diff --git a/Jenkinsfile.ops-web b/Jenkinsfile.ops-web
deleted file mode 100644
index 0a160b6..0000000
--- a/Jenkinsfile.ops-web
+++ /dev/null
@@ -1,132 +0,0 @@
-pipeline {
-  agent any
-
-  environment {
-    ACR_REGISTRY   = 'crpi-n44qjpuucgjt8e8c.cn-beijing.personal.cr.aliyuncs.com'
-    ACR_NAMESPACE  = 'xuqmgroup'
-    ACR_USERNAME   = 'xuqinmin12'
-    PROD_HOST      = '106.54.23.149'
-    PROD_USER      = 'ubuntu'
-    COMPOSE_FILE   = '/opt/xuqm/deploy/compose.production.yaml'
-    VERSIONS_FILE  = '/opt/xuqm/deploy/versions.json'
-    DOCKER_BUILDKIT = '1'
-    IMAGE_NAME     = 'ops-web'
-    DOCKERFILE     = 'Dockerfile.ops'
-    DEPLOY_SERVICE = 'ops-web'
-    BUILD_ARGS     = '--build-arg OPS_APP_BASE=/ --build-arg OPS_API_BASE_URL=/api'
-    VERSION_FILE   = 'VERSION.ops-web'
-  }
-
-  options {
-    timeout(time: 20, unit: 'MINUTES')
-    buildDiscarder(logRotator(numToKeepStr: '20'))
-    disableConcurrentBuilds()
-  }
-
-  stages {
-    stage('Checkout') {
-      steps {
-        checkout([
-          $class: 'GitSCM',
-          branches: [[name: 'main']],
-          extensions: [[$class: 'CleanBeforeCheckout']],
-          userRemoteConfigs: scm.userRemoteConfigs
-        ])
-      }
-    }
-
-    stage('Resolve Version') {
-      steps {
-        script {
-          def current = fileExists(env.VERSION_FILE) ? readFile(env.VERSION_FILE).trim() : '1.0.0'
-          def parts = current.tokenize('.')
-          while (parts.size() < 3) parts.add('0')
-          def newVer = "${parts[0]}.${parts[1]}.${parts[2].toInteger() + 1}"
-          env.IMAGE_VERSION = newVer
-          writeFile file: env.VERSION_FILE, text: newVer
-          echo "${env.IMAGE_NAME}: ${current} → ${newVer}"
-        }
-      }
-    }
-
-    stage('Docker Build & Push') {
-      steps {
-        withCredentials([string(credentialsId: 'ACR_PASSWORD', variable: 'ACR_PASS')]) {
-          script {
-            def base = "${env.ACR_REGISTRY}/${env.ACR_NAMESPACE}/${env.IMAGE_NAME}"
-            def versionedImage = "${base}:${env.IMAGE_VERSION}"
-            def latestImage = "${base}:latest"
-            def gitCommit = env.GIT_COMMIT ?: 'unknown'
-            bat """
-              docker login ${env.ACR_REGISTRY} -u ${env.ACR_USERNAME} -p %ACR_PASS%
-              if %errorlevel% neq 0 exit /b 1
-              set "PREVIOUS_IMAGE=nginx:1.27-alpine"
-              docker pull --platform=linux/amd64 ${latestImage} && set "PREVIOUS_IMAGE=${latestImage}" || echo Previous image unavailable, first release will not retain assets
-              docker build --platform=linux/amd64 -f ${env.DOCKERFILE} ${env.BUILD_ARGS} --build-arg PREVIOUS_IMAGE=%PREVIOUS_IMAGE% --build-arg GIT_COMMIT=${gitCommit} --build-arg SERVICE_VERSION=${env.IMAGE_VERSION} --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from ${latestImage} -t ${versionedImage} -t ${latestImage} .
