7 Commits

Include renames

Author	SHA1	Message	Date
justme	ad5efc62ff	agent: unify listening and dialing with directed mutual measurements ... Replace Probe with Agent across node runtime, Fleet contracts, backend state, API and storage. Report incoming sessions and outgoing link health through each Agent uplink, and retain directed link controls and retry. Update protocol fixtures and end-to-end coverage for the unified model; accept requested cancellation during the Fleet timeout test cleanup.	2026-10-21 11:55:36 +08:00
justme	238046d959	test(backend): parallelize isolated fixtures [CI] [SKIP TESTS]	2026-10-10 04:54:18 +08:00
justme	0f8f3f9a54	feat: trusted release keys setting; drop the duplicate release registration route [CI] ... The panel now lets the deployer decide which release keys it trusts. The official CI key is built in and always trusted; an own P-256 public key can be added (off by default, the private key is rejected) so manifests signed with it are accepted too. Removing it drops the manifests only it signed. Changes are audited and need update.confirm. Admin UI: System > Trust > "Trusted release keys" with a collapsible guide on generating a key pair and signing a manifest with openssl. Registration now has one path, POST /api/release/offer (no token, signature verified). The admin POST /releases route, the release.publish capability and the ci-release preset are removed.	2026-10-08 18:50:16 +08:00
justme	904ea2b0ae	refactor: remove the runtime binary binding; every release registration path verifies the CI signature [CI] ... The hash a node reports about itself cannot be trusted (a swapped binary can copy the old hash), so the runtime binding only caught files that were replaced by something that did not lie. Provenance stays where it can be verified: the signed release manifest (digest) and the signed SHA256SUMS. - Remove BinaryBindingService, the node_bindings table (schema v15 drops it), BinaryPolicy, the handshake hash/manifest fields and the admin binary column. - Drop the per-platform "binaries" list from the release manifest, the hash scripts and the updater's installed.manifest copy. - ReleaseService.PublishAsync now verifies the release signature, so the admin POST /releases route is no longer an unsigned path; tests sign with a test key. - Docs: section 16 explains why the runtime check is gone.	2026-10-08 18:30:05 +08:00
justme	ddb6608e32	feat!: capabilities replace API token scopes; every admin endpoint declares one, with a picker UI [CI]	2026-10-07 20:56:36 +08:00
justme	84f9d211bc	backend: require confirmation for signed channel updates [CI]	2026-10-07 12:57:20 +08:00
justme	2e146d4da7	refactor!: rename the project from Monitor to MoShiro [CI] ... Namespaces, assemblies, solution, binaries, images, systemd units, config paths, environment variables, protocol methods and the Linux user are all renamed. Breaking: existing databases, node identities and installed units must be recreated.	2026-10-07 02:03:25 +08:00