guanghu-ice-heart/deployment/requests/HLCC-HUMAN-MERGE-AUTO-DEPLOY-20260806.json

{
  "schema": "guanghu.existing-service-update-request/v1",
  "request_id": "HLCC-HUMAN-MERGE-AUTO-DEPLOY-20260806",
  "target_node": "JD-FD-PRIMARY",
  "status": "SERVICE_UPDATE_PACKAGE_READY · DEPLOYMENT_PENDING",
  "purpose": {
    "what": "把光湖代码频道中由冰朔人工完成的main合并转换为不可变部署事件，交给京东常驻部署Agent执行。",
    "why": "服务器已经具备清单校验、备份、部署、健康检查、回滚和回执能力，但代码频道的合并事件尚未接到部署队列，导致每次合并后仍需再次派发。",
    "success": "仅Forgejo已合并PR且merged_by=bingshuo、目标仓库和分支匹配、改动包含deployment/requests下的有效清单时入队；普通push、关闭未合并、错误签名、其他合并者和重复投递均不产生第二次部署。",
    "out_of_scope": [
      "不因普通Git push自动部署",
      "不执行PR或仓库提供的命令",
      "不允许清单选择目标服务器或扩大权限",
      "不修改光湖OS磁盘、内核、引导或启动状态"
    ]
  },
  "module": {
    "unit": "lake-lamp-authz.service",
    "run_user": "guanghu-authz",
    "install_root": "/opt/guanghu/lake-lamp-authz",
    "environment_files": [
      "/etc/guanghu/secrets/lake-lamp/authorization.env"
    ],
    "writable_paths": [
      "/var/lib/guanghu/lake-lamp-authz",
      "/var/lib/guanghu/repo-authorizations",
      "/var/lib/guanghu/repo-push-uploads",
      "/var/lib/guanghu/deployment-events",
      "/var/lib/guanghu/forgejo/repositories/bingshuo/hololake-platform.git",
      "/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git",
      "/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/hololake-knowledge-base.git"
    ]
  },
  "service_update": {
    "kind": "existing-systemd-service",
    "require_existing_unit": true,
    "required_existing_files": [
      "server.js",
      "deployment-event.js"
    ]
  },
  "unit_source": "server-tools/lake-lamp-authz/lake-lamp-authz.service",
  "files": [
    {
      "source": "server-tools/lake-lamp-authz/server.js",
      "destination": "server.js",
      "mode": "0644"
    },
    {
      "source": "server-tools/lake-lamp-authz/deployment-event.js",
      "destination": "deployment-event.js",
      "mode": "0644"
    },
    {
      "source": "server-tools/lake-lamp-authz/forgejo-merge-deployment.js",
      "destination": "forgejo-merge-deployment.js",
      "mode": "0644"
    }
  ],
  "runtime_check": {
    "url": "http://127.0.0.1:3921/health",
    "expected": {
      "ok": true,
      "service": "lake-lamp-authz",
      "merge_deployment_gate": {
        "configured": true,
        "mode": "human-merged-pull-request-only"
      }
    }
  },
  "acceptance_checks": [
    {
      "url": "http://127.0.0.1:3921/api/public/capabilities",
      "expected": {
        "schema": "guanghu.lake-lamp-public-workorder/v1"
      }
    }
  ],
  "bootstrap": {
    "one_time": true,
    "reason": "本清单合并前合并门尚不存在；首次由当前已授权实例按完整候选提交和同一回滚执行器安装，之后由人工合并自动触发。",
    "webhook_target": "https://guanghulab.com/authz/api/deployment/forgejo-merge",
    "webhook_event": "pull_request",
    "secret_location": "/etc/guanghu/secrets/lake-lamp/authorization.env",
    "secret_committed": false
  },
  "rollback": {
    "automatic_on_failure": true,
    "scope": "恢复server.js、deployment-event.js、原systemd单元并移除新增门模块，然后重启旧服务",
    "receipt_required": true
  },
  "security": {
    "hmac_sha256_required": true,
    "allowed_repository": "bingshuo/guanghu-ice-heart",
    "allowed_branch": "main",
    "allowed_mergers": [
      "bingshuo"
    ],
    "max_deployment_manifests_per_merge": 5,
    "delivery_idempotency": true,
    "repository_commands_executed": false,
    "no_secrets": true
  }
}