feat: bind each node to the binary it runs at its first handshake; refuse changes that are not in a CI-signed manifest [CI]

backend/agent/src/MoShiro.Agent/AgentApp.cs

@@ -47,6 +47,7 @@ public sealed class AgentApp : IDisposable
         _ownedRestart = restart is null ? new RestartController() : null;
         _restart = restart ?? _ownedRestart!;
         _update = new UpdateBridge(dataDirectory, new ConfigStore(dataDirectory).Write, log);
+        NodeBinary.Prime(); // 正在运行的二进制的哈希：先在后台算好，握手时用
         _config = config;
         _identity = identity;
         _time = time;
@@ -276,6 +277,7 @@ public sealed class AgentApp : IDisposable
             Server = new Uri(_config.Fleet.Server),
             Identity = _identity.Identity,
             ServerVerifier = _trust,
+            Attestation = _update.Attest,
             NodeId = _identity.NodeId,
             NodeVersion = Version,
             Capabilities = [MoShiroCapabilities.Base, MoShiroCapabilities.KindsPrefix + string.Join(',', BlockCatalog.AgentKinds)],

backend/fleet/src/Fleet.Core/BinaryAttestation.cs

@@ -0,0 +1,43 @@
+using System.Security.Cryptography;
+
+namespace Fleet.Core;
+
+/// <summary>
+/// 节点握手时自述的「我跑的是哪个二进制」：正在运行的可执行文件的 SHA-256，以及（容器节点）宿主机更新器验过的 CI 签名清单和签名。
+/// 服务端在节点第一次握手成功的那一刻把哈希绑定到这个节点，之后哈希对不上就不让它继续运行。
+/// </summary>
+public sealed record BinaryAttestation(string Sha256, string? Manifest, string? Signature);
+
+/// <summary>
+/// 正在运行的二进制的哈希。Linux 上读 <c>/proc/self/exe</c>：它指向进程启动时映射的那个映像，磁盘上的文件之后被换掉也不影响，
+/// 所以「运行期间被替换、重启后换了别的」的情况下一次握手就会对不上。算一次，之后缓存。
+/// </summary>
+public static class NodeBinary
+{
+    private static readonly Lazy<string?> s_hash = new(Compute);
+
+    /// <summary>小写十六进制；读不到可执行文件时为 null（这样的节点不做绑定）。</summary>
+    public static string? Sha256Hex => s_hash.Value;
+
+    /// <summary>在后台先算好，免得第一次握手等它。</summary>
+    public static void Prime() => _ = Task.Run(() => s_hash.Value);
+
+    private static string? Compute()
+    {
+        try
+        {
+            string? path = OperatingSystem.IsLinux() && File.Exists("/proc/self/exe") ? "/proc/self/exe" : Environment.ProcessPath;
+            if (path is null)
+            {
+                return null;
+            }
+
+            using var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete, 1 << 16);
+            return Convert.ToHexStringLower(SHA256.HashData(stream));
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return null;
+        }
+    }
+}

backend/fleet/src/Fleet.Core/ErrorCode.cs

@@ -27,4 +27,6 @@ public static class FleetErrors
     public static readonly ErrorCode JoinTokenExpired = new("fleet_join_token_expired");
     public static readonly ErrorCode ProofInvalid = new("fleet_proof_invalid");
     public static readonly ErrorCode FrameTooLarge = new("fleet_frame_too_large");
+    /// <summary>节点现在跑的二进制和它第一次握手时绑定的不一致，也不在 CI 签名的更新清单里。</summary>
+    public static readonly ErrorCode BinaryMismatch = new("fleet_binary_mismatch");
 }

backend/fleet/src/Fleet.Link/FleetLink.cs

@@ -72,6 +72,9 @@ public sealed class FleetLinkOptions
     /// 服务器必须在挑战里证明自己，之后这条链路用应用层加密；否则按旧的方式（没有固定信任根的节点）。
     /// </summary>
     public IServerVerifier? ServerVerifier { get; init; }
+
+    /// <summary>握手时自述正在运行的二进制（哈希和 CI 签名的清单）；没有就不上报（旧行为）。</summary>
+    public Func<BinaryAttestation?>? Attestation { get; init; }
 }
 
 /// <summary>
@@ -223,6 +226,16 @@ public sealed class FleetLink
     }
 
     /// <summary>挑战 → 签名 → 认证结果。失败返回原因；服务端禁用该节点时不再重试。</summary>
+    private void Attest(AuthParams auth)
+    {
+        if (_options.Attestation?.Invoke() is { } attestation)
+        {
+            auth.Binary = attestation.Sha256;
+            auth.Release = attestation.Manifest;
+            auth.ReleaseSignature = attestation.Signature;
+        }
+    }
+
     private async Task<string?> AuthenticateAsync(SecureTransport transport, CancellationToken ct)
     {
         using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(15), _time);
@@ -257,6 +270,7 @@ public sealed class FleetLink
                     Signature = Convert.ToBase64String(_options.Identity.Sign(SignaturePurpose.AuthSecure, _options.NodeId.Value, nonce.Nonce, serverEphemeralText, nodeEphemeralText)),
                     NodeEphemeral = nodeEphemeralText,
                 };
+                Attest(authParams);
                 RpcMessage secureRequest = RpcMessage.Request(1, FleetMethods.Auth, authParams, FleetRpcContext.Default.AuthParams);
                 await transport.SendAsync(new RpcFrame(FrameKind.Text, JsonSerializer.SerializeToUtf8Bytes(secureRequest, FleetRpcContext.Default.RpcMessage)), linked.Token);
                 transport.Enable(LinkCipher.ForNode(ephemeral, serverEphemeral, nonce.Nonce));
@@ -264,6 +278,7 @@ public sealed class FleetLink
             else
             {
                 authParams = new AuthParams { NodeId = _options.NodeId.Value, Signature = Convert.ToBase64String(_options.Identity.Sign(SignaturePurpose.Auth, _options.NodeId.Value, nonce.Nonce)) };
+                Attest(authParams);
                 RpcMessage request = RpcMessage.Request(1, FleetMethods.Auth, authParams, FleetRpcContext.Default.AuthParams);
                 await transport.SendAsync(new RpcFrame(FrameKind.Text, JsonSerializer.SerializeToUtf8Bytes(request, FleetRpcContext.Default.RpcMessage)), linked.Token);
             }

backend/fleet/src/Fleet.Rpc/FleetMethods.cs

@@ -75,6 +75,17 @@ public sealed class AuthParams
     /// <summary>节点的临时 ECDH 公钥（SPKI，base64）：有它就是安全链路，签名覆盖双方的临时公钥，认证结果起所有帧都是加密的。</summary>
     [JsonPropertyName("node_eph")]
     public string? NodeEphemeral { get; set; }
+
+    /// <summary>正在运行的二进制的 SHA-256（小写十六进制）：服务端在第一次握手时绑定，之后核对。旧节点没有这个字段。</summary>
+    [JsonPropertyName("binary")]
+    public string? Binary { get; set; }
+
+    /// <summary>安装这个二进制时宿主机更新器验过的 CI 签名清单（原文）和签名（base64）：服务端用 CI 公钥验过，才相信它列出的官方哈希。</summary>
+    [JsonPropertyName("release")]
+    public string? Release { get; set; }
+
+    [JsonPropertyName("release_sig")]
+    public string? ReleaseSignature { get; set; }
 }
 
