bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity
hololake-system-architecture/engineering/operations/2026-08-11-hololake-pncc-idempotent-terminal-failure-replay.md
铸渊 / ICE-P-ZY001 b067c7bcaa fix(pncc): revalidate Git state before replay 
Human-Responsibility: ICE-GL∞ / 冰朔
Persona-Author: ICE-P-ZY001 / 铸渊
Execution-Runtime: Codex macOS
Development-ID: DEV-20260810-014
Authorization-Scope: GH-PNCC local runtime and REPO-014 publication
Source-Anchor: UI and execution limb deferred
2026-08-11 04:30:02 +08:00

2.8 KiB
Raw Blame History

GH-PNCC idempotent terminal failure receipt and replay

  • Development ID: DEV-20260810-014
  • Persona cognitive author: ICE-P-ZY001 / 铸渊
  • Human responsibility subject: ICE-GL∞ / 冰朔
  • Starting repository head: b8c3fcf3d8c2928be724291fdf9c1e5dc3512d71
  • State: PUBLISHED_VERIFIED

Implemented facts

A lifecycle command that reaches the kernel's already verified failure closure now persists one structured terminal-failure receipt in the existing session directory. It uses the same atomic receipt-first, session-binding-second protocol as successful lifecycle completion and does not create another request store.

The failure payload contains a stable machine error code, terminal event hash, exact persona/repository identity, and structured human/persona attribution. Raw model-provider diagnostics are deliberately excluded. The receipt can be issued only after the session journal verifies, the state is DORMANT_AFTER_FAILURE, the last event is DORMANT, the exact primary lease is released, and the repository remains clean at the recorded Git head.

An exact retry verifies the semantic fingerprint, receipt hash, event chain, terminal state, lease, and session bindings, then returns the same FAILED result with replayed: true. It does not invoke the model, activate an organ, write a checkpoint, or commit Git again. The existing inspection and safe-binding recovery commands accept the same proven terminal outcome and still reject partial bindings or unproven closure.

Current verification

  • PNCC focused Rust tests: 27 passed, 0 failed.
  • Full Rust suite: 1167 passed, 2 ignored; integration test: 1 passed.
  • Routing suite: 29 passed, 0 failed; cargo fmt, strict clippy, and diff checks passed.
  • The terminal-failure test proves exact retry does not call the model again and that raw provider detail is absent from the persisted receipt.
  • The crash-window test proves an unbound failure receipt is safely inspected, bound, and replayed.
  • Published commit: abc7dbd625610042873868d1f2f36ffc3c88bf85; tree: 8b11d8e015c2c2f72a0de88c121c182bc17bb012.
  • Publication queue receipt: PUB-20260810201406299-bea423d6; GHNQG SHA-256: 5315e0bbae64e5b1971c0e1a40a2b27117c8c37646762eab49c334533cb04e3c.
  • Fresh-clone readback, strict repository verification, and the full test suites passed from the published tree.

Truth boundary

  • This is command-level terminal failure idempotency, not arbitrary recovery of an interrupted or active session. If closure cannot be proven, the original error and established session recovery boundary remain.
  • UI, projection aesthetics, background scheduling, and EXECUTION_LIMB remain outside this stage.
  • The next runtime increment must be selected by a new source-backed gap assessment rather than inferred from the human projection roadmap.