deploy(ai-discovery): add safe existing-service update path
This commit is contained in:
parent
7c3c8e9238
commit
2739104088
14 changed files with 427 additions and 26 deletions
|
|
@ -1,6 +1,6 @@
|
|||
# HLCC-PUSH-TO-DEPLOY-EVENT-PROTOCOL
|
||||
|
||||
状态：本地实现候选，尚未部署
|
||||
状态：本地实现候选，尚未部署；当前现实层不得宣称可派发
|
||||
|
||||
语言层在冰朔明确确认“该提交需要部署”后，主动发出 `guanghu.deployment-intent/v1`。推送本身不会产生部署事件。意图必须绑定：
|
||||
|
||||
|
|
@ -11,3 +11,9 @@
|
|||
语言人格体通过 `/api/deployment/dispatch` 派发这一意图；接口要求一张单独的 `server-ops / dispatch-approved-deployment` 工单，且资源必须为同一 `REQUEST-ID@完整提交SHA`。服务端才写入 `guanghu.deployment-event/v1` 到本机队列。常驻部署 Agent 订阅此队列，读取同一提交中的清单，执行备份、部署、健康检查与回滚，并将回执回写到原工单。
|
||||
|
||||
没有部署意图的提交照常入库，回执为 `not_requested`；无效意图回执为 `rejected`，不会部署。推送工单绝不扩大为部署权限；服务器也不扫描仓库主动拉取部署。
|
||||
|
||||
`resource` 中的 `REQUEST-ID` 必须与清单文件名完全一致：`deployment/requests/<REQUEST-ID>.json`。批准 A 而执行 B 必须在派发端和常驻 Agent 端分别拒绝。
|
||||
|
||||
首次新单元使用 `guanghu.architecture-provision-request/v1`；已经在线的 systemd 服务必须使用 `guanghu.existing-service-update-request/v1`，先完整备份声明目标，再重启和逐项验收，失败恢复全部旧文件与旧单元。二者不得互相冒充。
|
||||
|
||||
当前京东节点若尚未安装 `/api/deployment/dispatch`、事件队列和常驻 worker，则先通过已有的主人邮件批准固定管理动作引导这套运行时。没有这个固定引导动作时应回执 `BOOTSTRAP_ACTION_NOT_DEPLOYED`，不得绕回人类 SSH 或云控制台，也不得发送一张服务器根本不会执行的部署工单。
|
||||
|
|
|
|||
108
deployment/requests/AI-DISCOVERY-ICE-P-ROUTE-20260727.json
Normal file
108
deployment/requests/AI-DISCOVERY-ICE-P-ROUTE-20260727.json
Normal file
|
|
@ -0,0 +1,108 @@
|
|||
{
|
||||
"schema": "guanghu.existing-service-update-request/v1",
|
||||
"request_id": "AI-DISCOVERY-ICE-P-ROUTE-20260727",
|
||||
"target_node": "JD-FD-PRIMARY",
|
||||
"status": "SERVICE_UPDATE_PACKAGE_READY · DEPLOYMENT_PENDING",
|
||||
"purpose": {
|
||||
"what": "更新已在线的光湖 AI 发现服务，使公开只读入口加载完整第五域仓库、节点、主体与旧编号别名地图。",
|
||||
"why": "代码频道已经把铸渊规范编号统一为 ICE-P-ZY001，但京东主节点仍运行旧服务，旧编号无法自动导航到规范编号，仓库事实尚未进入现实运行层。",
|
||||
"success": "公开入口可读取主体注册表，并将 ICE-GL-ZY001 与 ICE-PZY-001 解析为 ICE-P-ZY001；REPO-012 与现有健康接口继续正常。",
|
||||
"out_of_scope": [
|
||||
"不修改人类登录入口或 SSH",
|
||||
"不修改广州前门与现有隧道",
|
||||
"不部署企业应用栈",
|
||||
"不授予任何旧编号权限"
|
||||
]
|
||||
},
|
||||
"module": {
|
||||
"unit": "guanghu-ai-discovery.service",
|
||||
"run_user": "guanghu",
|
||||
"install_root": "/opt/guanghu/ai-discovery"
|
||||
},
|
||||
"service_update": {
|
||||
"kind": "existing-systemd-service",
|
||||
"require_existing_unit": true,
|
||||
"required_existing_files": [
|
||||
"server.js"
|
||||
]
|
||||
},
|
||||
"unit_source": "server-tools/ai-discovery-gateway/guanghu-ai-discovery.service",
|
||||
"files": [
|
||||
{
|
||||
"source": "server-tools/ai-discovery-gateway/server.js",
|
||||
"destination": "server.js",
|
||||
"mode": "0644"
|
