Merge branch 'main' into dev

ci: all-platform node binaries in the signed release manifest; signed SHA256SUMS for the archives; web build once before the parallel backend builds; release 0.3.3 [CI SKIP]
2026-10-08 16:26:33 +08:00 · 2026-10-08 16:26:29 +08:00 · 2026-10-08 16:13:02 +08:00 · 2026-10-08 16:12:59 +08:00 · 2026-10-08 16:05:42 +08:00 · 2026-10-08 16:05:38 +08:00
500 changed files with 30878 additions and 5726 deletions
@@ -0,0 +1,9 @@
+ci/build-main-amd64.sh text eol=lf
+ci/index-backend-image.sh text eol=lf
+ci/publish-release-offer.sh text eol=lf
+ci/release-linux.sh text eol=lf
+packaging/update/*.sh text eol=lf
+packaging/container/*.sh text eol=lf
+ci/release-node-images.sh text eol=lf
+packaging/install/*.sh text eol=lf
+packaging/install/*.ps1 text eol=lf
@@ -17,11 +17,32 @@ depends_on:
  - windows-release

 steps:
+  - name: publish-agent-probe-oci
+    image: bash
+    environment:
+      GITEA_BASE: http://127.0.0.1:3100
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      ZOT_REGISTRY: registry.oeo.one
+      ZOT_USERNAME: justme
+      ZOT_SECRET:
+        from_secret: zot_secret
+      RELEASE_API_URL: https://mo.oeo.one
+      RELEASE_SIGNING_KEY:
+        from_secret: release_signing_key
+    commands:
+      - bash ci/release-node-images.sh
+    depends_on: []
+
  - name: publish-gitea-release
    image: bash
    environment:
      GITEA_BASE: http://127.0.0.1:3100
      GITEA_TOKEN:
        from_secret: gitea_token
+      RELEASE_SIGNING_KEY:
+        from_secret: release_signing_key
    commands:
      - bash ci/publish-gitea-release.sh
+    depends_on:
+      - publish-agent-probe-oci
@@ -15,6 +15,17 @@ when:
 concurrency: 1

 steps:
+  # 前端先打包好（几十秒），两个架构的 Backend 构建再并行：它们把 web/*/dist 内嵌进程序，只读这份产物，不再各自 npm ci
+  # （并行的两个 npm ci 会同时删 node_modules，互相搞坏）。步骤加了超时：卡住就几分钟内失败，不是耗着。
+  - name: web-build
+    image: bash
+    environment:
+      NPM_CONFIG_CACHE: /home/justme/.npm
+    commands:
+      - npm ci --prefix web --prefer-offline
+      - timeout 600 npm run build --prefix web
+    depends_on: []
+
  - name: linux-amd64-backend
    image: bash
    environment:
@@ -25,7 +36,8 @@ steps:
        from_secret: zot_secret
    commands:
      - bash ci/release-linux.sh amd64 backend
-    depends_on: []
+    depends_on:
+      - web-build

  - name: linux-arm64-backend
    image: bash
@@ -37,7 +49,8 @@ steps:
        from_secret: zot_secret
    commands:
      - bash ci/release-linux.sh arm64 backend
-    depends_on: []
+    depends_on:
+      - web-build

  - name: backend-multiarch-index
    image: bash
@@ -47,6 +60,9 @@ steps:
      ZOT_USERNAME: justme
      ZOT_SECRET:
        from_secret: zot_secret
+      RELEASE_API_URL: https://mo.oeo.one
+      RELEASE_SIGNING_KEY:
+        from_secret: release_signing_key
    commands:
      - bash ci/index-backend-image.sh
    depends_on:
@@ -0,0 +1,62 @@
+labels:
+  ci: domain-linux-native
+  platform: linux/amd64
+
+clone:
+  - name: git
+    image: plugin-git
+    settings:
+      lfs: false
+
+when:
+  - event: push
+    branch: main
+    evaluate: 'CI_COMMIT_MESSAGE contains "[CI]"'
+
+concurrency: 1
+
+steps:
+  - name: build-linux-amd64-backend
+    image: bash
+    environment:
+      NUGET_PACKAGES: /home/justme/.nuget/packages
+      ZOT_REGISTRY: registry.oeo.one
+      ZOT_USERNAME: justme
+      ZOT_SECRET:
+        from_secret: zot_secret
+      RELEASE_API_URL: https://mo.oeo.one
+      RELEASE_SIGNING_KEY:
+        from_secret: release_signing_key
+    commands:
+      - bash ci/build-main-amd64.sh backend
+    depends_on: []
+
+  - name: build-linux-amd64-agent
+    image: bash
+    environment:
+      NUGET_PACKAGES: /home/justme/.nuget/packages
+      ZOT_REGISTRY: registry.oeo.one
+      ZOT_USERNAME: justme
+      ZOT_SECRET:
+        from_secret: zot_secret
+      RELEASE_API_URL: https://mo.oeo.one
+      RELEASE_SIGNING_KEY:
+        from_secret: release_signing_key
+    commands:
+      - bash ci/build-main-amd64.sh agent
+    depends_on: []
+
+  - name: build-linux-amd64-probe
+    image: bash
+    environment:
+      NUGET_PACKAGES: /home/justme/.nuget/packages
+      ZOT_REGISTRY: registry.oeo.one
+      ZOT_USERNAME: justme
+      ZOT_SECRET:
+        from_secret: zot_secret
+      RELEASE_API_URL: https://mo.oeo.one
+      RELEASE_SIGNING_KEY:
+        from_secret: release_signing_key
+    commands:
+      - bash ci/build-main-amd64.sh probe
+    depends_on: []
@@ -9,22 +9,18 @@ clone:
      lfs: false

 when:
-  - event: [push, pull_request]
+  - event: pull_request
+  - event: push
+    branch: dev

+# On Gitea PR events, CI_COMMIT_MESSAGE is the PR title.
 steps:
  - name: backend-tests
    image: bash
+    # [SKIP TESTS] omits Backend tests only; web-build remains a dependent workflow.
+    when:
+      - evaluate: 'not (CI_COMMIT_MESSAGE contains "[SKIP TESTS]")'
    environment:
      NUGET_PACKAGES: /home/justme/.nuget/packages
    commands:
-      - cd backend && dotnet test --solution Monitor.slnx -c Release
-
-  - name: web-build
-    image: bash
-    environment:
-      NPM_CONFIG_CACHE: /home/justme/.npm
-    commands:
-      - npm ci --prefix web --prefer-offline
-      - npm run build --prefix web
-      - npm run lint:css --prefix web
-    depends_on: []
+      - cd backend && dotnet test --solution MoShiro.slnx -c Release
@@ -0,0 +1,27 @@
+labels:
+  ci: domain-linux-native
+  platform: linux/amd64
+
+clone:
+  - name: git
+    image: plugin-git
+    settings:
+      lfs: false
+
+when:
+  - event: pull_request
+  - event: push
+    branch: dev
+
+depends_on:
+  - verify
+
+steps:
+  - name: web-build
+    image: bash
+    environment:
+      NPM_CONFIG_CACHE: /home/justme/.npm
+    commands:
+      - npm ci --prefix web --prefer-offline
+      - npm run build --prefix web
+      - npm run lint:css --prefix web
@@ -0,0 +1,43 @@
+# Agent Instructions
+
+## Project
+
+MoShiro is a self-hosted network path quality monitor. Backend coordinates Agents and Probes, stores measurements, and serves the REST/SSE API. `web/display` is the read-only overview; `web/admin` manages nodes, tests, and settings.
+
+## Branch and workspace safety
+
+- Treat `main` as the stable release branch and `dev` as the integration branch. Keep ordinary implementation work on `dev` or a feature branch; integrate into `main` through a pull request.
+- A push to `main` builds images only if its commit message contains `[CI]` (for a merged PR, put it in the PR or merge commit title). Without `[CI]` nothing is built; use `[CI SKIP]` to skip the pipeline entirely. When squashing or pushing to `main`, add `[CI]` unless a build is explicitly not wanted.
+- Before editing, inspect `git status`. Preserve pre-existing user changes: do not reset, clean, stash, or include unrelated files in a commit.
+- Do not commit credentials, API keys, registry passwords, or generated runtime data. CI credentials belong in Woodpecker secrets (`zot_secret`, `gitea_token`, `release_signing_key` for signing release manifests). CI registers the signed manifests at `/api/release/offer`, which needs no token because the panel verifies the signature. The release signing private key never goes into the repository or the panel; only the public key in `packaging/update/` does.
+- Keep development OCI images in the `moshiro-dev/` repository path and release images in `moshiro/`. Do not let a development build overwrite release tags such as `latest`.
+
+## Project layout
+
+- `backend/src/MoShiro.Backend/`: service entry point and composition.
+- `backend/src/MoShiro.Backend.Api/`: REST endpoints, contracts, and OpenAPI.
+- `backend/agent/`, `backend/probe/`: node applications and their READMEs.
+- `backend/fleet/`, `backend/shared/`: reusable node framework, measurement engine, protocols, and data formats.
+- `web/display/`, `web/admin/`: Vite applications; `web/shared/`: API client, generated types, charts, and shared UI.
+- `packaging/`, `scripts/`, `.woodpecker/`, `docs/`: container/package builds, CI workflows, and project documentation.
+
+## Local development and builds
+
+Requirements: .NET SDK 10 and Node.js/npm. The SDK selection is defined by the root `global.json`; NuGet package versions are centralized in the root `Directory.Packages.props`.
+
+- All .NET projects: `dotnet build MoShiro.slnx -c Release` from the repository root.
+- Backend build: `cd backend && dotnet build MoShiro.slnx -c Release`
+- Backend tests: `cd backend && dotnet test --solution MoShiro.slnx -c Release`
+- Frontend dependencies/build: `npm ci --prefix web && npm run build --prefix web`
+- Frontend style check: `npm run lint:css --prefix web`
+- Local backend: from `backend/`, run `dotnet run --project src/MoShiro.Backend -- --urls http://localhost:5000`.
+- Local web apps: from the repository root, run `npm ci --prefix web` then `npm run dev --prefix web`. The current dev config uses display port 5173 and admin port 5175; `/admin/` is proxied through the display server. Check the Vite configs when working on another branch because ports can differ.
+- After changing API contracts, regenerate/check `backend/openapi/v1.json` and run `npm run gen:api --prefix web` so frontend API types stay aligned.
+
+Follow the user's requested validation scope. Do not start a full tag/release build unless requested.
+
+## CI and releases
+
+CI triggers and image tags can change; inspect `.woodpecker/*.yml` and `docs/deployment.md` before changing or describing them. In particular, check the distinction between `[CI]` main builds, `[SKIP TESTS]`, and version-tag releases in the current branch.
+
+A version tag `vMAJOR.MINOR.PATCH` runs the full cross-platform release pipeline. Development image builds and releases must remain isolated in their respective Zot repository paths.
@@ -1,10 +1,15 @@
 <Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <!-- Native SQLite source is pinned separately from the JIT/test binary package. -->
+    <MoShiroSqliteSourceVersion>3530400</MoShiroSqliteSourceVersion>
+    <MoShiroSqliteSourceYear>2026</MoShiroSqliteSourceYear>
+    <MoShiroSqliteSourceSha256>1e71ddf93849c6a6ecf58b827c0692073d2dd7ee40196158068f7b29f422e87d</MoShiroSqliteSourceSha256>
  </PropertyGroup>
  <ItemGroup>
    <PackageVersion Include="Microsoft.CodeAnalysis.BannedApiAnalyzers" Version="5.6.0" />
    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.12" />
+    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="3.53.3" />
    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.12" />
    <PackageVersion Include="Microsoft.Extensions.ApiDescription.Server" Version="10.0.12" />
    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.0.0" />
@@ -0,0 +1,52 @@
+<Solution>
+  <Folder Name="/backend/fleet/src/">
+    <Project Path="backend/fleet/src/Fleet.Core/Fleet.Core.csproj" />
+    <Project Path="backend/fleet/src/Fleet.Enrollment.Client/Fleet.Enrollment.Client.csproj" />
+    <Project Path="backend/fleet/src/Fleet.Hosting/Fleet.Hosting.csproj" />
+    <Project Path="backend/fleet/src/Fleet.Identity/Fleet.Identity.csproj" />
+    <Project Path="backend/fleet/src/Fleet.Link/Fleet.Link.csproj" />
+    <Project Path="backend/fleet/src/Fleet.Rpc/Fleet.Rpc.csproj" />
+    <Project Path="backend/fleet/src/Fleet.Server.Abstractions/Fleet.Server.Abstractions.csproj" />
+    <Project Path="backend/fleet/src/Fleet.Server.Enrollment/Fleet.Server.Enrollment.csproj" />
+    <Project Path="backend/fleet/src/Fleet.Server.Link/Fleet.Server.Link.csproj" />
+  </Folder>
+  <Folder Name="/backend/fleet/tests/">
+    <Project Path="backend/fleet/tests/Fleet.Tests/Fleet.Tests.csproj" />
+  </Folder>
+  <Folder Name="/backend/fleet/tools/">
+    <Project Path="backend/fleet/tools/fleet-enroll/fleet-enroll.csproj" />
+  </Folder>
+  <Folder Name="/backend/shared/">
+    <Project Path="backend/shared/MoShiro.Measurement/MoShiro.Measurement.csproj" />
+    <Project Path="backend/shared/MoShiro.Protocol/MoShiro.Protocol.csproj" />
+  </Folder>
+  <Folder Name="/backend/shared/tests/">
+    <Project Path="backend/shared/tests/MoShiro.Measurement.Tests/MoShiro.Measurement.Tests.csproj" />
+    <Project Path="backend/shared/tests/MoShiro.Protocol.Tests/MoShiro.Protocol.Tests.csproj" />
+  </Folder>
+  <Folder Name="/backend/agent/src/">
+    <Project Path="backend/agent/src/MoShiro.Agent/MoShiro.Agent.csproj" />
+  </Folder>
+  <Folder Name="/backend/probe/src/">
+    <Project Path="backend/probe/src/MoShiro.Probe/MoShiro.Probe.csproj" />
+  </Folder>
+  <Folder Name="/backend/probe/tests/">
+    <Project Path="backend/probe/tests/MoShiro.Probe.Tests/MoShiro.Probe.Tests.csproj" />
+  </Folder>
+  <Folder Name="/backend/src/">
+    <Project Path="backend/src/MoShiro.Backend.Analysis/MoShiro.Backend.Analysis.csproj" />
+    <Project Path="backend/src/MoShiro.Backend.Api/MoShiro.Backend.Api.csproj" />
+    <Project Path="backend/src/MoShiro.Backend.Application/MoShiro.Backend.Application.csproj" />
+    <Project Path="backend/src/MoShiro.Backend.Gateway/MoShiro.Backend.Gateway.csproj" />
+    <Project Path="backend/src/MoShiro.Backend.Storage.Sqlite/MoShiro.Backend.Storage.Sqlite.csproj" />
+    <Project Path="backend/src/MoShiro.Backend/MoShiro.Backend.csproj" />
+  </Folder>
+  <Folder Name="/backend/tests/">
+    <Project Path="backend/tests/MoShiro.Backend.Analysis.Tests/MoShiro.Backend.Analysis.Tests.csproj" />
+    <Project Path="backend/tests/MoShiro.Backend.Tests/MoShiro.Backend.Tests.csproj" />
+    <Project Path="backend/tests/MoShiro.TestSupport/MoShiro.TestSupport.csproj" />
+  </Folder>
+  <Folder Name="/ci/">
+    <Project Path="ci/MoShiro.Tar/MoShiro.Tar.csproj" />
+  </Folder>
+</Solution>
@@ -1,94 +1,117 @@
-# Monitor
+# MoShiro

