feat: pinned agents and probes only accept peers carrying the operator's proof; the panel ships the signed operator chain with the rosters [CI SKIP]

backend/agent/src/MoShiro.Agent/AgentApp.cs

@@ -81,7 +81,7 @@ public sealed class AgentApp : IDisposable
         };
         var chunks = new ChunkAssembler(_streams, _clock, _counters, _outbox, identity.NodeId, time, log);
         var targets = new TargetRunners(chunks, identity.NodeId, _clock, time, log);
-        _tasks = new TaskManager(CreateGuard, _streams, env, targets, () => _udp.BoundPorts, () => _tcp.BoundPorts);
+        _tasks = new TaskManager(CreateGuard, _streams, env, targets, () => _udp.BoundPorts, () => _tcp.BoundPorts, TrustAnchor.Load(config.Fleet.IdentityDir, log));
         _hub = new PeerHub(_sessions, _clock, chunks, _tasks, _uplink, time, log);
         _tests = new TestRunner(_tasks, _sessions, _streams, env, _uplink, config.Limits.MaxConcurrentTests, transport => transport == "udp" ? _udp.BoundPorts : _tcp.BoundPorts, time, log);
 

backend/agent/src/MoShiro.Agent/Tasks/TaskManager.cs

@@ -1,4 +1,6 @@
 using System.Text.Json;
+using Fleet.Hosting;
+using Fleet.Identity;
 using Fleet.Core;
 using Fleet.Rpc;
 using MoShiro.Measurement;
@@ -25,14 +27,16 @@ public sealed class TaskManager
     private readonly TargetRunners _targets;
     private readonly Func<IReadOnlyList<int>> _udpPorts;
     private readonly Func<IReadOnlyList<int>> _tcpPorts;
+    private readonly TrustAnchor _trust;
     private readonly Dictionary<ProbeSession, Dictionary<string, LineEntry>> _sessionLines = [];
     private volatile Dictionary<string, byte[]> _peers = new(StringComparer.Ordinal);
     private Dictionary<string, (TaskSpec Task, TaskDecision Decision)> _lineSpecs = [];
     private long _version;
     private BudgetGuard? _guard;
 
-    public TaskManager(Func<BudgetGuard> guardFactory, StreamRegistry streams, BlockEnv env, TargetRunners targets, Func<IReadOnlyList<int>> udpPorts, Func<IReadOnlyList<int>> tcpPorts)
+    public TaskManager(Func<BudgetGuard> guardFactory, StreamRegistry streams, BlockEnv env, TargetRunners targets, Func<IReadOnlyList<int>> udpPorts, Func<IReadOnlyList<int>> tcpPorts, TrustAnchor? trust = null)
     {
+        _trust = trust ?? TrustAnchor.None;
         _guardFactory = guardFactory;
         _streams = streams;
         _env = env;
@@ -98,12 +102,22 @@ public sealed class TaskManager
         _ = ct;
         var result = new StateSyncResult { AppliedVersion = version };
 
+        // 固定了操作员创世的节点：先验面板带来的操作员集合链（从固定的创世出发），再要求每个 Probe 带着操作员批准的证明。
+        // 面板自己改名册、塞进自己的 Probe 公钥是过不了这一关的：它签不出操作员的委托。
+        _trust.Update(set.TrustChain);
         var peers = new Dictionary<string, byte[]>(StringComparer.Ordinal);
         foreach (PeerSpec peer in set.Peers)
         {
             try
             {
-                peers[peer.ProbeId.Value] = Convert.FromBase64String(peer.PublicKey);
+                byte[] key = Convert.FromBase64String(peer.PublicKey);
+                if (_trust.VerifyPeer(peer.Proof, key, "probe") != TrustFailure.None)
+                {
+                    result.Rejected.Add(new RejectedItem { Id = peer.ProbeId.Value, Reason = RejectReasons.PolicyDenied });
+                    continue;
+                }
+
+                peers[peer.ProbeId.Value] = key;
             }
             catch (FormatException)
             {