[HLCC-ICE-000001][ZY-CONTRIB-20260723-001] feat: 以来光者贡献链启用冰朔第五域个人子频道

deployment/requests/HLCC-JD-APP-HUB-PROXY-PROVISION-20260723.json

@@ -0,0 +1,59 @@
+{
+  "schema": "guanghu.architecture-provision-request/v1",
+  "request_id": "HLCC-JD-APP-HUB-PROXY-PROVISION-20260723",
+  "target_node": "JD-FD-PRIMARY",
+  "architecture_id": "GLS-HLCC-002",
+  "module": {
+    "code": "JD-HUB-02",
+    "name": "京东应用入口与光湖代码频道本机代理",
+    "bind": "loopback:8088 -> loopback:3340 for /code/",
+    "owner": "systemd",
+    "unit": "jd-app-hub.service",
+    "run_user": "guanghu",
+    "writable_paths": [],
+    "read_only_paths": []
+  },
+  "source_ref": "REPO-001:refs/heads/main",
+  "deployed_commit_policy": "resolve immutable commit during provision and record it in the deployment receipt",
+  "source_paths": [
+    "server-tools/jd-app-hub/server.js",
+    "server-tools/jd-app-hub/index.html",
+    "server-tools/jd-app-hub/styles.css",
+    "server-tools/jd-app-hub/app.js",
+    "server-tools/jd-app-hub/jd-app-hub.service"
+  ],
+  "initial_provision": {
+    "kind": "new-architecture-unit",
+    "not_an_existing_action_bridge_extension": true,
+    "requires": [
+      "back up the existing jd-app-hub.service unit",
+      "preserve the existing loopback 8088 application entry",
+      "proxy only /code/ to the isolated loopback 3340 candidate",
+      "retain the current Guangzhou-to-JD app tunnel and SSH permitopen policy",
+      "install and verify the hardened non-root replacement unit",
+      "write a private deployment receipt"
+    ]
+  },
+  "verification": [
+    "the staged unit is backed by immutable v2 source files and the existing app hub remains healthy",
+    "a separate low-privilege activation package must restart and verify version=2.0.1 before public cutover",
+    "GET /api/code-channel-status exposes only a bounded candidate stage and failure category",
+    "the service still binds only to 127.0.0.1:8088",
+    "only /code/ is forwarded to 127.0.0.1:3340",
+    "current Gitea port 3001 and its tunnel remain unchanged",
+    "failure restores the previous jd-app-hub.service unit"
+  ],
+  "runtime_check": {
+    "url": "http://127.0.0.1:8088/api/status",
+    "expected": {
+      "ok": true,
+      "service": "jd-app-hub"
+    }
+  },
+  "rollback": [
+    "restore the backed-up jd-app-hub.service unit",
+    "restart the previous JD application hub",
+    "leave current Gitea and all Guangzhou tunnels unchanged"
+  ],
+  "status": "ARCHITECTURE_PACKAGE_READY · INITIAL_PROVISION_PENDING"
+}