-              if %errorlevel% neq 0 exit /b 1
-              docker push ${versionedImage}
-              if %errorlevel% neq 0 exit /b 1
-              docker push ${latestImage}
-              if %errorlevel% neq 0 exit /b 1
-              docker rmi ${versionedImage} ${latestImage}
-              exit /b 0
-            """
-          }
-        }
-      }
-    }
-
-    stage('Deploy to Production') {
-      steps {
-        lock('prod-deploy') {
-          withCredentials([sshUserPrivateKey(credentialsId: 'PROD_SSH_KEY', keyFileVariable: 'SSH_KEY')]) {
-            script {
-              def latestImage = "${env.ACR_REGISTRY}/${env.ACR_NAMESPACE}/${env.IMAGE_NAME}:latest"
-              retry(2) {
-                bat """
-                  ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${env.PROD_USER}@${env.PROD_HOST} "docker image prune -f 2>/dev/null || true; docker pull ${latestImage} || exit 1; docker compose -f ${env.COMPOSE_FILE} up -d --no-deps --force-recreate ${env.DEPLOY_SERVICE} || exit 1; docker image prune -f"
-                """
-              }
-              def releasedAt = new Date().format("yyyy-MM-dd'T'HH:mm:ss'Z'", TimeZone.getTimeZone('UTC'))
-              def updateScript = """\
-import json, os
-path = '${env.VERSIONS_FILE}'
-d = json.load(open(path)) if os.path.exists(path) else {}
-d.setdefault('services', {})['${env.DEPLOY_SERVICE}'] = {'version': '${env.IMAGE_VERSION}', 'changed': True}
-d['releasedAt'] = '${releasedAt}'
-json.dump(d, open(path, 'w'), indent=2, ensure_ascii=False)
-print('versions.json updated: ${env.DEPLOY_SERVICE} = ${env.IMAGE_VERSION}')
-""".stripIndent()
-              writeFile file: 'update_versions.py', text: updateScript
-              bat """
-                scp -i "%SSH_KEY%" -o StrictHostKeyChecking=no update_versions.py ${env.PROD_USER}@${env.PROD_HOST}:/tmp/update_versions.py
-                ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${env.PROD_USER}@${env.PROD_HOST} "python3 /tmp/update_versions.py && rm /tmp/update_versions.py"
-              """
-            }
-          }
-        }
-      }
-    }
-
-    stage('Commit Version') {
-      steps {
-        sshagent(credentials: ['jenkins-ssh-key']) {
-          script {
-            bat """
-              git config user.email "jenkins@xuqm.com"
-              git config user.name "Jenkins CI"
-              git add ${env.VERSION_FILE}
-              git diff --cached --quiet || git commit -m "ci: bump ${env.IMAGE_NAME} to ${env.IMAGE_VERSION} [skip ci]"
-              git push origin HEAD:main
-            """
-          }
-        }
-      }
-    }
-  }
-
-  post {
-    success { bat "chcp 65001 >nul && echo ✅ ${env.IMAGE_NAME}:${env.IMAGE_VERSION} 构建部署成功" }
-    failure  { bat 'chcp 65001 >nul && echo ❌ 构建失败，请检查日志' }
-  }
-}
diff --git a/Jenkinsfile.tenant-web b/Jenkinsfile.tenant-web
deleted file mode 100644
index 91a6ea6..0000000
--- a/Jenkinsfile.tenant-web
+++ /dev/null
@@ -1,171 +0,0 @@
-pipeline {
-  agent any
-
-  parameters {
-    choice(
-      name: 'DEPLOY_ENV',
-      choices: ['development', 'production'],
-      description: 'development 只执行验证；production 需要人工确认后发布'
-    )
-  }
-
-  environment {
-    ACR_REGISTRY   = 'crpi-n44qjpuucgjt8e8c.cn-beijing.personal.cr.aliyuncs.com'
