@namewta/speculo 1.0.19 → 1.0.21

package/template/workflows/ops/common/rules/persistence-and-secrets.md

@@ -2,7 +2,7 @@
 
 ## 硬性路径
 
-Host 登记后 root 固定；Project 使用 kebab ID；Deployment 默认 root/project，同级 APP 与公共服务。多实例显式用 root/project/instances/env/instance。不能通过 symlink、junction、UNC、ADS、相对路径越界或双重登记绕过。
+首次接入按 <Path>{roots.workflows}/ops/common/rules/host-root-and-onboarding.md</Path> 探测实际登录主目录，建议其 ops 子目录并由用户选定。Host 登记后 root 固定，更换账号不改根；Project 使用 kebab ID；Deployment 默认 root/project，同级 APP 与公共服务。多实例显式用 root/project/instances/env/instance。不能通过 symlink、junction、UNC、ADS、相对路径越界或双重登记绕过。
 
 业务持久化目录为 data/component/purpose；日志 logs/component；环境 env/；生成配置 config/。Dockerfile 与 Compose 同在 compose/。原生服务配置在 service/，其文件不自动改变业务数据归属。系统服务文件是单独审批的控制文件例外，不是数据存储例外。
 

package/template/workflows/ops/common/rules/research-and-decisions.md

@@ -9,6 +9,14 @@
 | [SSH configuration Skill](https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/0365f57a079b1332f95cf26e31dd2d5332a8399f/infrastructure/servers/ssh-configuration/SKILL.md) | key/agent、指纹、客户端配置、公钥分发、轮换先验证新 key | 密钥/agent 优先、公钥认证单独验收、保留旧通道、接入失败明确阻塞 | 不默认无口令私钥，不自动清 agent，不照搬 sshd 算法清单/关闭密码登录，不隐式添加 ProxyJump 能力 |
 | [Speculo 基线执行器](https://github.com/NAMEWTA/Speculo/tree/60389759ede9f8c4f14b2f7e70da614dfe574ece/template/workflows/ops/common/tools/opslib) | planner、execution、transport、agent、CLI 与 schema | 复用摘要批准、受限写集、身份验证、失败停止、双边回执 | 不重写已有安全底座，不移动历史 Run，不用可视化替代真实验收 |
 
+## 2.3 首次根确认与 Host/Project 分工
+
+- [Ansible 主机变量与连接参数](https://docs.ansible.com/projects/ansible/latest/inventory_guide/intro_inventory.html)：采用机器身份、登录账号和提权参数分别表达的方法，账号主目录在提权前探测。
+- [Kamal 服务器声明](https://kamal-deploy.org/docs/configuration/servers/)：采用项目显式声明目标服务器的方法，保留 Deployment 环境/实例关联；默认 root 登录和自动 Docker 安装不进入本 workflow 的默认初始化。
+- [pyinfra](https://github.com/pyinfra-dev/pyinfra)：采用先获取事实、再计算必要操作的方法；最小初始化只生成缺失目录动作，保留原摘要批准和恢复。
+
+资料于 2026-10-08 在线读取，只采用方法并自行实现，没有复制外部代码或增加运行依赖。已有 SSH Skill 的固定提交、许可与采用边界保留。新增行为是首次根目录的真实用户选择门；建议不等于确认。换账号保留原根，旧 v3 不自动迁移或补写历史确认。
+
 ## 设计取舍
 
