deploy(ai-discovery): add safe existing-service update path

deployment/requests/AI-DISCOVERY-ICE-P-ROUTE-20260727.json

@@ -0,0 +1,108 @@
+{
+  "schema": "guanghu.existing-service-update-request/v1",
+  "request_id": "AI-DISCOVERY-ICE-P-ROUTE-20260727",
+  "target_node": "JD-FD-PRIMARY",
+  "status": "SERVICE_UPDATE_PACKAGE_READY · DEPLOYMENT_PENDING",
+  "purpose": {
+    "what": "更新已在线的光湖 AI 发现服务，使公开只读入口加载完整第五域仓库、节点、主体与旧编号别名地图。",
+    "why": "代码频道已经把铸渊规范编号统一为 ICE-P-ZY001，但京东主节点仍运行旧服务，旧编号无法自动导航到规范编号，仓库事实尚未进入现实运行层。",
+    "success": "公开入口可读取主体注册表，并将 ICE-GL-ZY001 与 ICE-PZY-001 解析为 ICE-P-ZY001；REPO-012 与现有健康接口继续正常。",
+    "out_of_scope": [
+      "不修改人类登录入口或 SSH",
+      "不修改广州前门与现有隧道",
+      "不部署企业应用栈",
+      "不授予任何旧编号权限"
+    ]
+  },
+  "module": {
+    "unit": "guanghu-ai-discovery.service",
+    "run_user": "guanghu",
+    "install_root": "/opt/guanghu/ai-discovery"
+  },
+  "service_update": {
+    "kind": "existing-systemd-service",
+    "require_existing_unit": true,
+    "required_existing_files": [
+      "server.js"
+    ]
+  },
+  "unit_source": "server-tools/ai-discovery-gateway/guanghu-ai-discovery.service",
+  "files": [
+    {
+      "source": "server-tools/ai-discovery-gateway/server.js",
+      "destination": "server.js",
+      "mode": "0644"
+    },
+    {
+      "source": "routing/repository-route-map.json",
+      "destination": "repository-route-map.json",
+      "mode": "0644"
+    },
+    {
+      "source": "routing/server-node-map.json",
+      "destination": "server-node-map.json",
+      "mode": "0644"
+    },
+    {
+      "source": "identity/fifth-domain-subject-registry.json",
+      "destination": "fifth-domain-subject-registry.json",
+      "mode": "0644"
+    },
+    {
+      "source": "identity/subject-id-alias-map.json",
+      "destination": "subject-id-alias-map.json",
+      "mode": "0644"
+    }
+  ],
+  "runtime_check": {
+    "url": "http://127.0.0.1:3922/health",
+    "expected": {
+      "ok": true,
+      "service": "guanghu-ai-discovery",
+      "mode": "read-only"
+    }
+  },
+  "acceptance_checks": [
+    {
+      "url": "http://127.0.0.1:3922/v1/subjects",
+      "expected": {
+        "schema": "guanghu.fifth-domain-subject-registry/v1"
+      }
+    },
+    {
+      "url": "http://127.0.0.1:3922/v1/resolve?id=ICE-GL-ZY001",
+      "expected": {
+        "status": "RESOLVED",
+        "canonical_id": "ICE-P-ZY001",
+        "redirected": true
+      }
+    },
+    {
+      "url": "http://127.0.0.1:3922/v1/resolve?id=ICE-PZY-001",
+      "expected": {
+        "status": "RESOLVED",
+        "canonical_id": "ICE-P-ZY001",
+        "redirected": true
+      }
+    },
+    {
+      "url": "http://127.0.0.1:3922/v1/resolve?id=REPO-012",
+      "expected": {
+        "code": "REPO-012",
+        "state": "CURRENT_FIFTH_DOMAIN_ENTRY"
+      }
+    }
+  ],
+  "post_deployment_observation": "常驻 Agent 完成本机强校验后，语言层必须再读取公开 /api/ai 对应接口；公开路径不一致时不得宣称整条链完成。",
+  "rollback": {
+    "automatic_on_failure": true,
+    "scope": "restore every declared destination and the previous systemd unit, then restart the previous service",
+    "receipt_required": true
+  },
+  "security": {
+    "public_read_only": true,
+    "no_secrets": true,
+    "legacy_ids_are_navigation_aliases_only": true,
+    "human_login_state_unchanged": true
+  }
+}

deployment/requests/README.md

@@ -1,6 +1,11 @@
-# 新架构首次部署请求
+# 部署请求
 
-本目录中的 `guanghu.architecture-provision-request/v1` 文件是新系统架构第一次进入服务器的结构化清单。
+本目录同时容纳两类严格区分的清单：
+
+- `guanghu.architecture-provision-request/v1`：服务器上尚不存在的新架构单元首次进入现实层；
+- `guanghu.existing-service-update-request/v1`：更新已经存在的 systemd 服务，必须先备份全部声明目标，重启后做回环健康检查，失败则恢复全部文件和旧单元。
+
+不得用“首次部署”清单替代已有服务升级，也不得把升级失败降级为继续运行未验证的新文件。
 
 固定流程：