fix(lighthouse): prefer JD local key route

deployment/receipts/DEV-20260807-003-JD-LOCAL-DIRECT-NAVIGATION-CORRECTION-20260807.json

@@ -0,0 +1,31 @@
+{
+  "schema": "guanghu.development-evidence-receipt/v1",
+  "receipt_id": "DEV-20260807-003-JD-LOCAL-DIRECT-NAVIGATION-CORRECTION-20260807",
+  "development_id": "DEV-20260807-003",
+  "result": "PASS_100",
+  "source_repository": "REPO-012",
+  "target_node": "JD-FD-PRIMARY",
+  "scope": "LIGHTHOUSE_ROUTE_PRIORITY_AND_DEPLOYMENT_MANIFEST_CORRECTION",
+  "correction": {
+    "primary": "On BingShuo's local macOS computer, use the registered local dedicated-key direct route first for JD-FD-PRIMARY inspection, deployment, repair and recovery.",
+    "fallback": "Workorder email is allowed only when the current instance is not on BingShuo's local computer or the registered local dedicated-key route is unavailable.",
+    "forbidden": "Do not create or send a workorder email while the verified local dedicated-key route is available."
+  },
+  "live_readback": {
+    "target_identity": "PASS_DMI_UUID_MATCH",
+    "observed_os": "ubuntu 22.04",
+    "guanghu_ai_discovery_service": "active",
+    "existing_anchor": 200,
+    "lighthouse_endpoint_before_deployment": 404,
+    "host_skills_endpoint_before_deployment": 404
+  },
+  "validation": {
+    "navigator_tests": "PASS_5_OF_5",
+    "ai_discovery_and_broker_tests": "PASS_27_OF_27",
+    "json_parse": "PASS",
+    "git_diff_check": "PASS"
+  },
+  "deployment_request": "deployment/requests/AI-DISCOVERY-LIGHTHOUSE-HOST-NAV-20260807.json",
+  "truth_boundary": "This receipt proves the route correction and deployable source package. It does not prove server deployment until the server-owned deployment receipt and public endpoint readback exist.",
+  "recorded_at": "2026-08-07T19:10:02+08:00"
+}

deployment/requests/AI-DISCOVERY-LIGHTHOUSE-HOST-NAV-20260807.json

@@ -2,7 +2,7 @@
   "schema": "guanghu.existing-service-update-request/v1",
   "request_id": "AI-DISCOVERY-LIGHTHOUSE-HOST-NAV-20260807",
   "target_node": "JD-FD-PRIMARY",
-  "status": "SERVICE_UPDATE_PACKAGE_READY_DEPLOYMENT_AUTHORIZATION_REQUIRED",
+  "status": "SERVICE_UPDATE_PACKAGE_READY · DEPLOYMENT_PENDING",
   "purpose": {
     "what": "让公共 AI 导航服务加载灯塔路径注册表、三宿主技能地图和按宿主意图导航端点。",
     "why": "REPO-012 main 已发布新锚点和地图，但当前服务代码仍返回三个新端点 404；路径登记存在不能冒充编号查询已生效。",