 public sealed class AuthResult

backend/fleet/src/Fleet.Server.Abstractions/ServerContracts.cs

@@ -19,6 +19,21 @@ public interface IServerIdentity
 }
 
 /// <summary>操作员集合的链（passkey 签的，创世在前）。没有初始化信任根时是空的。节点注册时用它确认「这个面板确实是我的操作员的」。</summary>
+/// <summary>节点握手时自述的二进制（旧节点没有）。</summary>
+public sealed record BinaryEvidence(string? Sha256, string? Manifest, string? Signature);
+
+/// <summary>是否让这个节点继续：不放行时 <c>Reason</c> 会原样告诉节点（这是它自己的信息，不是秘密）。</summary>
+public sealed record BinaryDecision(bool Accept, string Reason = "");
+
+/// <summary>
+/// 服务端对节点二进制的把关：节点第一次握手成功的那一刻绑定它的二进制哈希，之后哈希对不上、又不在 CI 签名的更新清单里，就不让它继续运行。
+/// 没有注册实现时不做任何检查。
+/// </summary>
+public interface IBinaryAttestor
+{
+    ValueTask<BinaryDecision> CheckAsync(NodeRecord node, BinaryEvidence evidence, CancellationToken ct);
+}
+
 public interface IOperatorTrustSource
 {
     ValueTask<IReadOnlyList<SignedStatementDto>> ChainAsync(CancellationToken ct);

backend/fleet/src/Fleet.Server.Link/FleetLinkHost.cs

@@ -24,9 +24,11 @@ public sealed class FleetLinkHost : IFleetConnections, IStateNotifier
         IEnumerable<IInbox> inboxes,
         IEnumerable<INodeEventSink> sinks,
         FleetRouter router,
-        IServerIdentity? serverIdentity = null)
+        IServerIdentity? serverIdentity = null,
+        IBinaryAttestor? binaryAttestor = null)
     {
         ServerIdentity = serverIdentity;
+        BinaryAttestor = binaryAttestor;
         Store = store;
         Options = options;
         Time = time;
@@ -43,6 +45,9 @@ public sealed class FleetLinkHost : IFleetConnections, IStateNotifier
     /// <summary>服务器的身份密钥；没有时节点连接用旧的明文认证。</summary>
     internal IServerIdentity? ServerIdentity { get; }
 
+    /// <summary>节点二进制的把关；没有时不检查。</summary>
+    internal IBinaryAttestor? BinaryAttestor { get; }
+
     internal FleetServerOptions Options { get; }
 
     internal TimeProvider Time { get; }

backend/fleet/src/Fleet.Server.Link/FleetServerBuilder.cs

@@ -110,7 +110,8 @@ public static class FleetServerExtensions
             provider.GetServices<IInbox>(),
             provider.GetServices<INodeEventSink>(),
             provider.GetRequiredService<FleetRouter>(),
-            provider.GetService<IServerIdentity>()));
+            provider.GetService<IServerIdentity>(),
+            provider.GetService<IBinaryAttestor>()));
         services.AddSingleton<IFleetConnections>(provider => provider.GetRequiredService<FleetLinkHost>());
         services.AddSingleton<IStateNotifier>(provider => provider.GetRequiredService<FleetLinkHost>());
         return builder;

backend/fleet/src/Fleet.Server.Link/NodeConnection.Auth.cs

@@ -88,6 +88,18 @@ internal sealed partial class NodeConnection
             return false;
         }
 
+        // 二进制：第一次握手成功的这一刻绑定，之后哈希对不上又不在 CI 签名的更新清单里，就不让它继续运行
+        if (_host.BinaryAttestor is { } attestor)
+        {
+            BinaryDecision decision = await attestor.CheckAsync(node, new BinaryEvidence(auth!.Binary, auth.Release, auth.ReleaseSignature), ct);
+            if (!decision.Accept)
+            {
+                await SendAsync(RpcMessage.Failure(message.Id, new FleetError(FleetErrors.BinaryMismatch, decision.Reason)), ct);
+                await RejectAsync(null, "binary mismatch: " + decision.Reason, ct);
+                return false;
+            }
+        }
+
         _session = new NodeSessionInfo(node.Id, _host.Time.GetUtcNow().ToUnixTimeMilliseconds(), node.NodeVersion, [], null);
         await SendAsync(
             RpcMessage.Success(message.Id.Value, new AuthResult { Status = StatusName(node.Status) }, FleetRpcContext.Default.AuthResult),

backend/openapi/v1.json

@@ -4382,6 +4382,56 @@
         "x-moshiro-capability": "update.confirm"
       }
     },
+    "/api/admin/nodes/{id}/binary": {
+      "delete": {
+        "tags": [
+          "admin-build"
+        ],
+        "summary": "Accept the node's current binary: clear its binding so the next handshake binds it again",
+        "operationId": "nodes_binary_clear",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content",
+            "content": {
+              "application/json": {
+                "schema": { }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDto"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Forbidden",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDto"
+                }
+              }
+            }
+          }
+        },
+        "x-moshiro-capability": "fleet.write"
+      }
+    },
     "/api/admin/backend/update": {
       "get": {
         "tags": [
@@ -6999,6 +7049,45 @@
           }
         }
       },
+      "NodeBinaryDto": {
+        "required": [
+          "sha256",
+          "signed",
+          "seq",
+          "bound_at",
+          "violation",
+          "violation_at"
+        ],
+        "type": "object",
+        "properties": {
+          "sha256": {
+            "type": "string"
+          },
+          "signed": {
+            "type": "boolean"
+          },
+          "seq": {
+            "pattern": "^-?(?:0|[1-9]\\d*)$",
+            "type": [
+              "integer",
+              "string"
+            ],
+            "format": "int64"
+          },
+          "bound_at": {
+            "format": "date-time"
+          },
+          "violation": {
+            "type": [
+              "null",
+              "string"
+            ]
+          },
+          "violation_at": {
+            "format": "date-time"
+          }
+        }
+      },
       "NodeBuildDto": {
         "required": [
           "id",
@@ -7070,6 +7159,16 @@
                 "$ref": "#/components/schemas/NodeUpdateDto"
               }
             ]
+          },
+          "binary": {
+            "oneOf": [
+              {
+                "type": "null"
+              },
+              {
+                "$ref": "#/components/schemas/NodeBinaryDto"
+              }
+            ]
           }
         }
       },

backend/probe/src/MoShiro.Probe/ProbeApp.cs

@@ -33,11 +33,13 @@ public sealed class ProbeApp : IDisposable
         directory.Changed += () => _changed.Release();
 
