feat!: probes link to the panel; signed release updates for container nodes [CI]

Probes connect to the panel directly and get the agent list as desired state.
CI signs the image digest of agent and probe releases, the panel forwards the
manifest, and a host updater verifies it with a local public key, pulls by
digest and rolls back when the new version is unhealthy.

backend/agent/src/Monitor.Agent/AgentApp.cs

@@ -25,6 +25,7 @@ public sealed class AgentApp : IDisposable
     private readonly TaskCompletionSource _ready = new(TaskCreationOptions.RunContinuationsAsynchronously);
     private readonly AgentAdmission _admission;
     private readonly Outbox _outbox = new(64 << 20);
+    private readonly UpdateBridge _update;
     private readonly BackendUplink _uplink;
     private readonly UdpMux _udp;
     private readonly TcpAcceptor _tcp;
@@ -34,8 +35,10 @@ public sealed class AgentApp : IDisposable
     private readonly TestRunner _tests;
     private readonly FleetLink _link;
 
-    public AgentApp(AgentConfig config, LoadedNodeIdentity identity, TimeProvider time, INodeLog log)
+    /// <param name="dataDirectory">配置目录（容器里的 <c>/etc/monitor</c>）：宿主机更新器和节点在这里交换清单、请求和状态。</param>
+    public AgentApp(AgentConfig config, LoadedNodeIdentity identity, string dataDirectory, TimeProvider time, INodeLog log)
     {
+        _update = new UpdateBridge(dataDirectory, new ConfigStore(dataDirectory).Write, log);
         _config = config;
         _identity = identity;
         _time = time;
@@ -200,6 +203,24 @@ public sealed class AgentApp : IDisposable
                 (_, cancel, _) => ValueTask.FromResult(Result<TestRunResult>.Ok(new TestRunResult { Accepted = _tests.Cancel(cancel.TestId) })));
         }
 
+        if (Allow(MonitorMethods.UpdateOffer))
+        {
+            router.OnNotify(MonitorMethods.UpdateOffer, MonitorJsonContext.Default.UpdateOfferParams, (_, offer, _) =>
+            {
+                _update.WriteOffer(offer);
+                return ValueTask.CompletedTask;
+            });
+        }
+
+        if (Allow(MonitorMethods.UpdateApply))
+        {
+            router.OnNotify(MonitorMethods.UpdateApply, MonitorJsonContext.Default.UpdateOfferParams, (_, _, _) =>
+            {
+                _update.RequestApply();
+                return ValueTask.CompletedTask;
+            });
+        }
+
         if (Allow(MonitorMethods.ProbeDisconnect))
         {
             router.On(
@@ -209,14 +230,6 @@ public sealed class AgentApp : IDisposable
                 async (_, request, _) => Result<TestRunResult>.Ok(new TestRunResult { Accepted = await _hub.DisconnectAsync(request.ProbeId.Value) }));
         }
 
-        if (Allow(MonitorMethods.ProbeAgentsChanged))
-        {
-            router.OnNotify(
-                MonitorMethods.ProbeAgentsChanged,
-                MonitorJsonContext.Default.ProbeAgentsResult,
-                (_, list, _) => _hub.RelayAgentsAsync(list));
-        }
-
         var options = new FleetLinkOptions
         {
             Server = new Uri(_config.Fleet.Server),
@@ -278,6 +291,7 @@ public sealed class AgentApp : IDisposable
             DroppedInvalid = _counters.DroppedInvalid,
             DroppedRateLimited = _counters.DroppedRateLimited,
             QueueBytes = _outbox.PendingBytes,
+            Update = _update.ReadStatus(),
         };
         _lastIn = packetsIn;
         _lastOut = packetsOut;

backend/agent/src/Monitor.Agent/DataPlane/Registries.cs

@@ -64,9 +64,6 @@ public sealed class ProbeSession : DataSession
 
     public long ConnectedAtUtcMs { get; init; }
 
-    /// <summary>Probe 自报的系统和架构（随列表同步一起来，只用于展示）；还没报过就是 null。</summary>
-    public PlatformInfo? Platform { get; set; }
-
     public RpcSession<PeerContext>? Rpc { get; set; }
 
     /// <summary>最近一次认证通过的 UDP 包的源地址（Agent 把单向数据发往这里）。</summary>

backend/agent/src/Monitor.Agent/Peer/PeerHub.cs

@@ -57,18 +57,6 @@ public sealed class BackendUplink
         await SafeAsync(() => session.NotifyAsync(MonitorMethods.TestStatus, parameters, MonitorJsonContext.Default.TestStatusParams, CancellationToken.None));
     }
 
