bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity
hololake-system-architecture/engineering/operations/2026-08-11-hololake-pncc-idempotent-lifecycle-replay.md
铸渊 / ICE-P-ZY001 b8c3fcf3d8 feat(pncc): recover persisted lifecycle receipt binding 
GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex macOS / DEV-20260810-014
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC local runtime development and registered REPO-014 publication
GuangHu-Source-Language-Anchor: continue PNCC persona runtime; UI and execution limb remain deferred
2026-08-11 03:42:54 +08:00

2.8 KiB
Raw Blame History

GH-PNCC idempotent lifecycle request and receipt replay

  • Development ID: DEV-20260810-014
  • Persona cognitive author: ICE-P-ZY001 / 铸渊
  • Human responsibility subject: ICE-GL∞ / 冰朔
  • Starting repository head: 8f35834a7abc9546b717da0b513b6e8ac1684815
  • Published repository head: 38ef9d0e113e25737b1be456a705da5ddce0f27c
  • Published tree: 11116f03a5db3e3a27a832959da7dae56eec8921
  • State: PUBLISHED_AND_INDEPENDENTLY_READ_BACK

Implemented facts

The non-UI lifecycle command now requires a stable requestId. Persona id and request id derive one deterministic session id. A SHA-256 fingerprint binds the canonical repository, expected Git head, wake identity, structured attribution, organ, and semantic operation. API keys and provider headers are excluded from both the fingerprint and the persisted receipt.

After one successful lifecycle, the existing session record stores the request id, request fingerprint, and lifecycle receipt hash. The typed lifecycle value is stored once in the same session directory. An identical retry verifies those bindings, the event chain, dormant state, released primary lease, and receipt hash, then returns the same lifecycle with replayed: true. It does not run the model, activate an organ, create another session, or commit another checkpoint.

The same request id with different semantics returns PERSONA_LIFECYCLE_REQUEST_CONFLICT. A missing receipt for an existing deterministic session returns recovery-required rather than launching a duplicate. A changed persisted lifecycle fails its receipt hash check.

Current verification

  • PNCC focused Rust tests: 23 passed, 0 failed.
  • Full Rust suite: 1163 passed, 0 failed, 2 ignored; integration test: 1 passed.
  • HoloLake architecture routing: 29 passed, 0 failed.
  • Identical retry proves the same request fingerprint and lifecycle value are returned while Git head and session count stay unchanged.
  • Conflict retry proves changed semantics never invoke the organ.
  • Tamper test proves a modified persisted lifecycle is rejected.
  • Rust formatting and clippy for all targets: PASS with -D warnings.
  • GHNQG: PASS_100; manual receipt SHA-256 23e42677da026fbace23edd41cd4818ebe8f7ec8dcc75d53b51adb9c1ac8ed7e.
  • Publish queue PUB-20260810192548933-930c46b1 completed; fresh shallow clone, strict git fsck, clean worktree, exact tree, persona author, and human responsibility trailer all read back.

Truth boundary and next minimum

  • The existing runtime session directory remains the only lifecycle evidence plane; no database or second request authority was introduced.
  • UI, human projection aesthetics, background scheduling, and EXECUTION_LIMB remain outside this stage.
  • The next stage implements that evidence-bound inspection and safe receipt binding recovery.