-Monitor 是一个自托管的网络线路质量观测工具。它在 Probe 与多个 Agent 之间执行主动网络测量，记录逐包和逐事件结果；Backend 保存原始数据并生成可查询的线路指标，Web 界面用于查看、比较和管理节点。
+MoShiro 是一个自托管的**网络线路质量观测工具**。它在若干 Probe（例如家宽出口）与多台 Agent（例如海外 VPS）之间做主动网络测量，只记录逐包、逐事件的原始数据；Backend 保存这些原始数据，推算延迟、丢包、抖动、吞吐等指标，并回答「如果在这条线路上部署某类服务，体验会怎样」；Web 界面用来查看、比较和管理。

-它面向需要比较不同网络出口、评估线路稳定性，或观察特定网络服务体验的场景。Agent 与 Probe 专注于测量和上报；它们不提供远程终端、命令执行或文件管理能力。
+## 项目边界

-## 能力概览
+**它做什么**

- **主动测量**：组合 TCP、UDP 等测量模块，采集延迟、丢包、抖动、吞吐和连接事件。
- **线路分析**：从原始测量数据生成时间序列指标，并比较线路在不同服务模型下的体验。
- **节点管理**：通过 Fleet 节点框架处理身份、注册、连接、任务同步和数据上报。
- **实时面板**：展示端查看线路状态和历史趋势；管理端负责节点、任务和系统配置。
- **自托管**：Backend 使用段文件和 SQLite 保存数据；提供 Linux、systemd 和 OpenWrt 相关部署文件。
+- 主动测量：组合 TCP、UDP、TLS、ICMP 等采集积木，只记录时间、序号、大小这类原始事实，**不转发也不记录业务内容**。
+- 线路分析：Backend 从原始数据生成时间序列指标，按服务模型（REALITY、Hysteria2、Minecraft 等）评分并对多条线路排序、对比；模型和指标可以事后重算。
+- 管理：节点注册与审批、Probe 和 Agent 之间连哪些线路、任务与按需测试、节点版本与更新，都在管理端完成。
+
+**它不做什么**
+
+- **节点是纯采集器**：Agent 和 Probe 没有终端、命令执行、文件读写和自更新能力，也不加载外部代码。更新由节点宿主机上的更新器完成，节点进程只放面板转来的发布清单。
+- **不是主机监控**：Agent 只上报 CPU、内存、磁盘、网卡流量和运行时长这类只读的汇总数字，不采集型号、主机名、进程和任何 IP；Probe 不上报主机资源。
+- **不暴露地址**：公开接口里没有 IP、城市、ASN；国家和运营商只由 Backend 查询（节点自己不访问任何外部服务）。
+- 暂不包含告警（见文末待办）。
+
+## 信任关系
+
+```text
+ 管理员 ── 账号密码（Cookie 会话 + CSRF）或 API 令牌（按能力授权）──▶ Backend
+ 访客   ── 匿名只读，站点设为公开时才可用（没有 IP、城市、ASN）──────────────▶ Backend 公开接口
+
+ 节点   ── 加入令牌一次性注册，之后用自己的 ECDSA P-256 密钥签名认证 ───────▶ Backend（只存公钥）
+ Probe  ── 用同一把密钥签名建立测量会话 ───────────────────────────────────▶ Agent（只放行面板名单里的 Probe 公钥）
+ CI     ── 发布私钥对「镜像 digest 清单」签名 ──▶ Backend 原样转发 ──▶ 节点宿主机的更新器用本机公钥验签
+```
+
+- **Backend 不信任节点上报的内容**：数据按线路隔离存放；节点的身份靠签名，数据库泄露也无法冒充节点。
+- **节点不信任 Backend 的下发**：任务超出节点本机的硬上限（目标网段、码率、包速率、监听端口）就被拒绝；节点不执行任何「执行类」指令。
+- **更新不依赖面板的诚实**：清单必须由发布私钥签名；节点宿主机的更新器用本机公钥验签、只认本机配置的镜像仓库、按 digest 拉取、拒绝旧的 `seq`。面板被攻破也推不出恶意镜像。

 ## 架构

 ```text
-Probe <──测量会话──> Agent ──长连接与数据上报──> Backend <──REST / SSE──> Web 展示端与管理端
-                                                  ├── 段文件：原始数据
-                                                  └── SQLite：索引、指标与配置
+                         Web（展示端 · 管理端）
+                                     ▲  REST + SSE
+        ┌──────────────────────────────────────────────────────────┐
+        │ Backend（面板）                                          │
+        │ Api · Registry · Planner · Links                         │
+        │ Releases · Analysis · LiveHub                            │
+        │ Store（段文件 + SQLite）                                 │
+        └──────────────────────────────────────────────────────────┘
+              ▲                                       ▲
+              │ wss 长连接（节点发起）                │ wss 长连接（节点发起）
+              │ 任务、数据、状态、更新通知            │ 身份、Agent 列表、状态、更新通知
+   ┌────────────────────┐                 ┌──────────────────────┐
+   │ Agent × 10+        │ ◀── 测量会话 ── │ Probe × N            │
+   │ 有公网 IP，监听    │                 │ 家宽等出口，NAT 后   │
+   └────────────────────┘                 └──────────────────────┘
+   测量会话：TLS 控制通道 + UDP/TCP 数据通道，由 Probe 主动拨出
 ```

-## 快速开始
+两种连接：**Probe 和 Agent 都用长连接连 Backend**（身份、任务、状态、更新通知），**测量只走 Probe → Agent**（Probe 主动拨出，Agent 不需要连 Probe，家宽也不需要入站端口）。哪些 Probe 连哪些 Agent 由 Backend 决定：默认自动全连，也可以在管理端手动选择。

-### 环境要求
- .NET SDK 10；项目使用 `backend/global.json` 指定 SDK 版本和滚动策略。
- Node.js 与 npm，用于构建 Web 前端。
+```text
+ 采集（只记录）          传输（有界、至少一次）           分析（注册制、可重算）         展示
+ Probe / Agent 积木 ──▶ 原始列块（10 秒一块）──▶ Backend 段文件 ──▶ 指标与服务模型 ──▶ REST / SSE ──▶ Web
+```

-### 构建
+Backend 用段文件保存原始数据，用 SQLite 保存索引、指标与配置。**完整的架构、数据链路、安全边界和设计决策见 [`docs/architecture.md`](docs/architecture.md)。**

-从仓库根目录构建后端：
+## 协议
+
+- **控制链路（Fleet）**：节点到 Backend 的 `wss` 长连接（`/api/agent/v1/rpc`），JSON-RPC 2.0 信封加二进制通道；挑战加签名认证，`hello` 协商版本和能力，心跳；**期望状态同步**（Backend 下发完整快照，节点调和并回报已应用的版本和被拒绝的条目）；**可靠发件箱**（原始块至少一次投递，按 id 去重）。Fleet 与业务无关，放在 `backend/fleet/`。
+- **业务方法**：`moshiro.*`（按需测试、Probe 断开、事件、主机汇总、更新通知等），状态文档有 `task_set`（Agent 的任务集）和 `probe_agents`（Probe 的 Agent 列表）。
+- **测量数据面**：Probe 到 Agent 的 TLS 控制通道、UDP 和 TCP 数据通道（默认 `7443/tcp`、`7443/udp`、`7444/tcp`）；会话用 `session_id` 和 MAC 认证、不绑定五元组，NAT 映射变化后自动跟随。
+- **REST + SSE**：`/api/public`（展示，可匿名）、`/api/admin`（管理）；OpenAPI 在 `backend/openapi/v1.json`，前端据此生成类型。
+
+细节见 [`docs/protocol.md`](docs/protocol.md)、[`backend/fleet/README.md`](backend/fleet/README.md)、[`docs/api.md`](docs/api.md)、[`docs/enrollment.md`](docs/enrollment.md)。
+
+## 如何构建
+
+环境：.NET SDK 10（`global.json` 指定版本）、Node.js 与 npm。在仓库根目录：

 ```sh
-cd backend
-dotnet build Monitor.slnx -c Release
+dotnet build MoShiro.slnx -c Release          # Backend、Agent、Probe、Fleet、测试和 CI 工具
+npm ci --prefix web && npm run build --prefix web   # 展示端和管理端，产物在 web/display/dist、web/admin/dist
 ```

-安装前端依赖并构建展示端和管理端（在仓库根目录运行）：
+本地运行：先在 `backend/` 里 `dotnet run --project src/MoShiro.Backend -- --urls http://localhost:5000`，再 `npm run dev --prefix web`，展示端是 <http://localhost:5173/>，管理端是 <http://localhost:5173/admin/>。
+
+测试和检查：

 ```sh
-npm ci --prefix web
-npm run build --prefix web
+dotnet test --solution MoShiro.slnx            # 后端和节点的测试
+npm run lint:css --prefix web                  # 前端样式（颜色只能写在主题令牌里）
+npm run gen:api --prefix web                   # 后端改了接口之后重新生成前端类型
 ```

-前端产物位于 `web/display/dist/` 和 `web/admin/dist/`。NativeAOT 目标平台和 Windows 上使用 AotAnywhere 交叉构建的说明见 [`docs/deployment.md`](docs/deployment.md)。
+Backend、Agent、Probe 以 OCI 镜像发布（Linux amd64、arm64），Agent 和 Probe 另有 Linux glibc/musl、macOS、Windows 的二进制包。NativeAOT 的构建细节、CI 触发规则（`[CI]`、`[SKIP TESTS]`、版本 tag）、镜像路径、容器节点的运行和更新见 [`docs/deployment.md`](docs/deployment.md)；前端见 [`web/README.md`](web/README.md)，后端见 [`backend/README.md`](backend/README.md)。

-Backend 以 OCI 镜像发布，支持 Linux/amd64 与 Linux/arm64；Agent 和 Probe 发布 Linux glibc/musl x64、arm64，macOS x64/arm64，以及 Windows x64/arm64 二进制包。容器部署配置见 [`compose.yaml`](compose.yaml)，发布说明见 [`docs/deployment.md`](docs/deployment.md)。
+## 文档

-### 本地运行
-
-1. **启动 Backend。** 在仓库根目录运行：
-
-```sh
-cd backend
-dotnet run --project src/Monitor.Backend -- --urls http://localhost:5000
-```
-
-2. **启动前端。** 保持 Backend 运行，在另一个终端的仓库根目录运行：
-
-```sh
-npm ci --prefix web
-npm run dev --prefix web
-```
-
-打开 <http://localhost:5173/> 使用展示端，或访问 <http://localhost:5174/admin/> 进入管理端。依赖安装和前端配置见 [`web/README.md`](web/README.md)；Backend 的首次启动与配置见 [`backend/README.md`](backend/README.md)。
-
-## 项目布局
-
-| 路径 | 说明 |
+| 文档 | 内容 |
 | --- | --- |
-| [`backend/`](backend/README.md) | Backend 服务、Fleet 框架、共享测量代码与 .NET 测试 |
-| [`backend/agent/`](backend/agent/README.md) | Agent 节点：注册到 Backend，接受 Probe 测量并上报数据 |
-| [`backend/probe/`](backend/probe/README.md) | Probe 节点：发起线路测量并将采集数据交给 Agent |
-| `backend/fleet/` | 可复用的节点身份、注册和连接框架 |
-| `backend/shared/` | 测量引擎、协议和原始数据格式 |
-| `web/display/`、`web/admin/` | 展示端和管理端 |
-| `web/shared/` | 前端 API、图表、组件与主题 |
-| `packaging/`、`scripts/` | 部署、构建与维护脚本 |
-| `docs/` | [架构](docs/architecture.md)、[测量模型](docs/measurement.md)、[API](docs/api.md)、[部署](docs/deployment.md)等文档 |
+| [`docs/architecture.md`](docs/architecture.md) | 架构、数据链路、安全边界、设计决策 |
+| [`docs/security.md`](docs/security.md) | 零信任设计稿（部分已实现）：威胁模型、入网信任链、监听隐身、extension 授权 |
+| [`docs/access.md`](docs/access.md) | 访问控制与入网信任链设计（尚未实现）：账户、角色、能力、API key、提权窗口、passkey 到节点的签名链 |
+| [`docs/protocol.md`](docs/protocol.md)、[`backend/fleet/README.md`](backend/fleet/README.md) | 线协议、Fleet 节点框架（身份、注册、连接） |
+| [`docs/enrollment.md`](docs/enrollment.md) | 注册、身份、Probe 与 Agent 的接入 |
+| [`docs/measurement.md`](docs/measurement.md)、[`docs/analysis.md`](docs/analysis.md) | 采集引擎与任务模型、分析层与指标 |
+| [`docs/storage.md`](docs/storage.md)、[`docs/query.md`](docs/query.md) | 存储、展示数据查询 |
+| [`docs/api.md`](docs/api.md)、[`docs/api-guidelines.md`](docs/api-guidelines.md) | API 规范与约束 |
+| [`docs/deployment.md`](docs/deployment.md) | 构建、发布、CI、部署与更新 |
+| [`docs/project-layout.md`](docs/project-layout.md)、[`docs/coding-style.md`](docs/coding-style.md) | 仓库结构与依赖规则、代码风格 |