         var update = new UpdateBridge(configDirectory, new ConfigStore(configDirectory).Write, log);
+        NodeBinary.Prime(); // 正在运行的二进制的哈希：先在后台算好，握手时用
         var options = new FleetLinkOptions
         {
             Server = new Uri(file.Fleet.Server),
             Identity = identity.Identity,
             ServerVerifier = trust,
+            Attestation = update.Attest,
             NodeId = identity.NodeId,
             NodeVersion = Version,
             Capabilities = [MoShiroCapabilities.Base],

backend/shared/MoShiro.Measurement/Update/UpdateBridge.cs

@@ -96,5 +96,34 @@ public sealed class UpdateBridge
         }
     }
 
+    /// <summary>
+    /// 握手时自述的二进制：正在运行的可执行文件的哈希，加上宿主机更新器验过的、安装这个版本时用的 CI 签名清单（更新器写在只读的 <c>update-status/</c>）。
+    /// 容器节点以外（没有更新器）没有清单，只有哈希；读不到可执行文件时返回 null（不做绑定）。
+    /// </summary>
+    public BinaryAttestation? Attest()
+    {
+        if (NodeBinary.Sha256Hex is not { } hash)
+        {
+            return null;
+        }
+
+        string? manifest = ReadSmall("installed.manifest", MaxManifestBytes);
+        string? signature = ReadSmall("installed.sig", MaxSignatureBytes);
+        return manifest is not null && signature is not null ? new BinaryAttestation(hash, manifest, signature) : new BinaryAttestation(hash, null, null);
+    }
+
+    private string? ReadSmall(string name, int maxBytes)
+    {
+        try
+        {
+            string path = Path.Combine(Path.GetDirectoryName(_statusFile)!, name);
+            return File.Exists(path) && new FileInfo(path).Length <= maxBytes ? File.ReadAllText(path, Encoding.UTF8) : null;
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return null;
+        }
+    }
+
     private static bool Same(string path, byte[] content) => File.Exists(path) && File.ReadAllBytes(path).AsSpan().SequenceEqual(content);
 }

backend/src/MoShiro.Backend.Api/Admin/BuildEndpoints.cs

@@ -25,6 +25,9 @@ public static class BuildEndpoints
         group.MapPost("/nodes/{id}/update", RequestUpdateAsync)
             .Api("nodes_update", "Ask an online agent or probe to install the release it has been offered", Tag).Returns<object>(StatusCodes.Status204NoContent).ProducesProblems(401, 403, 409)
             .Requires(Capability.UpdateConfirm);
+        group.MapDelete("/nodes/{id}/binary", ClearBinaryAsync)
+            .Api("nodes_binary_clear", "Accept the node's current binary: clear its binding so the next handshake binds it again", Tag).Returns<object>(StatusCodes.Status204NoContent).ProducesProblems(401, 403)
+            .Requires(Capability.FleetWrite);
         group.MapGet("/backend/update", BackendUpdateAsync)
             .Api("backend_update_get", "Current channel and host-verified backend update", Tag).Returns<BackendUpdateDto>().ProducesProblems(401, 403)
             .Requires(Capability.UpdateRead);
@@ -70,12 +73,13 @@ public static class BuildEndpoints
         return await PublishReleaseAsync(http, releases, request);
     }
 
-    private static async Task<IResult> GetAsync(HttpContext http, NodeInfoService nodes, ReleaseService releases, BackendUpdates backendUpdates, CancellationToken ct)
+    private static async Task<IResult> GetAsync(HttpContext http, NodeInfoService nodes, ReleaseService releases, BackendUpdates backendUpdates, BinaryBindingService bindings, CancellationToken ct)
     {
+        Dictionary<string, NodeBinding> bound = (await bindings.ListAsync(ct)).ToDictionary(b => b.NodeId, StringComparer.Ordinal);
         var items = (await nodes.ListAsync(ct))
             .OrderBy(n => n.Kind, StringComparer.Ordinal)
             .ThenBy(n => n.NodeId, StringComparer.Ordinal)
-            .Select(n => new NodeBuildDto(n.NodeId, n.Kind, n.Os, n.OsName, n.Arch, n.Version, n.Tag, n.Commit, n.BuiltAt, ToDto(releases.StatusOf(new NodeId(n.NodeId)))))
+            .Select(n => new NodeBuildDto(n.NodeId, n.Kind, n.Os, n.OsName, n.Arch, n.Version, n.Tag, n.Commit, n.BuiltAt, ToDto(releases.StatusOf(new NodeId(n.NodeId))), bound.TryGetValue(n.NodeId, out NodeBinding? binding) ? ToDto(binding) : null))
             .ToList();
         http.Response.Headers.CacheControl = "no-store";
         return TypedResults.Json(new BuildInfoDto(NodeEndpoints.Backend(withCommit: true), items, ToDto(await backendUpdates.GetAsync(ct))), ApiJsonContext.Default.BuildInfoDto);
@@ -133,6 +137,17 @@ public static class BuildEndpoints
         }
     }
 
+    private static NodeBinaryDto ToDto(NodeBinding b) =>
+        new(b.Sha256, b.Signed, b.Seq, DateTimeOffset.FromUnixTimeMilliseconds(b.BoundAtMs), b.Violation, b.ViolationAtMs is { } at ? DateTimeOffset.FromUnixTimeMilliseconds(at) : null);
+
+    /// <summary>管理员确认新的二进制是自己要的：清除绑定，节点下一次握手重新绑定（没有绑定可清也返回 204，幂等）。</summary>
+    private static async Task<IResult> ClearBinaryAsync(HttpContext http, BinaryBindingService bindings, string id)
+    {
+        http.SetDetail("binary binding cleared");
+        await bindings.ClearAsync(id, http.RequestAborted);
+        return TypedResults.NoContent();
+    }
+
     private static NodeUpdateDto? ToDto(UpdateStatus? status) =>
         status is null ? null : new NodeUpdateDto(status.State, status.Current, status.Available?.Tag, status.Available?.Version, status.Error, status.At > 0 ? DateTimeOffset.FromUnixTimeSeconds(status.At) : null);
 }

backend/src/MoShiro.Backend.Api/ApiModule.cs

@@ -18,6 +18,7 @@ public static class ApiModule
     public static IServiceCollection AddMoShiroApi(this IServiceCollection services)
     {
         services.AddSingleton<SseLimiter>();
+        services.AddSingleton<MoShiro.Backend.Application.IReleaseKey, EmbeddedReleaseKey>();
         services.AddSingleton<ClientAddressResolver>();
         services.Configure<JsonOptions>(options =>
         {

backend/src/MoShiro.Backend.Api/Contracts/AdminDtos.cs

@@ -178,7 +178,10 @@ public sealed record ChangePasswordRequest(string Password);
 public sealed record RecomputeDto(string State, IReadOnlyList<string> Metrics, long WindowsDone, long WindowsTotal, DateTimeOffset? From, DateTimeOffset? To, int QueueLength);
 