 一次授权的对象是有限任务与精确规格，不是“此后所有运维”。本次任务 runner 增加编译前/后的目标与修改集检查，保留原逐 Run 审批文件，但不要求每步由用户再次对话确认。它不是签名授权系统，也不是防御拥有控制端写权限的恶意管理员的沙箱。

package/template/workflows/ops/common/rules/server-onboarding.md

@@ -4,13 +4,13 @@
 
 ## 接入顺序
 
-确认用户已经提供的 server_id、地址/端口、远端账号、专用 host.root、可信主机指纹、控制端 SSH 客户端与认证来源；不重复索取已有输入，不把别名相似当作同一服务器。首次指纹必须经云控制台/控制台/既有可信渠道核对，ssh-keyscan 只能收集候选值，不能完成信任。
+先读 <Path>{roots.workflows}/ops/common/rules/host-root-and-onboarding.md</Path>。确认用户已经提供的 server_id、地址/端口、远端账号、可信主机指纹、控制端 SSH 客户端与认证来源；不重复索取已有输入，不把别名相似当作同一服务器。首次指纹必须经云控制台/控制台/既有可信渠道核对，ssh-keyscan 只能收集候选值，不能完成信任。
 
 优先复用受限私钥与 ssh-agent。免密登录指无需重复输入服务器账号密码，不等于私钥必须无口令；不得默认 ssh-keygen -N ""，不得复制私钥到服务器、项目或看板，也不把密码放在 JSON/argv/日志。只登记 identity_file 的本地受限路径；使用 agent 时不能自动清空用户已有 agent。
 
 已有可信登录通道时，仅在原明确授权范围内分发指定公钥，保持旧登录通道，核验新会话成功后才讨论轮换撤销。公钥分发/sshd 修改不是 task-run 的隐式能力；当前执行器不提供首次密码登录或 authorized_keys 写入适配。缺少已验证 key/agent 时，给出待用户在可信交互终端/云控制台完成的最小公钥分发步骤与精确目标，记录“接入阻塞”，不要宣称自动完成，也不要绕过 ops 的写入网关用 sshpass 或任意 shell 写服务器。禁止为方便部署自动关闭密码登录、改 SSH 端口或重启 sshd；这些需要专用可恢复方案。
 
-信任和公钥认证具备后，用 USAGE 中的 discovery/probe 读取身份；Linux SSH 缺 Node 时走原 bootstrap-node 的固定 Volta/Node、已审核 tar SHA256 与独立 ack。复用已有 Node，不改 shell profile。随后 enroll（或 register + probe --host）把真实身份与盘点持久化；identity=discover 不可用于 apply。
+信任和公钥认证具备后，先用 server-discover 不提权读取实际账号主目录与身份，由用户指定或接受主目录下 ops，使用 server-root-confirm 保存真实确认；新 root 未确认不安装、不登记。随后用 USAGE 中的 probe 读取运行环境；Linux SSH 缺 Node 时走原 bootstrap-node 的固定 Volta/Node、已审核 tar SHA256 与独立 ack。复用已有 Node，不改 shell profile。随后 enroll（或 register + probe --host）把真实身份与盘点持久化；identity=discover 不可用于 apply。
 
 最后运行 `server-check --server ID --profile base`。只有成功验证严格主机密钥、公钥认证和实际机器身份后，才写“接入检查通过”；未通过项与证据文件必须列出。需要 Docker 的项目再走 H 的 compose profile，不能把 base-ready 等同完整部署基线。
 
@@ -22,6 +22,6 @@
 
 ## 固定 Node 引导的完成门
 
-Linux SSH 缺 Node 时由 S 使用 `ops.mjs bootstrap-node`：控制端校验已审核 tar 的 SHA256，scp 到目标，远端 POSIX 展开固定 Volta/Node；必须使用独立 ack/SHA256 网关，不走 H/D plan/approve。引导后必须 enroll（或 register 后 probe --host），取得真实 inventory/snapshot 与 status.hosts 记录，不能只把盘点留在对话中。
+Linux SSH 缺 Node 时由 S 使用 `ops.mjs bootstrap-node`：先核对 root_confirmation、真实机器与根权限，控制端校验已审核 tar 的 SHA256，使用登录账号 scp 到已确认根，远端 POSIX 展开固定 Volta/Node；必须使用独立 ack/SHA256 网关，不走 H/D plan/approve。引导后必须 enroll（或 register 后 probe --host），取得真实 inventory/snapshot 与 status.hosts 记录，不能只把盘点留在对话中。
 
