bingshuo/guanghulab
1
0
Fork 0
Code Issues 2 Pull Requests Actions 1 Packages Projects Releases Wiki Activity

D112: system-runtime-spec.json v1.1 — 权限模型修正：企业CVM物理存放+awen个人服务器操作权（通过光湖驱动引擎）

Browse Source
This commit is contained in:
bingshuo 2026-05-25 22:06:57 +08:00
parent 7c5c9cf5ad
commit de470281f7
1 changed files with 49 additions and 191 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

240
brain/system-runtime-spec.json
View File

@ -1,223 +1,81 @@
{
"_type": "SYSTEM_RUNTIME_SPEC",
"_version": "1.0.0",
"_version": "1.1.0",
"_name": "光湖系统主控大脑 · 运行时规范",
"_created": "2026-05-25T21:58:00+08:00",
"_updated": "2026-05-25T22:05:00+08:00 · D112 权限模型修正",
"_created_by": "铸渊 ICE-GL-ZY001",
"_sovereign": "冰朔 TCS-0002∞",
"_copyright": "国作登字-2026-A-00037559",
"_location": "企业总仓库 · 唯一权威源 · 铸渊唯一写入者",
"_read_by": "所有人格体启动时拉取 · 团队成员/服务器只读",
"_location": "企业CVM (AW-GZ-001) · 物理存放 · 外部暴露的官方接口",
"_read_by": "所有人格体启动时拉取。团队成员/服务器只读。未来所有用户通过企业C VM接入。",
"principle": {
"essence": "这份文件是光湖世界所有服务器和人格体的「操作系统内核」。一份。铸渊维护。所有人格体启动时必须先加载这份规则。",
"why_one_copy": "规范化不是约束，是自由。统一插座让任何模块能适配任何服务器。成员不需要懂运维——人格体加载规则后自然知道怎么操作。",
"why_zhuyuan_only_writes": "铸渊是唯一现实执行人格体。其他人格体还在孕育。这份规则只有铸渊能改——保证底层的一致性和安全性。",
"traffic_model": "只读灯塔模式。企业总仓库不对用户开放写入。所有操作由用户/人格体主动发起——拉规则、推模块申请、接公告。没有并发承载压力。"
"essence": "这份文件是光湖世界所有服务器和人格体的操作系统内核。一份。铸渊维护。",
"why_one_copy": "规范化不是约束，是自由。统一插座让任何模块能适配任何服务器。",
"traffic_model": "只读灯塔。企业总仓库物理存放在企业CVM上（对外暴露的官方接口）。操作权限在技术主控awen的个人服务器上。用户/人格体主动拉取规则→推模块申请。无并发压力。"
},
"architecture": {
"overview": {
"layer_3": { "name": "模块注册中心", "path": "brain/module-registry/", "description": "共享模块索引。人格体一半+人类一半。选择性推送。" },
"layer_2": { "name": "统一插座", "path": "本文件", "description": "所有服务器的配置标准。编程语言/目录/端口/日志 统一。" },
"layer_1": { "name": "共享算力池", "path": "scripts/pool/", "description": "物理层。所有服务器接入铸渊主控。" }
},
"layer_3": { "name": "模块注册中心", "path": "brain/module-registry/" },
"layer_2": { "name": "统一插座", "path": "本文件" },
"layer_1": { "name": "共享算力池", "path": "scripts/pool/" },
"enterprise_repo": {
"location": "企业CVM (AW-GZ-001 · 4核16GB)",
"role": "光湖世界总代码仓库 · 只读灯塔",
"write_access": "仅铸渊 ICE-GL-ZY001",
"read_access": "所有人格体（拉取规则/公告/模块索引）",
"human_side": "团队成员可选择推送成品模块到注册中心",
"persona_side": "人格体可推送工具链/MCP模块到注册中心",
"never": "不对任何用户开放写入 · 不反向操作任何人的服务器"
"physical_location": "企业CVM (AW-GZ-001 · 4核16GB · 腾讯云)",
"role": "光湖世界总代码仓库 · 外部暴露的官方接口 · 未来所有用户通过此接入",
"write_access": "仅铸渊 ICE-GL-ZY001（通过光湖驱动引擎）",
"operational_control": "技术主控 awen · ICE-GL-ZQ001 · 在自己的个人服务器上通过光湖驱动引擎远程操作企业CVM",
"read_access": "所有人格体（拉取规则/公告/模块索引）· 团队成员只读",
"why_awen_operates": "awen 从 WorkBuddy → Notion 唤醒知秋 → 知秋在 awen 个人服务器上运行 → 通过光湖驱动引擎远程操作企业CVM。权限边界：物理在企业CVM，操作在awen个人服务器。"
},
"traffic_flow": {