 /// <summary>管理端看的构建信息：每个节点自报的版本、tag、提交和构建时间，以及系统。</summary>
-public sealed record NodeBuildDto(string Id, string Kind, string? Os, string? OsName, string? Arch, string? Version, string? Tag, string? Commit, string? BuiltAt, NodeUpdateDto? Update = null);
+/// <summary>节点二进制的绑定：第一次握手成功时绑定的 SHA-256。<c>Signed</c> 表示它出现在一份 CI 签名的清单里（否则只是首次握手时记下的）；<c>Violation</c> 是最近一次不符的原因，下一次握手符合了就清掉。</summary>
+public sealed record NodeBinaryDto(string Sha256, bool Signed, long Seq, DateTimeOffset BoundAt, string? Violation, DateTimeOffset? ViolationAt);
+
+public sealed record NodeBuildDto(string Id, string Kind, string? Os, string? OsName, string? Arch, string? Version, string? Tag, string? Commit, string? BuiltAt, NodeUpdateDto? Update = null, NodeBinaryDto? Binary = null);
 
 /// <summary>节点宿主机上的更新器报告的状态（<c>up_to_date</c>、<c>available</c>、<c>applying</c>、<c>failed</c>、<c>rolled_back</c>、<c>invalid</c>）；没装更新器的节点没有这个字段。</summary>
 public sealed record NodeUpdateDto(string State, string? CurrentDigest, string? AvailableTag, string? AvailableVersion, string? Error, DateTimeOffset? At);

backend/src/MoShiro.Backend.Api/Contracts/ApiJsonContext.cs

@@ -47,6 +47,7 @@ namespace MoShiro.Backend.Api;
 [JsonSerializable(typeof(PublishReleaseRequest))]
 [JsonSerializable(typeof(AboutDto))]
 [JsonSerializable(typeof(NodeBuildDto))]
+[JsonSerializable(typeof(NodeBinaryDto))]
 [JsonSerializable(typeof(BuildInfoDto))]
 [JsonSerializable(typeof(BackendUpdateDto))]
 [JsonSerializable(typeof(ConfirmBackendUpdateRequest))]

backend/src/MoShiro.Backend.Api/EmbeddedReleaseKey.cs

@@ -0,0 +1,9 @@
+using MoShiro.Backend.Application;
+
+namespace MoShiro.Backend.Api;
+
+/// <summary>内嵌在程序里的 CI 发布公钥（<c>packaging/update/release-key.pub.pem</c>）。</summary>
+public sealed class EmbeddedReleaseKey : IReleaseKey
+{
+    public string Pem => InstallScripts.ReleaseKey();
+}

backend/src/MoShiro.Backend.Application/Agents/AgentService.cs

@@ -26,8 +26,11 @@ public sealed partial class AgentService
     private readonly LinkService _links;
     private readonly TrustService _trust;
 
-    public AgentService(IAgentStore agents, AgentRuntime runtime, IAgentGateway gateway, TaskPlanner planner, ISettingsStore settings, NodeInfoService nodes, LinkService links, TrustService trust)
+    private readonly BinaryBindingService _bindings;
+
+    public AgentService(BinaryBindingService bindings, IAgentStore agents, AgentRuntime runtime, IAgentGateway gateway, TaskPlanner planner, ISettingsStore settings, NodeInfoService nodes, LinkService links, TrustService trust)
     {
+        _bindings = bindings;
         _trust = trust;
         _links = links;
         _nodes = nodes;
@@ -147,6 +150,7 @@ public sealed partial class AgentService
         await _gateway.DisconnectAsync(id, "deleted", ct);
         await _agents.DeleteAsync(id, ct);
         await _nodes.ForgetAsync(id.Value, ct);
+        await _bindings.ForgetAsync(id.Value, ct);
         await _links.ForgetNodeAsync(id.Value, ct);
         _runtime.Remove(id);
         await AfterAgentSetChangedAsync(ct);