-## 测试
+代码目录：`backend/`（Backend、`fleet/` 节点框架、`shared/` 测量引擎和协议、`agent/`、`probe/`、`tests/`）、`web/`（`display` 展示端、`admin` 管理端、`shared`）、`packaging/` 和 `scripts/`（部署与维护）、`ci/` 和 `.woodpecker/`（流水线）。

-```sh
-cd backend
-dotnet test --solution Monitor.slnx
-```
+## 待办

-```sh
-# 前端样式检查（仓库根目录）
-npm run lint:css --prefix web
-```
+见 [`TODO.md`](TODO.md)。

 ## 许可证

@@ -0,0 +1,48 @@
+# TODO
+
+按主题记录还没做的事，做完就删掉对应的条目。已经实现的东西以 [`docs/`](docs/) 和代码为准。
+
+## 测量
+
+- 路由跳数、路径漂移和 trace
+- QUIC 握手耗时：TCP 建连和 TLS 握手已经有了（`connect` 任务）。.NET 的 QUIC 依赖系统里的 msquic 原生库，和节点「只依赖 OpenSSL、NativeAOT 单文件」冲突，要做只能自己写最小的 QUIC Initial 握手探测
+- 网页长截图
+- pcap / eBPF 采集
+
+## 任务与面板
+
+- 单个 Agent 的任务（目前是线路模板加按 Agent 的覆盖，没有只属于某一个 Agent 的独立任务）
+- 原生 webhook 投递；告警（基于 webhook）。实现之前先定约束（只允许 HTTPS、禁止私网和回环、不跟随重定向、限制超时和响应大小、解析后再检查地址），见 [`docs/security.md`](docs/security.md) 第 9.2 节
+
+## 部署
+
+- 后端自动下载前端资源：用 Podman、Docker 部署时，默认拉取最新的前端资源（现在前端要自己构建，镜像里没有）。
+[security.md](docs/security.md)
+## 访客页面
+
+- 人机验证：访客页面要通过验证才能拉数据，前端访问时静默触发。候选 tiago2/cap 和 Cloudflare Turnstile。
+
+## 更新
+
+- 更新遥测（现在面板只有每个节点的「当前更新状态」）
+- **回滚路径的实机测试**：容器节点更新后观察 20 秒、失败回滚，只有单元和脚本测试，没有在真实节点上触发过。
+- **更新的灰度和自动策略**：按标签分批发布；`POLICY=auto` 的长期验证。
+- **纯二进制节点的更新**（`fleet-updater`、`fleet-release`、Windows 服务和 OpenWrt procd 适配器）。设计要点，实现时照这个来：
+  - 信任来自签名：只接受离线发布密钥签名的清单，发布源可以是面板、GitHub Releases 或任意 HTTP 服务；面板被攻破也推不出恶意二进制。
+  - 本地说了算：更新策略（`auto` / `notify` / `pinned:<version>`）和信任的公钥写在节点本地配置里，面板只能「建议」；支持多把公钥以便轮换。
+  - 清单带 `app`、`channel`、`version`、`min_from`、各 RID 制品的 `sha256` 和大小、`key_id`、签名（对规范化 JSON 签名）；本地记录已装过的最高版本，拒绝降级和旧清单重放。
+  - 流程：下载 → 校验 → 解包到 `versions/<v>/` → 原子切换 `current`（Linux 符号链接，Windows 目录联结）→ 重启服务 → 等健康信标确认 → 失败切回旧版本并把该版本标记为坏版本。
+  - 权限分离：更新进程只能写安装目录和重启被管理的服务，读不到节点身份私钥。
+  - OpenWrt：`keep_versions = 1`，下载前检查闪存剩余空间。
+  - 容器节点已经实现的那一套（清单签名、`seq` 防重放、按 digest 拉取、回滚）见 [`docs/deployment.md`](docs/deployment.md)。
+
+## 安全
+
+- **零信任**：设计稿在 [`docs/security.md`](docs/security.md)，按其中第 12 节的顺序实现（阶段零「协议方向声明表」已完成）：Probe 自己生成密钥、Agent 预握手敲门、操作员凭证和名册、测量数据的签名和归属校验、入库配额和管理端 CSP、Backend 应用层身份、extension 框架（敏感能力都放进可选安装的独立 extension，核心保持 NativeAOT）；可选的 UDP 单包授权、UDP 会话迁移的路径验证。
+- **extension**（Web SSH、TTY、更新遥测，敏感 operator）：设计时必须保住「节点是纯采集器」这条边界，见 [`README.md`](README.md) 的项目边界。
+- 对 UDP 包、控制帧、RawChunk、JSON-RPC 做模糊测试；伪造签名和重放的专项测试。
+
+## 打包
+
+- OpenWrt：procd 脚本、ipk/apk 包、sysupgrade 保留列表，在 aarch64 路由器上长时间运行验证。
+- Windows 服务适配。
@@ -13,7 +13,7 @@
    <UseArtifactsOutput>true</UseArtifactsOutput>
    <ArtifactsPath>$(MSBuildThisFileDirectory)artifacts</ArtifactsPath>
    <Deterministic>true</Deterministic>
-    <Version>0.1.0</Version>
+    <Version>0.3.3</Version>
    <NuGetAudit>false</NuGetAudit>
  </PropertyGroup>
  <ItemGroup>
@@ -17,33 +17,33 @@
    <Project Path="fleet/tools/fleet-enroll/fleet-enroll.csproj" />
  </Folder>
  <Folder Name="/shared/">
-    <Project Path="shared/Monitor.Measurement/Monitor.Measurement.csproj" />
-    <Project Path="shared/Monitor.Protocol/Monitor.Protocol.csproj" />
+    <Project Path="shared/MoShiro.Measurement/MoShiro.Measurement.csproj" />
+    <Project Path="shared/MoShiro.Protocol/MoShiro.Protocol.csproj" />
  </Folder>
  <Folder Name="/shared/tests/">
-    <Project Path="shared/tests/Monitor.Measurement.Tests/Monitor.Measurement.Tests.csproj" />
-    <Project Path="shared/tests/Monitor.Protocol.Tests/Monitor.Protocol.Tests.csproj" />
+    <Project Path="shared/tests/MoShiro.Measurement.Tests/MoShiro.Measurement.Tests.csproj" />
+    <Project Path="shared/tests/MoShiro.Protocol.Tests/MoShiro.Protocol.Tests.csproj" />
  </Folder>
  <Folder Name="/agent/src/">
-    <Project Path="agent/src/Monitor.Agent/Monitor.Agent.csproj" />
+    <Project Path="agent/src/MoShiro.Agent/MoShiro.Agent.csproj" />
  </Folder>
  <Folder Name="/probe/src/">
-    <Project Path="probe/src/Monitor.Probe/Monitor.Probe.csproj" />
+    <Project Path="probe/src/MoShiro.Probe/MoShiro.Probe.csproj" />
  </Folder>
  <Folder Name="/probe/tests/">
-    <Project Path="probe/tests/Monitor.Probe.Tests/Monitor.Probe.Tests.csproj" />
+    <Project Path="probe/tests/MoShiro.Probe.Tests/MoShiro.Probe.Tests.csproj" />
  </Folder>
  <Folder Name="/backend/src/">
-    <Project Path="src/Monitor.Backend.Analysis/Monitor.Backend.Analysis.csproj" />
-    <Project Path="src/Monitor.Backend.Api/Monitor.Backend.Api.csproj" />
-    <Project Path="src/Monitor.Backend.Application/Monitor.Backend.Application.csproj" />
-    <Project Path="src/Monitor.Backend.Gateway/Monitor.Backend.Gateway.csproj" />
-    <Project Path="src/Monitor.Backend.Storage.Sqlite/Monitor.Backend.Storage.Sqlite.csproj" />
-    <Project Path="src/Monitor.Backend/Monitor.Backend.csproj" />
+    <Project Path="src/MoShiro.Backend.Analysis/MoShiro.Backend.Analysis.csproj" />
+    <Project Path="src/MoShiro.Backend.Api/MoShiro.Backend.Api.csproj" />
+    <Project Path="src/MoShiro.Backend.Application/MoShiro.Backend.Application.csproj" />
+    <Project Path="src/MoShiro.Backend.Gateway/MoShiro.Backend.Gateway.csproj" />
+    <Project Path="src/MoShiro.Backend.Storage.Sqlite/MoShiro.Backend.Storage.Sqlite.csproj" />
+    <Project Path="src/MoShiro.Backend/MoShiro.Backend.csproj" />
  </Folder>
  <Folder Name="/backend/tests/">
-    <Project Path="tests/Monitor.Backend.Analysis.Tests/Monitor.Backend.Analysis.Tests.csproj" />
-    <Project Path="tests/Monitor.Backend.Tests/Monitor.Backend.Tests.csproj" />
-    <Project Path="tests/Monitor.TestSupport/Monitor.TestSupport.csproj" />
+    <Project Path="tests/MoShiro.Backend.Analysis.Tests/MoShiro.Backend.Analysis.Tests.csproj" />
+    <Project Path="tests/MoShiro.Backend.Tests/MoShiro.Backend.Tests.csproj" />
+    <Project Path="tests/MoShiro.TestSupport/MoShiro.TestSupport.csproj" />
  </Folder>
 </Solution>
@@ -1,24 +1,24 @@
 # Backend

-Backend 是 Monitor 的控制面和数据服务，负责 Agent 注册与连接、任务编排、原始测量数据持久化、指标分析，以及供前端使用的 REST API 和 SSE 实时数据流。
+Backend 是 MoShiro 的控制面和数据服务，负责 Agent 注册与连接、任务编排、原始测量数据持久化、指标分析，以及供前端使用的 REST API 和 SSE 实时数据流。

 ## 组件

 | 路径 | 职责 |
 | --- | --- |
-| `src/Monitor.Backend/` | 应用入口与依赖组合 |
-| `src/Monitor.Backend.Api/` | Public、Admin API 和 OpenAPI |
-| `src/Monitor.Backend.Gateway/` | Fleet RPC、节点状态与测量数据接收 |
-| `src/Monitor.Backend.Application/` | 业务用例、查询、任务和后台服务 |
-| `src/Monitor.Backend.Analysis/` | 指标计算、累加器和服务模型 |
-| `src/Monitor.Backend.Storage.Sqlite/` | 段文件与 SQLite 存储 |
+| `src/MoShiro.Backend/` | 应用入口与依赖组合 |
+| `src/MoShiro.Backend.Api/` | Public、Admin API 和 OpenAPI |
+| `src/MoShiro.Backend.Gateway/` | Fleet RPC、节点状态与测量数据接收 |
+| `src/MoShiro.Backend.Application/` | 业务用例、查询、任务和后台服务 |
+| `src/MoShiro.Backend.Analysis/` | 指标计算、累加器和服务模型 |
+| `src/MoShiro.Backend.Storage.Sqlite/` | 段文件与 SQLite 存储 |
 | `fleet/` | 通用节点身份、注册和连接框架 |
 | `shared/` | 测量引擎、协议和数据格式 |
 | `tests/` | 集成测试和测试支持代码 |

 ## 环境要求

-使用 .NET SDK 10。仓库根目录的 `backend/global.json` 指定所需 SDK 版本及滚动策略。
+使用 .NET SDK 10。仓库根目录的 `global.json` 指定所需 SDK 版本及滚动策略。

 ## 构建与测试

@@ -26,14 +26,14 @@ Backend 是 Monitor 的控制面和数据服务，负责 Agent 注册与连接

 ```sh
 cd backend
-dotnet build Monitor.slnx -c Release
-dotnet test --solution Monitor.slnx
+dotnet build MoShiro.slnx -c Release
+dotnet test --solution MoShiro.slnx
 ```

 发布当前平台的 NativeAOT Backend：

 ```sh
-dotnet publish src/Monitor.Backend -c Release -r <RID> -p:PublishAot=true
+dotnet publish src/MoShiro.Backend -c Release -r <RID> -p:PublishAot=true
 ```

 例如 `<RID>` 可为 `win-x64`、`linux-x64` 或 `linux-arm64`。NativeAOT 发布需要对应平台的 C/C++ 工具链。仓库根目录的 `scripts/publish.sh backend <RID>` 可构建单个平台的 Backend 可执行文件；容器发布由 Woodpecker tag 流水线完成，详见 [`../docs/deployment.md`](../docs/deployment.md)。
@@ -46,9 +46,9 @@ dotnet publish src/Monitor.Backend -c Release -r <RID> -p:PublishAot=true

 ```sh
 cd backend
-dotnet run --project src/Monitor.Backend -- --urls http://localhost:5000
+dotnet run --project src/MoShiro.Backend -- --urls http://localhost:5000
 ```

-首次启动时可用 `Monitor__InitialAdminUser` 和 `Monitor__InitialAdminPassword` 设置初始管理员。数据目录、公开地址、Cookie 和 CORS 等设置通过 `Monitor` 配置节传入；完整配置说明见 [`../docs/deployment.md`](../docs/deployment.md)。站点默认需要登录，可在管理端修改公开设置。
+没有默认管理员：第一次打开面板时按页面引导自己创建管理员、注册 passkey、建立信任根，页面要的认领码写在后端日志里（或用 `MoShiro__ClaimCode` 指定）。`MoShiro__InitialAdminUser` / `MoShiro__InitialAdminPassword` 只给自动化用。数据目录、公开地址、Cookie 和 CORS 等设置通过 `MoShiro` 配置节传入；完整配置说明见 [`../docs/deployment.md`](../docs/deployment.md)。站点默认需要登录，可在管理端修改公开设置。

 OpenAPI 文档由构建生成到 `openapi/v1.json`。API 设计和端点说明见 [`../docs/api.md`](../docs/api.md)；项目总览见仓库根目录的 [`README.md`](../README.md)。
@@ -8,6 +8,10 @@
    <EventSourceSupport>false</EventSourceSupport>
    <DebuggerSupport>false</DebuggerSupport>
    <HttpActivityPropagationSupport>false</HttpActivityPropagationSupport>
+    <Http3Support>false</Http3Support>
+    <MetricsSupport>false</MetricsSupport>
+    <UseSizeOptimizedLinq>true</UseSizeOptimizedLinq>
+    <JsonSerializerIsReflectionEnabledByDefault>false</JsonSerializerIsReflectionEnabledByDefault>
    <ServerGarbageCollection>false</ServerGarbageCollection>
    <ConcurrentGarbageCollection>false</ConcurrentGarbageCollection>
  </PropertyGroup>
@@ -1,4 +1,4 @@
-# Monitor Agent
+# MoShiro Agent

