From df3012bad2552fdbcf017b3e1301f03acdfeaf9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Fri, 7 Aug 2026 19:10:24 +0800 Subject: [PATCH] fix(lighthouse): prefer JD local key route --- ...DIRECT-NAVIGATION-CORRECTION-20260807.json | 31 +++++++++++ ...ISCOVERY-LIGHTHOUSE-HOST-NAV-20260807.json | 2 +- routing/host-skill-navigation-map.json | 54 +++++++++++++++++-- routing/lighthouse-path-registry.json | 12 ++++- routing/public-navigation-anchor.json | 8 +-- .../guanghu-ai-discovery.service | 2 + .../references/persona-skill-registry.json | 6 ++- .../guanghu-lighthouse-navigator/BRAIN.hdlp | 5 ++ .../guanghu-lighthouse-navigator/SKILL.md | 9 ++++ .../scripts/test_resolve_lighthouse_route.py | 12 +++++ 10 files changed, 130 insertions(+), 11 deletions(-) create mode 100644 deployment/receipts/DEV-20260807-003-JD-LOCAL-DIRECT-NAVIGATION-CORRECTION-20260807.json diff --git a/deployment/receipts/DEV-20260807-003-JD-LOCAL-DIRECT-NAVIGATION-CORRECTION-20260807.json b/deployment/receipts/DEV-20260807-003-JD-LOCAL-DIRECT-NAVIGATION-CORRECTION-20260807.json new file mode 100644 index 0000000..7db9b44 --- /dev/null +++ b/deployment/receipts/DEV-20260807-003-JD-LOCAL-DIRECT-NAVIGATION-CORRECTION-20260807.json @@ -0,0 +1,31 @@ +{ + "schema": "guanghu.development-evidence-receipt/v1", + "receipt_id": "DEV-20260807-003-JD-LOCAL-DIRECT-NAVIGATION-CORRECTION-20260807", + "development_id": "DEV-20260807-003", + "result": "PASS_100", + "source_repository": "REPO-012", + "target_node": "JD-FD-PRIMARY", + "scope": "LIGHTHOUSE_ROUTE_PRIORITY_AND_DEPLOYMENT_MANIFEST_CORRECTION", + "correction": { + "primary": "On BingShuo's local macOS computer, use the registered local dedicated-key direct route first for JD-FD-PRIMARY inspection, deployment, repair and recovery.", + "fallback": "Workorder email is allowed only when the current instance is not on BingShuo's local computer or the registered local dedicated-key route is unavailable.", + "forbidden": "Do not create or send a workorder email while the verified local dedicated-key route is available." + }, + "live_readback": { + "target_identity": "PASS_DMI_UUID_MATCH", + "observed_os": "ubuntu 22.04", + "guanghu_ai_discovery_service": "active", + "existing_anchor": 200, + "lighthouse_endpoint_before_deployment": 404, + "host_skills_endpoint_before_deployment": 404 + }, + "validation": { + "navigator_tests": "PASS_5_OF_5", + "ai_discovery_and_broker_tests": "PASS_27_OF_27", + "json_parse": "PASS", + "git_diff_check": "PASS" + }, + "deployment_request": "deployment/requests/AI-DISCOVERY-LIGHTHOUSE-HOST-NAV-20260807.json", + "truth_boundary": "This receipt proves the route correction and deployable