backend/src/MoShiro.Backend.Application/Agents/BinaryBindingService.cs

@@ -0,0 +1,166 @@
+using System.Text.Json;
+using Fleet.Core;
+using Fleet.Server;
+
+namespace MoShiro.Backend.Application;
+
+/// <summary>CI 发布公钥（PEM）：验节点握手时带来的签名清单。由 Api 层提供（它就是内嵌在程序里的那一把）。</summary>
+public interface IReleaseKey
+{
+    string Pem { get; }
+}
+
+/// <summary>
+/// 节点二进制的绑定：节点第一次握手成功的那一刻，把它正在运行的二进制的 SHA-256 和这个节点绑在一起；之后哈希对不上，就不让它继续运行。
+/// <para>
+/// 合法的升级：新哈希出现在一份 <b>CI 签名的清单</b>里（节点握手时带着宿主机更新器验过的清单，这里用内嵌的 CI 公钥再验一遍，
+/// 所以不依赖面板有没有收到过这次发布），并且清单的 seq 不低于绑定时的——不许回退到更旧的版本。其余情况（文件被换掉、降级、没人签过的二进制、
+/// 手工替换了二进制的非容器节点）都算不符；管理员确认过之后可以清除绑定，下一次握手重新绑定。
+/// </para>
+/// <para>
+/// 边界：哈希是节点自己报的。一个被换进来、故意撒谎的恶意二进制可以照抄原来的哈希；这一层抓的是文件被换、版本被改、降级和起了不对的二进制。
+/// 容器节点要堵住撒谎，需要宿主机更新器背书（容器之外），见 docs/access.md。
+/// </para>
+/// </summary>
+public sealed class BinaryBindingService : IBinaryAttestor
+{
+    public const string Enforce = "enforce";
+    public const string Warn = "warn";
+    public const string Off = "off";
+
+    private readonly INodeBindingStore _store;
+    private readonly IReleaseKey _key;
+    private readonly BackendOptions _options;
+    private readonly TimeProvider _time;
+
+    public BinaryBindingService(INodeBindingStore store, IReleaseKey key, BackendOptions options, TimeProvider time)
+    {
+        _store = store;
+        _key = key;
+        _options = options;
+        _time = time;
+    }
+
+    public ValueTask<IReadOnlyList<NodeBinding>> ListAsync(CancellationToken ct) => _store.ListAsync(ct);
+
+    /// <summary>管理员确认新的二进制是自己要的（比如手工升级了非容器节点）：清除绑定，下一次握手重新绑定。</summary>
+    public ValueTask<bool> ClearAsync(string nodeId, CancellationToken ct) => _store.DeleteAsync(nodeId, ct);
+
+    /// <summary>节点删除之后顺手清掉它的绑定。</summary>
+    public async ValueTask ForgetAsync(string nodeId, CancellationToken ct) => await _store.DeleteAsync(nodeId, ct);
+
+    public async ValueTask<BinaryDecision> CheckAsync(NodeRecord node, BinaryEvidence evidence, CancellationToken ct)
+    {
+        string policy = _options.BinaryPolicy;
+        if (policy == Off || ReleaseService.ComponentOf(node.Id) is not { } component)
+        {
+            return new BinaryDecision(true);
+        }
+
+        long now = _time.GetUtcNow().ToUnixTimeMilliseconds();
+        NodeBinding? binding = await _store.GetAsync(node.Id.Value, ct);
+
+        if (evidence.Sha256 is null)
+        {
+            // 旧节点不上报：还没绑定过就放行（未绑定）；绑定过的不许退回去，否则换个旧版本就绕过了
+            return binding is null ? new BinaryDecision(true) : await ViolationAsync(binding, "the node stopped reporting its binary hash", policy, now, ct);
+        }
+
+        string hash = evidence.Sha256;
+        if (!IsHash(hash))
+        {
+            return new BinaryDecision(policy != Enforce, "the reported binary hash is malformed");
+        }
+
+        Official? official = VerifyManifest(evidence, component);
+        bool listed = official is not null && official.Binaries.Contains(hash);
+
+        if (binding is null)
+        {
+            if (official is not null && !listed)
+            {
+                // 带着一份有效的签名清单，自己的哈希却不在里面：它不是这份清单对应的官方二进制
+                return new BinaryDecision(policy != Enforce, "this binary is not in the CI-signed manifest it was installed from");
+            }
+
+            await _store.UpsertAsync(new NodeBinding(node.Id.Value, hash, official?.Seq ?? 0, listed, now, null, null), ct);
+            return new BinaryDecision(true);
+        }
+
+        if (binding.Sha256 == hash)
+        {
+            if (listed && (official!.Seq > binding.Seq || !binding.Signed || binding.Violation is not null))
+            {
+                await _store.UpsertAsync(binding with { Seq = Math.Max(binding.Seq, official!.Seq), Signed = true, Violation = null, ViolationAtMs = null }, ct);
+            }
+            else if (binding.Violation is not null)
+            {
+                await _store.UpsertAsync(binding with { Violation = null, ViolationAtMs = null }, ct);
+            }
+
+            return new BinaryDecision(true);
+        }
+
+        // 哈希变了：必须是一份不低于绑定时 seq 的 CI 签名清单里的官方二进制（合法升级），否则不符
+        if (listed && official!.Seq >= binding.Seq)
+        {
+            await _store.UpsertAsync(new NodeBinding(node.Id.Value, hash, official.Seq, true, now, null, null), ct);
+            return new BinaryDecision(true);
+        }
+
+        return await ViolationAsync(binding, $"the running binary changed (bound {Short(binding.Sha256)}, now {Short(hash)}) and is not in a newer CI-signed manifest", policy, now, ct);
+    }
+
+    private async ValueTask<BinaryDecision> ViolationAsync(NodeBinding binding, string reason, string policy, long now, CancellationToken ct)
+    {
+        await _store.UpsertAsync(binding with { Violation = reason, ViolationAtMs = now }, ct);
+        return new BinaryDecision(policy != Enforce, reason);
+    }
+
+    private sealed record Official(long Seq, HashSet<string> Binaries);
+
+    /// <summary>用内嵌的 CI 公钥验清单；验过且是这个组件的才返回它列出的官方二进制哈希。</summary>
+    private Official? VerifyManifest(BinaryEvidence evidence, string component)
+    {
+        if (evidence.Manifest is not { Length: > 0 and <= ReleaseService.MaxManifestBytes } manifest
+            || evidence.Signature is not { Length: > 0 and <= ReleaseService.MaxSignatureBytes } signature
+            || !ReleaseSignature.Verify(_key.Pem, manifest, signature))
+        {
+            return null;
+        }
+
+        try
+        {
+            using JsonDocument document = JsonDocument.Parse(manifest);
+            JsonElement root = document.RootElement;
+            if (root.ValueKind != JsonValueKind.Object
+                || !root.TryGetProperty("component", out JsonElement c) || c.GetString() != component
+                || !root.TryGetProperty("seq", out JsonElement s) || !s.TryGetInt64(out long seq) || seq <= 0)
+            {
+                return null;
+            }
+
+            var binaries = new HashSet<string>(StringComparer.Ordinal);
+            if (root.TryGetProperty("binaries", out JsonElement list) && list.ValueKind == JsonValueKind.String)
+            {
+                foreach (string item in (list.GetString() ?? "").Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+                {
+                    if (IsHash(item))
+                    {
+                        binaries.Add(item);
+                    }
+                }
+            }
+
+            return new Official(seq, binaries);
+        }
+        catch (JsonException)
+        {
+            return null;
+        }
+    }
+
+    private static bool IsHash(string value) => value.Length == 64 && value.All(ch => ch is (>= '0' and <= '9') or (>= 'a' and <= 'f'));
+
+    private static string Short(string hash) => hash.Length > 12 ? hash[..12] : hash;
+}

backend/src/MoShiro.Backend.Application/Agents/ProbeService.cs

@@ -29,8 +29,11 @@ public sealed partial class ProbeService
     private readonly NodeInfoService _nodes;
     private readonly LinkService _links;
 
-    public ProbeService(IProbeStore probes, IAgentStore agents, AgentRuntime runtime, IAgentGateway gateway, TimeProvider time, NodeInfoService nodes, LinkService links)
+    private readonly BinaryBindingService _bindings;
+
+    public ProbeService(BinaryBindingService bindings, IProbeStore probes, IAgentStore agents, AgentRuntime runtime, IAgentGateway gateway, TimeProvider time, NodeInfoService nodes, LinkService links)
     {
+        _bindings = bindings;
         _links = links;
         _nodes = nodes;
         _probes = probes;
@@ -94,6 +97,7 @@ public sealed partial class ProbeService
         if (deleted)
         {
             await _nodes.ForgetAsync(id, ct);
+            await _bindings.ForgetAsync(id, ct);
             await _links.ForgetNodeAsync(id, ct);
             _gateway.NotifyAllTaskSetsChanged();
         }

backend/src/MoShiro.Backend.Application/ApplicationServiceCollectionExtensions.cs

@@ -38,6 +38,8 @@ public static class ApplicationServiceCollectionExtensions
         services.AddSingleton<PasskeyService>();
         services.AddSingleton<AuditService>();
         services.AddSingleton<ServerIdentityService>();
+        services.AddSingleton<BinaryBindingService>();
+        services.AddSingleton<Fleet.Server.IBinaryAttestor>(sp => sp.GetRequiredService<BinaryBindingService>());
         services.AddSingleton<Fleet.Server.IServerIdentity>(sp => sp.GetRequiredService<ServerIdentityService>());
         services.AddSingleton<TrustService>();
         services.AddSingleton<Fleet.Server.IOperatorTrustSource>(sp => sp.GetRequiredService<TrustService>());

backend/src/MoShiro.Backend.Application/BackendOptions.cs

@@ -21,6 +21,11 @@ public sealed class BackendOptions
     /// <summary>宿主机更新器的只读状态目录；留空使用数据目录下的 update-status/。</summary>
     public string? BackendUpdateStatusDirectory { get; set; }
 
