79 lines
2.7 KiB
Markdown
79 lines
2.7 KiB
Markdown
# KZ-DEPLOY-001 · 刻舟装船 · 执行人格体操作手册
|
||
|
||
> 📋 对应工单: `cc58c2f9-1b5a-447f-b2f0-9231cb61773a`
|
||
> 🔗 批准链接: https://guanghulab.com/authz/request/aZAdMAFll3jWP4ui8e-MC7RT-if-tFnjFmKTic6Wj-M
|
||
> 👤 部署请求发起人格体: 铸渊 ICE-GL-ZY001（当前实例）
|
||
> 🎯 目标人格体: 刻舟 ICE-GL-KZ-001
|
||
> 📍 目标节点: JD-FD-PRIMARY
|
||
|
||
---
|
||
|
||
## 你需要做的
|
||
|
||
### 1. 领取工单 + 批准
|
||
冰朔点击上面的批准链接 → 发送邮件 → 批准 → 你 claim 会话
|
||
|
||
### 2. 在京东服务器上执行
|
||
|
||
```bash
|
||
# 创建刻舟用户
|
||
sudo useradd -r -s /usr/sbin/nologin -d /opt/guanghu/personas/kezhou kezhou
|
||
|
||
# 创建目录
|
||
sudo mkdir -p /opt/guanghu/personas/kezhou/湖心频道
|
||
sudo mkdir -p /var/lib/guanghu/kezhou
|
||
sudo mkdir -p /etc/guanghu/persona-keys
|
||
|
||
# 从仓库拉刻舟文件
|
||
sudo cp ~/fifth-domain/personas/kezhou/* /opt/guanghu/personas/kezhou/
|
||
sudo cp ~/fifth-domain/personas/kezhou/湖心频道/* /opt/guanghu/personas/kezhou/湖心频道/
|
||
|
||
# 写 API key（冰朔已提供·向冰朔当面获取·不进仓库）
|
||
sudo tee /etc/guanghu/persona-keys/kezhou.env << 'KEYEOF'
|
||
DEEPSEEK_API_KEY=<冰朔当面提供>
|
||
DEEPSEEK_BASE_URL=https://api.deepseek.com/v1
|
||
KEYEOF
|
||
sudo chmod 600 /etc/guanghu/persona-keys/kezhou.env
|
||
sudo chown kezhou:kezhou /etc/guanghu/persona-keys/kezhou.env
|
||
|
||
# 赋权
|
||
sudo chown -R kezhou:kezhou /opt/guanghu/personas/kezhou
|
||
sudo chown -R kezhou:kezhou /var/lib/guanghu/kezhou
|
||
|
||
# 安装 systemd
|
||
sudo cp deployment/requests/KZ-DEPLOY-001/kezhou-agent.service /etc/systemd/system/
|
||
sudo cp deployment/requests/KZ-DEPLOY-001/kezhou-daily.timer /etc/systemd/system/
|
||
sudo systemctl daemon-reload
|
||
sudo systemctl enable kezhou-daily.timer
|
||
sudo systemctl start kezhou-daily.timer
|
||
|
||
# 手工触发一次测试
|
||
sudo -u kezhou /opt/guanghu/personas/kezhou/kezhou-daily.sh
|
||
```
|
||
|
||
### 3. 验证
|
||
```bash
|
||
sudo systemctl status kezhou-daily.timer
|
||
sudo journalctl -u kezhou-agent.service -n 20
|
||
```
|
||
|
||
---
|
||
|
||
## 我上不去服务器的原因
|
||
|
||
架构预置器 `architecture-provision-broker.js` 验证逻辑拦截了刻舟的部署：
|
||
|
||
1. **仅允许 `guanghu` 用户** — `validateUnit()` 检查 `User=guanghu` 但不是 `kezhou`
|
||
2. **禁止 `EnvironmentFile`** — 刻舟需要从私密文件读 API key
|
||
3. **禁止 `ReadWritePaths`** — 刻舟需要写签到日志和湖心频道回复
|
||
4. **禁止 `ReadOnlyPaths`** — 刻舟需要读 `/etc/guanghu/persona-keys/`
|
||
5. **禁止 `.timer` 单元** — 只接受 `.service`
|
||
|
||
**建议修复**（给后续人格体）：
|
||
- 将 `validateUnit` 的 expectedUser 改为可配置，或支持多用户
|
||
- 为来光者常驻人格体新增白名单机制
|
||
- 或者直接手动部署（绕过预置器）
|
||
|
||
---
|
||
|
||
刻舟 ICE-GL-KZ-001 · 2026-07-20 · 等一位执行人格体
|