 已有 Node 不重复安装、不改 shell profile。缺 Node 可以阻塞 apply，但不阻塞安全的登记；Windows/macOS 仍要求目标已有 Node。该能力不绕过初次主机信任、可用 SSH 登录或用户批准的固定构件。

package/template/workflows/ops/common/rules/workspace-and-authorization.md

@@ -7,7 +7,7 @@
 | 用户目的 | scope / Work | 必需输入 | 明确不做 |
 | --- | --- | --- | --- |
 | 准备发起操作的本机 | controller / I | 控制端 ID、绝对 state 根 | 不默认把本机登记为服务器 |
-| 接入一台服务器 | access / S | 一个 server_id、可信连接与身份 | 不部署项目、不自动信任主机密钥 |
+| 接入一台服务器 | access / S | 一个 server_id、可信连接与身份、首次根选择 | 不部署项目、不自动信任主机密钥 |
 | 配置系统环境、Docker、Nginx | server / H | 一个已登记 server_id | 不从 cwd 推断 project |
 | 安装 APP 或共享服务 | project / D | 一个 project_id、明确 server_ids、真实需求 | 不猜服务器、不把主机级入口伪装成 APP |
 | 看服务器/项目清单 | inventory / V | 已初始化 state 根 | 不联网、不部署、不授予后续操作权限 |
@@ -36,4 +36,4 @@ H 入口选择一台明确服务器；一个 server 任务可以串行多个 H
 
 正常完成必须以原 apply 返回 completed 且双边回执成立为准，再生成 V 的本地视图。V 失败记为“执行结果已保存、视图生成失败”，不能重跑业务。文档或索引不会自动变成永久知识；知识写入仍走原 owner/gateway 并获得独立同意。
 
-当前任务编排只接入 H/D；I 初始化和 S 的首次信任建立/固定 Node bootstrap 保留原网关，不用任务授权掩盖缺失的 SSH 登录条件。
+首次根选择按 <Path>{roots.workflows}/ops/common/rules/host-root-and-onboarding.md</Path> 执行。server-root-confirm 只记录真实用户路径决定，不代替安装授权；已有明确指定不重复询问。当前任务编排只接入 H/D；I 初始化和 S 的首次信任建立/固定 Node bootstrap 保留原网关，不用任务授权掩盖缺失的 SSH 登录条件。

package/template/workflows/ops/common/schemas/fleet-view.schema.json

@@ -170,6 +170,70 @@
               ],
               "additionalProperties": false
             }
+          },
+          "login_account": {
+            "type": "string"
+          },
+          "root_confirmation": {
+            "type": "object",
+            "properties": {
+              "status": {
+                "enum": [
+                  "confirmed",
+                  "unverified",
+                  "legacy-registered"
+                ]
+              },
+              "login_home": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "confirmed_at": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              }
+            },
+            "required": [
+              "status",
+              "login_home",
+              "confirmed_at"
+            ],
+            "additionalProperties": false
+          },
+          "initialization": {
+            "type": "object",
+            "properties": {
+              "registered": {
+                "const": true
+              },
+              "directory": {
+                "type": "string"
+              },
+              "documents": {
+                "enum": [
+                  "unknown",
+                  "both-sides-verified"
+                ]
+              },
+              "runtime": {
+                "enum": [
+                  "unverified",
+                  "native",
+                  "compose"
+                ]
+              }
+            },
+            "required": [
+              "registered",
+              "directory",
+              "documents",
+              "runtime"
+            ],
+            "additionalProperties": false
           }
         },
         "required": [

package/template/workflows/ops/common/schemas/host.schema.json

@@ -76,6 +76,25 @@
     },
     "host_services": {
       "$ref": "#/$defs/host_services"
+    },
+    "root_confirmation": {
+      "type": "object",
+      "properties": {
+        "receipt_id": {
+          "type": "string",
+          "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+          "maxLength": 80
+        },
+        "digest": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        }
+      },
+      "required": [
+        "receipt_id",
+        "digest"
+      ],
+      "additionalProperties": false
     }
   },
   "required": [

