{
  "schema": "guanghu.architecture-provision-request/v1",
  "request_id": "HLCC-EXACT-REPOSITORY-ACL-PERSIST-20260806",
  "target_node": "JD-FD-PRIMARY",
  "architecture_id": "GLS-HLCC-009",
  "module": {
    "code": "HLCC-JD-CANDIDATE-01",
    "name": "光湖代码频道精确仓库 ACL 持久化",
    "bind": "loopback:3340,3341",
    "owner": "systemd",
    "unit": "hlcc-jd-candidate.service",
    "run_user": "guanghu",
    "writable_paths": [
      "/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1"
    ],
    "read_only_paths": []
  },
  "source_ref": "REPO-012:refs/heads/main",
  "deployed_commit_policy": "use the exact human-merged commit and record it in the server-owned deployment receipt",
  "source_paths": [
    "server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py",
    "server-tools/hololake-code-channel/jd-candidate/app.ini",
    "server-tools/hololake-code-channel/jd-candidate/hlcc-jd-candidate.service"
  ],
  "initial_provision": {
    "kind": "new-architecture-unit",
    "not_an_existing_action_bridge_extension": true,
    "requires": [
      "leave core.sharedRepository unset to avoid setgid operations under RestrictSUIDSGID",
      "apply inherited ACLs only to the exact repository objects and refs",
      "grant only guanghu-authz the additional repository access",
      "preserve UMask=0077 for all other code-channel state",
      "keep the obsolete recursive chmod repository hook absent",
      "quote the generated Forgejo custom-hook basename test",
      "restart only hlcc-jd-candidate.service",
      "do not alter repository content, branches, owner identity or authentication"
    ]
  },
  "verification": [
    "the automatic deployment receipt records DEPLOYED_AND_VERIFIED",
    "the candidate subsequently reaches ready=true and mode=isolated-candidate",
    "core.sharedRepository remains unset",
    "objects and refs inherit the exact guanghu-authz ACL",
    "a new-object multilevel branch push and delete complete without warnings",
    "both code-channel and direct-receiver repository checks pass"
  ],
  "runtime_check": {
    "url": "http://127.0.0.1:3341/health",
    "expected": {
      "ok": true,
      "mode": "bootstrap",
      "version": "16.0.1",
      "code": "HLCC-JD-CANDIDATE-01",
      "package_profile": "full-offline-v16.0.1"
    }
  },
  "rollback": [
    "restore the backed-up hlcc-jd-candidate.service",
    "restart the previous immutable release",
    "retain repository content and authentication state",
    "use the server-owned ACL backup for manual permission recovery"
  ],
  "status": "ARCHITECTURE_PACKAGE_READY · INITIAL_PROVISION_PENDING"
}