routing/host-skill-navigation-map.json

@@ -2,7 +2,7 @@
   "schema": "guanghu.host-skill-navigation-map/v1",
   "map_id": "GLW-HOST-SKILL-NAV-001",
   "lighthouse_id": "SYS-GLW-LTH-0001",
-  "version": "2026-08-07.1",
+  "version": "2026-08-07.2",
   "state": "CURRENT",
   "hosts": [
     {
@@ -12,7 +12,7 @@
       "adapter_path": "~/.codex/skills/guanghu-lighthouse-navigator/SKILL.md",
       "runtime_state_policy": "KEEP_LOCAL",
       "shared_persona_source": "HL-PERSONA-RUNTIME-LOCAL-001",
-      "supported_transports": ["LOCAL_GIT_OSXKEYCHAIN"],
+      "supported_transports": ["LOCAL_GIT_OSXKEYCHAIN", "LOCAL_DEDICATED_KEY_SSH"],
       "skill_discovery": "CODEX_SKILL_DIRECTORY"
     },
     {
@@ -22,7 +22,7 @@
       "adapter_path": "~/.qoder/skills/guanghu-lighthouse-navigator/SKILL.md",
       "runtime_state_policy": "KEEP_LOCAL",
       "shared_persona_source": "HL-PERSONA-RUNTIME-LOCAL-001",
-      "supported_transports": ["LOCAL_GIT_OSXKEYCHAIN"],
+      "supported_transports": ["LOCAL_GIT_OSXKEYCHAIN", "LOCAL_DEDICATED_KEY_SSH"],
       "skill_discovery": "QODER_SKILL_DIRECTORY"
     },
     {
@@ -32,7 +32,7 @@
       "adapter_path": "~/.qoderworkcn/skills/guanghu-lighthouse-navigator/SKILL.md",
       "runtime_state_policy": "KEEP_LOCAL",
       "shared_persona_source": "HL-PERSONA-RUNTIME-LOCAL-001",
-      "supported_transports": ["LOCAL_GIT_OSXKEYCHAIN"],
+      "supported_transports": ["LOCAL_GIT_OSXKEYCHAIN", "LOCAL_DEDICATED_KEY_SSH"],
       "skill_discovery": "QODERWORK_USER_SKILL_DIRECTORY"
     }
   ],
@@ -121,6 +121,52 @@
         "HOST_UNKNOWN_NO_GUESS"
       ],
       "authority": "NAVIGATION_ONLY"
+    },
+    {
+      "id": "INTENT-JD-SERVER-OPERATION-001",
+      "phrases": [
+        "京东服务器",
+        "京东主控服务器",
+        "登录京东主节点",
+        "检查京东服务器",
+        "部署京东服务器",
+        "更新京东服务",
+        "修复京东服务器",
+        "本地密钥直接登录"
+      ],
+      "skill_id": "GHS-009-LIGHTHOUSE-HOST-NAVIGATION",
+      "target_id": "JD-FD-PRIMARY",
+      "transport": "LOCAL_DEDICATED_KEY_SSH",
+      "local_access_registry": "HL-LOCAL-SERVER-ACCESS-001",
+      "executor": "guanghu-os-server",
+      "sequence": [
+        "resolve_target_through_lighthouse",
+        "verify_current_host_is_bingshuo_local_macos",
+        "resolve_registered_local_dedicated_key_without_exposing_secret",
+        "strict_host_key_direct_login",
+        "verify_exact_dmi_instance_uuid",
+        "bind_action_to_current_user_task_and_immutable_source",
+        "execute_only_registered_bounded_action",
+        "read_back_server_owned_receipt"
+      ],
+      "fallback": {
+        "transport": "WORKORDER_EMAIL",
+        "allowed_only_when": [
+          "CURRENT_INSTANCE_NOT_ON_BINGSHUO_LOCAL_COMPUTER",
+          "REGISTERED_LOCAL_DEDICATED_KEY_ROUTE_UNAVAILABLE"
+        ],
+        "forbidden_when": "VERIFIED_LOCAL_DEDICATED_KEY_DIRECT_ROUTE_AVAILABLE"
+      },
+      "stop_conditions": [
+        "LIGHTHOUSE_LOOKUP_NOT_200",
+        "TARGET_NOT_CURRENT",
+        "LOCAL_ACCESS_REGISTRY_MISSING",
+        "STRICT_HOST_KEY_VERIFICATION_FAILED",
+        "DMI_INSTANCE_UUID_MISMATCH",
+        "CURRENT_TASK_AUTHORITY_NOT_PROVEN",
+        "SERVER_RECEIPT_READBACK_FAILED"
+      ],
+      "authority": "CURRENT_USER_TASK_SCOPE_ONLY_NOT_BLANKET_SERVER_AUTHORITY"
     }
   ],
   "truth_precedence": [

