abc7dbd625
Human-Responsibility: ICE-GL∞ / 冰朔 Persona-Author: ICE-P-ZY001 / 铸渊 Execution-Runtime: Codex macOS Development-ID: DEV-20260810-014 Authorization-Scope: GH-PNCC local runtime and REPO-014 publication Source-Anchor: UI and execution limb deferred
45 lines
2.8 KiB
Markdown
45 lines
2.8 KiB
Markdown
# GH-PNCC incomplete idempotent request inspection and safe receipt recovery
|
|
|
|
- Development ID: `DEV-20260810-014`
|
|
- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
|
|
- Human responsibility subject: `ICE-GL∞ / 冰朔`
|
|
- Starting repository head: `38ef9d0e113e25737b1be456a705da5ddce0f27c`
|
|
- Published repository head: `b8c3fcf3d8c2928be724291fdf9c1e5dc3512d71`
|
|
- Published tree: `6218fb109913649151609a0f956b699ae375198a`
|
|
- Publication queue: `PUB-20260810194731692-1ad8ad9a`
|
|
- GHNQG manual SHA-256: `691d600d1f8743212bfb16bbd47a7609ec22b0219a2af76b35bc281feb364f77`
|
|
- State: `PUBLISHED_VERIFIED`
|
|
|
|
## Implemented facts
|
|
|
|
The lifecycle coordinator now persists the immutable full lifecycle receipt before atomically binding its
|
|
request id, semantic fingerprint, and receipt hash into the mutable session record. A crash between those
|
|
two writes therefore leaves an exact, inspectable recovery state instead of an ambiguous duplicate request.
|
|
|
|
`inspect_persona_code_channel_lifecycle_request` derives the deterministic session from the original semantic
|
|
request and reports `NOT_STARTED`, `COMPLETE_REPLAYABLE`, `SAFE_BIND_PERSISTED_RECEIPT`,
|
|
`INCOMPLETE_REQUIRES_SESSION_RECOVERY`, or `MANUAL_REVIEW_REQUIRED`. It verifies the canonical repository,
|
|
persona, receipt schema and hash, request fingerprint, lifecycle identity, event chain, dormancy, and lease.
|
|
|
|
`recover_persona_code_channel_lifecycle_request` may write only when a complete persisted receipt exists, the
|
|
session is fully dormant with no lease, and all three session binding fields are absent. It rechecks the state,
|
|
binds the receipt, and returns through the ordinary verified replay path. It refuses missing receipts, partial
|
|
bindings, changed semantics, damaged evidence, active leases, or non-dormant sessions. Missing receipts are
|
|
never reconstructed from guesses and remain owned by the established session recovery path.
|
|
|
|
## Current verification
|
|
|
|
- PNCC focused Rust tests: `25 passed, 0 failed`.
|
|
- A simulated crash after receipt persistence proves inspection and binding recovery return the exact original
|
|
lifecycle without another model call, session, organ activation, or Git commit.
|
|
- A session interrupted before receipt persistence proves recovery refuses to fabricate a success receipt.
|
|
- Full repository gates, GHNQG, publication, strict fsck, and fresh-clone readback from
|
|
`/tmp/pncc-verify-b8c3fcf-readback` passed for the exact published head and tree.
|
|
|
|
## Truth boundary and next minimum
|
|
|
|
- Runtime files in the existing session directory remain the only evidence plane; no database or second
|
|
request authority was introduced.
|
|
- UI, projection aesthetics, background scheduling, and `EXECUTION_LIMB` remain outside this stage.
|
|
- The next stage implements the separately bounded terminal-failure receipt and replay rule; this published
|
|
stage remains the success-receipt and crash-window recovery authority.
|