fix(authz): allow approved deployment dispatch

server-tools/lake-lamp-authz/install-architecture-provisioner.test.js

@@ -13,6 +13,10 @@ const architectureProvisionUnit = fs.readFileSync(
   path.join(__dirname, "lake-lamp-architecture-provision.service"),
   "utf8",
 );
+const authorizationUnit = fs.readFileSync(
+  path.join(__dirname, "lake-lamp-authz.service"),
+  "utf8",
+);
 
 test("bootstrap installer preserves secrets and deploys the complete HoloLake capability set", () => {
   for (const file of [
@@ -58,3 +62,14 @@ test("architecture provision broker can update the registered AI discovery servi
     /^ReadWritePaths=.*\/opt\/guanghu\/ai-discovery(?:\s|$)/m,
   );
 });
+
+test("authorization service can enqueue an approved deployment event", () => {
+  assert.match(
+    authorizationUnit,
+    /^ReadWritePaths=.*\/var\/lib\/guanghu\/deployment-events(?:\s|$)/m,
+  );
+  assert.match(
+    source,
+    /install -d -m 0770 -o root -g guanghu-authz \/var\/lib\/guanghu\/deployment-events/,
+  );
+});