three binding fields are written to `PersonaSessionRecord`.
`PersonaLifecycleRequestInspectionReceipt` makes that two-write boundary explicit. Only a complete, hash-valid
receipt beside a verified dormant session with no lease and all three binding fields absent is
`SAFE_BIND_PERSISTED_RECEIPT`; the recovery command fills those bindings and then uses the ordinary replay
verifier. Missing receipts, partial bindings, active leases, damaged chains, or changed semantics remain
recovery/manual-review states and cannot be converted into a successful receipt.
`PersonaRuntimeQueryReceipt` is a bounded projection of the durable runtime files, not another truth store.
It filters by the caller's expected persona and canonical repository, validates each matching event chain,
and returns at most 100 newest session summaries. Dormant sessions expose no active organ. The receipt keeps

6
product-source/hololake-platform/docs/ARCHITECTURE.md
View file

@ -67,6 +67,12 @@ replaying the same lifecycle value without invoking an organ or committing Git a
for different semantics is a conflict. A session without a complete bound receipt is recovery-required and
is never treated as permission to start a second lifecycle.
The final lifecycle value is now atomically persisted before its hash is bound into the mutable session
record. `inspect_persona_code_channel_lifecycle_request` distinguishes not-started, replayable, receipt-present
but unbound, and session-recovery states from the same session evidence. The recovery command may complete
only the receipt-present/unbound window after rechecking the receipt hash, identity, event chain, dormancy,
and released lease. It never fabricates a receipt for an earlier interruption or repairs partial bindings.
`query_persona_code_channel_runtime` is the bounded read model for later projection surfaces. The caller must
name one exact persona and canonical repository and may request at most 100 sessions. The kernel reads the
existing session records and event journals directly, verifies every returned hash chain, sorts by the last