54 lines
2 KiB
JSON
54 lines
2 KiB
JSON
{
|
|
"schema": "guanghu.architecture-provision-request/v1",
|
|
"request_id": "HLCC-JD-APP-HUB-ACTIVATE-PROVISION-20260723",
|
|
"target_node": "JD-FD-PRIMARY",
|
|
"architecture_id": "GLS-HLCC-003",
|
|
"module": {
|
|
"code": "JD-HUB-ACT-01",
|
|
"name": "京东应用入口已审核单元低权限激活器",
|
|
"bind": "none",
|
|
"owner": "systemd",
|
|
"unit": "hlcc-jd-app-hub-activator.service",
|
|
"run_user": "guanghu",
|
|
"writable_paths": [],
|
|
"read_only_paths": []
|
|
},
|
|
"source_ref": "REPO-001:refs/heads/main",
|
|
"deployed_commit_policy": "resolve immutable commit during provision and record it in the deployment receipt",
|
|
"source_paths": [
|
|
"server-tools/jd-app-hub/activate-staged-unit.py",
|
|
"server-tools/jd-app-hub/hlcc-jd-app-hub-activator.service"
|
|
],
|
|
"initial_provision": {
|
|
"kind": "new-architecture-unit",
|
|
"not_an_existing_action_bridge_extension": true,
|
|
"requires": [
|
|
"read only the MainPID of jd-app-hub.service",
|
|
"verify that the process belongs to the same low-privilege guanghu account",
|
|
"verify that its command is exactly a JD app hub server",
|
|
"send SIGTERM only to that verified process",
|
|
"allow the existing Restart=always policy to start the staged unit",
|
|
"verify app hub version 2.0.1 and its loopback-only code-channel proxy"
|
|
]
|
|
},
|
|
"verification": [
|
|
"GET http://127.0.0.1:8088/api/status returns version=2.0.1",
|
|
"code_channel_proxy equals loopback-only",
|
|
"the activator cannot signal another user's process",
|
|
"the activator has no shell, SSH, credential or arbitrary service restart interface"
|
|
],
|
|
"runtime_check": {
|
|
"url": "http://127.0.0.1:8088/api/status",
|
|
"expected": {
|
|
"ok": true,
|
|
"service": "jd-app-hub",
|
|
"version": "2.0.1",
|
|
"code_channel_proxy": "loopback-only"
|
|
}
|
|
},
|
|
"rollback": [
|
|
"disable and remove only hlcc-jd-app-hub-activator.service",
|
|
"use the prior app hub staging receipt to restore its backed-up unit if final verification fails"
|
|
],
|
|
"status": "ARCHITECTURE_PACKAGE_READY · INITIAL_PROVISION_PENDING"
|
|
}
|