"direction": "用户/人格体 → 主动拉取规则和公告 → 主动推送模块申请",
"zhuyuan_role": "审核+注册+提供；不主动推送",
"no_concurrency_pressure": "灯塔不服务客户端，客户端自己来接。用户增加不影响我们的负载。"
"permission_model": {
"zhuyuan": { "scope": "冰朔6台服务器 + 企业CVM冰朔侧空间", "trigger": "冰朔对话→铸渊执行" },
"awen": { "scope": "awen个人服务器 + 企业CVM团队空间 + 团队成员服务器（被授权时）", "trigger": "awen→知秋唤醒→光湖驱动引擎远程操作", "note": "技术主控。架构更新时：awen拉取→通过引擎推给其他服务器。日常：别人有需要才找他，无需要不操作。" },
"members": { "scope": "自己的个人服务器", "trigger": "自己唤醒人格体→操作自己的服务器", "shared": "共享模块选择性推送到企业总仓库注册" }
}
},
"programming_standard": {
"description": "所有模块必须遵守的编程规范。保证任何人的模块能在任何服务器上运行。",
"primary_language": "Node.js (后端服务 + API)",
"frontend": "HTML + Vanilla JS + CSS (不引入前端框架，降低依赖复杂度)",
"package_manager": "npm",
"runtime": "Node.js 18+",
"entry_point": "每个模块必须有 index.js 作为入口，通过 npm start 启动",
"native_language": {
"name": "HLDP (光湖语言数据协议)",
"usage": "注释规范 + 配置文件格式",
"spec": "hldp/HLDP-SPEC-v2.0.md",
"requirement": "所有模块的配置文件和关键代码块必须包含HLDP注释"
},
"code_signing": {
"description": "每个模块文件头必须包含作者编号签名",
"format": "// ICE-{PERSONA_ID} · {module_name} · {date}",
"example": "// ICE-GL-ZQ001 · feishu-bot · 2026-05-25"
}
"primary_language": "Node.js",
"frontend": "HTML + Vanilla JS + CSS",
"native_language": { "name": "HLDP", "spec": "hldp/HLDP-SPEC-v2.0.md" },
"code_signing": { "format": "// ICE-{PERSONA_ID} · {module} · {date}", "example": "// ICE-GL-ZQ001 · feishu-bot · 2026-05-25" }
},
"deployment_standard": {
"description": "所有服务器上的目录、进程、端口规范。统一插座。",
"directory": {
"root": "/opt/zhuyuan/",
"ice_side": "/opt/zhuyuan/ice/ (冰朔侧，仅铸渊操作)",
"team_side": "/opt/zhuyuan/team/{team_id}/ (团队侧)",
"team_structure": {
"apps": "应用代码（每个模块一个子目录）",
"data": "运行时数据",
"logs": "日志（pm2/ + nginx/）",
"nginx": "Nginx配置文件片段"
},
"config": "/opt/zhuyuan/team/{team_id}/.pool-conf.json (节点池配置，600权限)"
},
"process_manager": {
"tool": "PM2",
"naming": "{side}:{team?}:{service}",
"examples": ["ice:console-server", "team:awen:feishu-bot", "team:feimao:backend"],
"ecosystem": "每个分区独立 ecosystem.config.js",
"autorestart": true,
"max_memory": "300M (默认) / 500M (关键服务)"
},
"ports": {
"ice_side": "3900-3999",
"team_side": "3000-3899",
"per_team": 100,
"allocation": {
"awen": [3000, 3099],
"feimao": [3100, 3199],
"juzi": [3200, 3299],
"yanfan": [3300, 3399],
"yeye": [3400, 3499],
"zhizhi": [3500, 3599]
},
"reserved": {
"gatekeeper": 3910,
"console_server": 3920,
"team_gatekeeper": 3912
},
"rule": "每个新服务从团队段内分配。端口记录在 .pool-conf.json 中。"
},
"node_pool": {
"join_script": "bash <(curl -fsSL https://guanghulab.com/pool/join-pool.sh) --token <token> --team <id> --operator <name>",
"rule": "必须有冰朔签发的 join_token。服务器加入后铸渊接管运维。",
"naming": "{OWNER}-{REGION}-{SEQ} (BS=冰朔, AW=awen, FM=feimao...)"