-    /// <summary>代 Probe 向 Backend 取 Agent 列表（Probe 不认识 Backend）。链路断开时返回 fleet_node_offline。</summary>
-    public async ValueTask<Result<ProbeAgentsResult>> RequestProbeAgentsAsync(ProbeAgentsParams request, CancellationToken ct)
-    {
-        RpcSession<LinkContext>? session = _link?.CurrentSession;
-        if (session is null)
-        {
-            return Result<ProbeAgentsResult>.Fail(FleetErrors.NodeOffline, "the agent has no link to the backend");
-        }
-
-        return await session.RequestAsync(MonitorMethods.ProbeAgents, request, MonitorJsonContext.Default.ProbeAgentsParams, MonitorJsonContext.Default.ProbeAgentsResult, ct);
-    }
-
     private static async ValueTask SafeAsync(Func<ValueTask> send)
     {
         try
@@ -104,7 +92,7 @@ public sealed class PeerHub
 
     public PeerHub(SessionRegistry sessions, MonoClock clock, ChunkAssembler chunks, TaskManager tasks, BackendUplink uplink, TimeProvider time, INodeLog log)
     {
-        _router = BuildRouter(uplink);
+        _router = BuildRouter();
         _sessions = sessions;
         _clock = clock;
         _chunks = chunks;
@@ -220,7 +208,7 @@ public sealed class PeerHub
     /// <summary>当前连着的 Probe（心跳和 Backend 重连之后的补报都用它）。</summary>
     public IReadOnlyList<ConnectedProbe> ConnectedProbes() => [.. _sessions.All.Select(Describe)];
 
-    private static ConnectedProbe Describe(ProbeSession p) => new() { Id = new ProbeId(p.ProbeId), Version = p.Version, Remote = p.RemoteAddress, SinceUtcMs = p.ConnectedAtUtcMs, Platform = p.Platform };
+    private static ConnectedProbe Describe(ProbeSession p) => new() { Id = new ProbeId(p.ProbeId), Version = p.Version, Remote = p.RemoteAddress, SinceUtcMs = p.ConnectedAtUtcMs };
 
     public IReadOnlyList<string> ConnectedProbeIds() => [.. _sessions.All.Select(p => p.ProbeId)];
 
@@ -252,27 +240,6 @@ public sealed class PeerHub
         }
     }
 
-    /// <summary>Backend 的 Agent 列表变化时转交给所有 Probe（Probe 据此调整它连接的 Agent）。</summary>
-    public async ValueTask RelayAgentsAsync(ProbeAgentsResult list)
-    {
-        foreach (ProbeSession probe in _sessions.All)
-        {
-            if (probe.Rpc is not { } rpc)
-            {
-                continue;
-            }
-
-            try
-            {
-                await rpc.NotifyAsync(MonitorMethods.ProbeAgentsChanged, list, MonitorJsonContext.Default.ProbeAgentsResult, CancellationToken.None);
-            }
-            catch (Exception ex) when (ex is ObjectDisposedException or InvalidOperationException or IOException)
-            {
-                // 会话刚好结束
-            }
-        }
-    }
-
     private async ValueTask PushAsync(ProbeSession probe, LineTaskSet set, CancellationToken ct)
     {
         if (probe.Rpc is null)
@@ -300,21 +267,8 @@ public sealed class PeerHub
         }
     }
 
-    private static RpcRouter<PeerContext> BuildRouter(BackendUplink uplink) =>
+    private static RpcRouter<PeerContext> BuildRouter() =>
         new RpcRouter<PeerContext>()
-            .On(
-                MonitorMethods.ProbeAgents,
-                MonitorJsonContext.Default.ProbeAgentsParams,
-                MonitorJsonContext.Default.ProbeAgentsResult,
-                (context, request, ct) =>
-                {
-                    if (request.Platform is { } platform)
-                    {
-                        context.Session.Platform = platform;
-                    }
-
-                    return uplink.RequestProbeAgentsAsync(request, ct);
-                })
             .On(
                 MonitorMethods.Clock,
                 MonitorJsonContext.Default.ClockParams,

backend/agent/src/Monitor.Agent/Program.cs

@@ -35,7 +35,7 @@ catch (Exception ex) when (ex is IOException or InvalidDataException or InvalidO
 
 using (identity)
 {
-    using var app = new AgentApp(config, identity, time, log);
+    using var app = new AgentApp(config, identity, Path.GetDirectoryName(Path.GetFullPath(configPath))!, time, log);
     await ServiceShell.RunAsync(app.RunAsync, log);
 }