 Agent 是部署在 VPS 或其他可达网络节点上的采集进程。它向 Backend 注册并保持连接，接受 Probe 的测量会话，执行线路任务中的 Agent 侧工作，再将两端数据合并后上报。

@@ -14,18 +14,18 @@ Probe ──TLS 控制 / UDP、TCP 测量──> Agent ──长连接与数据

 ## 构建

-需要 .NET SDK 10。为应用 `backend/global.json` 的 SDK 设置，请从 `backend/` 目录构建：
+需要 .NET SDK 10。为应用 根目录的 `global.json` 的 SDK 设置，请从 `backend/` 目录构建：

 ```sh
 cd backend
-dotnet build agent/src/Monitor.Agent -c Release
+dotnet build agent/src/MoShiro.Agent -c Release
 dotnet build fleet/tools/fleet-enroll -c Release
 ```

 发布 NativeAOT 程序需要对应平台的 C/C++ 工具链；`<RID>` 应与构建环境和目标平台匹配：

 ```sh
-dotnet publish agent/src/Monitor.Agent -c Release -r <RID> -p:PublishAot=true
+dotnet publish agent/src/MoShiro.Agent -c Release -r <RID> -p:PublishAot=true
 dotnet publish fleet/tools/fleet-enroll -c Release -r <RID> -p:PublishAot=true
 ```

@@ -36,7 +36,7 @@ dotnet publish fleet/tools/fleet-enroll -c Release -r <RID> -p:PublishAot=true
 先在管理端创建加入令牌，然后在 Agent 主机上运行一次性注册工具：

 ```sh
-fleet-enroll --server https://<backend> --join <token> --name <agent-name> --identity-dir /etc/monitor
+fleet-enroll --server https://<backend> --join <token> --name <agent-name> --identity-dir /etc/moshiro
 ```

 注册工具会在身份目录写入节点身份和证书。准备本地 `agent.json`，其中 `fleet.server` 指向 Backend，`fleet.identity_dir` 指向上述目录；`listen`、`limits` 和 `reporting` 可按节点环境调整。配置文件不会由 Backend 修改。限制目标网段和测量预算时，应按实际网络与机器能力配置；`allowed_target_cidrs` 默认为空，不允许 Agent 执行目标探测任务。
@@ -44,10 +44,14 @@ fleet-enroll --server https://<backend> --join <token> --name <agent-name> --ide
 启动 Agent：

 ```sh
-monitor-agent --config /etc/monitor/agent.json
+moshiro-agent --config /etc/moshiro/agent.json
 ```

-不传 `--config` 时默认读取 `/etc/monitor/agent.json`。Agent 默认监听控制端口 `7443/tcp`，数据端口 `7443/udp` 和 `7444/tcp`；防火墙和面板中的节点端口配置需与本地配置一致。`reporting.host_stats` 可关闭主机状态上报；启用时只上报资源使用等汇总数据，不包含主机名、进程或 IP。
+容器节点的运行方式（podman + systemd）和宿主机更新器见 [`../../docs/deployment.md`](../../docs/deployment.md)。也可使用 OCI 镜像 `registry.oeo.one/moshiro/moshiro-agent:<version>`，自动选择 Linux amd64 或 arm64 镜像。镜像同时包含 `fleet-enroll`；可通过 `--entrypoint /usr/local/bin/fleet-enroll` 执行首次注册。容器默认读取命名 volume 中的 `/etc/moshiro/agent.json` 与身份文件；建议使用宿主网络，Linux ICMP 优先使用普通用户 ping socket，内核 ping_group_range 需允许映射后的 GID。镜像以 UID/GID 1654 运行，新命名 volume 由引擎按镜像目录初始化权限。
+
+不传 `--config` 时默认读取 `/etc/moshiro/agent.json`。Agent 默认监听控制端口 `7443/tcp`，数据端口 `7443/udp` 和 `7444/tcp`；防火墙和面板中的节点端口配置需与本地配置一致。`reporting.host_stats` 可关闭主机状态上报；启用时只上报资源使用等汇总数据，不包含主机名、进程或 IP。
+
+IPv6 线路需要 Agent 实际绑定 IPv6。新配置的默认 `listen.bind` 为 `::`，覆盖整个双栈接口；已有配置如果仍写 `0.0.0.0`，可改为 `::` 后重启。Compose 与 systemd 容器部署使用宿主网络，诊断反映宿主 IPv6；自定义容器网络时，Agent 同时报告容器网络以及可读取到的宿主 `/proc` IPv6 状态。诊断不上传 IP 或接口名称。

 ## 设计说明

@@ -55,3 +59,5 @@ monitor-agent --config /etc/monitor/agent.json
 - 数据面会校验会话认证、重放窗口和速率限制；无效数据包会静默丢弃。
 - 测量引擎和协议由 `backend/shared/` 提供；节点身份、注册和连接由 `backend/fleet/` 提供。
 - 详细安全边界与拓扑见 [`../../docs/architecture.md`](../../docs/architecture.md)，协议说明见 [`../../docs/protocol.md`](../../docs/protocol.md)，部署见 [`../../docs/deployment.md`](../../docs/deployment.md)。
+
+Docker 与 rootless/rootful Podman 共用 `packaging/compose/agent/compose.yaml`，配置、身份和缓存放在命名 volume 中，无需宿主配置目录、keep-id 或手动 chown。首次导入和自动更新见部署文档。
@@ -1,20 +1,26 @@
+using Fleet.Identity;
 using System.Net;
 using System.Text.Json;
 using Fleet.Core;
 using Fleet.Hosting;
 using Fleet.Link;
 using Fleet.Rpc;
-using Monitor.Measurement;
-using Monitor.Protocol;
+using MoShiro.Measurement;
+using MoShiro.Protocol;

-namespace Monitor.Agent;
+namespace MoShiro.Agent;

 /// <summary>Agent 的组装点：数据面、点对点监听、与 Backend 的链路都在这里接起来。没有全局状态，测试可以在同一进程里启动多个。</summary>
 public sealed class AgentApp : IDisposable
 {
-    public const string Version = "0.1.0";
+    public const string Version = MoShiro.Protocol.BuildInfo.Version;

    private readonly AgentConfig _config;
+    private readonly bool _ipv6Supported;
+    private readonly KnockGate _knock;
+    private readonly TrustAnchor _trust;
+    private readonly RestartController _restart;
+    private readonly RestartController? _ownedRestart;
    private readonly LoadedNodeIdentity _identity;
    private readonly TimeProvider _time;
    private readonly INodeLog _log;
@@ -25,6 +31,7 @@ public sealed class AgentApp : IDisposable
    private readonly TaskCompletionSource _ready = new(TaskCreationOptions.RunContinuationsAsynchronously);
    private readonly AgentAdmission _admission;
    private readonly Outbox _outbox = new(64 << 20);
+    private readonly UpdateBridge _update;
    private readonly BackendUplink _uplink;
    private readonly UdpMux _udp;
    private readonly TcpAcceptor _tcp;
@@ -34,8 +41,13 @@ public sealed class AgentApp : IDisposable
    private readonly TestRunner _tests;
    private readonly FleetLink _link;

-    public AgentApp(AgentConfig config, LoadedNodeIdentity identity, TimeProvider time, INodeLog log)
+    /// <param name="dataDirectory">配置目录（容器里的 <c>/etc/moshiro</c>）：宿主机更新器和节点在这里交换清单、请求和状态。</param>
+    public AgentApp(AgentConfig config, LoadedNodeIdentity identity, string dataDirectory, TimeProvider time, INodeLog log, RestartController? restart = null)
    {
+        _ownedRestart = restart is null ? new RestartController() : null;
+        _restart = restart ?? _ownedRestart!;
+        _update = new UpdateBridge(dataDirectory, new ConfigStore(dataDirectory).Write, log);
+        NodeBinary.Prime(); // 正在运行的二进制的哈希：先在后台算好，握手时用
        _config = config;
        _identity = identity;
        _time = time;
@@ -44,9 +56,18 @@ public sealed class AgentApp : IDisposable
        _uplink = new BackendUplink(time);

        IPAddress bind = IPAddress.Parse(config.Listen.Bind);
+        if (bind.Equals(IPAddress.IPv6Any) && !System.Net.Sockets.Socket.OSSupportsIPv6)
+        {
+            bind = IPAddress.Any;
+        }
+
+        _ipv6Supported = bind.AddressFamily == System.Net.Sockets.AddressFamily.InterNetworkV6;
        _admission = new AgentAdmission(_streams);
        _udp = new UdpMux(_sessions, _admission, _clock, _counters.Data, log, bind, config.Listen.UdpPorts);
-        _tcp = new TcpAcceptor(bind, config.Listen.TcpPorts, identity.Certificate, _sessions, _counters.Data);
+        // 预握手敲门：控制端口和数据端口共用一个关卡（限速和去重一起算）；名册就是期望状态里的 peers
+        _trust = TrustAnchor.Load(config.Fleet.IdentityDir, log);
+        _knock = new KnockGate(identity.PeerIdentity, RosterKeys, time);
+        _tcp = new TcpAcceptor(bind, config.Listen.TcpPorts, identity.Certificate, _sessions, _counters.Data, _knock);

        // 监听方积木的环境：和 Probe 的拨号方共用同一套积木，区别只在这里装配的部分（准入策略、TCP 监听）
        var env = new BlockEnv
@@ -63,7 +84,7 @@ public sealed class AgentApp : IDisposable
        };
        var chunks = new ChunkAssembler(_streams, _clock, _counters, _outbox, identity.NodeId, time, log);
        var targets = new TargetRunners(chunks, identity.NodeId, _clock, time, log);
-        _tasks = new TaskManager(CreateGuard, _streams, env, targets, () => _udp.BoundPorts, () => _tcp.BoundPorts);
+        _tasks = new TaskManager(CreateGuard, _streams, env, targets, () => _udp.BoundPorts, () => _tcp.BoundPorts, _trust);
        _hub = new PeerHub(_sessions, _clock, chunks, _tasks, _uplink, time, log);
        _tests = new TestRunner(_tasks, _sessions, _streams, env, _uplink, config.Limits.MaxConcurrentTests, transport => transport == "udp" ? _udp.BoundPorts : _tcp.BoundPorts, time, log);

@@ -78,6 +99,7 @@ public sealed class AgentApp : IDisposable
                Listen = new IPEndPoint(bind, config.Listen.ControlPort),
                Certificate = identity.Certificate,
                LookupPeerKey = _tasks.LookupPeerKey,
+                Knock = _knock,
            },
            _hub.OnSessionAsync,
            log,
@@ -90,7 +112,11 @@ public sealed class AgentApp : IDisposable
    /// <summary>数据面和控制端口都开始监听之后完成（配置里的端口为 0 时，这里能读到实际端口）。</summary>
    public Task Ready => _ready.Task;

-    public void Dispose() => _udp.Dispose();
+    public void Dispose()
+    {
+        _udp.Dispose();
+        _ownedRestart?.Dispose();
+    }

    internal StreamRegistry Streams => _streams;

@@ -100,10 +126,16 @@ public sealed class AgentApp : IDisposable

    public int ControlPort => _peers.Port;

+    /// <summary>节点当前采用的操作员集合版本（没有固定信任根时是 0）。</summary>
+    public int TrustVersion => _trust.Version;
+
    public AgentCounters Counters => _counters;

    public FleetLink Link => _link;

+    /// <summary>对等面（Probe 连进来的会话）的路由器，测试用。</summary>
+    public RpcRouter<PeerContext> PeerRouter => _hub.Router;
+
    /// <summary>期望状态里是否已经有这个 Probe 的公钥（测试用：握手会按它校验）。</summary>
    public bool IsPeerKnown(string probeId, string publicKeyBase64) =>
        _tasks.LookupPeerKey(probeId) is { } key && Convert.ToBase64String(key) == publicKeyBase64;
@@ -178,56 +210,81 @@ public sealed class AgentApp : IDisposable

    private FleetLink BuildLink()
    {
-        var router = new RpcRouter<LinkContext>();
+        var router = new RpcRouter<LinkContext>(RpcSide.Node, MoShiroMethodTable.Table, NodeRoles.Agent);
        HashSet<string>? allowed = _config.Policy.AllowMethods is { } list ? [.. list] : null;
        bool Allow(string method) => allowed is null || allowed.Contains(method);

-        if (Allow(MonitorMethods.TestRun))
+        if (Allow(MoShiroMethods.TestRun))
        {
            router.On(
-                MonitorMethods.TestRun,
-                MonitorJsonContext.Default.TestRunParams,
-                MonitorJsonContext.Default.TestRunResult,
+                MoShiroMethods.TestRun,
+                MoShiroJsonContext.Default.TestRunParams,
+                MoShiroJsonContext.Default.TestRunResult,
                (_, run, _) => ValueTask.FromResult(_tests.Start(run)));
        }

-        if (Allow(MonitorMethods.TestCancel))
+        if (Allow(MoShiroMethods.TestCancel))
        {
            router.On(
-                MonitorMethods.TestCancel,
-                MonitorJsonContext.Default.TestCancelParams,
-                MonitorJsonContext.Default.TestRunResult,
+                MoShiroMethods.TestCancel,
+                MoShiroJsonContext.Default.TestCancelParams,
+                MoShiroJsonContext.Default.TestRunResult,
                (_, cancel, _) => ValueTask.FromResult(Result<TestRunResult>.Ok(new TestRunResult { Accepted = _tests.Cancel(cancel.TestId) })));
        }

-        if (Allow(MonitorMethods.ProbeDisconnect))
+        if (Allow(MoShiroMethods.UpdateOffer))
        {
-            router.On(
-                MonitorMethods.ProbeDisconnect,
-                MonitorJsonContext.Default.ProbeDisconnectParams,
-                MonitorJsonContext.Default.TestRunResult,
-                async (_, request, _) => Result<TestRunResult>.Ok(new TestRunResult { Accepted = await _hub.DisconnectAsync(request.ProbeId.Value) }));
+            router.OnNotify(MoShiroMethods.UpdateOffer, MoShiroJsonContext.Default.UpdateOfferParams, (_, offer, _) =>
+            {
+                _update.WriteOffer(offer);
+                return ValueTask.CompletedTask;
+            });
        }

