bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity
hololake-system-architecture/engineering/operations/2026-08-11-hololake-pncc-idempotent-lifecycle-replay.md
铸渊 / ICE-P-ZY001 38ef9d0e11 feat(pncc): make lifecycle retries idempotent 
GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex macOS / DEV-20260810-014
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC local runtime development and registered REPO-014 publication
GuangHu-Source-Language-Anchor: continue PNCC persona runtime; UI and execution limb remain deferred
2026-08-11 03:21:15 +08:00

2.5 KiB
Raw Blame History

GH-PNCC idempotent lifecycle request and receipt replay

  • Development ID: DEV-20260810-014
  • Persona cognitive author: ICE-P-ZY001 / 铸渊
  • Human responsibility subject: ICE-GL∞ / 冰朔
  • Starting repository head: 8f35834a7abc9546b717da0b513b6e8ac1684815
  • State: LOCAL_SOURCE_IMPLEMENTED_FOCUSED_TESTED

Implemented facts

The non-UI lifecycle command now requires a stable requestId. Persona id and request id derive one deterministic session id. A SHA-256 fingerprint binds the canonical repository, expected Git head, wake identity, structured attribution, organ, and semantic operation. API keys and provider headers are excluded from both the fingerprint and the persisted receipt.

After one successful lifecycle, the existing session record stores the request id, request fingerprint, and lifecycle receipt hash. The typed lifecycle value is stored once in the same session directory. An identical retry verifies those bindings, the event chain, dormant state, released primary lease, and receipt hash, then returns the same lifecycle with replayed: true. It does not run the model, activate an organ, create another session, or commit another checkpoint.

The same request id with different semantics returns PERSONA_LIFECYCLE_REQUEST_CONFLICT. A missing receipt for an existing deterministic session returns recovery-required rather than launching a duplicate. A changed persisted lifecycle fails its receipt hash check.

Current verification

  • PNCC focused Rust tests: 23 passed, 0 failed.
  • Full Rust suite: 1163 passed, 0 failed, 2 ignored; integration test: 1 passed.
  • HoloLake architecture routing: 29 passed, 0 failed.
  • Identical retry proves the same request fingerprint and lifecycle value are returned while Git head and session count stay unchanged.
  • Conflict retry proves changed semantics never invoke the organ.
  • Tamper test proves a modified persisted lifecycle is rejected.
  • Rust formatting and clippy for all targets: PASS with -D warnings.
  • GHNQG, commit, publication, and fresh-clone gates remain pending for this stage.

Truth boundary and next minimum

  • The existing runtime session directory remains the only lifecycle evidence plane; no database or second request authority was introduced.
  • UI, human projection aesthetics, background scheduling, and EXECUTION_LIMB remain outside this stage.
  • The next minimum is evidence-bound inspection and safe receipt recovery for an idempotent request that was interrupted after lifecycle progress but before its replay receipt became complete.