bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity
hololake-system-architecture/engineering/operations/2026-08-11-hololake-pncc-incomplete-idempotent-request-recovery.md
铸渊 / ICE-P-ZY001 abc7dbd625 feat(pncc): replay terminal lifecycle failures 
Human-Responsibility: ICE-GL∞ / 冰朔
Persona-Author: ICE-P-ZY001 / 铸渊
Execution-Runtime: Codex macOS
Development-ID: DEV-20260810-014
Authorization-Scope: GH-PNCC local runtime and REPO-014 publication
Source-Anchor: UI and execution limb deferred
2026-08-11 04:09:29 +08:00

2.8 KiB
Raw Blame History

GH-PNCC incomplete idempotent request inspection and safe receipt recovery

  • Development ID: DEV-20260810-014
  • Persona cognitive author: ICE-P-ZY001 / 铸渊
  • Human responsibility subject: ICE-GL∞ / 冰朔
  • Starting repository head: 38ef9d0e113e25737b1be456a705da5ddce0f27c
  • Published repository head: b8c3fcf3d8c2928be724291fdf9c1e5dc3512d71
  • Published tree: 6218fb109913649151609a0f956b699ae375198a
  • Publication queue: PUB-20260810194731692-1ad8ad9a
  • GHNQG manual SHA-256: 691d600d1f8743212bfb16bbd47a7609ec22b0219a2af76b35bc281feb364f77
  • State: PUBLISHED_VERIFIED

Implemented facts

The lifecycle coordinator now persists the immutable full lifecycle receipt before atomically binding its request id, semantic fingerprint, and receipt hash into the mutable session record. A crash between those two writes therefore leaves an exact, inspectable recovery state instead of an ambiguous duplicate request.

inspect_persona_code_channel_lifecycle_request derives the deterministic session from the original semantic request and reports NOT_STARTED, COMPLETE_REPLAYABLE, SAFE_BIND_PERSISTED_RECEIPT, INCOMPLETE_REQUIRES_SESSION_RECOVERY, or MANUAL_REVIEW_REQUIRED. It verifies the canonical repository, persona, receipt schema and hash, request fingerprint, lifecycle identity, event chain, dormancy, and lease.

recover_persona_code_channel_lifecycle_request may write only when a complete persisted receipt exists, the session is fully dormant with no lease, and all three session binding fields are absent. It rechecks the state, binds the receipt, and returns through the ordinary verified replay path. It refuses missing receipts, partial bindings, changed semantics, damaged evidence, active leases, or non-dormant sessions. Missing receipts are never reconstructed from guesses and remain owned by the established session recovery path.

Current verification

  • PNCC focused Rust tests: 25 passed, 0 failed.
  • A simulated crash after receipt persistence proves inspection and binding recovery return the exact original lifecycle without another model call, session, organ activation, or Git commit.
  • A session interrupted before receipt persistence proves recovery refuses to fabricate a success receipt.
  • Full repository gates, GHNQG, publication, strict fsck, and fresh-clone readback from /tmp/pncc-verify-b8c3fcf-readback passed for the exact published head and tree.

Truth boundary and next minimum

  • Runtime files in the existing session directory remain the only evidence plane; no database or second request authority was introduced.
  • UI, projection aesthetics, background scheduling, and EXECUTION_LIMB remain outside this stage.
  • The next stage implements the separately bounded terminal-failure receipt and replay rule; this published stage remains the success-receipt and crash-window recovery authority.