diff --git a/.project-docs/10-decisions/proposals/20260825-pi-runtime-resilience-plan-4b8e2c71__pi-runtime-resilience-hardening.md b/.project-docs/10-decisions/proposals/20260825-pi-worker-exit-thinking-5e7c2a91__pi-runtime-resilience-hardening.md similarity index 99% rename from .project-docs/10-decisions/proposals/20260825-pi-runtime-resilience-plan-4b8e2c71__pi-runtime-resilience-hardening.md rename to .project-docs/10-decisions/proposals/20260825-pi-worker-exit-thinking-5e7c2a91__pi-runtime-resilience-hardening.md index 554f743..0bba1cd 100644 --- a/.project-docs/10-decisions/proposals/20260825-pi-runtime-resilience-plan-4b8e2c71__pi-runtime-resilience-hardening.md +++ b/.project-docs/10-decisions/proposals/20260825-pi-worker-exit-thinking-5e7c2a91__pi-runtime-resilience-hardening.md @@ -4,8 +4,9 @@ | 字段 | 值 | | --- | --- | -| 状态 | 已获用户授权，可实施 | +| 状态 | PI-R001 已实施并完成验证；PI-R002 保持后续任务 | | 规划任务 | `20260825-pi-runtime-resilience-plan-4b8e2c71` | +| 当前文档所有者 | `20260825-pi-worker-exit-thinking-5e7c2a91` | | 规划基线 | `274187e3cfe2ae6cb97f2b4bcb422b3fdf06fbf2` | | 原始规范 | `20260822-pi-runtime-spec-b6e2c9a4__pi-runtime-cutover-spec.md` | | 原始票据图 | `20260822-pi-runtime-spec-b6e2c9a4__pi-runtime-cutover-tickets.md` | diff --git a/.project-docs/30-worklog/tasks/20260825-pi-runtime-resilience-plan-4b8e2c71.md b/.project-docs/30-worklog/tasks/20260825-pi-runtime-resilience-plan-4b8e2c71.md deleted file mode 100644 index 5f22640..0000000 --- a/.project-docs/30-worklog/tasks/20260825-pi-runtime-resilience-plan-4b8e2c71.md +++ /dev/null @@ -1,136 +0,0 @@ -# Task: Plan Pi runtime resilience hardening - -## Identity - -- Task ID: 20260825-pi-runtime-resilience-plan-4b8e2c71 -- Mode: Feature -- Branch: codex/20260825-pi-runtime-resilience-plan-4b8e2c71-pi-runtime-resilience-plan -- Worktree: D:\Datas\OthersProjects\makelore-pi-runtime-resilience-plan-4b8e2c71 -- Base commit: 274187e3cfe2ae6cb97f2b4bcb422b3fdf06fbf2 -- Owner: codex-root -- Status: Ready for Integration - -## Scope - -- Produce a task-owned, executable Pi runtime resilience hardening proposal - based on the installed Windows worker-loss incident and the existing Pi - cutover Spec. -- Define lifecycle invariants, crash/abort/settled ordering, explicit restart - policy, resource cleanup, session safety, thinking-level correctness, - privacy-safe diagnostics, packaged fault injection, release gates, and the - executor handoff. -- Do not modify product code, the active executor worktree, canonical project - memory, or the original 18-node / 31-edge cutover DAG. - -## Intent And Constraints - -- Treat process exit as unavoidable but make application survival, target-only - failure convergence, no uncertain prompt replay, and explainable worker - replacement mandatory product guarantees. -- Keep the Pi hard cutover; do not introduce OpenCode fallback, a second - runtime path, a global Pi daemon, generic Provider watchdog, feature flag, or - speculative compatibility framework. -- Preserve the original Conversation/session binding and generation isolation. - Keep real external Provider validation as `Explicitly Waived / Accepted - Risk`, `realTurnVerified=false`; do not present loopback evidence as Pass. -- Follow repository-pinned pnpm, focused/full tests, `build:vite`, Windows - Electron E2E, formal packaging, artifact verification, and final packaged - fault injection. -- Use no subagents, in accordance with the user's explicit direction and the - repository policy. - -## Project Context Loaded - -- Concurrent Task Gate passed in the isolated worktree owned by `codex-root`; - task ID, mode, branch, worktree, base commit, and task record match the local - registry. -- Planning Gate passed after reading the entry and memory indexes, active task, - positioning/current-state/decision/architecture/domain/success/evidence/ - reflection/commitment/stale records, the Pi hard-cutover Spec and tickets, - the installed stuck-processing diagnosis, the Windows proxy/session-reopen - records, and active peer task scopes. -- Base `274187e3cfe2ae6cb97f2b4bcb422b3fdf06fbf2` contains the cumulative Windows - Pi proxy and persisted-session reopen fixes used by the installed package - diagnosis. -- Shared canonical architecture still contains superseded OpenCode-era text. - This feature task records a future promotion candidate instead of modifying - canonical files outside Integration Gate. -- Executor task `20260825-pi-worker-exit-thinking-5e7c2a91` is already isolated - on the same base and implements the exact current-fix portion of this plan. - This task owns only its proposal/task record, so there is no code-path write - conflict or competing architecture direction. -- The initiating worker-exit class remains unknown. Eleven installed-runtime - copied-session loopback cases settled, so ordinary tested Provider/SSE, - session corruption, and `task_state` are not established causes. -- Gate result: Passed. - -## Plan - -1. Consolidate confirmed incident evidence and the existing Pi Spec invariants - without claiming