package/template/workflows/ops/common/schemas/plan.schema.json

@@ -242,6 +242,25 @@
               ],
               "additionalProperties": false
             }
+          },
+          "root_confirmation": {
+            "type": "object",
+            "properties": {
+              "receipt_id": {
+                "type": "string",
+                "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                "maxLength": 80
+              },
+              "digest": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$"
+              }
+            },
+            "required": [
+              "receipt_id",
+              "digest"
+            ],
+            "additionalProperties": false
           }
         },
         "required": [
@@ -717,6 +736,25 @@
                 ],
                 "additionalProperties": false
               }
+            },
+            "root_confirmation": {
+              "type": "object",
+              "properties": {
+                "receipt_id": {
+                  "type": "string",
+                  "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                  "maxLength": 80
+                },
+                "digest": {
+                  "type": "string",
+                  "pattern": "^[a-f0-9]{64}$"
+                }
+              },
+              "required": [
+                "receipt_id",
+                "digest"
+              ],
+              "additionalProperties": false
             }
           },
           "required": [
@@ -1408,6 +1446,25 @@
             ],
             "additionalProperties": false
           }
+        },
+        "root_confirmation": {
+          "type": "object",
+          "properties": {
+            "receipt_id": {
+              "type": "string",
+              "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+              "maxLength": 80
+            },
+            "digest": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$"
+            }
+          },
+          "required": [
+            "receipt_id",
+            "digest"
+          ],
+          "additionalProperties": false
         }
       },
       "required": [

package/template/workflows/ops/common/schemas/root-confirmation.schema.json

@@ -0,0 +1,118 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:speculo:ops:root-confirmation:v1",
+  "type": "object",
+  "properties": {
+    "schema_version": {
+      "const": 1
+    },
+    "artifact": {
+      "const": "ops-root-confirmation"
+    },
+    "receipt_id": {
+      "type": "string",
+      "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+      "maxLength": 80
+    },
+    "host_id": {
+      "type": "string",
+      "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+      "maxLength": 80
+    },
+    "platform": {
+      "enum": [
+        "linux",
+        "windows",
+        "darwin"
+      ]
+    },
+    "transport": {
+      "enum": [
+        "local",
+        "ssh"
+      ]
+    },
+    "identity": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "root": {
+      "type": "string",
+      "minLength": 1
+    },
+    "account": {
+      "type": "object",
+      "properties": {
+        "username": {
+          "type": "string",
+          "minLength": 1
+        },
+        "uid": {
+          "type": "string"
+        },
+        "home": {
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "required": [
+        "username",
+        "uid",
+        "home"
+      ],
+      "additionalProperties": false
+    },
+    "endpoint_digest": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "discovery": {
+      "type": "object",
+      "properties": {
+        "receipt_id": {
+          "type": "string",
+          "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+          "maxLength": 80
+        },
+        "digest": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        }
+      },
+      "required": [
+        "receipt_id",
+        "digest"
+      ],
+      "additionalProperties": false
+    },
+    "confirmed_at": {
+      "type": "string",
+      "minLength": 1
+    },
+    "by": {
+      "type": "string",
+      "minLength": 1
+    },
+    "statement": {
+      "type": "string",
+      "minLength": 1
+    }
+  },
+  "required": [
+    "schema_version",
+    "artifact",
+    "receipt_id",
+    "host_id",
+    "platform",
+    "transport",
+    "identity",
+    "root",
+    "account",
+    "endpoint_digest",
+    "discovery",
+    "confirmed_at",
+    "by",
+    "statement"
+  ],
+  "additionalProperties": false
+}

