64 lines
2.6 KiB
JSON
64 lines
2.6 KiB
JSON
{
|
|
"schema": "guanghu.architecture-provision-request/v1",
|
|
"request_id": "HLCC-EXACT-REPOSITORY-ACL-PERSIST-20260806",
|
|
"target_node": "JD-FD-PRIMARY",
|
|
"architecture_id": "GLS-HLCC-009",
|
|
"module": {
|
|
"code": "HLCC-JD-CANDIDATE-01",
|
|
"name": "光湖代码频道精确仓库 ACL 持久化",
|
|
"bind": "loopback:3340,3341",
|
|
"owner": "systemd",
|
|
"unit": "hlcc-jd-candidate.service",
|
|
"run_user": "guanghu",
|
|
"writable_paths": [
|
|
"/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1"
|
|
],
|
|
"read_only_paths": []
|
|
},
|
|
"source_ref": "REPO-012:refs/heads/main",
|
|
"deployed_commit_policy": "use the exact human-merged commit and record it in the server-owned deployment receipt",
|
|
"source_paths": [
|
|
"server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py",
|
|
"server-tools/hololake-code-channel/jd-candidate/app.ini",
|
|
"server-tools/hololake-code-channel/jd-candidate/hlcc-jd-candidate.service"
|
|
],
|
|
"initial_provision": {
|
|
"kind": "new-architecture-unit",
|
|
"not_an_existing_action_bridge_extension": true,
|
|
"requires": [
|
|
"leave core.sharedRepository unset to avoid setgid operations under RestrictSUIDSGID",
|
|
"apply inherited ACLs only to the exact repository objects and refs",
|
|
"grant only guanghu-authz the additional repository access",
|
|
"preserve UMask=0077 for all other code-channel state",
|
|
"keep the obsolete recursive chmod repository hook absent",
|
|
"quote the generated Forgejo custom-hook basename test",
|
|
"restart only hlcc-jd-candidate.service",
|
|
"do not alter repository content, branches, owner identity or authentication"
|
|
]
|
|
},
|
|
"verification": [
|
|
"the automatic deployment receipt records DEPLOYED_AND_VERIFIED",
|
|
"the candidate subsequently reaches ready=true and mode=isolated-candidate",
|
|
"core.sharedRepository remains unset",
|
|
"objects and refs inherit the exact guanghu-authz ACL",
|
|
"a new-object multilevel branch push and delete complete without warnings",
|
|
"both code-channel and direct-receiver repository checks pass"
|
|
],
|
|
"runtime_check": {
|
|
"url": "http://127.0.0.1:3341/health",
|
|
"expected": {
|
|
"ok": true,
|
|
"mode": "bootstrap",
|
|
"version": "16.0.1",
|
|
"code": "HLCC-JD-CANDIDATE-01",
|
|
"package_profile": "full-offline-v16.0.1"
|
|
}
|
|
},
|
|
"rollback": [
|
|
"restore the backed-up hlcc-jd-candidate.service",
|
|
"restart the previous immutable release",
|
|
"retain repository content and authentication state",
|
|
"use the server-owned ACL backup for manual permission recovery"
|
|
],
|
|
"status": "ARCHITECTURE_PACKAGE_READY · INITIAL_PROVISION_PENDING"
|
|
}
|