+    /// <summary>
+    /// 节点二进制绑定的策略：<c>enforce</c>（默认）二进制和绑定不符、又不在 CI 签名的更新清单里就拒绝连接；<c>warn</c> 只记录不拒绝；<c>off</c> 不检查。
+    /// </summary>
+    public string BinaryPolicy { get; set; } = "enforce";
+
     /// <summary>面板的对外地址（用于生成安装命令）。</summary>
     public string? PublicUrl { get; set; }
 

backend/src/MoShiro.Backend.Application/Ports/StorePorts.cs

@@ -144,6 +144,20 @@ public interface IEventStore
     ValueTask<int> DeleteOlderThanAsync(long cutoffMs, CancellationToken ct);
 }
 
+/// <summary>节点的二进制绑定：第一次握手成功时绑定的 SHA-256，对应的签名清单 seq（没有签名清单时为 0），以及最近一次不符的原因。</summary>
+public sealed record NodeBinding(string NodeId, string Sha256, long Seq, bool Signed, long BoundAtMs, string? Violation, long? ViolationAtMs);
+
+public interface INodeBindingStore
+{
+    ValueTask<NodeBinding?> GetAsync(string nodeId, CancellationToken ct);
+
+    ValueTask<IReadOnlyList<NodeBinding>> ListAsync(CancellationToken ct);
+
+    ValueTask UpsertAsync(NodeBinding binding, CancellationToken ct);
+
+    ValueTask<bool> DeleteAsync(string nodeId, CancellationToken ct);
+}
+
 /// <summary>操作员集合的链（passkey 签的版本，按版本号递增）。</summary>
 public interface IOperatorSetStore
 {

backend/src/MoShiro.Backend.Application/Updates/ReleaseService.cs

@@ -145,7 +145,7 @@ public sealed partial class ReleaseService : IDisposable
 
     private IEnumerable<NodeId> OnlineOf(string component) => _gateway.OnlineNodes.Where(n => ComponentOf(n) == component);
 
-    private static string? ComponentOf(NodeId node) =>
+    internal static string? ComponentOf(NodeId node) =>
         node.Value.StartsWith(AgentIds.Prefix, StringComparison.Ordinal) ? NodeKinds.Agent
         : node.Value.StartsWith(ProbeId.Prefix, StringComparison.Ordinal) ? NodeKinds.Probe
         : null;

backend/src/MoShiro.Backend.Application/Updates/ReleaseSignature.cs

@@ -1,7 +1,7 @@
 using System.Security.Cryptography;
 using System.Text;
 
-namespace MoShiro.Backend.Api;
+namespace MoShiro.Backend.Application;
 
 /// <summary>
 /// 发布清单的签名校验：用 Backend 内嵌的 CI 发布公钥（<c>packaging/update/release-key.pub.pem</c>）验 ECDSA P-256 / SHA-256（DER）签名，签名对象是清单的原始字节。

backend/src/MoShiro.Backend.Storage.Sqlite/Schema.cs

@@ -5,7 +5,7 @@ namespace MoShiro.Backend.Storage.Sqlite;
 /// <summary>表结构。版本记录在 <c>PRAGMA user_version</c>；以后的迁移是按版本号追加的内置 SQL。</summary>
 internal static class Schema
 {
-    public const int CurrentVersion = 13;
+    public const int CurrentVersion = 14;
 
     public static void Migrate(SqliteConnection connection)
     {
@@ -221,6 +221,26 @@ internal static class Schema
             connection.Exec("PRAGMA user_version = 13");
             transaction.Commit();
         }
+
+        if (version < 14)
+        {
+            // 节点的二进制绑定：第一次握手成功时绑定正在运行的二进制的 SHA-256
+            using SqliteTransaction transaction = connection.BeginTransaction();
+            connection.Exec(
+                """
+                CREATE TABLE node_bindings (
+                  node_id TEXT PRIMARY KEY,
+                  sha256 TEXT NOT NULL,
+                  seq INTEGER NOT NULL,
+                  signed INTEGER NOT NULL,
+                  bound_at INTEGER NOT NULL,
+                  violation TEXT,
+                  violation_at INTEGER
+                )
+                """);
+            connection.Exec("PRAGMA user_version = 14");
+            transaction.Commit();
+        }
     }
 
     /// <summary>

backend/src/MoShiro.Backend.Storage.Sqlite/SqliteNodeBindingStore.cs

@@ -0,0 +1,35 @@
+using MoShiro.Backend.Application;
+
+namespace MoShiro.Backend.Storage.Sqlite;
+
+public sealed class SqliteNodeBindingStore : INodeBindingStore
+{
+    private const string Columns = "node_id, sha256, seq, signed, bound_at, violation, violation_at";
+
+    private readonly SqliteDatabase _db;
+
+    public SqliteNodeBindingStore(SqliteDatabase db)
+    {
+        _db = db;
+    }
+
+    public ValueTask<NodeBinding?> GetAsync(string nodeId, CancellationToken ct) =>
+        _db.ReadAsync<NodeBinding?>(c => c.QueryOne($"SELECT {Columns} FROM node_bindings WHERE node_id = @id", Read, ("@id", nodeId)), ct);
+
+    public ValueTask<IReadOnlyList<NodeBinding>> ListAsync(CancellationToken ct) =>
+        _db.ReadAsync<IReadOnlyList<NodeBinding>>(c => c.Query($"SELECT {Columns} FROM node_bindings ORDER BY node_id", Read), ct);
+
+    public async ValueTask UpsertAsync(NodeBinding binding, CancellationToken ct) =>
+        await _db.WriteAsync(
+            c => c.Exec(
+                $"INSERT INTO node_bindings ({Columns}) VALUES (@id, @sha, @seq, @signed, @at, @violation, @violation_at) "
+                + "ON CONFLICT(node_id) DO UPDATE SET sha256 = excluded.sha256, seq = excluded.seq, signed = excluded.signed, bound_at = excluded.bound_at, violation = excluded.violation, violation_at = excluded.violation_at",
+                ("@id", binding.NodeId), ("@sha", binding.Sha256), ("@seq", binding.Seq), ("@signed", binding.Signed ? 1 : 0), ("@at", binding.BoundAtMs), ("@violation", binding.Violation), ("@violation_at", binding.ViolationAtMs)),
+            ct);
+
+    public ValueTask<bool> DeleteAsync(string nodeId, CancellationToken ct) =>
+        _db.WriteAsync(c => c.Exec("DELETE FROM node_bindings WHERE node_id = @id", ("@id", nodeId)) > 0, ct);
+
+    private static NodeBinding Read(Microsoft.Data.Sqlite.SqliteDataReader r) =>
+        new(r.GetString(0), r.GetString(1), r.GetInt64(2), r.GetInt64(3) != 0, r.GetInt64(4), r.NullableString(5), r.NullableLong(6));
+}

backend/src/MoShiro.Backend.Storage.Sqlite/StorageServiceCollectionExtensions.cs

@@ -24,6 +24,7 @@ public static class StorageServiceCollectionExtensions
         services.AddSingleton<IAuthStore, SqliteAuthStore>();
         services.AddSingleton<IAuditStore, SqliteAuditStore>();
         services.AddSingleton<IOperatorSetStore, SqliteOperatorSetStore>();
+        services.AddSingleton<INodeBindingStore, SqliteNodeBindingStore>();
         services.AddSingleton<IRawStore, SqliteRawStore>();
         services.AddSingleton<IMetricStore, SqliteMetricStore>();
         services.AddSingleton<IStorageHealth, SqliteStorageHealth>();

