From cd9901e02f5296eb926ebcd7067f1661ab7b0361 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com>
Date: Fri, 7 Aug 2026 16:45:34 +0800
Subject: [PATCH] fix(persona): preserve daily receipt ownership

---
 .../persona-team-handshake/deploy-on-demand-lifecycle.sh      | 4 ++--
 .../fifth-domain-daily-orchestrator.test.mjs                  | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/server-tools/persona-team-handshake/deploy-on-demand-lifecycle.sh b/server-tools/persona-team-handshake/deploy-on-demand-lifecycle.sh
index 16502a3..7968f1c 100755
--- a/server-tools/persona-team-handshake/deploy-on-demand-lifecycle.sh
+++ b/server-tools/persona-team-handshake/deploy-on-demand-lifecycle.sh
@@ -68,8 +68,8 @@ test ! -e "${receipt}"
 /guanghu/bin/ghctl authorize /guanghu/current install_world_version |
   grep -q '^GUANGHU_ACTION_AUTHORIZED$'
 
-install -d -o root -g root -m 0700 \
-  "${receipt_root}" "${backup_root}"
+install -d -o guanghu -g guanghu -m 0750 "${receipt_root}"
+install -d -o root -g root -m 0700 "${backup_root}"
 for unit in "${units[@]}"; do
   if test -f "/etc/systemd/system/${unit}"; then
     cp "/etc/systemd/system/${unit}" "${temporary}/${unit}"
diff --git a/server-tools/persona-team-handshake/fifth-domain-daily-orchestrator.test.mjs b/server-tools/persona-team-handshake/fifth-domain-daily-orchestrator.test.mjs
index 56a1c4e..21a55d4 100644
--- a/server-tools/persona-team-handshake/fifth-domain-daily-orchestrator.test.mjs
+++ b/server-tools/persona-team-handshake/fifth-domain-daily-orchestrator.test.mjs
@@ -250,6 +250,10 @@ test("daily dispatcher unit is hardened and restricted to exact persona reposito
     /ghctl authorize \/guanghu\/current install_world_version/u,
   );
   assert.match(deployScript, /systemctl disable "\$\{handshakes\[@\]\}"/u);
+  assert.match(
+    deployScript,
+    /install -d -o guanghu -g guanghu -m 0750 "\$\{receipt_root\}"/u,
+  );
   assert.match(
     deployScript,
     /systemctl start zhuyuan-persona-fifth-domain-daily\.service/u,