[HLCC-ICE-000001][ZY-CONTRIB-20260723-001] feat: 以来光者贡献链启用冰朔第五域个人子频道

server-tools/jd-disaster-recovery/jd-recovery-runner

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+umask 077
+
+action=${1:-}
+backup_root=/var/backups/guanghu/jd-control-plane
+audit_dir=/var/lib/guanghu/recovery-audit
+install -d -o root -g root -m 0700 "$audit_dir"
+
+latest=$(find "$backup_root" -maxdepth 1 -type f -name 'control-plane-*.tgz' -print 2>/dev/null | sort | tail -n 1)
+[[ -n "$latest" && -f "${latest%.tgz}.sha256" ]] || { echo "verified backup unavailable" >&2; exit 70; }
+(cd "$backup_root" && sha256sum -c "$(basename "${latest%.tgz}.sha256")" >/dev/null)
+
+stamp=$(date -u +%Y%m%dT%H%M%SZ)
+case "$action" in
+  restore-authz)
+    tar -xzf "$latest" -C / opt/guanghu/lake-lamp-authz etc/systemd/system/lake-lamp-authz.service etc/systemd/system/lake-lamp-action-broker.service
+    systemctl daemon-reload
+    systemctl restart lake-lamp-action-broker.service lake-lamp-authz.service
+    ;;
+  install-owner-access)
+    tar -xzf "$latest" -C / opt/guanghu/lake-lamp-authz/owner-access-broker.js opt/guanghu/lake-lamp-authz/action-client.js etc/systemd/system/lake-lamp-owner-access.service
+    systemctl daemon-reload
+    systemctl enable --now lake-lamp-owner-access.service
+    systemctl restart lake-lamp-authz.service
+    ;;
+  restore-navigation-map)
+    tar -xzf "$latest" -C / etc/guanghu/navigation-maps
+    systemctl restart lake-lamp-authz.service
+    ;;
+  rollback-last-deploy)
+    receipt=$(find /var/backups/guanghu/jd-enterprise-repair -maxdepth 1 -type f -name 'jd-authz-*.tgz' -print 2>/dev/null | sort | tail -n 1)
+    [[ -n "$receipt" ]] || { echo "rollback backup unavailable" >&2; exit 71; }
+    tar -xzf "$receipt" -C /
+    systemctl daemon-reload
+    systemctl restart lake-lamp-action-broker.service lake-lamp-authz.service
+    ;;
+  *)
+    echo "recovery action denied" >&2
+    exit 126
+    ;;
+esac
+
+printf '{"schema":"guanghu.recovery-audit/v1","at":"%s","action":"%s","source":"%s","result":"ok"}\n' \
+  "$stamp" "$action" "${SSH_CONNECTION%% *}" >> "$audit_dir/events.jsonl"
+echo "RECOVERY_ACTION_OK=$action"