-        if (Allow(MonitorMethods.ProbeAgentsChanged))
+        if (Allow(MoShiroMethods.Schedule))
        {
-            router.OnNotify(
-                MonitorMethods.ProbeAgentsChanged,
-                MonitorJsonContext.Default.ProbeAgentsResult,
-                (_, list, _) => _hub.RelayAgentsAsync(list));
+            router.OnNotify(MoShiroMethods.Schedule, MoShiroJsonContext.Default.ScheduleParams, (_, schedule, _) =>
+            {
+                if (!_restart.SetRemote(schedule.RestartAt))
+                {
+                    _log.Warn("ignoring an invalid restart schedule from the panel");
+                }
+
+                return ValueTask.CompletedTask;
+            });
+        }
+
+        if (Allow(MoShiroMethods.UpdateApply))
+        {
+            router.OnNotify(MoShiroMethods.UpdateApply, MoShiroJsonContext.Default.UpdateOfferParams, (_, _, _) =>
+            {
+                _update.RequestApply();
+                return ValueTask.CompletedTask;
+            });
+        }
+
+        if (Allow(MoShiroMethods.ProbeDisconnect))
+        {
+            router.On(
+                MoShiroMethods.ProbeDisconnect,
+                MoShiroJsonContext.Default.ProbeDisconnectParams,
+                MoShiroJsonContext.Default.TestRunResult,
+                async (_, request, _) => Result<TestRunResult>.Ok(new TestRunResult { Accepted = await _hub.DisconnectAsync(request.ProbeId.Value) }));
        }

        var options = new FleetLinkOptions
        {
            Server = new Uri(_config.Fleet.Server),
            Identity = _identity.Identity,
+            ServerVerifier = _trust,
+            Attestation = _update.Attest,
            NodeId = _identity.NodeId,
            NodeVersion = Version,
-            Capabilities = [MonitorCapabilities.Base, MonitorCapabilities.KindsPrefix + string.Join(',', BlockCatalog.AgentKinds)],
+            Capabilities = [MoShiroCapabilities.Base, MoShiroCapabilities.KindsPrefix + string.Join(',', BlockCatalog.AgentKinds)],
            HelloMeta = HelloMeta,
            HeartbeatExtra = HeartbeatExtra,
        };
-        var link = new FleetLink(options, router, [new StateHandler<TaskSet>(TaskSet.StateType, MonitorJsonContext.Default.TaskSet, _tasks.ApplyAsync)], _outbox, _time, _log);
+        var link = new FleetLink(options, router, [new StateHandler<TaskSet>(TaskSet.StateType, MoShiroJsonContext.Default.TaskSet, _tasks.ApplyAsync)], _outbox, _time, _log);

        // 链路重新连上之后补报：在线的 Probe 都告诉 Backend（Backend 重启或链路抖动期间错过了 probe_connected）
        link.OnConnected = async (_, _) =>
@@ -240,11 +297,19 @@ public sealed class AgentApp : IDisposable
        return link;
    }

+    /// <summary>敲门关卡的名册：期望状态里的 peers（任务管理器在构造之后才有）。</summary>
+    private IReadOnlyList<byte[]> RosterKeys() => _tasks.PeerKeys();
+
    private JsonElement? HelloMeta()
    {
        var meta = new AgentHelloMeta
        {
-            TlsSpki = _identity.File.TlsSpki,
+            Owners = [.. _trust.Controllers],
+            Ipv6 = Ipv6Diagnostics.Sample(_ipv6Supported, Environment.GetEnvironmentVariable("MOSHIRO_NETWORK_SCOPE"), Environment.GetEnvironmentVariable("HOST_PROC")),
+            Ipv6Supported = _ipv6Supported,
+            Addresses = [.. LocalAddresses.Sample()],
+            Platform = MoShiro.Measurement.PlatformDetector.Detect(),
+            TlsPublicKey = Convert.ToBase64String(_identity.Certificate.PublicKey.ExportSubjectPublicKeyInfo()),
            ProbeTcpPort = ControlPort,
            ProbeUdpPorts = [.. UdpPorts],
            LocalLimits = new LocalLimits
@@ -255,7 +320,7 @@ public sealed class AgentApp : IDisposable
                MaxConcurrentTests = _config.Limits.MaxConcurrentTests,
            },
        };
-        return JsonSerializer.SerializeToElement(meta, MonitorJsonContext.Default.AgentHelloMeta);
+        return JsonSerializer.SerializeToElement(meta, MoShiroJsonContext.Default.AgentHelloMeta);
    }

    private long _lastIn;
@@ -270,6 +335,7 @@ public sealed class AgentApp : IDisposable
        long packetsOut = _counters.PacketsOut;
        var extra = new AgentHeartbeatExtra
        {
+            Ipv6 = Ipv6Diagnostics.Sample(_ipv6Supported, Environment.GetEnvironmentVariable("MOSHIRO_NETWORK_SCOPE"), Environment.GetEnvironmentVariable("HOST_PROC")),
            Probes = [.. _hub.ConnectedProbes()],
            Sessions = _sessions.All.Count,
            PpsIn = _lastAtMs == 0 ? 0 : (packetsIn - _lastIn) / seconds,
@@ -277,10 +343,11 @@ public sealed class AgentApp : IDisposable
            DroppedInvalid = _counters.DroppedInvalid,
            DroppedRateLimited = _counters.DroppedRateLimited,
            QueueBytes = _outbox.PendingBytes,
+            Update = _update.ReadStatus(),
        };
        _lastIn = packetsIn;
        _lastOut = packetsOut;
        _lastAtMs = nowMs;
-        return JsonSerializer.SerializeToElement(extra, MonitorJsonContext.Default.AgentHeartbeatExtra);
+        return JsonSerializer.SerializeToElement(extra, MoShiroJsonContext.Default.AgentHeartbeatExtra);
    }
 }
@@ -1,6 +1,6 @@
 using System.Text.Json.Serialization;

-namespace Monitor.Agent;
+namespace MoShiro.Agent;

 /// <summary>
 /// <c>agent.json</c>：节点本地配置，面板无法修改。其中 <c>limits</c> 是本地硬上限：期望任务集超出这些范围时，
@@ -22,6 +22,10 @@ public sealed class AgentConfig

    [JsonPropertyName("reporting")]
    public ReportingSection Reporting { get; set; } = new();
+
+    /// <summary>每天定时重启一次，例如 <c>04:00+08:00</c>（不写偏移按 UTC）；不写就不重启。环境变量 <c>MOSHIRO_RESTART_AT</c> 优先。</summary>
+    [JsonPropertyName("restart_at")]
+    public string? RestartAt { get; set; }
 }

 public sealed class ReportingSection
@@ -40,13 +44,17 @@ public sealed class FleetSection
    public string Server { get; set; } = "";

    [JsonPropertyName("identity_dir")]
-    public string IdentityDir { get; set; } = "/etc/monitor";
+    public string IdentityDir { get; set; } = "/etc/moshiro";
+
+    /// <summary>节点自己要求有属主（passkey）：没有就不运行。见 <c>OwnerGuard</c>。</summary>
+    [JsonPropertyName("require_owner")]
+    public bool RequireOwner { get; set; } = true;
 }

 public sealed class ListenSection
 {
    [JsonPropertyName("bind")]
-    public string Bind { get; set; } = "0.0.0.0";
+    public string Bind { get; set; } = "::";

    /// <summary>Probe 控制通道（TLS，点对点会话）。</summary>
    [JsonPropertyName("control_port")]
@@ -1,9 +1,9 @@
 using Fleet.Core;
 using Fleet.Link;
-using Monitor.Measurement;
-using Monitor.Protocol;
+using MoShiro.Measurement;
+using MoShiro.Protocol;

-namespace Monitor.Agent;
+namespace MoShiro.Agent;

 /// <summary>
 /// Probe 的列块到达之后：找到对应的流 → 与 Agent 在数据面记录的列合并 → 盖章（块头、时钟锚点）→ 编码 → 放进发件箱（通道 16）。
@@ -44,6 +44,7 @@ public sealed class ChunkAssembler
            _ => null,
        };
        header.ProbeId = new ProbeId(probe.ProbeId);
+        header.IpVersion = probe.IpVersion; // 地址族以认证过的控制会话为准，不接受列块自报值
        KindSpec? spec = stream is null ? null : Kinds.Find(stream.Kind);
        if (stream is null || spec is null || spec.Id != header.Kind)
        {
@@ -70,6 +71,6 @@ public sealed class ChunkAssembler
    /// <summary>Agent 自己采集的块（目标任务）直接发出。</summary>
    public void Emit(RawChunk chunk)
    {
-        _outbox.Enqueue(MonitorChannels.RawChunk, chunk.Header.ChunkId.Value, RawChunkCodec.Encode(chunk));
+        _outbox.Enqueue(MoShiroChannels.RawChunk, chunk.Header.ChunkId.Value, RawChunkCodec.Encode(chunk));
    }
 }
@@ -4,10 +4,10 @@ using System.Net.Sockets;
 using Fleet.Core;
 using Fleet.Link;
 using Fleet.Rpc;
-using Monitor.Measurement;
-using Monitor.Protocol;
+using MoShiro.Measurement;
+using MoShiro.Protocol;

-namespace Monitor.Agent;
+namespace MoShiro.Agent;

 /// <summary>进程内计数（只有计数，没有主机信息）：用于心跳和面板上的节点状态。数据面的包计数由共享的 <see cref="DataPlaneCounters"/> 提供。</summary>
 public sealed class AgentCounters
@@ -56,6 +56,10 @@ public sealed class ProbeSession : DataSession

    public string ProbeId => Info.PeerId;

+    public string IpVersion => Info.Remote is IPEndPoint endpoint && endpoint.Address.AddressFamily == AddressFamily.InterNetworkV6 && !endpoint.Address.IsIPv4MappedToIPv6 ? IpVersions.V6 : IpVersions.V4;
+
+    public string PathKey => ProbeId + "~" + IpVersion;
+
    /// <summary>Probe 的程序版本（握手里自报，只用于展示）。</summary>
    public string? Version => Info.Version;

@@ -72,7 +76,7 @@ public sealed class ProbeSession : DataSession
        get
        {
            SocketAddress? source = Volatile.Read(ref _udpSource);
-            return source is null ? null : (IPEndPoint)new IPEndPoint(IPAddress.Any, 0).Create(source);
+            return source is null ? null : (IPEndPoint)new IPEndPoint(source.Family == AddressFamily.InterNetworkV6 ? IPAddress.IPv6Any : IPAddress.Any, 0).Create(source);
        }
    }

@@ -125,7 +129,7 @@ public sealed class ProbeSession : DataSession
    public void ForgetStream(uint streamId) => _windows.TryRemove(streamId, out _);
 }

-/// <summary>当前连着的 Probe 会话：每个 Probe 一个；同一个 Probe 重连时新会话取代它自己的旧会话。</summary>
+/// <summary>每个 Probe 的 IPv4、IPv6 会话独立；重连只替换同地址族的旧会话。</summary>
 public sealed class SessionRegistry : IDataSessions
 {
    private readonly object _gate = new();
@@ -143,11 +147,11 @@ public sealed class SessionRegistry : IDataSessions
        }
    }

-    public ProbeSession? Get(string probeId)
+    public ProbeSession? Get(string probeId, string ipVersion = IpVersions.V4)
    {
        lock (_gate)
        {
-            return _byProbe.GetValueOrDefault(probeId);
+            return _byProbe.GetValueOrDefault(probeId + "~" + ipVersion);
        }
    }

@@ -156,13 +160,13 @@ public sealed class SessionRegistry : IDataSessions
    {
        lock (_gate)
        {
-            _byProbe.TryGetValue(session.ProbeId, out ProbeSession? old);
+            _byProbe.TryGetValue(session.PathKey, out ProbeSession? old);
            if (old is not null)
            {
                _bySession.Remove(old.SessionId);
            }

-            _byProbe[session.ProbeId] = session;
+            _byProbe[session.PathKey] = session;
            _bySession[session.SessionId] = session;
            return old;
        }
@@ -172,9 +176,9 @@ public sealed class SessionRegistry : IDataSessions
    {
        lock (_gate)
        {
-            if (_byProbe.TryGetValue(session.ProbeId, out ProbeSession? current) && ReferenceEquals(current, session))
+            if (_byProbe.TryGetValue(session.PathKey, out ProbeSession? current) && ReferenceEquals(current, session))
            {
-                _byProbe.Remove(session.ProbeId);
+                _byProbe.Remove(session.PathKey);
            }

            if (_bySession.TryGetValue(session.SessionId, out ProbeSession? bySession) && ReferenceEquals(bySession, session))
@@ -1,28 +1,35 @@
 using System.Globalization;
-using Monitor.Protocol;
+using MoShiro.Protocol;

-namespace Monitor.Agent;
+namespace MoShiro.Agent;

 /// <summary>
 /// 主机资源占用的只读快照：CPU 占用、内存、根分区、网卡累计流量与瞬时网速、系统运行时长。
 /// 只有汇总的数字：<b>不采集 CPU 型号、主机名、网卡名和任何 IP 地址</b>，所以面板和展示页想泄漏也泄漏不出去。
-/// Linux 读 <c>/proc</c>；读不到的项是 null（例如 Windows 上的 CPU）。不执行任何命令，不写文件。
+/// Linux 读 <c>/proc</c> 和 <c>/sys</c>；容器通过 HOST_PROC、HOST_SYS、HOST_ROOT 指定宿主路径。
+/// 读不到的项是 null（例如 Windows 上的 CPU）。不执行任何命令，不写文件。
 /// </summary>
 public sealed class HostSampler
 {
-    private static readonly string[] s_virtualPrefixes = ["lo", "veth", "docker", "br-", "virbr", "cni", "flannel", "cali", "tun", "tap"];
+    private static readonly string[] s_virtualPrefixes = ["lo", "veth", "docker", "podman", "br-", "virbr", "cni", "flannel", "cali", "tun", "tap"];

    private readonly TimeProvider _time;
    private readonly Func<string, string?> _read;
    private readonly Func<(long Total, long Used)?> _disk;
+    private readonly string _procRoot;
+    private readonly string _sysRoot;
    private (long Total, long Idle)? _previousCpu;
    private (long At, long Rx, long Tx)? _previousNet;