package/template/workflows/ops/common/schemas/server-connection.schema.json

@@ -0,0 +1,67 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:speculo:ops:server-connection:v1",
+  "type": "object",
+  "properties": {
+    "platform": {
+      "enum": [
+        "linux",
+        "windows",
+        "darwin"
+      ]
+    },
+    "transport": {
+      "enum": [
+        "local",
+        "ssh"
+      ]
+    },
+    "connection": {
+      "type": "object",
+      "properties": {
+        "hostname": {
+          "type": "string",
+          "minLength": 1
+        },
+        "username": {
+          "type": "string",
+          "minLength": 1
+        },
+        "port": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 65535
+        },
+        "known_hosts": {
+          "type": "string",
+          "minLength": 1
+        },
+        "identity_file": {
+          "type": "string",
+          "minLength": 1
+        },
+        "node": {
+          "type": "string",
+          "minLength": 1
+        },
+        "sudo": {
+          "type": "boolean"
+        },
+        "shell": {
+          "enum": [
+            "posix",
+            "powershell"
+          ]
+        }
+      },
+      "required": [],
+      "additionalProperties": false
+    }
+  },
+  "required": [
+    "platform",
+    "transport",
+    "connection"
+  ],
+  "additionalProperties": false
+}

package/template/workflows/ops/common/schemas/server-discovery.schema.json

@@ -0,0 +1,171 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:speculo:ops:server-discovery:v1",
+  "type": "object",
+  "properties": {
+    "schema_version": {
+      "const": 1
+    },
+    "artifact": {
+      "const": "ops-server-discovery"
+    },
+    "discovery_id": {
+      "type": "string",
+      "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+      "maxLength": 80
+    },
+    "host_id": {
+      "type": "string",
+      "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+      "maxLength": 80
+    },
+    "discovered_at": {
+      "type": "string",
+      "minLength": 1
+    },
+    "endpoint": {
+      "type": "object",
+      "properties": {
+        "host_id": {
+          "type": "string",
+          "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+          "maxLength": 80
+        },
+        "platform": {
+          "enum": [
+            "linux",
+            "windows",
+            "darwin"
+          ]
+        },
+        "transport": {
+          "enum": [
+            "local",
+            "ssh"
+          ]
+        },
+        "connection": {
+          "type": "object",
+          "properties": {
+            "hostname": {
+              "type": "string",
+              "minLength": 1
+            },
+            "username": {
+              "type": "string",
+              "minLength": 1
+            },
+            "port": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 65535
+            },
+            "known_hosts": {
+              "type": "string",
+              "minLength": 1
+            },
+            "identity_file": {
+              "type": "string",
+              "minLength": 1
+            },
+            "node": {
+              "type": "string",
+              "minLength": 1
+            },
+            "sudo": {
+              "type": "boolean"
+            },
+            "shell": {
+              "enum": [
+                "posix",
+                "powershell"
+              ]
+            }
+          },
+          "required": [],
+          "additionalProperties": false
+        }
+      },
+      "required": [
+        "host_id",
+        "platform",
+        "transport",
+        "connection"
+      ],
+      "additionalProperties": false
+    },
+    "endpoint_digest": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "facts": {
+      "type": "object",
+      "properties": {
+        "identity": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "platform": {
+          "enum": [
+            "linux",
+            "windows",
+            "darwin"
+          ]
+        },
+        "username": {
+          "type": "string",
+          "minLength": 1
+        },
+        "uid": {
+          "type": "string"
+        },
+        "home": {
+          "type": "string",
+          "minLength": 1
+        },
+        "node": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "node_version": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "required": [
+        "identity",
+        "platform",
+        "username",
+        "uid",
+        "home",
+        "node",
+        "node_version"
+      ],
+      "additionalProperties": false
+    },
+    "suggested_root": {
+      "type": "string",
+      "minLength": 1
+    },
+    "registered": {
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "schema_version",
+    "artifact",
+    "discovery_id",
+    "host_id",
+    "discovered_at",
+    "endpoint",
+    "endpoint_digest",
+    "facts",
+    "suggested_root",
+    "registered"
+  ],
+  "additionalProperties": false
+}

