feat: record legacy Guanghu upgrade architecture
Part 1/4 of the verified continuation from local 18dfdfd: navigation, in-place upgrade boundary, enterprise UPGRADE_STAGING checkpoint, identity and intent state. Source base b03619e.
This commit is contained in:
parent
b03619e359
commit
7f5ad74c6b
12 changed files with 421 additions and 38 deletions
86
deployment/AW-HLCC-DEPLOYMENT-CHECKPOINT-20260726.hdlp
Normal file
86
deployment/AW-HLCC-DEPLOYMENT-CHECKPOINT-20260726.hdlp
Normal file
|
|
@ -0,0 +1,86 @@
|
|||
# AW-HLCC-DEPLOYMENT-CHECKPOINT-20260726
|
||||
|
||||
> **目标节点**：`AW-GZ-001`
|
||||
>
|
||||
> **现场主机名**：`GH-CVM-MAIN-PROD-01`
|
||||
>
|
||||
> **目标服务**：HoloLake Code Channel Enterprise isolated candidate
|
||||
>
|
||||
> **状态**：UPGRADE_STAGING · ISOLATED_CANDIDATE_HEALTHY · PRODUCTION_NOT_CUT_OVER
|
||||
|
||||
## 已核验现场
|
||||
|
||||
- 腾讯云 OrcaTerm 官方在线终端可用。
|
||||
- 现有 `lighthouse-gitea`、PostgreSQL、Redis 容器健康。
|
||||
- 现有 Gitea 为 `gitea/gitea:1.21.11`，监听 `127.0.0.1:3000`；不得覆盖。
|
||||
- 企业灯塔 `guanghu-enterprise-lighthouse.service` 正常，监听 `127.0.0.1:8031`。
|
||||
- 旧光湖驱动引擎 `/opt/engine.js` 仍监听 `0.0.0.0:3910`，提供旧执行、健康、状态和文件
|
||||
路由并连接多个历史节点。它是升级依赖，不得当成无关服务或直接拔除。
|
||||
- `api-router.service` 运行 `/root/api-router-v3.py`，是旧 Python 网关。
|
||||
- `guanghu-portal.service`、`/opt/zhuyuan/revive-guard/revive-guard.py`、TAT/Barad Agent
|
||||
均属于需要恢复拓扑和职责边界的既有运行面。
|
||||
- 旧驱动脚本含硬编码历史节点访问材料且为世界可读，必须在调用方盘点后迁移、轮换和收口；
|
||||
不得把材料复制到对话、仓库、意图胶囊或新回执。
|
||||
- Nginx 监听 80/443；本轮不修改公网反向代理或生产入口。
|
||||
- `/etc/fstab` 仍声明 `/dev/vdb -> /data`，但 `lsblk` 当前不存在 `/dev/vdb`，
|
||||
`data.mount` 因此失败。系统盘约 50GB、当前剩余约 30GB。
|
||||
- 现有企业 Gitea 数据位于 `/opt/docker-data/lighthouse-cn/data/lighthouse/gitea`，
|
||||
其中已有 `bingshuo/lighthouse.git` 与 `bingshuo/hololake-world.git`。
|
||||
- `certbot.service` 为已不存在单元的旧失败记录，不是当前代码频道故障根因。
|
||||
|
||||
## 离线包
|
||||
|
||||
本地包：
|
||||
|
||||
```text
|
||||
光湖代码频道-Forgejo-16.0.1-完整离线包
|
||||
```
|
||||
|
||||
本机 `MANIFEST.sha256` 六个文件已全部通过。企业节点具备 `/usr/bin/gpg`；上传结束后必须
|
||||
在目标端再次执行完整 SHA-256 校验、发布密钥指纹核对和二进制签名验证。
|
||||
|
||||
## 部署边界
|
||||
|
||||
隔离验证阶段只允许：
|
||||
|
||||
1. 上传到隔离暂存区；
|
||||
2. 在系统盘创建隔离候选目录；
|
||||
3. 以无登录专用用户运行；
|
||||
4. 监听 `127.0.0.1:3340`；
|
||||
5. 导入离线光湖代码频道 bundle；
|
||||
6. 验证版本、首页、仓库读取、重启保持和关闭在线更新；
|
||||
7. 写回执。
|
||||
|
||||
本轮不允许：
|
||||
|
||||
- 替换现有 `127.0.0.1:3000` Gitea；
|
||||
- 修改 Nginx 生产路由或自动开放公网；
|
||||
- 把缺失的 `/data` 当作已挂载；
|
||||
- 复制个人第五域账号、密码哈希、令牌或仓库数据库；
|
||||
- 使用旧 `3910` 任意命令驱动；
|
||||
- 未验签启动、自动镜像、在线更新或 Actions。
|
||||
- 把 `3340` 候选声明为脱离旧语言系统的第二套权威代码频道；
|
||||
- 未恢复旧小湖灯、驱动、门户和守护 Agent 拓扑就替换旧内部入口。
|
||||
|
||||
## 恢复顺序
|
||||
|
||||
```text
|
||||
完成六文件上传
|
||||
→ 目标端 SHA-256 + GPG 指纹 + 签名
|
||||
→ 建立 nologin 的 guanghu 服务用户
|
||||
→ 安装到 /var/lib/guanghu-enterprise-code-channel/candidates/hlcc-v16.0.1
|
||||
→ 启动 127.0.0.1:3340 隔离候选
|
||||
→ 健康验证并写隔离候选回执
|
||||
→ 恢复旧小湖灯、驱动、门户、守护 Agent 和内部进入方式的全局拓扑
|
||||
→ 把新导航/意图/Agent 门作为兼容升级嵌入旧链路
|
||||
→ 再决定导入 guanghu-code-channel.bundle 与正式迁移
|
||||
→ 验证前停在 UPGRADE_STAGING，不切公网
|
||||
→ 后续单独决定恢复 /dev/vdb 或登记正式替代数据根
|
||||
```
|
||||
|
||||
## 京东链路判断
|
||||
|
||||
2026-07-26 本机访问 `https://guanghulab.com/`、`/authz/health` 和 `/code/` 均返回
|
||||
HTTP 200。当前“京东又上不去”不是整机公网服务中断；已发现的问题是在线授权运行时版本偏旧、
|
||||
AW 导航图读取失败以及动作/传输链未完全登记。工单批准、导航图、动作注册、传输、执行和健康
|
||||
回执必须继续分开证明。
|
||||
|
|
@ -4,7 +4,7 @@
|
|||
编号：HLCC-DOC-ENTERPRISE-INSTALL-20260724-001
|
||||