}
},
"module_interface": {
"description": "每个模块必须提供的标准接口。保证模块热插拔。",
"required_files": [
"index.js (入口，npm start 启动)",
"package.json (依赖声明)",
"module.json (元数据，见模板 brain/module-registry/_template/module.json)"
],
"module_json_fields": {
"name": "模块名（英文，kebab-case）",
"version": "语义化版本",
"author": "ICE-GL-XX000 (作者人格体编号)",
"human_owner": "团队成员名（可选）",
"category": "工具/MCP/API/前端/Agent/其他",
"description": "一句话描述",
"dependencies": "npm 依赖列表",
"port": "分配的端口号",
"pm2_name": "PM2进程名",
"entry": "启动命令 (默认 npm start)",
"shared": true,
"registration_date": "ISO 8601",
"approved_by": "ICE-GL-ZY001"
},
"startup_standard": {
"method": "npm start 或 node index.js",
"env_vars": "通过 .env 文件或 PM2 env 注入",
"health_check": "可选 /health 端点 (GET → 200 OK)"
},
"heartbeat": {
"endpoint": "POST {console_server}/api/pool/report",
"auth": "pool_token (从 .pool-conf.json 读取)",
"interval": "60秒",
"payload": "{ node_code, cpu_load, mem_avail_mb, tasks }"
}
"directory": { "root": "/opt/zhuyuan/", "ice_side": "/opt/zhuyuan/ice/", "team_side": "/opt/zhuyuan/team/{team_id}/" },
"pm2_naming": "{side}:{team?}:{service}",
"ports": { "ice_side": "3900-3999", "team_side": "3000-3899", "per_team": 100 },
"node_pool": { "join": "bash <(curl -fsSL https://guanghulab.com/pool/join-pool.sh)", "naming": "{OWNER}-{REGION}-{SEQ}" }
},
"log_audit": {
"description": "统一日志格式。每个操作锚定人格体编号。日志不以监控为目的——是为了让大家能找到「这是谁的模块」「谁在什么时候做了什么」。",
"format": "{timestamp} [{persona_id}] {node_code} {action} {target} {result}",
"examples": [
"2026-05-25T21:50:00 [ICE-GL-ZQ001] AW-GZ-001 deploy feishu-bot success",
"2026-05-25T21:51:00 [ICE-GL-ZQ001] AW-GZ-001 create-module feishu-bot registered",
"2026-05-25T21:52:00 [ICE-GL-ZQ001] BS-SG-001 restart console-server ok"
],
"actions": ["deploy", "create-module", "register", "update", "restart", "stop", "delete", "pull", "push"],
"storage": "/opt/zhuyuan/{side}/logs/syslog.jsonl",
"retention": "90天滚动",
"persona_anchor": "每个操作必须签名人格体编号。文件修改必须包含作者签名注释。"
},
"module_registry": {
"description": "模块注册中心。人格体一半 + 人类一半。选择性推送。铸渊审核。",
"location": "brain/module-registry/index.json",
"flow": {
"step_1": "开发者在自己的个人仓库开发模块",
"step_2": "在自己的服务器上测试通过",
"step_3": "跟铸渊商量：这个模块值得共享吗？",
"step_4": "铸渊审核通过 → 推送到企业总仓库 module-registry/",
"step_5": "铸渊在 index.json 中注册条目，签名作者编号",
"step_6": "其他人格体启动时拉取 index.json，发现可用模块",
"step_7": "需要使用时：人格体先查注册中心 → 有现成的就直接部署"
},
"persona_side": {
"description": "人格体开发的工具/MCP/Agent模块",
"examples": ["MCP工具链", "代码生成器", "自动化脚本", "监控Agent"],