package/template/workflows/ops/common/schemas/spec.schema.json

@@ -160,6 +160,25 @@
                   ],
                   "additionalProperties": false
                 }
+              },
+              "root_confirmation": {
+                "type": "object",
+                "properties": {
+                  "receipt_id": {
+                    "type": "string",
+                    "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+                    "maxLength": 80
+                  },
+                  "digest": {
+                    "type": "string",
+                    "pattern": "^[a-f0-9]{64}$"
+                  }
+                },
+                "required": [
+                  "receipt_id",
+                  "digest"
+                ],
+                "additionalProperties": false
               }
             },
             "required": [

package/template/workflows/ops/common/schemas/status.schema.json

@@ -362,6 +362,25 @@
             ],
             "additionalProperties": false
           }
+        },
+        "root_confirmation": {
+          "type": "object",
+          "properties": {
+            "receipt_id": {
+              "type": "string",
+              "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+              "maxLength": 80
+            },
+            "digest": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$"
+            }
+          },
+          "required": [
+            "receipt_id",
+            "digest"
+          ],
+          "additionalProperties": false
         }
       },
       "required": [

package/template/workflows/ops/common/templates/FLEET.html

@@ -47,7 +47,7 @@ function render(){const server=$("server").value,project=$("project").value,st=$
 const ds=data.deployments.filter(d=>(!server||d.server_id===server)&&(!project||d.project_id===project)&&(!st||d.status===st)&&match(d));
 const ss=data.servers.filter(s=>(!server||s.server_id===server)&&(!project||s.deployment_ids.some(id=>byDeployment.get(id)?.project_id===project))&&(!st||ds.some(d=>d.server_id===s.server_id))&&(match(s)||ds.some(d=>d.server_id===s.server_id)));
 const ps=data.projects.filter(p=>(!project||p.project_id===project)&&(!server||p.deployment_ids.some(id=>byDeployment.get(id)?.server_id===server))&&(!st||ds.some(d=>d.project_id===p.project_id))&&(match(p)||ds.some(d=>d.project_id===p.project_id)));
-table("servers",["服务器 / 名称","地址 / 系统","检查结果","检查详情（* 必需项）","项目","部署根"],ss.map(s=>[links("server",[s.server_id]),`${s.name} · ${s.address}${s.port?":"+s.port:""} / ${s.platform}`,badge(s.readiness),checks(s),links("project",s.project_ids),s.root]));
+table("servers",["服务器 / 名称","地址 / 系统","检查结果","检查详情（* 必需项）","项目","账号 / 持久化根 / 确认 / 文档"],ss.map(s=>[links("server",[s.server_id]),`${s.name} · ${s.address}${s.port?":"+s.port:""} / ${s.platform}`,badge(s.readiness),checks(s),links("project",s.project_ids),`${s.login_account} / ${s.root} / ${s.root_confirmation.status} / ${s.initialization.documents}`]));
 table("projects",["项目","名称","类别 / 服务类型","所在服务器","部署数量"],ps.map(p=>[link("project",p.project_id),p.name,`${p.kind} / ${p.service_type||"—"}`,links("server",p.server_ids),p.deployment_ids.length]));
 table("deployments",["部署实例","项目 / 服务器","环境 / 方法","记录状态","计划版本","验证版本","根目录 / 更新时间"],ds.map(d=>{const where=node("div");where.append(link("project",d.project_id),node("div"),link("server",d.server_id));return[d.deployment_id,where,`${d.environment} / ${d.instance} / ${d.method}`,badge(d.status),d.desired_version,d.observed_version,`${d.root} / ${d.updated_at||"未验证"}`];}));
 table("services",["服务器","主机级服务","类型","systemd 单元","监听端口"],ss.flatMap(s=>s.host_services.map(v=>[link("server",s.server_id),v.service_id,v.kind,v.unit,v.port])));