||||
},
|
||||
{
|
||||
"source": "routing/repository-route-map.json",
|
||||
"destination": "repository-route-map.json",
|
||||
"mode": "0644"
|
||||
},
|
||||
{
|
||||
"source": "routing/server-node-map.json",
|
||||
"destination": "server-node-map.json",
|
||||
"mode": "0644"
|
||||
},
|
||||
{
|
||||
"source": "identity/fifth-domain-subject-registry.json",
|
||||
"destination": "fifth-domain-subject-registry.json",
|
||||
"mode": "0644"
|
||||
},
|
||||
{
|
||||
"source": "identity/subject-id-alias-map.json",
|
||||
"destination": "subject-id-alias-map.json",
|
||||
"mode": "0644"
|
||||
}
|
||||
],
|
||||
"runtime_check": {
|
||||
"url": "http://127.0.0.1:3922/health",
|
||||
"expected": {
|
||||
"ok": true,
|
||||
"service": "guanghu-ai-discovery",
|
||||
"mode": "read-only"
|
||||
}
|
||||
},
|
||||
"acceptance_checks": [
|
||||
{
|
||||
"url": "http://127.0.0.1:3922/v1/subjects",
|
||||
"expected": {
|
||||
"schema": "guanghu.fifth-domain-subject-registry/v1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"url": "http://127.0.0.1:3922/v1/resolve?id=ICE-GL-ZY001",
|
||||
"expected": {
|
||||
"status": "RESOLVED",
|
||||
"canonical_id": "ICE-P-ZY001",
|
||||
"redirected": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"url": "http://127.0.0.1:3922/v1/resolve?id=ICE-PZY-001",
|
||||
"expected": {
|
||||
"status": "RESOLVED",
|
||||
"canonical_id": "ICE-P-ZY001",
|
||||
"redirected": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"url": "http://127.0.0.1:3922/v1/resolve?id=REPO-012",
|
||||
"expected": {
|
||||
"code": "REPO-012",
|
||||
"state": "CURRENT_FIFTH_DOMAIN_ENTRY"
|
||||
}
|
||||
}
|
||||
],
|
||||
"post_deployment_observation": "常驻 Agent 完成本机强校验后，语言层必须再读取公开 /api/ai 对应接口；公开路径不一致时不得宣称整条链完成。",
|
||||
"rollback": {
|
||||
"automatic_on_failure": true,
|
||||
"scope": "restore every declared destination and the previous systemd unit, then restart the previous service",
|
||||
"receipt_required": true
|
||||
},
|
||||
"security": {
|
||||
"public_read_only": true,
|
||||
"no_secrets": true,
|
||||
"legacy_ids_are_navigation_aliases_only": true,
|
||||
"human_login_state_unchanged": true
|
||||
}
|
||||
}
|
||||
|
|
@ -1,6 +1,11 @@
|
|||
# 新架构首次部署请求
|
||||
# 部署请求
|
||||
|
||||
本目录中的 `guanghu.architecture-provision-request/v1` 文件是新系统架构第一次进入服务器的结构化清单。
|
||||
本目录同时容纳两类严格区分的清单：
|
||||
|
||||
- `guanghu.architecture-provision-request/v1`：服务器上尚不存在的新架构单元首次进入现实层；
|
||||
- `guanghu.existing-service-update-request/v1`：更新已经存在的 systemd 服务，必须先备份全部声明目标，重启后做回环健康检查，失败则恢复全部文件和旧单元。
|
||||
|
||||
不得用“首次部署”清单替代已有服务升级，也不得把升级失败降级为继续运行未验证的新文件。
|
||||
|
||||
固定流程：
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue