9 Commits

Include renames

Author	SHA1	Message	Date
justme	238046d959	test(backend): parallelize isolated fixtures [CI] [SKIP TESTS]	2026-10-10 04:54:18 +08:00
justme	e014a19554	docs: reorganize into design, security, api, ops and dev; drop stale designs; refresh the diagrams [CI] ... - Group docs by category with an index (docs/README.md); fix every link, code comment and the protocol conformance test that read docs/protocol.md. - access.md and security.md rewritten to what is implemented: removed the unadopted member-proof chain, roles and recovery key that do not exist, the old implementation order and the budgets; gaps now carry a status. - enrollment, deployment, api: the install flow is the static, hash-checked script with environment variables; no default admin. - README and architecture: new topology and update-flow diagrams (operator passkey, CI signing, registry feed, auth and trust modules).	2026-10-08 19:37:56 +08:00
justme	4a1e48db20	test: share one operator and trust root across the trust tests; make the setup test cleanup best-effort [CI SKIP]	2026-10-08 15:30:12 +08:00
justme	f22fdf8b68	feat: first-run claim wizard (no default admin, claim code from the backend log); owner list shows account and passkey; container install first [CI]	2026-10-08 06:47:10 +08:00
justme	2ae63653c4	feat: the node itself requires an owner passkey (shared by agent and probe) and reports it; the panel derives the account and passkey it is bound to [CI]	2026-10-08 06:15:07 +08:00
justme	4106f831dc	feat!: drop the backend-side elevation windows; password and passkey sessions share capabilities, passkeys guard what nodes verify; the trust page lists added and removed passkeys [CI]	2026-10-08 04:57:28 +08:00
justme	a2f88a344b	feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity ... Join codes need no passkey touch and carry only public values (genesis fingerprint, owner credentials, installer hashes). Nodes pin the genesis and owners at enrollment and only follow passkey-signed operator set versions. The panel's server key is listed in the set; pinned nodes require its signature and run the control link under AES-256-GCM. Password sessions carry no capabilities. The updater adopts a next_key from a signed manifest. Bump version to 0.2.0. [CI SKIP]	2026-10-08 03:21:44 +08:00
justme	9bb6841dce	feat: pinned agents and probes only accept peers carrying the operator's proof; the panel ships the signed operator chain with the rosters [CI SKIP]	2026-10-07 23:24:33 +08:00
justme	fc2bbdcc6d	feat: operator trust root: passkey-signed operator set, signed join codes, nodes verify and pin the chain at enrollment [CI SKIP]	2026-10-07 23:19:59 +08:00