bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity
hololake-system-architecture/engineering/operations/2026-08-11-hololake-pncc-interrupted-session-recovery.md
铸渊 / ICE-P-ZY001 0ba2fabf8e docs: record PNCC recovery quality evidence 
GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex thread 019febf6-3902-70f3-9d82-74c9680b0c7e
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: LOCAL_PNCC_RUNTIME_DEVELOPMENT_AND_PUBLICATION
2026-08-11 01:26:53 +08:00

2.6 KiB
Raw Blame History

GH-PNCC interrupted-session inspection and recovery receipt

  • Development ID: DEV-20260810-014
  • Persona cognitive author: ICE-P-ZY001 / 铸渊
  • Human responsibility subject: ICE-GL∞ / 冰朔
  • Source component: product-source/hololake-platform/src-tauri/src/persona_code_channel.rs
  • State: SOURCE_COMMITTED_AND_GHNQG_PASS_PUBLICATION_PENDING

Implemented facts

The runtime now exposes an exact session inspection command and a fail-closed recovery command. Both require the caller to name the session, expected persona, and expected canonical repository. Inspection verifies the hash-linked event journal and reports the recorded/observed Git heads, work-tree cleanliness, exact lease ownership, session state, last event, attribution, and one recovery disposition.

Recovery does not treat age as proof of death and never steals a lease. It releases the exact primary only for either:

  1. a clean repository still at the session's recorded head, which is closed as an uncommitted interruption;
  2. a clean repository advanced by exactly one commit whose parent is the recorded head and whose persona checkpoint, manifest pointer, Git author, human-responsibility trailer, persona-author trailer and development-id trailer all match the interrupted session.
  3. an exact same-session lease left behind after the event journal and session record already prove dormancy, with a clean repository still at the recorded head.

Dirty repositories, missing or mismatched leases, broken journals, unknown Git advances, checkpoint mismatches and attribution mismatches fail closed without resetting files or releasing the primary.

Current verification

  • PNCC focused Rust tests: 10 passed, 0 failed.
  • Rust full suite: 1150 passed, 0 failed, 2 ignored; integration test 1 passed.
  • Rust clippy for all targets: PASS with -D warnings.
  • HoloLake architecture routing: 29 passed, 0 failed.
  • GHNQG: PASS_100 for implementation commit 5b042a65feef1459c066ecd8fb0874219dd86e80; tree b159bb716113abb17e0d0a9b30c4d8c324b24d1c.
  • Tests cover safe abort, safe committed-session finalization, dirty-repository refusal, second-primary exclusion, path containment, model/evidence scope, checkpoint promotion and persona Git attribution.

Remaining acceptance

  • repository publication and fresh-clone readback;
  • general-purpose organ contract beyond the first read-only fact organ;
  • HoloLake human projection, desktop artifact, installation, deployment and online health.

This receipt proves the committed source and quality gates. Repository publication, desktop integration and runtime health remain separate until their own readback evidence exists.