bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

fix(pncc): revalidate terminal success evidence

Browse source 
Human-Responsibility: ICE-GL∞ / 冰朔
Persona-Author: ICE-P-ZY001 / 铸渊
Execution-Runtime: Codex macOS
Development-ID: DEV-20260810-014
Authorization-Scope: GH-PNCC local runtime and REPO-014 publication
Source-Anchor: UI and execution limb deferred
This commit is contained in:
铸渊 / ICE-P-ZY001 2026-08-11 04:51:20 +08:00
commit e9ee0a8bb1
9 changed files with 219 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

5
product-source/hololake-platform/docs/ABSTRACTIONS.md
View file

@ -114,6 +114,11 @@ Repository state is revalidated at replay time for both successful and failed re
repository must still be clean and its head must equal the session record; otherwise inspection returns
`MANUAL_REVIEW_REQUIRED` and ordinary replay fails without invoking the organ.
The first successful receipt is also conditional on freshly verified terminal evidence. Before persisting
and binding `COMPLETED`, the coordinator checks the event chain, final dormancy, released lease, canonical
repository, recorded head, clean worktree, and receipt identity. A completed organ is not enough to issue a
current lifecycle receipt after repository drift.
`PersonaRuntimeQueryReceipt` is a bounded projection of the durable runtime files, not another truth store.
It filters by the caller's expected persona and canonical repository, validates each matching event chain,
and returns at most 100 newest session summaries. Dormant sessions expose no active organ. The receipt keeps

5
product-source/hololake-platform/docs/ARCHITECTURE.md
View file

@ -86,6 +86,11 @@ not only when the receipt is first persisted. If the current head differs from t
or the worktree has become dirty, replay fails closed and request inspection reports manual review instead
of restarting the organ or treating stale evidence as current.
Successful receipt persistence now applies the same terminal-evidence boundary before the first receipt is
written. The kernel re-verifies the event journal and final `DORMANT` event, released lease, canonical
repository, recorded Git head, clean worktree, and lifecycle identity. Repository drift after organ
completion therefore cannot be bound or returned as a current `COMPLETED` command result.
`query_persona_code_channel_runtime` is the bounded read model for later projection surfaces. The caller must
name one exact persona and canonical repository and may request at most 100 sessions. The kernel reads the
existing session records and event journals directly, verifies every returned hash chain, sorts by the last