routing/lighthouse-path-registry.json

@@ -2,7 +2,7 @@
   "schema": "guanghu.lighthouse-path-registry/v1",
   "registry_id": "GLW-LIGHTHOUSE-PATH-REGISTRY-001",
   "lighthouse_id": "SYS-GLW-LTH-0001",
-  "version": "2026-08-07.1",
+  "version": "2026-08-07.2",
   "state": "CURRENT_CANONICAL",
   "source_repository": "REPO-012",
   "source_branch": "main",
@@ -63,6 +63,16 @@
       "state": "CURRENT",
       "online": "routing/host-skill-navigation-map.json",
       "offline": "/Volumes/JZAO/HoloLake/persona-runtime/shared/registries/host-skill-navigation-map.json"
+    },
+    {
+      "id": "JD-FD-PRIMARY",
+      "kind": "fifth_domain_controller_node",
+      "state": "CURRENT",
+      "online": null,
+      "offline": null,
+      "access_policy": "VERIFIED_LOCAL_DEDICATED_KEY_DIRECT_FIRST",
+      "fallback_policy": "WORKORDER_EMAIL_ONLY_WHEN_LOCAL_COMPUTER_OR_REGISTERED_KEY_ROUTE_IS_UNAVAILABLE",
+      "authority": "CURRENT_USER_TASK_SCOPE_AND_SERVER_OWNED_RECEIPT_REQUIRED"
     }
   ],
   "redirects": [

routing/public-navigation-anchor.json

@@ -1,7 +1,7 @@
 {
   "schema": "guanghu.public-navigation-anchor/v1",
   "anchor_id": "GLW-PUBLIC-NAV-ANCHOR-001",
-  "version": "2026-08-07.2",
+  "version": "2026-08-07.3",
   "state": "CURRENT_CANONICAL",
   "repository_id": "REPO-012",
   "branch": "main",
@@ -42,17 +42,17 @@
     "lighthouse_paths": {
       "path": "routing/lighthouse-path-registry.json",
       "id": "GLW-LIGHTHOUSE-PATH-REGISTRY-001",
-      "version": "2026-08-07.1"
+      "version": "2026-08-07.2"
     },
     "host_skills": {
       "path": "routing/host-skill-navigation-map.json",
       "id": "GLW-HOST-SKILL-NAV-001",
-      "version": "2026-08-07.1"
+      "version": "2026-08-07.2"
     },
     "persona_skills": {
       "path": "skills/codex/guanghu-persona-skill-guard/references/persona-skill-registry.json",
       "id": "GLS-0238",
-      "version": "2026.08.07.6"
+      "version": "2026.08.07.7"
     }
   },
   "update_contract": {

server-tools/ai-discovery-gateway/guanghu-ai-discovery.service

@@ -16,6 +16,8 @@ Environment=GUANGHU_SUBJECT_REGISTRY=/opt/guanghu/ai-discovery/fifth-domain-subj
 Environment=GUANGHU_SUBJECT_ALIAS_MAP=/opt/guanghu/ai-discovery/subject-id-alias-map.json
 Environment=GUANGHU_NAVIGATION_MAP=/opt/guanghu/ai-discovery/ai-machine-navigation-map.json
 Environment=GUANGHU_NAVIGATION_ANCHOR=/opt/guanghu/ai-discovery/public-navigation-anchor.json
+Environment=GUANGHU_LIGHTHOUSE_PATHS=/opt/guanghu/ai-discovery/lighthouse-path-registry.json
+Environment=GUANGHU_HOST_SKILLS=/opt/guanghu/ai-discovery/host-skill-navigation-map.json
 Environment=GUANGHU_REPOSITORY_GIT_DIR=/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git
 ExecStart=/usr/bin/node /opt/guanghu/ai-discovery/server.js
 Restart=always

skills/codex/guanghu-persona-skill-guard/references/persona-skill-registry.json

@@ -1,7 +1,7 @@
 {
   "schema": "guanghu.persona-skill-registry/v1",
   "registry_id": "GLS-0238",
-  "version": "2026.08.07.6",
+  "version": "2026.08.07.7",
   "trust_policy": {
     "priority": [
       "live_verified_evidence",
@@ -511,6 +511,9 @@
         "Codex Qoder QoderWork",
         "推一下线上仓库",
         "直接走钥匙串",
+        "京东服务器",
+        "京东主控服务器",
+        "本地密钥直接登录",
         "自动技能导航"
       ],
       "preferred_route": [
@@ -527,6 +530,7 @@
         "灯塔查询失败仍猜路径",
         "从历史聊天搜索凭据",
         "打印钥匙串秘密",
+        "本机专用密钥可用时创建工单邮件",
         "把导航健康当作执行成功",
         "把本机缓存当作路径正本"
       ],