an initiating cause that current artifacts cannot prove. -2. Define the Main-owned lifecycle seam, terminal-state and generation - invariants, explicit stop/replacement reasons, no-replay recovery policy, - and bounded privacy-safe diagnostics. -3. Define resource/session/thinking contracts, exact implementation phases, - focused and final packaged fault-injection acceptance, and release blockers. -4. Record `PI-R001` as the current corrective implementation task and defer - soak/field classification to a dependent `PI-R002`, without changing the - original cutover DAG. -5. Run document drift/project-doc gates, commit only the owned proposal and - task record, then send the fixed document and acceptance contract to the - existing implementation thread. - -## Outcome - -- Added task-owned proposal - `10-decisions/proposals/20260825-pi-runtime-resilience-plan-4b8e2c71__pi-runtime-resilience-hardening.md`. -- The proposal defines the difference between an impossible “never exits” - promise and enforceable product guarantees: Electron survival, bounded run - terminalization, target isolation, explicit replacement reasons, no mutation - replay, same-session recovery, resource convergence, effective thinking - state, privacy-safe forensics, and final Windows packaged fault injection. -- Assigned current implementation scope to corrective ticket `PI-R001` and the - already-active executor task `20260825-pi-worker-exit-thinking-5e7c2a91`. - Defined `PI-R002` as a later non-concurrent soak/field-classification task. -- Kept the original 18-node / 31-edge cutover DAG unchanged and retained all - existing Provider/platform risk labels. - -## Verification - -- Concurrent Task Gate and Planning Gate: passed. -- Proposal cross-checked against Pi Spec sections 8, 12.2/12.3, 17, 18, 19, - and 20, plus the current implementation/diagnosis records. -- Product code and the executor worktree were not modified. -- `check_doc_drift.py`: passed; only the task-owned proposal and task record - are present. -- `check_project_docs.py`: passed. -- `git diff --check`: passed. - -## Follow-ups - -- Executor task `20260825-pi-worker-exit-thinking-5e7c2a91` implements and - verifies `PI-R001`, produces the Windows NSIS, and returns commit/path/hash. -- After `PI-R001` package acceptance, schedule `PI-R002` for repeated - loopback/fault-injection soak and use the new lifecycle evidence if a real - installed-user recurrence occurs. -- Real external Provider validation remains explicitly waived accepted risk; - macOS and native non-WSL Linux status is unchanged. - -## Promotion Candidates - -- Target canonical documents: Pi runtime release runbook, accepted Pi - architecture/current-state, and future integration status. -- Proposal: promote the invariants that worker failure must terminalize the - matching run, every generation replacement has a bounded reason, accepted or - uncertain mutation is never auto-replayed, and recover reopens the same - session binding. -- Evidence: installed-package diagnosis - `20260825-pi-stuck-processing-diagnosis-7c4e91a2`, this proposal, and the - future accepted `PI-R001` implementation/package evidence. -- Future impact: all later Pi upgrades and Windows release candidates must keep - the packaged failure-injection gate and explainable lifecycle diagnostics. -- Semantic conflicts: canonical files still describe the superseded OpenCode - runtime; Integration Gate must reconcile them with the completed Pi chain. -- Human confirmation: not required for these already-authorized invariants; - required if integration changes the existing real-Provider waiver or - deferred platform release scope. diff --git a/.project-docs/30-worklog/tasks/20260825-pi-worker-exit-thinking-5e7c2a91.md b/.project-docs/30-worklog/tasks/20260825-pi-worker-exit-thinking-5e7c2a91.md index 788e2a4..702edb6 100644 --- a/.project-docs/30-worklog/tasks/20260825-pi-worker-exit-thinking-5e7c2a91.md +++ b/.project-docs/30-worklog/tasks/20260825-pi-worker-exit-thinking-5e7c2a91.md @@ -85,9 +85,14 @@ task's base and identifies this executor task as `PI-R001`. Its `RES-INV-001..009`, `RES-ACC-001..016`, release blockers, Main-only privacy boundary, and final packaged fault-injection matrix are additional acceptance - contracts for this implementation. It is present in this branch as the - conflict-free cherry-pick `2b13454`, so planning and implementation share one - history without rewriting either line of work. + contracts for this implementation. The content first entered as the + conflict-free cherry-pick `2b13454`; the exact source commit `2d9d827` was + then retained as a merge parent, so planning and implementation share one + history without rewriting either line of work. At the executor tip the + specification is materialized under the task-owned path + `20260825-pi-worker-exit-thinking-5e7c2a91__pi-runtime-resilience-hardening.md`; + the planner task record remains available in the original commit history + instead of violating feature-task document ownership. ## Plan