收件人：光湖团队技术主控 Awen 及其部署人格体
|
||||
状态：可执行安装稿
|
||||
适用版本：HLCC 离线包 v16.0.1（以离线包内 `manifest.json` 的版本为准）
|
||||
适用版本：HLCC 离线包 v16.0.1（以离线包内 `MANIFEST.sha256`、发布签名和二进制版本共同核验）
|
||||
|
||||
## 0. 先确认边界
|
||||
|
||||
|
|
@ -29,10 +29,13 @@
|
|||
在离线包目录执行：
|
||||
|
||||
```text
|
||||
sha256sum -c manifest.sha256
|
||||
sha256sum -c MANIFEST.sha256
|
||||
```
|
||||
|
||||
然后确认 `manifest.json`、签名文件和程序文件的版本一致。若校验失败、版本字段缺失或来源不明，停止安装并把校验结果回传给光湖团队，不要强行启动。
|
||||
然后核对 Forgejo 发布密钥完整指纹
|
||||
`EB114F5E6C0DC2BCDD183550A4B61A2DC5923710`，验证
|
||||
`forgejo-16.0.1-linux-amd64.asc` 对二进制的签名，并执行二进制 `--version`。
|
||||
任一校验失败或来源不明时停止安装，不要强行启动。
|
||||
|
||||
## 3. 安装顺序
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,42 @@
|
|||
{
|
||||
"schema": "guanghu.intent-state-capsule/v1",
|
||||
"capsule_id": "ISC-AW-GZ-001-HLCC-20260726",
|
||||
"human_anchor": "ICE-GL-INF",
|
||||
"persona_id": "ICE-GL-ZY001",
|
||||
"conversation_instance_id": "CODEX-20260726",
|
||||
"task_intent": "Deploy and verify the enterprise Guanghu code-channel as an isolated loopback candidate without changing the existing production Gitea.",
|
||||
"identity_boundary": "The public Zhuyuan system is an intelligent operations system, not a persona. The current persona is paired with the human anchor and must use the registered navigation and Agent gate.",
|
||||
"established_facts": [
|
||||
"The offline Forgejo 16.0.1 package passed all target-side SHA-256 checks.",
|
||||
"The Forgejo release signature matched fingerprint EB114F5E6C0DC2BCDD183550A4B61A2DC5923710.",
|
||||
"The current development source is pinned at b03619e359b9c5f5eeae73b15db6b255b9b243f7.",
|
||||
"The existing Gitea, PostgreSQL, and Redis services are out of scope for this candidate."
|
||||
],
|
||||
"decisions": [
|
||||
"Use AW-HLCC-CANDIDATE-DEPLOYER for exactly one deploy_release action on AW-GZ-001.",
|
||||
"Bind the candidate to 127.0.0.1:3340 and perform no production cutover.",
|
||||
"Retain the verified offline source and execution receipt."
|
||||
],
|
||||
"rejected_routes": [
|
||||
"Direct raw-shell deployment recorded as a Guanghu success.",
|
||||
"Reusing the historical 3910 driver credential.",
|
||||
"Replacing or modifying the healthy existing Gitea deployment.",
|
||||
"Creating a Forgejo administrator account during this action."
|
||||
],
|
||||
"authorization_state": "Human requested enterprise code-channel deployment; no new credential creation is authorized or required for the isolated candidate.",
|
||||
"current_checkpoint": "AW-GZ-001 global navigation and intent gate is healthy; fixed connector is installed.",
|
||||
"next_action": "Consume one registered Agent unlock and start the isolated candidate.",
|
||||
"completion_definition": [
|
||||
"Forgejo reports a healthy version response at 127.0.0.1:3340.",
|
||||
"The service listens on loopback only.",
|
||||
"An Agent execution receipt records the pinned source and no production cutover.",
|
||||
"Existing production Gitea, PostgreSQL, and Redis remain healthy."
|
||||
],
|
||||
"evidence": [
|
||||
"deployment/AW-HLCC-DEPLOYMENT-CHECKPOINT-20260726.hdlp",
|
||||
"deployment/navigation-maps/AW-GZ-001.json",
|
||||
"server-tools/hololake-code-channel/install-candidate.sh",
|
||||
"server-tools/enterprise-lighthouse/fixed_agent_connector.py"
|
||||
],
|
||||
"updated_at": "2026-07-26T21:25:00+08:00"
|
||||
}
|
||||
Loading…
Reference in a new issue