-    ACR_NAMESPACE  = 'xuqmgroup'
-    ACR_USERNAME   = 'xuqinmin12'
-    PROD_HOST      = '106.54.23.149'
-    PROD_USER      = 'ubuntu'
-    COMPOSE_FILE   = '/opt/xuqm/deploy/compose.production.yaml'
-    VERSIONS_FILE  = '/opt/xuqm/deploy/versions.json'
-    DOCKER_BUILDKIT = '1'
-    IMAGE_NAME     = 'tenant-web'
-    DOCKERFILE     = 'Dockerfile.tenant'
-    DEPLOY_SERVICE = 'tenant-web'
-    BUILD_ARGS     = '--build-arg TENANT_APP_BASE=/ --build-arg TENANT_API_BASE_URL=/api'
-    VERSION_FILE   = 'VERSION.tenant-web'
-  }
-
-  options {
-    timeout(time: 20, unit: 'MINUTES')
-    buildDiscarder(logRotator(numToKeepStr: '20'))
-    disableConcurrentBuilds()
-  }
-
-  stages {
-    stage('Checkout') {
-      steps {
-        checkout([
-          $class: 'GitSCM',
-          branches: [[name: 'main']],
-          extensions: [[$class: 'CleanBeforeCheckout']],
-          userRemoteConfigs: [[
-            url: 'ssh://git@xuqinmin.com:2222/xuqmGroup/XuqmGroup-Web.git',
-            credentialsId: 'jenkins-ssh-key'
-          ]]
-        ])
-      }
-    }
-
-    stage('Verify') {
-      steps {
-        bat 'yarn install --frozen-lockfile && yarn build:tenant'
-      }
-    }
-
-    stage('Confirm Production') {
-      when { expression { params.DEPLOY_ENV == 'production' } }
-      input {
-        message '确认发布并部署租户平台到生产环境？'
-        ok '确认生产发布'
-      }
-      steps {
-        echo '生产发布已人工确认'
-      }
-    }
-
-    stage('Resolve Version') {
-      when { expression { params.DEPLOY_ENV == 'production' } }
-      steps {
-        script {
-          def current = fileExists(env.VERSION_FILE) ? readFile(env.VERSION_FILE).trim() : '1.0.0'
-          def parts = current.tokenize('.')
-          while (parts.size() < 3) parts.add('0')
-          def newVer = "${parts[0]}.${parts[1]}.${parts[2].toInteger() + 1}"
-          env.IMAGE_VERSION = newVer
-          writeFile file: env.VERSION_FILE, text: newVer
-          echo "${env.IMAGE_NAME}: ${current} → ${newVer}"
-        }
-      }
-    }
-
-    stage('Docker Build & Push') {
-      when { expression { params.DEPLOY_ENV == 'production' } }
-      steps {
-        withCredentials([string(credentialsId: 'ACR_PASSWORD', variable: 'ACR_PASS')]) {
-          script {
-            def base = "${env.ACR_REGISTRY}/${env.ACR_NAMESPACE}/${env.IMAGE_NAME}"
-            def versionedImage = "${base}:${env.IMAGE_VERSION}"
-            def latestImage = "${base}:latest"
-            def gitCommit = env.GIT_COMMIT ?: 'unknown'
-            bat """
-              docker login ${env.ACR_REGISTRY} -u ${env.ACR_USERNAME} -p %ACR_PASS%
-              if %errorlevel% neq 0 exit /b 1
-              set "PREVIOUS_IMAGE=nginx:1.27-alpine"
-              docker pull --platform=linux/amd64 ${latestImage} && set "PREVIOUS_IMAGE=${latestImage}" || echo Previous image unavailable, first release will not retain assets
-              docker build --platform=linux/amd64 -f ${env.DOCKERFILE} ${env.BUILD_ARGS} --build-arg PREVIOUS_IMAGE=%PREVIOUS_IMAGE% --build-arg GIT_COMMIT=${gitCommit} --build-arg SERVICE_VERSION=${env.IMAGE_VERSION} --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from ${latestImage} -t ${versionedImage} -t ${latestImage} .