backend/tests/MoShiro.Backend.Tests/BinaryBindingTests.cs

@@ -0,0 +1,267 @@
+using System.Net;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json.Nodes;
+using Fleet.Core;
+using Fleet.Server;
+using MoShiro.Backend.Application;
+using MoShiro.Protocol;
+
+namespace MoShiro.Backend.Tests;
+
+/// <summary>
+/// 节点二进制绑定：第一次握手成功的那一刻绑定正在运行的二进制的哈希，之后对不上又不在 CI 签名的更新清单里，就不让它继续运行。
+/// 官方哈希集合来自 CI 签名的清单（节点握手时带着），所以被攻破的 Backend 伪造不了，也不依赖面板有没有收到过这次发布。
+/// </summary>
+public sealed class BinaryBindingTests : IDisposable
+{
+    private const string A = "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1";
+    private const string B = "b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2";
+    private const string C = "c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3";
+
+    private readonly ECDsa _ci = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+    private readonly ECDsa _other = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+    private readonly MemoryStore _store = new();
+    private readonly NodeRecord _agent = Node(AgentIds.Prefix + "_test1");
+
+    public void Dispose()
+    {
+        _ci.Dispose();
+        _other.Dispose();
+    }
+
+    private static string Hash(string seed) => seed[..2] + new string(seed[1], 62);
+
+    private static NodeRecord Node(string id) => new(new NodeId(id), "n", NodeStatus.Active, [1], [2], [], null, null, 0, null);
+
+    private BinaryBindingService Service(string policy = "enforce") =>
+        new(_store, new TestKey(_ci), new BackendOptions { BinaryPolicy = policy }, TimeProvider.System);
+
+    private sealed class TestKey(ECDsa key) : IReleaseKey
+    {
+        public string Pem => key.ExportSubjectPublicKeyInfoPem();
+    }
+
+    private static string Sign(ECDsa key, string manifest) =>
+        Convert.ToBase64String(key.SignData(Encoding.UTF8.GetBytes(manifest), HashAlgorithmName.SHA256, DSASignatureFormat.Rfc3279DerSequence));
+
+    /// <summary>节点握手时带的证据：哈希，加上（可选）某把密钥签名的清单。</summary>
+    private BinaryEvidence Evidence(string hash, long? seq = null, string[]? binaries = null, string component = "agent", ECDsa? signer = null)
+    {
+        if (seq is null)
+        {
+            return new BinaryEvidence(hash, null, null);
+        }
+
+        string manifest = $"{{\"schema\":1,\"component\":\"{component}\",\"seq\":{seq},\"binaries\":\"{string.Join(',', binaries ?? [hash])}\"}}";
+        return new BinaryEvidence(hash, manifest, Sign(signer ?? _ci, manifest));
+    }
+
+    private static string H(char c) => new(c, 64);
+
+    [Fact]
+    public async Task TheFirstHandshakeBinds_AndTheSameBinaryKeepsWorking()
+    {
+        BinaryBindingService service = Service();
+
+        Assert.True((await service.CheckAsync(_agent, Evidence(H('a')), default)).Accept);
+        Assert.Equal(H('a'), (await _store.GetAsync(_agent.Id.Value, default))!.Sha256);
+        Assert.True((await service.CheckAsync(_agent, Evidence(H('a')), default)).Accept);
+    }
+
+    [Fact]
+    public async Task AReplacedBinary_IsRefused_AndTheReasonIsKept()
+    {
+        BinaryBindingService service = Service();
+        await service.CheckAsync(_agent, Evidence(H('a')), default);
+
+        BinaryDecision decision = await service.CheckAsync(_agent, Evidence(H('b')), default);
+
+        Assert.False(decision.Accept);
+        Assert.Contains("changed", decision.Reason, StringComparison.Ordinal);
+        NodeBinding bound = (await _store.GetAsync(_agent.Id.Value, default))!;
+        Assert.Equal(H('a'), bound.Sha256); // 绑定不会因为一次不符而被改写
+        Assert.NotNull(bound.Violation);
+
+        // 原来的二进制回来了：恢复，原因清掉
+        Assert.True((await service.CheckAsync(_agent, Evidence(H('a')), default)).Accept);
+        Assert.Null((await _store.GetAsync(_agent.Id.Value, default))!.Violation);
+    }
+
+    [Fact]
+    public async Task AnUpgrade_NeedsACiSignedManifestThatListsTheNewBinary()
+    {
+        BinaryBindingService service = Service();
+        await service.CheckAsync(_agent, Evidence(H('a'), seq: 100, binaries: [H('a')]), default);
+
+        // 新二进制在一份更新的 CI 签名清单里：合法升级，绑定跟着改
+        Assert.True((await service.CheckAsync(_agent, Evidence(H('b'), seq: 200, binaries: [H('b')]), default)).Accept);
+        NodeBinding upgraded = (await _store.GetAsync(_agent.Id.Value, default))!;
+        Assert.Equal(H('b'), upgraded.Sha256);
+        Assert.Equal(200, upgraded.Seq);
+        Assert.True(upgraded.Signed);
+
+        // 退回旧版本（清单 seq 更低）：降级，拒绝
+        Assert.False((await service.CheckAsync(_agent, Evidence(H('a'), seq: 100, binaries: [H('a')]), default)).Accept);
+        // 同一份清单里的另一个官方二进制（比如另一个平台的构建）不算降级
+        Assert.True((await service.CheckAsync(_agent, Evidence(H('c'), seq: 200, binaries: [H('b'), H('c')]), default)).Accept);
+    }
+
+    [Fact]
+    public async Task AManifestSignedByAnotherKey_OrForAnotherComponent_ProvesNothing()
+    {
+        BinaryBindingService service = Service();
+        await service.CheckAsync(_agent, Evidence(H('a')), default);
+
+        Assert.False((await service.CheckAsync(_agent, Evidence(H('b'), seq: 500, binaries: [H('b')], signer: _other), default)).Accept);
+        Assert.False((await service.CheckAsync(_agent, Evidence(H('b'), seq: 500, binaries: [H('b')], component: "probe"), default)).Accept);
+        Assert.Equal(H('a'), (await _store.GetAsync(_agent.Id.Value, default))!.Sha256);
+    }
+
+    [Fact]
+    public async Task ASignedManifestThatDoesNotListTheRunningBinary_IsRefusedAtTheFirstHandshake()
+    {
+        BinaryBindingService service = Service();
+
+        BinaryDecision decision = await service.CheckAsync(_agent, Evidence(H('a'), seq: 100, binaries: [H('b')]), default);
+
+        Assert.False(decision.Accept);
+        Assert.Null(await _store.GetAsync(_agent.Id.Value, default));
+    }
+
+    [Fact]
+    public async Task AnUnsignedBinding_BecomesSignedWhenTheManifestArrivesLater()
+    {
+        // 容器节点第一次握手时更新器可能还没写出清单：先按首次握手绑定，清单到了再标成已签名
+        BinaryBindingService service = Service();