-    public HostSampler(TimeProvider time, Func<string, string?>? read = null, Func<(long Total, long Used)?>? disk = null)
+    public HostSampler(TimeProvider time, Func<string, string?>? read = null, Func<(long Total, long Used)?>? disk = null,
+        string? procRoot = null, string? sysRoot = null, string? diskRoot = null)
    {
        _time = time;
        _read = read ?? ReadProc;
-        _disk = disk ?? ReadRootDisk;
+        _procRoot = Root(procRoot, "HOST_PROC", "/proc");
+        _sysRoot = Root(sysRoot, "HOST_SYS", "/sys");
+        string root = Root(diskRoot, "HOST_ROOT", OperatingSystem.IsWindows() ? Path.GetPathRoot(Environment.SystemDirectory) ?? "C:\\" : "/");
+        _disk = disk ?? (() => ReadRootDisk(root));
    }

    public HostSnapshot Sample()
@@ -30,7 +37,7 @@ public sealed class HostSampler
        long now = _time.GetTimestamp();
        var snapshot = new HostSnapshot { AtUtcMs = _time.GetUtcNow().ToUnixTimeMilliseconds() };

-        if (_read("/proc/stat") is { } stat && ParseCpu(stat) is { } cpu)
+        if (_read(Path.Combine(_procRoot, "stat")) is { } stat && ParseCpu(stat) is { } cpu)
        {
            if (_previousCpu is { } before && cpu.Total > before.Total)
            {
@@ -41,7 +48,7 @@ public sealed class HostSampler
            _previousCpu = cpu;
        }

-        if (_read("/proc/meminfo") is { } meminfo && ParseMemory(meminfo) is { } memory)
+        if (_read(Path.Combine(_procRoot, "meminfo")) is { } meminfo && ParseMemory(meminfo) is { } memory)
        {
            snapshot.MemTotal = memory.Total;
            snapshot.MemUsed = memory.Used;
@@ -53,10 +60,11 @@ public sealed class HostSampler
            snapshot.DiskUsed = disk.Used;
        }

-        if (_read("/proc/net/dev") is { } dev && ParseNetwork(dev) is { } net)
+        if (_read(Path.Combine(_procRoot, "net/dev")) is { } dev && ParseNetwork(dev) is { } net)
        {
            snapshot.NetRxTotal = net.Rx;
            snapshot.NetTxTotal = net.Tx;
+            snapshot.NetLinkMbps = ReadLinkSpeed(dev);
            if (_previousNet is { } before && net.Rx >= before.Rx && net.Tx >= before.Tx)
            {
                double seconds = Math.Max(0.001, _time.GetElapsedTime(before.At, now).TotalSeconds);
@@ -67,7 +75,11 @@ public sealed class HostSampler
            _previousNet = (now, net.Rx, net.Tx);
        }

-        snapshot.UptimeSeconds = _read("/proc/uptime") is { } uptime && ParseUptime(uptime) is { } up ? up : Environment.TickCount64 / 1000;
+        snapshot.UptimeSeconds = _read(Path.Combine(_procRoot, "uptime")) is { } uptime && ParseUptime(uptime) is { } up ? up : null;
+        if (!OperatingSystem.IsLinux() && snapshot.UptimeSeconds is null)
+        {
+            snapshot.UptimeSeconds = Environment.TickCount64 / 1000;
+        }
        return snapshot;
    }

@@ -165,11 +177,54 @@ public sealed class HostSampler
        }
    }

-    private static (long Total, long Used)? ReadRootDisk()
+    private static string Root(string? value, string variable, string fallback)
+    {
+        value ??= Environment.GetEnvironmentVariable(variable);
+        return string.IsNullOrWhiteSpace(value) ? fallback : value;
+    }
+
+    private long? ReadLinkSpeed(string dev)
+    {
+        long total = 0;
+        bool any = false;
+        foreach (string line in dev.Split('\n'))
+        {
+            int colon = line.IndexOf(':', StringComparison.Ordinal);
+            if (colon < 0)
+            {
+                continue;
+            }
+
+            string name = line[..colon].Trim();
+            if (s_virtualPrefixes.Any(p => name.StartsWith(p, StringComparison.Ordinal)))
+            {
+                continue;
+            }
+
+            string? speed = _read(Path.Combine(_sysRoot, "class/net", name, "speed"));
+            if (long.TryParse(speed?.Trim(), CultureInfo.InvariantCulture, out long mbps) && mbps > 0)
+            {
+                total += mbps;
+                any = true;
+            }
+            else
+            {
+                return null;
+            }
+        }
+
+        return any ? total : null;
+    }
+
+    private static (long Total, long Used)? ReadRootDisk(string root)
    {
        try
        {
-            string root = OperatingSystem.IsWindows() ? Path.GetPathRoot(Environment.SystemDirectory) ?? "C:\\" : "/";
+            if (!Directory.Exists(root))
+            {
+                return null;
+            }
+
            var drive = new DriveInfo(root);
            return drive.IsReady ? (drive.TotalSize, drive.TotalSize - drive.AvailableFreeSpace) : null;
        }
@@ -0,0 +1,26 @@
+<Project>
+  <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.props" Sdk="StuDev.AotAnywhere"
+          Condition="'$(UseAotAnywhere)' == 'true'" />
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <AssemblyName>moshiro-agent</AssemblyName>
+    <RootNamespace>MoShiro.Agent</RootNamespace>
+    <IsAotCompatible>true</IsAotCompatible>
+    <PublishAot>true</PublishAot>
+    <PublishTrimmed>true</PublishTrimmed>
+    <TrimMode>full</TrimMode>
+    <StripSymbols>true</StripSymbols>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <MetadataUpdaterSupport>false</MetadataUpdaterSupport>
+  </PropertyGroup>
+  <ItemGroup>
+    <InternalsVisibleTo Include="MoShiro.Backend.Tests" />
+    <ProjectReference Include="..\..\..\fleet\src\Fleet.Link\Fleet.Link.csproj" />
+    <ProjectReference Include="..\..\..\fleet\src\Fleet.Hosting\Fleet.Hosting.csproj" />
+    <ProjectReference Include="..\..\..\shared\MoShiro.Measurement\MoShiro.Measurement.csproj" />
+  </ItemGroup>
+  <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
+          Condition="'$(UseAotAnywhere)' == 'true'" />
+</Project>
@@ -2,10 +2,10 @@ using System.Text.Json;
 using Fleet.Core;
 using Fleet.Link;
 using Fleet.Rpc;
-using Monitor.Measurement;
-using Monitor.Protocol;
+using MoShiro.Measurement;
+using MoShiro.Protocol;

-namespace Monitor.Agent;
+namespace MoShiro.Agent;

 /// <summary>Agent → Backend 的上行：事件和测试状态是尽力而为的通知（链路断开时丢弃；列块走发件箱，不会丢）。</summary>
 public sealed class BackendUplink
@@ -31,7 +31,7 @@ public sealed class BackendUplink
        }

        var parameters = new AgentEventParams { Kind = kind, AtUtcMs = _time.GetUtcNow().ToUnixTimeMilliseconds(), Detail = detail, Probe = probe };
-        await SafeAsync(() => session.NotifyAsync(MonitorMethods.Event, parameters, MonitorJsonContext.Default.AgentEventParams, CancellationToken.None));
+        await SafeAsync(() => session.NotifyAsync(MoShiroMethods.Event, parameters, MoShiroJsonContext.Default.AgentEventParams, CancellationToken.None));
    }

    public async ValueTask SendHostAsync(HostSnapshot snapshot)
@@ -42,7 +42,7 @@ public sealed class BackendUplink
            return;
        }

-        await SafeAsync(() => session.NotifyAsync(MonitorMethods.Host, snapshot, MonitorJsonContext.Default.HostSnapshot, CancellationToken.None));
+        await SafeAsync(() => session.NotifyAsync(MoShiroMethods.Host, snapshot, MoShiroJsonContext.Default.HostSnapshot, CancellationToken.None));
    }

    public async ValueTask SendTestStatusAsync(TestId test, string status, int? phase = null, string? errorCode = null)
@@ -54,19 +54,7 @@ public sealed class BackendUplink
        }

        var parameters = new TestStatusParams { TestId = test, Status = status, Phase = phase, ErrorCode = errorCode };
-        await SafeAsync(() => session.NotifyAsync(MonitorMethods.TestStatus, parameters, MonitorJsonContext.Default.TestStatusParams, CancellationToken.None));
-    }
-
-    /// <summary>代 Probe 向 Backend 取 Agent 列表（Probe 不认识 Backend）。链路断开时返回 fleet_node_offline。</summary>
-    public async ValueTask<Result<ProbeAgentsResult>> RequestProbeAgentsAsync(ProbeAgentsParams request, CancellationToken ct)
-    {
-        RpcSession<LinkContext>? session = _link?.CurrentSession;
-        if (session is null)
-        {
-            return Result<ProbeAgentsResult>.Fail(FleetErrors.NodeOffline, "the agent has no link to the backend");
-        }
-
-        return await session.RequestAsync(MonitorMethods.ProbeAgents, request, MonitorJsonContext.Default.ProbeAgentsParams, MonitorJsonContext.Default.ProbeAgentsResult, ct);
+        await SafeAsync(() => session.NotifyAsync(MoShiroMethods.TestStatus, parameters, MoShiroJsonContext.Default.TestStatusParams, CancellationToken.None));
    }

    private static async ValueTask SafeAsync(Func<ValueTask> send)
@@ -102,9 +90,12 @@ public sealed class PeerHub
    private readonly TimeProvider _time;
    private readonly INodeLog _log;

+    /// <summary>对等面入站方法的路由器（只读，测试用）。</summary>
+    public RpcRouter<PeerContext> Router => _router;
+
    public PeerHub(SessionRegistry sessions, MonoClock clock, ChunkAssembler chunks, TaskManager tasks, BackendUplink uplink, TimeProvider time, INodeLog log)
    {
-        _router = BuildRouter(uplink);
+        _router = BuildRouter();
        _sessions = sessions;
        _clock = clock;
        _chunks = chunks;
@@ -127,7 +118,7 @@ public sealed class PeerHub
        var order = new Queue<Guid>();
        rpc.OnBinary = async (frame, token) =>
        {
-            if (!OutboxFrame.TryParse(frame, out byte channel, out Guid id, out ReadOnlyMemory<byte> payload) || channel != MonitorChannels.ColumnBlock)
+            if (!OutboxFrame.TryParse(frame, out byte channel, out Guid id, out ReadOnlyMemory<byte> payload) || channel != MoShiroChannels.ColumnBlock)
            {
                return;
            }
@@ -188,7 +179,7 @@ public sealed class PeerHub
            await _tasks.CloseSessionAsync(probe);
            _log.Info("probe disconnected", ("probe", info.PeerId));
            OnProbeLost?.Invoke(probe);
-            await _uplink.EmitEventAsync(AgentEventKinds.ProbeDisconnected, info.PeerId);
+            await _uplink.EmitEventAsync(AgentEventKinds.ProbeDisconnected, info.PeerId, Describe(probe));
        }
    }

@@ -220,7 +211,7 @@ public sealed class PeerHub
    /// <summary>当前连着的 Probe（心跳和 Backend 重连之后的补报都用它）。</summary>
    public IReadOnlyList<ConnectedProbe> ConnectedProbes() => [.. _sessions.All.Select(Describe)];

-    private static ConnectedProbe Describe(ProbeSession p) => new() { Id = new ProbeId(p.ProbeId), Version = p.Version, Remote = p.RemoteAddress, SinceUtcMs = p.ConnectedAtUtcMs };
+    private static ConnectedProbe Describe(ProbeSession p) => new() { Id = new ProbeId(p.ProbeId), Version = p.Version, Remote = p.RemoteAddress, SinceUtcMs = p.ConnectedAtUtcMs, IpVersion = p.IpVersion };

    public IReadOnlyList<string> ConnectedProbeIds() => [.. _sessions.All.Select(p => p.ProbeId)];

@@ -230,13 +221,17 @@ public sealed class PeerHub
    /// <summary>Backend 要求断开某个 Probe（它会按退避重连，除非已经被吊销）。没有这个会话时返回 false。</summary>
    public async ValueTask<bool> DisconnectAsync(string probeId)
    {
-        if (_sessions.Get(probeId)?.Rpc is not { } rpc)
+        bool disconnected = false;
+        foreach (ProbeSession probe in _sessions.All)
        {
-            return false;
+            if (probe.ProbeId == probeId && probe.Rpc is { } rpc)
+            {
+                await rpc.CloseAsync("disconnected", CancellationToken.None);
+                disconnected = true;
+            }
        }

-        await rpc.CloseAsync("disconnected", CancellationToken.None);
-        return true;
+        return disconnected;
    }

    /// <summary>名单（期望状态里的 peers）里已经没有的 Probe：立刻关闭它的会话（吊销生效）。</summary>
@@ -252,27 +247,6 @@ public sealed class PeerHub
        }
    }

-    /// <summary>Backend 的 Agent 列表变化时转交给所有 Probe（Probe 据此调整它连接的 Agent）。</summary>
-    public async ValueTask RelayAgentsAsync(ProbeAgentsResult list)
-    {
-        foreach (ProbeSession probe in _sessions.All)
-        {
-            if (probe.Rpc is not { } rpc)
-            {
-                continue;
-            }
-
-            try
-            {
-                await rpc.NotifyAsync(MonitorMethods.ProbeAgentsChanged, list, MonitorJsonContext.Default.ProbeAgentsResult, CancellationToken.None);
-            }
-            catch (Exception ex) when (ex is ObjectDisposedException or InvalidOperationException or IOException)
-            {
-                // 会话刚好结束
-            }
-        }
-    }
-
    private async ValueTask PushAsync(ProbeSession probe, LineTaskSet set, CancellationToken ct)
    {
        if (probe.Rpc is null)
@@ -284,7 +258,7 @@ public sealed class PeerHub
        {
            Type = LineTaskSet.StateType,
            Version = set.Version,
-            Doc = JsonSerializer.SerializeToElement(set, MonitorJsonContext.Default.LineTaskSet),
+            Doc = JsonSerializer.SerializeToElement(set, MoShiroJsonContext.Default.LineTaskSet),
        };
        try
        {
@@ -300,16 +274,11 @@ public sealed class PeerHub
        }
    }

