8 Commits

Include renames

Author	SHA1	Message	Date
justme	5822285a88	fleet: require a minimum version of the peer at the handshake [CI] ... MoShiro__MinAgentVersion makes the backend refuse agents below it at hello (fleet_version_required); fleet.min_server_version or MOSHIRO_MIN_SERVER_VERSION makes the agent drop a backend below it. Either side waits five seconds and shakes hands again, because the other one may be updating.	2026-10-22 05:28:29 +08:00
justme	ad5efc62ff	agent: unify listening and dialing with directed mutual measurements ... Replace Probe with Agent across node runtime, Fleet contracts, backend state, API and storage. Report incoming sessions and outgoing link health through each Agent uplink, and retain directed link controls and retry. Update protocol fixtures and end-to-end coverage for the unified model; accept requested cancellation during the Fleet timeout test cleanup.	2026-10-21 11:55:36 +08:00
justme	0d532caf08	fix(nodes): locate agents behind a proxy and retry missing countries [CI]	2026-10-18 00:06:39 +08:00
justme	904ea2b0ae	refactor: remove the runtime binary binding; every release registration path verifies the CI signature [CI] ... The hash a node reports about itself cannot be trusted (a swapped binary can copy the old hash), so the runtime binding only caught files that were replaced by something that did not lie. Provenance stays where it can be verified: the signed release manifest (digest) and the signed SHA256SUMS. - Remove BinaryBindingService, the node_bindings table (schema v15 drops it), BinaryPolicy, the handshake hash/manifest fields and the admin binary column. - Drop the per-platform "binaries" list from the release manifest, the hash scripts and the updater's installed.manifest copy. - ReleaseService.PublishAsync now verifies the release signature, so the admin POST /releases route is no longer an unsigned path; tests sign with a test key. - Docs: section 16 explains why the runtime check is gone.	2026-10-08 18:30:05 +08:00
justme	4841f7b15b	feat: bind each node to the binary it runs at its first handshake; refuse changes that are not in a CI-signed manifest [CI]	2026-10-08 05:39:13 +08:00
justme	a2f88a344b	feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity ... Join codes need no passkey touch and carry only public values (genesis fingerprint, owner credentials, installer hashes). Nodes pin the genesis and owners at enrollment and only follow passkey-signed operator set versions. The panel's server key is listed in the set; pinned nodes require its signature and run the control link under AES-256-GCM. Password sessions carry no capabilities. The updater adopts a next_key from a signed manifest. Bump version to 0.2.0. [CI SKIP]	2026-10-08 03:21:44 +08:00
justme	1ff847e45a	feat: declare every protocol method's direction and enforce it in the router; add the zero-trust design [CI] ... Methods, roles and binary channels are declared in one table per plane (node and peer). RpcRouter checks direction, kind and role when handlers are registered, when messages arrive (fleet_protocol_violation, disconnect after repeated violations) and before sending. NodeConnection is split by responsibility.	2026-10-07 16:17:02 +08:00
justme	26620707a0	chore: initial project import	2026-10-04 21:46:39 +08:00