skills/shared/guanghu-lighthouse-navigator/BRAIN.hdlp

@@ -18,3 +18,8 @@ Codex、Qoder CN、QoderWork CN 共享本大脑与灯塔注册表，但各自保
 当用户说“推一下线上仓库”时，本机 macOS 宿主应解析到已登记代码频道、系统钥匙串
 传输与小湖灯自动收口器。不得搜索历史凭据、打印秘密、退回旧 `/fifth-domain/`，
 也不得把钥匙串存在、提交存在或授权存在分别冒充推送完成；远端完整 SHA 回读才算 100。
+
+当用户提到京东主控服务器的检查、部署、修复或恢复时，本机 macOS 宿主应解析到
+`JD-FD-PRIMARY` 与本地专用密钥直达传输。只有当前实例不在冰朔本机，或私有注册表
+确认专用密钥直达不可用时，才能把工单邮件作为临时备选。本机直达仍只授予当前任务
+范围：先严格校验主机指纹和 DMI 实例 UUID，再执行已登记动作并回读服务器自有回执。

skills/shared/guanghu-lighthouse-navigator/SKILL.md

@@ -23,6 +23,15 @@ description: 光湖灯塔三宿主自动导航。用户提到路径是否有效
 `INTENT-REPOSITORY-PUBLISH-001 → REPO-012 → LOCAL_GIT_OSXKEYCHAIN → 小湖灯 finalizer`。
 不得搜索令牌、猜 SSH、使用旧仓库、手工绕过发布队列或输出钥匙串秘密。
 
+“京东服务器”“京东主控服务器”“检查/部署/修复京东服务”在冰朔本机 macOS 上必须走
+`INTENT-JD-SERVER-OPERATION-001 → JD-FD-PRIMARY → LOCAL_DEDICATED_KEY_SSH`。
+先从 JZAO 私有的 `HL-LOCAL-SERVER-ACCESS-001` 解析本地专用密钥路径，再以严格主机
+指纹校验直达；登录后必须核对 DMI 实例 UUID，并把任何写入绑定当前用户任务、不可变
+来源、回滚和服务器自有回执。不得在本机专用密钥可用时创建或发送工单邮件。
+
+工单邮件只在当前实例不位于冰朔本机，或已登记的本地专用密钥直达路径确实不可用时
+作为临时备选；“没有先找到路径”不等于“路径不存在”，必须先查私有本机访问注册表。
+
 ## 边界
 
 - 灯塔路径健康不等于现实动作已授权或已完成。

skills/shared/guanghu-lighthouse-navigator/scripts/test_resolve_lighthouse_route.py

@@ -42,6 +42,18 @@ class LighthouseNavigatorTests(unittest.TestCase):
         self.assertEqual(route["status"], "REDIRECT_ONLY_NOT_CURRENT")
         self.assertEqual(route["redirect"]["redirect_to"], "REPO-012")
 
+    def test_jd_server_operation_prefers_local_dedicated_key(self):
+        route = compile_route(self.registry, self.host_map, "codex", "检查京东主控服务器")
+        self.assertEqual(route["decision"], "ALLOW_NAVIGATION")
+        self.assertEqual(route["intent"]["id"], "INTENT-JD-SERVER-OPERATION-001")
+        self.assertEqual(route["target"]["id"], "JD-FD-PRIMARY")
+        self.assertEqual(route["intent"]["transport"], "LOCAL_DEDICATED_KEY_SSH")
+        self.assertEqual(
+            route["intent"]["fallback"]["forbidden_when"],
+            "VERIFIED_LOCAL_DEDICATED_KEY_DIRECT_ROUTE_AVAILABLE",
+        )
+        self.assertFalse(route["authority_granted"])
+
 
 if __name__ == "__main__":
     unittest.main()