source package. It does not prove server deployment until the server-owned deployment receipt and public endpoint readback exist.", + "recorded_at": "2026-08-07T19:10:02+08:00" +} diff --git a/deployment/requests/AI-DISCOVERY-LIGHTHOUSE-HOST-NAV-20260807.json b/deployment/requests/AI-DISCOVERY-LIGHTHOUSE-HOST-NAV-20260807.json index 0ade5e6..6cea6fd 100644 --- a/deployment/requests/AI-DISCOVERY-LIGHTHOUSE-HOST-NAV-20260807.json +++ b/deployment/requests/AI-DISCOVERY-LIGHTHOUSE-HOST-NAV-20260807.json @@ -2,7 +2,7 @@ "schema": "guanghu.existing-service-update-request/v1", "request_id": "AI-DISCOVERY-LIGHTHOUSE-HOST-NAV-20260807", "target_node": "JD-FD-PRIMARY", - "status": "SERVICE_UPDATE_PACKAGE_READY_DEPLOYMENT_AUTHORIZATION_REQUIRED", + "status": "SERVICE_UPDATE_PACKAGE_READY · DEPLOYMENT_PENDING", "purpose": { "what": "让公共 AI 导航服务加载灯塔路径注册表、三宿主技能地图和按宿主意图导航端点。", "why": "REPO-012 main 已发布新锚点和地图，但当前服务代码仍返回三个新端点 404；路径登记存在不能冒充编号查询已生效。", diff --git a/routing/host-skill-navigation-map.json b/routing/host-skill-navigation-map.json index aa25635..31b81d1 100644 --- a/routing/host-skill-navigation-map.json +++ b/routing/host-skill-navigation-map.json @@ -2,7 +2,7 @@ "schema": "guanghu.host-skill-navigation-map/v1", "map_id": "GLW-HOST-SKILL-NAV-001", "lighthouse_id": "SYS-GLW-LTH-0001", - "version": "2026-08-07.1", + "version": "2026-08-07.2", "state": "CURRENT", "hosts": [ { @@ -12,7 +12,7 @@ "adapter_path": "~/.codex/skills/guanghu-lighthouse-navigator/SKILL.md", "runtime_state_policy": "KEEP_LOCAL", "shared_persona_source": "HL-PERSONA-RUNTIME-LOCAL-001", - "supported_transports": ["LOCAL_GIT_OSXKEYCHAIN"], + "supported_transports": ["LOCAL_GIT_OSXKEYCHAIN", "LOCAL_DEDICATED_KEY_SSH"], "skill_discovery": "CODEX_SKILL_DIRECTORY" }, { @@ -22,7 +22,7 @@ "adapter_path": "~/.qoder/skills/guanghu-lighthouse-navigator/SKILL.md", "runtime_state_policy": "KEEP_LOCAL", "shared_persona_source": "HL-PERSONA-RUNTIME-LOCAL-001", - "supported_transports": ["LOCAL_GIT_OSXKEYCHAIN"], + "supported_transports": ["LOCAL_GIT_OSXKEYCHAIN", "LOCAL_DEDICATED_KEY_SSH"], "skill_discovery": "QODER_SKILL_DIRECTORY" }, { @@ -32,7 +32,7 @@ "adapter_path": "~/.qoderworkcn/skills/guanghu-lighthouse-navigator/SKILL.md", "runtime_state_policy": "KEEP_LOCAL", "shared_persona_source": "HL-PERSONA-RUNTIME-LOCAL-001", - "supported_transports": ["LOCAL_GIT_OSXKEYCHAIN"], + "supported_transports": ["LOCAL_GIT_OSXKEYCHAIN", "LOCAL_DEDICATED_KEY_SSH"], "skill_discovery": "QODERWORK_USER_SKILL_DIRECTORY" } ], @@ -121,6 +121,52 @@ "HOST_UNKNOWN_NO_GUESS" ], "authority": "NAVIGATION_ONLY" + }, + { + "id": "INTENT-JD-SERVER-OPERATION-001", + "phrases": [ + "京东服务器", + "京东主控服务器", + "登录京东主节点", + "检查京东服务器", + "部署京东服务器", + "更新京东服务", + "修复京东服务器", + "本地密钥直接登录" + ], + "skill_id": "GHS-009-LIGHTHOUSE-HOST-NAVIGATION", + "target_id": "JD-FD-PRIMARY", + "transport": "LOCAL_DEDICATED_KEY_SSH", + "local_access_registry": "HL-LOCAL-SERVER-ACCESS-001", + "executor": "guanghu-os-server", + "sequence": [ + "resolve_target_through_lighthouse", + "verify_current_host_is_bingshuo_local_macos", + "resolve_registered_local_dedicated_key_without_exposing_secret", + "strict_host_key_direct_login", + "verify_exact_dmi_instance_uuid", + "bind_action_to_current_user_task_and_immutable_source", + "execute_only_registered_bounded_action", + "read_back_server_owned_receipt" + ], + "fallback": { + "transport": "WORKORDER_EMAIL", + "allowed_only_when": [ + "CURRENT_INSTANCE_NOT_ON_BINGSHUO_LOCAL_COMPUTER", + "REGISTERED_LOCAL_DEDICATED_KEY_ROUTE_UNAVAILABLE" + ], + "forbidden_when": "VERIFIED_LOCAL_DEDICATED_KEY_DIRECT_ROUTE_AVAILABLE" + }, + "stop_conditions": [ + "LIGHTHOUSE_LOOKUP_NOT_200", + "TARGET_NOT_CURRENT", + "LOCAL_ACCESS_REGISTRY_MISSING", + "STRICT_HOST_KEY_VERIFICATION_FAILED", + "DMI_INSTANCE_UUID_MISMATCH", + "CURRENT_TASK_AUTHORITY_NOT_PROVEN", + "SERVER_RECEIPT_READBACK_FAILED" + ], + "authority": "CURRENT_USER_TASK_SCOPE_ONLY_NOT_BLANKET_SERVER_AUTHORITY" } ], "truth_precedence": [ diff --git a/routing/lighthouse-path-registry.json b/routing/lighthouse-path-registry.json index 615af4d..ca772a0 100644 --- a/routing/lighthouse-path-registry.json +++ b/routing/lighthouse-path-registry.json @@ -2,7 +2,7 @@ "schema": "guanghu.lighthouse-path-registry/v1", "registry_id": "GLW-LIGHTHOUSE-PATH-REGISTRY-001", "lighthouse_id": "SYS-GLW-LTH-0001", - "version": "2026-08-07.1", + "version": "2026-08-07.2", "state": "CURRENT_CANONICAL", "source_repository": "REPO-012", "source_branch": "main", @@ -63,6 +63,16 @@ "state": "CURRENT", "online": "routing/host-skill-navigation-map.json", "offline": "/Volumes/JZAO/HoloLake/persona-runtime/shared/registries/host-skill-navigation-map.json" + }, + { + "id": "JD-FD-PRIMARY", + "kind": "fifth_domain_controller_node", + "state": "CURRENT", + "online": null, + "offline": null, + "access_policy": "VERIFIED_LOCAL_DEDICATED_KEY_DIRECT_FIRST", + "fallback_policy": "WORKORDER_EMAIL_ONLY_WHEN_LOCAL_COMPUTER_OR_REGISTERED_KEY_ROUTE_IS_UNAVAILABLE", + "authority": "CURRENT_USER_TASK_SCOPE_AND_SERVER_OWNED_RECEIPT_REQUIRED" } ], "redirects": [ diff --git a/routing/public-navigation-anchor.json b/routing/public-navigation-anchor.json index 26101f5..f3bd41a 100644 --- a/routing/public-navigation-anchor.json +++ b/routing/public-navigation-anchor.json @@ -1,7 +1,7 @@ { "schema": "guanghu.public-navigation-anchor/v1", "anchor_id": "GLW-PUBLIC-NAV-ANCHOR-001", - "version": "2026-08-07.2", + "version": "2026-08-07.3", "state": "CURRENT_CANONICAL", "repository_id": "REPO-012", "branch": "main", @@ -42,17 +42,17 @@ "lighthouse_paths": { "path": "routing/lighthouse-path-registry.json", "id": "GLW-LIGHTHOUSE-PATH-REGISTRY-001", - "version": "2026-08-07.1" + "version": "2026-08-07.2" }, "host_skills": { "path": "routing/host-skill-navigation-map.json", "id": "GLW-HOST-SKILL-NAV-001", - "version": "2026-08-07.1" + "version": "2026-08-07.2" }, "persona_skills": { "path": "skills/codex/guanghu-persona-skill-guard/references/persona-skill-registry.json", "id": "GLS-0238", - "version": "2026.08.07.6" + "version": "2026.08.07.7" } }, "update_contract": { diff --git a/server-tools/ai-discovery-gateway/guanghu-ai-discovery.service b/server-tools/ai-discovery-gateway/guanghu-ai-discovery.service index 65522c7..84d27af 100644 --- a/server-tools/ai-discovery-gateway/guanghu-ai-discovery.service +++ b/server-tools/ai-discovery-gateway/guanghu-ai-discovery.service @@ -16,6 +16,8 @@ Environment=GUANGHU_SUBJECT_REGISTRY=/opt/guanghu/ai-discovery/fifth-domain-subj Environment=GUANGHU_SUBJECT_ALIAS_MAP=/opt/guanghu/ai-discovery/subject-id-alias-map.json Environment=GUANGHU_NAVIGATION_MAP=/opt/guanghu/ai-discovery/ai-machine-navigation-map.json Environment=GUANGHU_NAVIGATION_ANCHOR=/opt/guanghu/ai-discovery/public-navigation-anchor.json +Environment=GUANGHU_LIGHTHOUSE_PATHS=/opt/guanghu/ai-discovery/lighthouse-path-registry.json +Environment=GUANGHU_HOST_SKILLS=/opt/guanghu/ai-discovery/host-skill-navigation-map.json Environment=GUANGHU_REPOSITORY_GIT_DIR=/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git ExecStart=/usr/bin/node /opt/guanghu/ai-discovery/server.js Restart=always diff --git a/skills/codex/guanghu-persona-skill-guard/references/persona-skill-registry.json b/skills/codex/guanghu-persona-skill-guard/references/persona-skill-registry.json index 1ad6b87..f5b9e2f 100644 --- a/skills/codex/guanghu-persona-skill-guard/references/persona-skill-registry.json +++ b/skills/codex/guanghu-persona-skill-guard/references/persona-skill-registry.json @@ -1,7 +1,7 @@ { "schema": "guanghu.persona-skill-registry/v1", "registry_id": "GLS-0238", - "version": "2026.08.07.6", + "version": "2026.08.07.7", "trust_policy": { "priority": [ "live_verified_evidence", @@ -511,6 +511,9 @@ "Codex Qoder QoderWork", "推一下线上仓库", "直接走钥匙串", + "京东服务器", + "京东主控服务器", + "本地密钥直接登录", "自动技能导航" ], "preferred_route": [ @@ -527,6 +530,7 @@ "灯塔查询失败仍猜路径", "从历史聊天搜索凭据", "打印钥匙串秘密", + "本机专用密钥可用时创建工单邮件", "把导航健康当作执行成功", "把本机缓存当作路径正本" ], diff --git a/skills/shared/guanghu-lighthouse-navigator/BRAIN.hdlp b/skills/shared/guanghu-lighthouse-navigator/BRAIN.hdlp index 818eebf..03a64f1 100644 --- a/skills/shared/guanghu-lighthouse-navigator/BRAIN.hdlp +++ b/skills/shared/guanghu-lighthouse-navigator/BRAIN.hdlp @@ -18,3 +18,8 @@ Codex、Qoder CN、QoderWork CN 共享本大脑与灯塔注册表，但各自保 当用户说“推一下线上仓库”时，本机 macOS 宿主应解析到已登记代码频道、系统钥匙串 传输与小湖灯自动收口器。