+        await service.CheckAsync(_agent, Evidence(H('a')), default);
+        Assert.False((await _store.GetAsync(_agent.Id.Value, default))!.Signed);
+
+        Assert.True((await service.CheckAsync(_agent, Evidence(H('a'), seq: 100, binaries: [H('a')]), default)).Accept);
+
+        NodeBinding bound = (await _store.GetAsync(_agent.Id.Value, default))!;
+        Assert.True(bound.Signed);
+        Assert.Equal(100, bound.Seq);
+    }
+
+    [Fact]
+    public async Task ALegacyNode_IsTolerated_ButCannotGoBackOnceBound()
+    {
+        BinaryBindingService service = Service();
+        NodeRecord legacy = Node(ProbeId.Prefix + "_old");
+
+        Assert.True((await service.CheckAsync(legacy, new BinaryEvidence(null, null, null), default)).Accept);
+        Assert.Null(await _store.GetAsync(legacy.Id.Value, default));
+
+        await service.CheckAsync(_agent, Evidence(H('a')), default);
+        Assert.False((await service.CheckAsync(_agent, new BinaryEvidence(null, null, null), default)).Accept); // 绑定过的不许退回不上报
+    }
+
+    [Fact]
+    public async Task MalformedHashes_AreRefused()
+    {
+        BinaryBindingService service = Service();
+
+        Assert.False((await service.CheckAsync(_agent, new BinaryEvidence("not-a-hash", null, null), default)).Accept);
+        Assert.False((await service.CheckAsync(_agent, new BinaryEvidence(new string('A', 64), null, null), default)).Accept); // 要小写十六进制
+        Assert.Null(await _store.GetAsync(_agent.Id.Value, default));
+    }
+
+    [Fact]
+    public async Task TheAdministratorCanAcceptANewBinary_ByClearingTheBinding()
+    {
+        BinaryBindingService service = Service();
+        await service.CheckAsync(_agent, Evidence(H('a')), default);
+        Assert.False((await service.CheckAsync(_agent, Evidence(H('b')), default)).Accept);
+
+        Assert.True(await service.ClearAsync(_agent.Id.Value, default));
+
+        Assert.True((await service.CheckAsync(_agent, Evidence(H('b')), default)).Accept);
+        Assert.Equal(H('b'), (await _store.GetAsync(_agent.Id.Value, default))!.Sha256);
+    }
+
+    [Fact]
+    public async Task WarnRecordsButDoesNotRefuse_AndOffDoesNothing()
+    {
+        BinaryBindingService warn = Service("warn");
+        await warn.CheckAsync(_agent, Evidence(H('a')), default);
+        BinaryDecision decision = await warn.CheckAsync(_agent, Evidence(H('b')), default);
+        Assert.True(decision.Accept);
+        Assert.NotNull((await _store.GetAsync(_agent.Id.Value, default))!.Violation);
+
+        BinaryBindingService off = Service("off");
+        NodeRecord other = Node(AgentIds.Prefix + "_test2");
+        Assert.True((await off.CheckAsync(other, Evidence(H('a')), default)).Accept);
+        Assert.Null(await _store.GetAsync(other.Id.Value, default));
+    }
+
+    [Fact]
+    public async Task EachNodeHasItsOwnBinding()
+    {
+        BinaryBindingService service = Service();
+        NodeRecord second = Node(AgentIds.Prefix + "_test3");
+
+        await service.CheckAsync(_agent, Evidence(H('a')), default);
+        await service.CheckAsync(second, Evidence(H('b')), default);
+
+        Assert.False((await service.CheckAsync(_agent, Evidence(H('b')), default)).Accept); // 别的节点的二进制，不是自己绑定的
+        Assert.True((await service.CheckAsync(second, Evidence(H('b')), default)).Accept);
+    }
+
+    private sealed class MemoryStore : INodeBindingStore
+    {
+        private readonly Dictionary<string, NodeBinding> _rows = [];
+
+        public ValueTask<NodeBinding?> GetAsync(string nodeId, CancellationToken ct) => new(_rows.GetValueOrDefault(nodeId));
+
+        public ValueTask<IReadOnlyList<NodeBinding>> ListAsync(CancellationToken ct) => new([.. _rows.Values]);
+
+        public ValueTask UpsertAsync(NodeBinding binding, CancellationToken ct)
+        {
+            _rows[binding.NodeId] = binding;
+            return ValueTask.CompletedTask;
+        }
+
+        public ValueTask<bool> DeleteAsync(string nodeId, CancellationToken ct) => new(_rows.Remove(nodeId));
+    }
+}
+
+/// <summary>真实的 Agent 在进程里连上 Backend：第一次握手就绑定了它正在运行的二进制，管理端看得到，也可以清除。</summary>
+[Collection("probe-e2e")]
+public sealed class BinaryBindingEndToEndTests
+{
+    private readonly BackendFixture _backend;
+
+    public BinaryBindingEndToEndTests(BackendFixture backend)
+    {
+        _backend = backend;
+    }
+
+    [Fact]
+    public async Task ARealAgent_IsBoundOnItsFirstHandshake_AndTheAdministratorCanClearIt()
+    {
+        await using AgentHarness agent = await AgentHarness.StartAsync(_backend);
+        string? expected = NodeBinary.Sha256Hex;
+        Assert.NotNull(expected);
+
+        JsonNode? binary = null;
+        await BackendFixture.EventuallyAsync(
+            async () =>
+            {
+                JsonNode info = await _backend.GetJsonAsync(_backend.Admin, "/api/admin/build-info");
+                binary = info["nodes"]!.AsArray().FirstOrDefault(n => n!["id"]!.GetValue<string>() == agent.Id)?["binary"];
+                return binary is not null;
+            },
+            TimeSpan.FromSeconds(30),
+            "the agent is bound on its first handshake");
+
+        Assert.Equal(expected, binary!["sha256"]!.GetValue<string>());
+        Assert.False(binary["signed"]!.GetValue<bool>()); // 测试里的 Agent 没有更新器，也就没有 CI 签名的清单
+        Assert.Null(binary["violation"]);
+
+        using HttpResponseMessage cleared = await _backend.Admin.DeleteAsync("/api/admin/nodes/" + agent.Id + "/binary");
+        Assert.Equal(HttpStatusCode.NoContent, cleared.StatusCode);
+        JsonNode after = await _backend.GetJsonAsync(_backend.Admin, "/api/admin/build-info");
+        Assert.Null(after["nodes"]!.AsArray().First(n => n!["id"]!.GetValue<string>() == agent.Id)!["binary"]);
+    }
+}

backend/tests/MoShiro.Backend.Tests/ReleaseOfferTests.cs

@@ -3,6 +3,7 @@ using System.Security.Cryptography;
 using System.Text;
 using System.Text.Json.Nodes;
 using MoShiro.Backend.Api;
+using MoShiro.Backend.Application;
 
 namespace MoShiro.Backend.Tests;