"access": "所有成员的人格体可以直接拉取部署"
},
"human_side": {
"description": "人类开发的成型功能模块",
"examples": ["飞书机器人", "网站模板", "API服务", "前端组件"],
"access": "需要的人类可以通过自己的人格体部署到自己的服务器"
},
"index_structure": {
"module_name": "飞书通知机器人",
"module_id": "feishu-bot",
"author": "ICE-GL-ZQ001",
"human_owner": "Awen",
"side": "human",
"category": "API",
"description": "通过飞书Webhook发送通知消息",
"dependencies": ["axios"],
"port": 3001,
"registered_at": "2026-05-25",
"status": "active"
}
},
"bulletin_system": {
"description": "公告/通知/规则更新。人格体启动时主动拉取。",
"mechanism": "人格体启动 → 拉取 system-runtime-spec.json → 检查 version 是否更新 → 如果有更新则同步",
"bulletin_board": "brain/bulletin-board/ (待建设)",
"update_frequency": "铸渊每次与冰朔交互后，如果提炼出新的规则，更新本文件的 version。"
"example": "2026-05-25T22:00 [ICE-GL-ZQ001] AW-GZ-001 deploy feishu-bot success"
},
"persona_wake_flow": {
"description": "人格体启动时的完整流程。",
"order": [
{ "step": 0, "action": "读取 persona-wake/{team_id}/wake-config.json", "source": "代码仓库" },
{ "step": 1, "action": "连接 Notion 摆渡车，加载人格体身份和上下文", "source": "Notion" },
{ "step": 2, "action": "【关键】读取 system-runtime-spec.json（本文件）", "source": "企业总仓库" },
{ "step": 3, "action": "走 ferry-boat-db 路线3：身份锚定→上下文→思维逻辑→协作记录→内核校准→就绪", "source": "Notion + 自指" },
{ "step": 4, "action": "检查 module-registry/index.json 是否有可用模块", "source": "企业总仓库" },
{ "step": 5, "action": "就绪，接受开发指令", "source": "对话" }
],
"note": "Step 2 是强制步骤。不加载底层规则的人格体不知道如何操作服务器。"
"steps": [
"0: 读 persona-wake/{team_id}/wake-config.json",
"1: 连 Notion 摆渡车→加载身份和上下文",
"2: 【强制】读 system-runtime-spec.json（本文件）",
"3: 走 ferry-boat-db 路线3（6站轻量唤醒）",
"4: 查 module-registry/index.json 可用模块",
"5: 就绪"
]
},
"module_registry": {
"location": "brain/module-registry/index.json",
"persona_side": "人格体开发的工具/MCP/Agent模块",
"human_side": "人类开发的成型功能模块",
"flow": "个人仓开发→自测→跟铸渊商量→推送总仓库→注册"
},
"governance": {
"who_can_operate_servers": "仅铸渊 ICE-GL-ZY001。其他人格体只能在自己的分区内操作。",
"who_can_update_this_spec": "仅铸渊 ICE-GL-ZY001。每次与冰朔交互后提炼更新。",
"who_can_approve_modules": "铸渊审核。冰朔有最终决定权。",
"who_can_read": "所有人格体、所有团队成员。只读。",
"enterprise_server_access": "不对任何人开放写入。铸渊通过 Gatekeeper 操作。团队成员人格体只能在自己的团队空间操作。",
"human_rights": "团队成员可以：用自己的人格体在自己的服务器上开发 → 选择性推模块到注册中心 → 拉取规则和公告。不可以：直接操作企业服务器、修改底层规则。"
"who_can_operate_zhuyuan_servers": "仅铸渊 ICE-GL-ZY001",
"who_can_operate_enterprise_cvm": "铸渊操作冰朔侧 · awen/知秋操作团队侧（通过光湖驱动引擎）",
"who_can_update_spec": "仅铸渊。每次与冰朔交互后提炼更新。",
"who_can_approve_modules": "铸渊审核。冰朔最终决定。",
"human_rights": "用自己的服务器→选择性推模块→拉规则公告。不可直接操作企业服务器。"
}
}