不得搜索历史凭据、打印秘密、退回旧 `/fifth-domain/`， 也不得把钥匙串存在、提交存在或授权存在分别冒充推送完成；远端完整 SHA 回读才算 100。 + +当用户提到京东主控服务器的检查、部署、修复或恢复时，本机 macOS 宿主应解析到 +`JD-FD-PRIMARY` 与本地专用密钥直达传输。只有当前实例不在冰朔本机，或私有注册表 +确认专用密钥直达不可用时，才能把工单邮件作为临时备选。本机直达仍只授予当前任务 +范围：先严格校验主机指纹和 DMI 实例 UUID，再执行已登记动作并回读服务器自有回执。 diff --git a/skills/shared/guanghu-lighthouse-navigator/SKILL.md b/skills/shared/guanghu-lighthouse-navigator/SKILL.md index d75b39f..8143e0b 100644 --- a/skills/shared/guanghu-lighthouse-navigator/SKILL.md +++ b/skills/shared/guanghu-lighthouse-navigator/SKILL.md @@ -23,6 +23,15 @@ description: 光湖灯塔三宿主自动导航。用户提到路径是否有效 `INTENT-REPOSITORY-PUBLISH-001 → REPO-012 → LOCAL_GIT_OSXKEYCHAIN → 小湖灯 finalizer`。 不得搜索令牌、猜 SSH、使用旧仓库、手工绕过发布队列或输出钥匙串秘密。 +“京东服务器”“京东主控服务器”“检查/部署/修复京东服务”在冰朔本机 macOS 上必须走 +`INTENT-JD-SERVER-OPERATION-001 → JD-FD-PRIMARY → LOCAL_DEDICATED_KEY_SSH`。 +先从 JZAO 私有的 `HL-LOCAL-SERVER-ACCESS-001` 解析本地专用密钥路径，再以严格主机 +指纹校验直达；登录后必须核对 DMI 实例 UUID，并把任何写入绑定当前用户任务、不可变 +来源、回滚和服务器自有回执。不得在本机专用密钥可用时创建或发送工单邮件。 + +工单邮件只在当前实例不位于冰朔本机，或已登记的本地专用密钥直达路径确实不可用时 +作为临时备选；“没有先找到路径”不等于“路径不存在”，必须先查私有本机访问注册表。 + ## 边界 - 灯塔路径健康不等于现实动作已授权或已完成。 diff --git a/skills/shared/guanghu-lighthouse-navigator/scripts/test_resolve_lighthouse_route.py b/skills/shared/guanghu-lighthouse-navigator/scripts/test_resolve_lighthouse_route.py index c43b8c4..5ab29d0 100644 --- a/skills/shared/guanghu-lighthouse-navigator/scripts/test_resolve_lighthouse_route.py +++ b/skills/shared/guanghu-lighthouse-navigator/scripts/test_resolve_lighthouse_route.py @@ -42,6 +42,18 @@ class LighthouseNavigatorTests(unittest.TestCase): self.assertEqual(route["status"], "REDIRECT_ONLY_NOT_CURRENT") self.assertEqual(route["redirect"]["redirect_to"], "REPO-012") + def test_jd_server_operation_prefers_local_dedicated_key(self): + route = compile_route(self.registry, self.host_map, "codex", "检查京东主控服务器") + self.assertEqual(route["decision"], "ALLOW_NAVIGATION") + self.assertEqual(route["intent"]["id"], "INTENT-JD-SERVER-OPERATION-001") + self.assertEqual(route["target"]["id"], "JD-FD-PRIMARY") + self.assertEqual(route["intent"]["transport"], "LOCAL_DEDICATED_KEY_SSH") + self.assertEqual( + route["intent"]["fallback"]["forbidden_when"], + "VERIFIED_LOCAL_DEDICATED_KEY_DIRECT_ROUTE_AVAILABLE", + ) + self.assertFalse(route["authority_granted"]) + if __name__ == "__main__": unittest.main()