fix(authz): allow registered AI discovery updates

server-tools/lake-lamp-authz/install-architecture-provisioner.test.js

@@ -9,6 +9,10 @@ const source = fs.readFileSync(
   path.join(__dirname, "install-architecture-provisioner.sh"),
   "utf8",
 );
+const architectureProvisionUnit = fs.readFileSync(
+  path.join(__dirname, "lake-lamp-architecture-provision.service"),
+  "utf8",
+);
 
 test("bootstrap installer preserves secrets and deploys the complete HoloLake capability set", () => {
   for (const file of [
@@ -47,3 +51,10 @@ test("provider migration writes only a private registry and never prints API key
   assert.doesNotMatch(source, /echo .*API_KEY/);
   assert.doesNotMatch(source, /printf .*API_KEY/);
 });
+
+test("architecture provision broker can update the registered AI discovery service", () => {
+  assert.match(
+    architectureProvisionUnit,
+    /^ReadWritePaths=.*\/opt\/guanghu\/ai-discovery(?:\s|$)/m,
+  );
+});

server-tools/lake-lamp-authz/lake-lamp-architecture-provision.service

@@ -15,7 +15,7 @@ NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
 ProtectHome=true
-ReadWritePaths=/var/lib/guanghu/architecture-provision /opt/guanghu/architecture-releases /etc/systemd/system
+ReadWritePaths=/var/lib/guanghu/architecture-provision /opt/guanghu/architecture-releases /opt/guanghu/ai-discovery /etc/systemd/system
 RuntimeDirectory=guanghu-architecture-provision
 RuntimeDirectoryMode=0755
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6