bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity
hololake-system-architecture/engineering/operations/2026-08-11-hololake-pncc-incomplete-idempotent-request-recovery.md
铸渊 / ICE-P-ZY001 b8c3fcf3d8 feat(pncc): recover persisted lifecycle receipt binding 
GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex macOS / DEV-20260810-014
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC local runtime development and registered REPO-014 publication
GuangHu-Source-Language-Anchor: continue PNCC persona runtime; UI and execution limb remain deferred
2026-08-11 03:42:54 +08:00

2.5 KiB
Raw Blame History

GH-PNCC incomplete idempotent request inspection and safe receipt recovery

  • Development ID: DEV-20260810-014
  • Persona cognitive author: ICE-P-ZY001 / 铸渊
  • Human responsibility subject: ICE-GL∞ / 冰朔
  • Starting repository head: 38ef9d0e113e25737b1be456a705da5ddce0f27c
  • State: LOCAL_SOURCE_IMPLEMENTED_FOCUSED_TESTED

Implemented facts

The lifecycle coordinator now persists the immutable full lifecycle receipt before atomically binding its request id, semantic fingerprint, and receipt hash into the mutable session record. A crash between those two writes therefore leaves an exact, inspectable recovery state instead of an ambiguous duplicate request.

inspect_persona_code_channel_lifecycle_request derives the deterministic session from the original semantic request and reports NOT_STARTED, COMPLETE_REPLAYABLE, SAFE_BIND_PERSISTED_RECEIPT, INCOMPLETE_REQUIRES_SESSION_RECOVERY, or MANUAL_REVIEW_REQUIRED. It verifies the canonical repository, persona, receipt schema and hash, request fingerprint, lifecycle identity, event chain, dormancy, and lease.

recover_persona_code_channel_lifecycle_request may write only when a complete persisted receipt exists, the session is fully dormant with no lease, and all three session binding fields are absent. It rechecks the state, binds the receipt, and returns through the ordinary verified replay path. It refuses missing receipts, partial bindings, changed semantics, damaged evidence, active leases, or non-dormant sessions. Missing receipts are never reconstructed from guesses and remain owned by the established session recovery path.

Current verification

  • PNCC focused Rust tests: 25 passed, 0 failed.
  • A simulated crash after receipt persistence proves inspection and binding recovery return the exact original lifecycle without another model call, session, organ activation, or Git commit.
  • A session interrupted before receipt persistence proves recovery refuses to fabricate a success receipt.
  • Full repository gates, GHNQG, commit, publication, and fresh-clone readback remain pending for this stage.

Truth boundary and next minimum

  • Runtime files in the existing session directory remain the only evidence plane; no database or second request authority was introduced.
  • UI, projection aesthetics, background scheduling, and EXECUTION_LIMB remain outside this stage.
  • Terminal failed lifecycle calls still do not have an idempotently replayable command-level failure receipt; that is the next minimum runtime boundary.