-              if %errorlevel% neq 0 exit /b 1
-              docker push ${versionedImage}
-              if %errorlevel% neq 0 exit /b 1
-              docker push ${latestImage}
-              if %errorlevel% neq 0 exit /b 1
-              docker rmi ${versionedImage} ${latestImage}
-              exit /b 0
-            """
-          }
-        }
-      }
-    }
-
-    stage('Deploy to Production') {
-      when { expression { params.DEPLOY_ENV == 'production' } }
-      steps {
-        lock('prod-deploy') {
-          withCredentials([sshUserPrivateKey(credentialsId: 'PROD_SSH_KEY', keyFileVariable: 'SSH_KEY')]) {
-            script {
-              def latestImage = "${env.ACR_REGISTRY}/${env.ACR_NAMESPACE}/${env.IMAGE_NAME}:latest"
-              retry(2) {
-                bat """
-                  ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${env.PROD_USER}@${env.PROD_HOST} "docker image prune -f 2>/dev/null || true; docker pull ${latestImage} || exit 1; docker compose -f ${env.COMPOSE_FILE} up -d --no-deps --force-recreate ${env.DEPLOY_SERVICE} || exit 1; docker image prune -f"
-                """
-              }
-              def releasedAt = new Date().format("yyyy-MM-dd'T'HH:mm:ss'Z'", TimeZone.getTimeZone('UTC'))
-              def updateScript = """\
-import json, os
-path = '${env.VERSIONS_FILE}'
-d = json.load(open(path)) if os.path.exists(path) else {}
-d.setdefault('services', {})['${env.DEPLOY_SERVICE}'] = {'version': '${env.IMAGE_VERSION}', 'changed': True}
-d['releasedAt'] = '${releasedAt}'
-json.dump(d, open(path, 'w'), indent=2, ensure_ascii=False)
-print('versions.json updated: ${env.DEPLOY_SERVICE} = ${env.IMAGE_VERSION}')
-""".stripIndent()
-              writeFile file: 'update_versions.py', text: updateScript
-              bat """
-                scp -i "%SSH_KEY%" -o StrictHostKeyChecking=no update_versions.py ${env.PROD_USER}@${env.PROD_HOST}:/tmp/update_versions.py
-                ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${env.PROD_USER}@${env.PROD_HOST} "python3 /tmp/update_versions.py && rm /tmp/update_versions.py"
-              """
-            }
-          }
-        }
-      }
-    }
-
-    stage('Commit Version') {
-      when { expression { params.DEPLOY_ENV == 'production' } }
-      steps {
-        sshagent(credentials: ['jenkins-ssh-key']) {
-          script {
-            bat """
-              git config user.email "jenkins@xuqm.com"
-              git config user.name "Jenkins CI"
-              git add ${env.VERSION_FILE}
-              git diff --cached --quiet || git commit -m "ci: bump ${env.IMAGE_NAME} to ${env.IMAGE_VERSION} [skip ci]"
-              git push origin HEAD:main
-            """
-          }
-        }
-      }
-    }
-  }
-
-  post {
-    success {
-      script {
-        def resultText = params.DEPLOY_ENV == 'production'
-          ? "${env.IMAGE_NAME}:${env.IMAGE_VERSION} 构建部署成功"
-          : 'tenant-web development 验证成功（未发布）'
-        bat "chcp 65001 >nul && echo ✅ ${resultText}"
-      }
-    }
-    failure  { bat 'chcp 65001 >nul && echo ❌ 构建失败，请检查日志' }
-  }
-}
diff --git a/README.md b/README.md
index 0e6a7bf..0cc9e79 100644
--- a/README.md
+++ b/README.md
@@ -190,3 +190,5 @@ Windows Jenkins 节点通过 `jenkins-ssh-key` 私钥凭据生成构建期临时
 `git-ssh.cmd` 执行版本提交推送，作用域结束后立即删除该脚本。
 `xuqmgroup-tenant-web` 与 `xuqmgroup-ops-web` 共用 Jenkinsfile 时，以 job 名确定
 构建目标；`APP` 参数仅供其它通用手工 job 使用，避免首次加载参数时误发另一应用。
+仓库只保留根 `Jenkinsfile` 作为 Web 构建、版本、部署和 Git 推送的权威实现；
+Jenkins job 不得再配置独立的 tenant/ops 脚本路径。