-    private static RpcRouter<PeerContext> BuildRouter(BackendUplink uplink) =>
-        new RpcRouter<PeerContext>()
+    private static RpcRouter<PeerContext> BuildRouter() =>
+        new RpcRouter<PeerContext>(RpcSide.Listener, MoShiroMethodTable.Table)
            .On(
-                MonitorMethods.ProbeAgents,
-                MonitorJsonContext.Default.ProbeAgentsParams,
-                MonitorJsonContext.Default.ProbeAgentsResult,
-                (_, request, ct) => uplink.RequestProbeAgentsAsync(request, ct))
-            .On(
-                MonitorMethods.Clock,
-                MonitorJsonContext.Default.ClockParams,
-                MonitorJsonContext.Default.ClockResult,
+                MoShiroMethods.Clock,
+                MoShiroJsonContext.Default.ClockParams,
+                MoShiroJsonContext.Default.ClockResult,
                (context, _, _) => ValueTask.FromResult(Result<ClockResult>.Ok(new ClockResult { AgentMonoUs = context.Clock.NowUs() })));
 }
@@ -1,6 +1,6 @@
 using Fleet.Core;
 using Fleet.Hosting;
-using Monitor.Agent;
+using MoShiro.Agent;

 TimeProvider time = TimeProvider.System;
 INodeLog log = new ConsoleNodeLog(time);
@@ -11,7 +11,7 @@ if (PlatformCheck.VerifyCrypto() is { } problem)
    return 1;
 }

-string configPath = "/etc/monitor/agent.json";
+string configPath = "/etc/moshiro/agent.json";
 for (int i = 0; i < args.Length - 1; i++)
 {
    if (args[i] == "--config")
@@ -22,10 +22,17 @@ for (int i = 0; i < args.Length - 1; i++)

 AgentConfig config;
 LoadedNodeIdentity identity;
+RestartController restart;
 try
 {
    config = NodeConfig.Load(configPath, AgentConfigContext.Default.AgentConfig);
+    restart = new RestartController(RestartSchedule.Resolve(config.RestartAt));
    identity = LoadedNodeIdentity.Load(config.Fleet.IdentityDir);
+    if (!OwnerGuard.Check(config.Fleet.IdentityDir, config.Fleet.RequireOwner, log))
+    {
+        identity.Dispose();
+        return 1;
+    }
 }
 catch (Exception ex) when (ex is IOException or InvalidDataException or InvalidOperationException or System.Text.Json.JsonException or System.Security.Cryptography.CryptographicException)
 {
@@ -33,10 +40,11 @@ catch (Exception ex) when (ex is IOException or InvalidDataException or InvalidO
    return 1;
 }

+using var restartScope = restart;
 using (identity)
 {
-    using var app = new AgentApp(config, identity, time, log);
-    await ServiceShell.RunAsync(app.RunAsync, log);
+    using var app = new AgentApp(config, identity, Path.GetDirectoryName(Path.GetFullPath(configPath))!, time, log, restart);
+    await ServiceShell.RunAsync(app.RunAsync, log, restart, time);
 }

 return 0;
@@ -1,10 +1,10 @@
 using System.Net;
 using System.Text.Json;
 using Fleet.Core;
-using Monitor.Measurement;
-using Monitor.Protocol;
+using MoShiro.Measurement;
+using MoShiro.Protocol;

-namespace Monitor.Agent;
+namespace MoShiro.Agent;

 /// <summary>
 /// 目标任务（Agent 自己探测一个地址，没有对端）：用和线路任务同一套积木（<see cref="BlockCatalog"/> 里的拨号方，例如 icmp_echo、connect），
@@ -80,7 +80,7 @@ public sealed class TargetRunners
                Log = _log,
                Session = () => null,
                PeerAddress = address,
-                Fragments = new LocalSink(this, spec),
+                Fragments = new LocalSink(this, spec, address.AddressFamily == System.Net.Sockets.AddressFamily.InterNetworkV6 ? IpVersions.V6 : IpVersions.V4),
            };
            IBlock block = BlockCatalog.Find(spec.Kind)!.Dialer(env, new BlockSpec(decision.Kind!, decision.Resolved!, 0, port, new FragmentScope(spec.Id, null, null)));
            using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
@@ -132,11 +132,13 @@ public sealed class TargetRunners
    {
        private readonly TargetRunners _owner;
        private readonly TaskSpec _spec;
+        private readonly string _ipVersion;

-        public LocalSink(TargetRunners owner, TaskSpec spec)
+        public LocalSink(TargetRunners owner, TaskSpec spec, string ipVersion)
        {
            _owner = owner;
            _spec = spec;
+            _ipVersion = ipVersion;
        }

        public void Ship(string kind, FragmentScope scope, IReadOnlyList<RawStream> streams, IReadOnlyDictionary<string, JsonElement>? parameters, long startUtcMs, int durationMs, int port)
@@ -149,6 +151,7 @@ public sealed class TargetRunners
                TaskId = scope.Task,
                AgentId = _owner._agent,
                Target = _spec.Target,
+                IpVersion = _ipVersion,
                Params = parameters is null ? [] : new Dictionary<string, JsonElement>(parameters),
                Port = port,
                StartUtcMs = startUtcMs,
@@ -1,10 +1,11 @@
 using System.Text.Json;
+using Fleet.Hosting;
 using Fleet.Core;
 using Fleet.Rpc;
-using Monitor.Measurement;
-using Monitor.Protocol;
+using MoShiro.Measurement;
+using MoShiro.Protocol;

-namespace Monitor.Agent;
+namespace MoShiro.Agent;

 /// <summary>
 /// 期望任务集（<c>task_set</c>）的调和器：每个任务先经过 <see cref="BudgetGuard"/>（参数校验 + 本地硬上限）。
@@ -25,14 +26,16 @@ public sealed class TaskManager
    private readonly TargetRunners _targets;
    private readonly Func<IReadOnlyList<int>> _udpPorts;
    private readonly Func<IReadOnlyList<int>> _tcpPorts;
+    private readonly TrustAnchor _trust;
    private readonly Dictionary<ProbeSession, Dictionary<string, LineEntry>> _sessionLines = [];
    private volatile Dictionary<string, byte[]> _peers = new(StringComparer.Ordinal);
    private Dictionary<string, (TaskSpec Task, TaskDecision Decision)> _lineSpecs = [];
    private long _version;
    private BudgetGuard? _guard;

-    public TaskManager(Func<BudgetGuard> guardFactory, StreamRegistry streams, BlockEnv env, TargetRunners targets, Func<IReadOnlyList<int>> udpPorts, Func<IReadOnlyList<int>> tcpPorts)
+    public TaskManager(Func<BudgetGuard> guardFactory, StreamRegistry streams, BlockEnv env, TargetRunners targets, Func<IReadOnlyList<int>> udpPorts, Func<IReadOnlyList<int>> tcpPorts, TrustAnchor? trust = null)
    {
+        _trust = trust ?? TrustAnchor.None;
        _guardFactory = guardFactory;
        _streams = streams;
        _env = env;
@@ -52,6 +55,9 @@ public sealed class TaskManager
    /// <summary>点对点握手时查找 Probe 的公钥（SPKI）。</summary>
    public byte[]? LookupPeerKey(string peerId) => _peers.TryGetValue(peerId, out byte[]? key) ? key : null;

+    /// <summary>名册里全部 Probe 的公钥：敲门关卡用它们派生配对密钥。</summary>
+    public IReadOnlyList<byte[]> PeerKeys() => [.. _peers.Values];
+
    /// <summary>一个新的 Probe 会话开始：为它登记全部线路任务的流并启动监听方积木，返回要下发给它的线路任务集。</summary>
    public LineTaskSet OpenSession(ProbeSession probe)
    {
@@ -95,6 +101,8 @@ public sealed class TaskManager
        _ = ct;
        var result = new StateSyncResult { AppliedVersion = version };

+        // 固定了操作员创世的节点：面板带来的新版本操作员集合，从固定的创世验过才采用（名册本身由面板决定）
+        _trust.Update(set.TrustChain);
        var peers = new Dictionary<string, byte[]>(StringComparer.Ordinal);
        foreach (PeerSpec peer in set.Peers)
        {
@@ -1,15 +1,15 @@
 using System.Collections.Concurrent;
 using Fleet.Core;
 using Fleet.Rpc;
-using Monitor.Measurement;
-using Monitor.Protocol;
+using MoShiro.Measurement;
+using MoShiro.Protocol;

-namespace Monitor.Agent;
+namespace MoShiro.Agent;

 /// <summary>
-/// 按需测试的编排（<c>monitor.test.run</c>）：Agent 是时间的主人。每个阶段：
-/// 登记数据面的流 → <c>monitor.test.phase</c>（Probe 准备好自己一侧的角色）→ 运行（单向数据流由 Agent 发包，回显类等待 Probe 发包）
-/// → <c>monitor.test.phase_end</c>（Probe 收尾，回复它交出的列块个数）→ 等所有列块合并上传 → <c>phase_done</c>。
+/// 按需测试的编排（<c>moshiro.test.run</c>）：Agent 是时间的主人。每个阶段：
+/// 登记数据面的流 → <c>moshiro.test.phase</c>（Probe 准备好自己一侧的角色）→ 运行（单向数据流由 Agent 发包，回显类等待 Probe 发包）
+/// → <c>moshiro.test.phase_end</c>（Probe 收尾，回复它交出的列块个数）→ 等所有列块合并上传 → <c>phase_done</c>。
 /// 同一时间只能运行 <c>max_concurrent_tests</c> 个测试；Probe 掉线或被取消时测试中止，已经上传的阶段数据保留。
 /// </summary>
 public sealed class TestRunner
@@ -43,17 +43,22 @@ public sealed class TestRunner

    public int Running => _running.Count;

-    /// <summary>校验并接受一个测试（立即返回），实际运行在后台进行，状态通过 <c>monitor.test.status</c> 回报。</summary>
+    /// <summary>校验并接受一个测试（立即返回），实际运行在后台进行，状态通过 <c>moshiro.test.status</c> 回报。</summary>
    public Result<TestRunResult> Start(TestRunParams run)
    {
-        if (_sessions.Get(run.ProbeId.Value) is not { } probe)
+        if (!IpVersions.IsValid(run.IpVersion))
        {
-            return Result<TestRunResult>.Fail(MonitorErrors.ProbeOffline, $"probe {run.ProbeId.Value} is not connected to this agent");
+            return Result<TestRunResult>.Fail(MoShiroErrors.ValidationFailed, "ip_version must be ipv4 or ipv6");
+        }
+
+        if (_sessions.Get(run.ProbeId.Value, run.IpVersion) is not { } probe)
+        {
+            return Result<TestRunResult>.Fail(MoShiroErrors.ProbeOffline, $"probe {run.ProbeId.Value} is not connected to this agent");
        }

        if (run.Phases.Count == 0)
        {
-            return Result<TestRunResult>.Fail(MonitorErrors.ValidationFailed, "a test needs at least one phase");
+            return Result<TestRunResult>.Fail(MoShiroErrors.ValidationFailed, "a test needs at least one phase");
        }

        var resolved = new List<(TestPhase Phase, TaskDecision Decision)>();
@@ -64,7 +69,7 @@ public sealed class TestRunner
            if (!decision.Accepted)
            {
                return Result<TestRunResult>.Fail(
-                    decision.Reason == RejectReasons.Unsupported ? FleetErrors.Unsupported : MonitorErrors.BudgetExceeded,
+                    decision.Reason == RejectReasons.Unsupported ? FleetErrors.Unsupported : MoShiroErrors.BudgetExceeded,
                    $"phase {phase.Kind} refused: {decision.Reason}");
            }

@@ -84,7 +89,7 @@ public sealed class TestRunner
        if (_running.Count >= _maxConcurrent || !_running.TryAdd(run.TestId.Value, running))
        {
            running.Dispose();
-            return Result<TestRunResult>.Fail(MonitorErrors.TestBusy, "this agent is already running a test");
+            return Result<TestRunResult>.Fail(MoShiroErrors.TestBusy, "this agent is already running a test");
        }

        _ = Task.Run(() => RunAsync(run.TestId, resolved, running), CancellationToken.None);
@@ -154,7 +159,7 @@ public sealed class TestRunner
        catch (OperationCanceledException)
        {
            finalStatus = running.Lost ? TestStatuses.Failed : TestStatuses.Aborted;
-            errorCode = running.Lost ? MonitorErrors.ProbeOffline.Value : null;
+            errorCode = running.Lost ? MoShiroErrors.ProbeOffline.Value : null;
            await TryAbortProbeAsync(running.Probe, test);
        }
        catch (TestFailure failure)
@@ -183,7 +188,7 @@ public sealed class TestRunner
        _streams.Add(stream);
        try
        {
-            RpcSession<PeerContext> rpc = probe.Rpc ?? throw new TestFailure(MonitorErrors.ProbeOffline.Value);
+            RpcSession<PeerContext> rpc = probe.Rpc ?? throw new TestFailure(MoShiroErrors.ProbeOffline.Value);
            var start = new TestPhaseStartParams
            {
                TestId = test,
@@ -194,7 +199,7 @@ public sealed class TestRunner
                DurationSeconds = durationSeconds,
                Port = stream.Port,
            };
-            Result<TestPhaseStartResult> accepted = await rpc.RequestAsync(MonitorMethods.TestPhase, start, MonitorJsonContext.Default.TestPhaseStartParams, MonitorJsonContext.Default.TestPhaseStartResult, ct);
+            Result<TestPhaseStartResult> accepted = await rpc.RequestAsync(MoShiroMethods.TestPhase, start, MoShiroJsonContext.Default.TestPhaseStartParams, MoShiroJsonContext.Default.TestPhaseStartResult, ct);
            if (!accepted.TryGet(out TestPhaseStartResult? started, out FleetError? error) || !started.Accepted)
            {
                throw new TestFailure(error?.Code.Value ?? FleetErrors.Unsupported.Value);
@@ -209,7 +214,7 @@ public sealed class TestRunner
                }
                catch (BlockFaultException)
                {
-                    throw new TestFailure(MonitorErrors.ProbeOffline.Value);
+                    throw new TestFailure(MoShiroErrors.ProbeOffline.Value);
                }
            }
            else
@@ -219,7 +224,7 @@ public sealed class TestRunner

