fix(jd): register Guanghu source push route

server-tools/lake-lamp-authz/README.md

@@ -79,6 +79,17 @@ node server-tools/lake-lamp-authz/authorize-repo-push.js \
 命令运行期间不要关闭它。公开空工单不会发邮件，也没有推送权限；只有冰朔打开
 `REQUEST_URL` 后，服务器才向预登记邮箱发送批准邮件。
 
+直达接收器写入的本地裸仓库必须同时满足三项部署条件：
+
+- 精确登记在 `repo-push-registry.json`，仓库 URL 与允许分支不得模糊匹配；
+- 裸仓库路径加入 `lake-lamp-authz.service` 的 `ReadWritePaths`，且只向
+  `guanghu-authz` 所属共享组开放所需的穿行和读写权限；
+- 当裸仓库归属代码频道服务账户时，在系统 Git 配置中把该精确路径登记为
+  `safe.directory`，不得使用通配符。
+
+部署后用当前主分支生成无变化验收 bundle，经 `receiveBundle` 完整执行一次；验收前后
+主分支 SHA 必须一致，并且代码频道账户与授权服务账户执行 `git fsck` 均通过。
+
 ## 受控电脑兼容入口
 
 如果环境中存在 `LAKE_LAMP_REQUEST_TOKEN` 或 `LAKE_LAMP_REQUEST_TOKEN_FILE`，脚本

server-tools/lake-lamp-authz/lake-lamp-authz.service

@@ -16,7 +16,7 @@ NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
 ProtectHome=true
-ReadWritePaths=/var/lib/guanghu/lake-lamp-authz /var/lib/guanghu/repo-authorizations /var/lib/guanghu/repo-push-uploads /var/lib/guanghu/forgejo/repositories/bingshuo/hololake-platform.git
+ReadWritePaths=/var/lib/guanghu/lake-lamp-authz /var/lib/guanghu/repo-authorizations /var/lib/guanghu/repo-push-uploads /var/lib/guanghu/forgejo/repositories/bingshuo/hololake-platform.git /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 LockPersonality=true
 

server-tools/lake-lamp-authz/repo-push-broker.test.js

@@ -41,6 +41,37 @@ test("repository resolution is exact and returns an explicit unregistered receip
   );
 });
 
+test("Guanghu Ice Heart resolves only through its public code-channel URL", () => {
+  const registry = {
+    "bingshuo/guanghu-ice-heart": {
+      branches: ["main"],
+      remote: "file:///var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git",
+      source_urls: [
+        "https://guanghulab.com/code/bingshuo/guanghu-ice-heart.git",
+      ],
+    },
+  };
+  assert.deepEqual(
+    resolveRepository(
+      "https://guanghulab.com/code/bingshuo/guanghu-ice-heart.git",
+      registry,
+    ),
+    {
+      ok: true,
+      diagnostic_code: "repository_registered",
+      repo: "bingshuo/guanghu-ice-heart",
+      branches: ["main"],
+    },
+  );
+  assert.equal(
+    resolveRepository(
+      "https://guanghulab.com/fifth-domain/bingshuo/guanghu-ice-heart.git",
+      registry,
+    ).diagnostic_code,
+    "repository_not_registered",
+  );
+});
+
 test("receiver permits only an allowlisted fast-forward bundle with an exact base", async () => {
   const uploadDir = fs.mkdtempSync(path.join(os.tmpdir(), "lake-lamp-upload-"));
   const bundle = path.join(uploadDir, "one.bundle"); fs.writeFileSync(bundle, "bundle");

server-tools/lake-lamp-authz/repo-push-registry.example.json

@@ -11,6 +11,16 @@
         "https://guanghulab.com/fifth-domain/bingshuo/hololake-platform.git"
       ],
       "verification_url": "https://guanghulab.com/fifth-domain/bingshuo/hololake-platform/commits/branch/{branch}"
+    },
+    "bingshuo/guanghu-ice-heart": {
+      "branches": [
+        "main"
+      ],
+      "remote": "file:///var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git",
+      "source_urls": [
+        "https://guanghulab.com/code/bingshuo/guanghu-ice-heart.git"
+      ],
+      "verification_url": "https://guanghulab.com/code/bingshuo/guanghu-ice-heart/commits/branch/{branch}"
     }
   }
 }