            long sent = stream.Running.Block.Produced;
            var end = new TestPhaseEndParams { TestId = test, Phase = index, StreamId = stream.Id, SentCount = sent };
-            Result<TestPhaseEndResult> ended = await rpc.RequestAsync(MonitorMethods.TestPhaseEnd, end, MonitorJsonContext.Default.TestPhaseEndParams, MonitorJsonContext.Default.TestPhaseEndResult, ct, s_phaseSlack);
+            Result<TestPhaseEndResult> ended = await rpc.RequestAsync(MoShiroMethods.TestPhaseEnd, end, MoShiroJsonContext.Default.TestPhaseEndParams, MoShiroJsonContext.Default.TestPhaseEndResult, ct, s_phaseSlack);
            if (!ended.TryGet(out TestPhaseEndResult? finished, out FleetError? endError))
            {
                throw new TestFailure(endError.Code.Value);
@@ -254,7 +259,7 @@ public sealed class TestRunner

        try
        {
-            await rpc.NotifyAsync(MonitorMethods.TestAbort, new TestAbortParams { TestId = test }, MonitorJsonContext.Default.TestAbortParams, CancellationToken.None);
+            await rpc.NotifyAsync(MoShiroMethods.TestAbort, new TestAbortParams { TestId = test }, MoShiroJsonContext.Default.TestAbortParams, CancellationToken.None);
        }
        catch (Exception ex) when (ex is ObjectDisposedException or InvalidOperationException or IOException)
        {
@@ -1,20 +0,0 @@
-<Project>
-  <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
-  <Import Project="Sdk.props" Sdk="StuDev.AotAnywhere"
-          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
-  <PropertyGroup>
-    <OutputType>Exe</OutputType>
-    <AssemblyName>monitor-agent</AssemblyName>
-    <RootNamespace>Monitor.Agent</RootNamespace>
-    <IsAotCompatible>true</IsAotCompatible>
-  </PropertyGroup>
-  <ItemGroup>
-    <InternalsVisibleTo Include="Monitor.Backend.Tests" />
-    <ProjectReference Include="..\..\..\fleet\src\Fleet.Link\Fleet.Link.csproj" />
-    <ProjectReference Include="..\..\..\fleet\src\Fleet.Hosting\Fleet.Hosting.csproj" />
-    <ProjectReference Include="..\..\..\shared\Monitor.Measurement\Monitor.Measurement.csproj" />
-  </ItemGroup>
-  <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
-  <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
-          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
-</Project>
@@ -0,0 +1,104 @@
+# Fleet：通用节点框架
+
+「很多节点连到一个面板」这类产品都要解决同一批问题：节点怎么接入、怎么证明身份、怎么保持连接、怎么可靠上报、怎么接收配置。Fleet 把这些做成与业务无关的库，MoShiro 是它的第一个使用者；产品只写业务。Fleet 不引用任何 `MoShiro.*`，也不出现产品的名字、端口和协议前缀，由 `ArchitectureTests` 在构建时检查。
+
+```text
+┌──────────────────── 产品层（MoShiro：Protocol · Measurement · Agent · Probe · Backend）────────────────────┐
+└────────────────────────────────────────────┬─────────────────────────────────────────────────────────────┘
+                                             │ 只依赖 Fleet
+┌───────────────────────────── Fleet ────────┴─────────────────────────────────────────────────────────────┐
+│ 节点侧（只依赖 BCL，NativeAOT）                          服务端侧（ASP.NET Core）                          │
+│ Fleet.Core     Result、退避、有界队列、ID、令牌哈希       Fleet.Server.Abstractions  IFleetStore 等接口      │
+│ Fleet.Identity 密钥、签名、证书、KeyStore                 Fleet.Server.Enrollment    加入令牌、注册、审批     │
+│ Fleet.Rpc      JSON-RPC 信封、路由、二进制帧              Fleet.Server.Link          wss 网关、在线表、状态下发 │
+│ Fleet.Link     会话、认证、重连、发件箱、状态同步、点对点                                                    │
+│ Fleet.Hosting  模块宿主、配置、日志、服务外壳               工具：fleet-enroll（一次性注册）                  │
+│ Fleet.Enrollment.Client  注册流程（给 fleet-enroll 用）                                                      │
+└────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+```
+
+## 设计原则
+
+1. **与业务无关**：产品通过扩展点接入：元数据类型、RPC 方法、发件箱消息类型、期望状态文档类型。
+2. **安全默认值**：Fleet 永远不提供 exec、shell、文件读写、远程下发代码这类方法；节点只响应本地注册过的方法（本地策略 `allow_methods` 还能收窄）；调用对方不支持的方法在本地直接返回 `fleet_unsupported`。
+3. **权限分离**：注册（`fleet-enroll`，一次性）和常驻业务进程是两个进程；常驻进程不含注册代码，也不使用 `HttpClient`。
+4. **NativeAOT**：节点侧只依赖 BCL，泛型扩展点通过产品传入的 `JsonTypeInfo<T>` 序列化，不使用反射。
+5. **更新不在 Fleet 里**：节点进程没有自更新能力。容器节点的签名更新由宿主机上的更新器完成，见 [`docs/deployment.md`](../../docs/deployment.md)；纯二进制节点的更新是待办，见 [`TODO.md`](../../TODO.md)。
+
+## 身份
+
+| 对象 | 算法 | 保存位置 |
+| --- | --- | --- |
+| 节点身份密钥 | ECDSA P-256（BCL 自带） | `<identity_dir>/node.key`（0600）；服务端只保存公钥 |
+| 点对点 TLS 证书 | 自签名 ECDSA P-256 | `<identity_dir>/tls.pfx`；对端按 SPKI SHA-256 指纹校验 |
+| 签名串 | `"fleet|v1|<purpose>|" + 各字段` | 带用途前缀，防止同一个签名在不同场景被复用 |
+
+用途：`auth`（连接服务端）、`peer`（点对点）、`enroll`（注册时的持有证明）。产品可以追加自己的用途，不能占用 `fleet` 保留的。
+
+## 注册
+
+```text
+管理员 ── 创建加入令牌 {labels, max_uses, expires_at, auto_approve} ──> 服务端
+       <── 令牌明文（只返回一次）+ 安装命令
+
+节点：fleet-enroll --server https://panel --join jt_xxx --name jp-1 --identity-dir /etc/myapp
+  ├─ 生成身份密钥和 TLS 证书
+  ├─ POST 注册端点 { join_token, name, pubkey, tls_spki, proof = 签名("enroll", 令牌哈希 + pubkey), node_version, meta }
+  │    服务端：校验令牌 → uses+1 → 创建节点（active 或 pending）→ 触发产品的 IEnrollmentHook
+  └─ 写入 <identity_dir>/node.json { node_id, server, … }，然后退出
+```
+
+- 同名节点已存在时，新注册进入 `pending`，管理员选择「接管」（旧记录换成新公钥，历史数据保留）或「作为新节点」。
+- 节点状态：`pending`（能连接，但不下发状态、不接收上报）、`active`、`disabled`（拒绝连接）。
+
+## RPC
+
+- JSON-RPC 2.0；方法名 `领域.动作`，`fleet.*` 保留给框架，产品用自己的前缀（MoShiro 是 `moshiro.*`）。
+- 二进制帧 `u8 channel | 正文`：`0`–`15` 框架保留，产品从 `16` 开始。
+- 错误：`error.data.code` 为 snake_case，框架的以 `fleet_` 开头，产品可以扩展。
+- **方法必须声明**：每个方法在声明表（`MethodTable`）里写明发起方、请求还是通知、哪些角色可以参与；不存在双向方法，同一个方法名在一个平面里只有一个发起方。`RpcRouter` 在注册、分发和发送三处核对，违规回 `fleet_protocol_violation`，超过上限断开连接。详见 [`docs/security.md`](../../docs/security.md) 第 8 节。
+- 与传输无关：同一套路由跑在 wss 上，也跑在 TLS 帧（`u32 长度 | u8 类型 | 正文`）上。
+
+| 保留方法 | 方向 | 说明 |
+| --- | --- | --- |
+| `fleet.challenge` / `fleet.auth` | 服务端→节点 / 节点→服务端 | 签名认证（`auth` 用途，nonce 30 秒内有效） |
+| `fleet.hello` | 节点→服务端 | 版本、能力、本地策略摘要、当前时间 → 返回时钟偏差；产品的元数据也放在这里 |
+| `fleet.heartbeat` | 节点→服务端 | 每 10 秒一次，产品可以附加计数 |
+| `fleet.state.sync` | 服务端→节点 | `{version, doc}` → `{applied_version, rejected[]}` |
+| `fleet.outbox.ack` | 服务端→节点 | `{ids[], duplicates[]}` |
+| `fleet.revoked` | 服务端→节点 | 节点被禁用或接管，随后断开 |
+
+## 连接
+
+```text
+connect(wss) → fleet.challenge → fleet.auth → fleet.hello → 状态同步 → 正常运行
+      ▲                                                                  │
+      └──── 指数退避重连（1 s → 60 s，带抖动；401 或 revoked 时停止重试）◀─ 断开
+```
+
+本地策略：`allow_methods`、`max_frame_bytes`、`max_inflight`。
+
+**可靠发件箱**：产品 `EnqueueAsync` → 有界队列（按字节和条数；满时 `DropOldest` 或 `Reject`）→ 发送 → 服务端收件箱（`IInbox`）持久化后 `fleet.outbox.ack` → 移除。至少一次，按 `msg_id`（UUIDv7）去重；在途数据默认限 4 MiB；丢弃会累计缺口，通过 `OnGap` 通知产品。只在内存里，不落盘。
+
+**期望状态同步**：服务端 `IStateProvider<TDoc>` 给每个节点算 `{version, doc}`，变化时 `NotifyChanged` 推送；节点 `StateHandler<TDoc>` 调和后返回 `{applied_version, rejected[]}`。下发的是**完整快照**，天然幂等，重连后服务端总会重发当前版本。`rejected[]` 带结构化原因（`unsupported`、`budget_exceeded`、`policy_denied`），面板可以直接展示。
+
+## 点对点会话
+
+```text
+节点 A（发起方，如 Probe）── TLS（按 SPKI 校验证书）──> 节点 B（监听方，如 Agent）
+    <── fleet.peer.challenge ──
+    ── fleet.peer.auth（peer 用途，A 的私钥签名）──>
+    B 用服务端下发的对端公钥列表验签（经 state.sync 下发），之后复用同一套 Rpc：路由、二进制通道、发件箱
+```
+
+握手用两个方法：`fleet.peer.challenge`（监听方→拨号方，通知）和 `fleet.peer.auth`（拨号方→监听方，请求）；握手完成后，两侧各自只能发起声明表里属于自己这一侧的方法。
+
+对端公钥和允许连接的节点由产品通过期望状态下发给监听方，Fleet 只管认证和会话，拓扑由产品决定；UDP、原始 TCP 数据面由产品自己实现，Fleet 只提供会话密钥派生和首帧 MAC 的辅助函数。
+
+## 宿主与服务端抽象
+
+- `ModuleHost`：按依赖顺序启动模块、相反顺序停止，隔离故障，重启时退避。
+- `NodeConfig`：源生成 JSON 读取，环境变量覆盖，启动时校验。
+- `ConfigStore`：常驻进程里**唯一**允许写文件的地方，只能写配置目录，写入原子替换、权限 0600；父目录不存在会创建。
+- `ServiceShell`：SIGTERM、Ctrl+C，systemd `sd_notify`、OpenWrt procd（前台运行）和 Windows 服务。
+- 服务端接口：`IFleetStore`（节点、令牌、公钥、状态版本）、`IStateProvider<TDoc>`、`IInbox`、`INodeEventSink`、`IEnrollmentHook`。MoShiro 把 `IFleetStore` 放进自己的 `moshiro.db`，和业务数据由同一个单写入者写入。
@@ -0,0 +1,43 @@
+using System.Security.Cryptography;
+
+namespace Fleet.Core;
+
+/// <summary>
+/// 节点握手时自述的「我跑的是哪个二进制」：正在运行的可执行文件的 SHA-256，以及（容器节点）宿主机更新器验过的 CI 签名清单和签名。
+/// 服务端在节点第一次握手成功的那一刻把哈希绑定到这个节点，之后哈希对不上就不让它继续运行。
+/// </summary>
+public sealed record BinaryAttestation(string Sha256, string? Manifest, string? Signature);
+
+/// <summary>
+/// 正在运行的二进制的哈希。Linux 上读 <c>/proc/self/exe</c>：它指向进程启动时映射的那个映像，磁盘上的文件之后被换掉也不影响，
+/// 所以「运行期间被替换、重启后换了别的」的情况下一次握手就会对不上。算一次，之后缓存。
+/// </summary>
+public static class NodeBinary
+{
+    private static readonly Lazy<string?> s_hash = new(Compute);
+
+    /// <summary>小写十六进制；读不到可执行文件时为 null（这样的节点不做绑定）。</summary>
+    public static string? Sha256Hex => s_hash.Value;
+
+    /// <summary>在后台先算好，免得第一次握手等它。</summary>
+    public static void Prime() => _ = Task.Run(() => s_hash.Value);
+
+    private static string? Compute()
+    {
+        try
+        {
+            string? path = OperatingSystem.IsLinux() && File.Exists("/proc/self/exe") ? "/proc/self/exe" : Environment.ProcessPath;
+            if (path is null)
+            {
+                return null;
+            }
+
+            using var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete, 1 << 16);
+            return Convert.ToHexStringLower(SHA256.HashData(stream));
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return null;
+        }
+    }
+}
@@ -13,6 +13,8 @@ public static class FleetErrors
    public static readonly ErrorCode Unauthorized = new("fleet_unauthorized");
    public static readonly ErrorCode Forbidden = new("fleet_forbidden");
    public static readonly ErrorCode Unsupported = new("fleet_unsupported");
+    /// <summary>方法没有声明、方向不对、类型不对或角色不允许：对方违反了协议。</summary>
+    public static readonly ErrorCode ProtocolViolation = new("fleet_protocol_violation");
    public static readonly ErrorCode InvalidParams = new("fleet_invalid_params");
    public static readonly ErrorCode NotFound = new("fleet_not_found");
    public static readonly ErrorCode Internal = new("fleet_internal");
@@ -25,4 +27,6 @@ public static class FleetErrors
    public static readonly ErrorCode JoinTokenExpired = new("fleet_join_token_expired");
    public static readonly ErrorCode ProofInvalid = new("fleet_proof_invalid");
    public static readonly ErrorCode FrameTooLarge = new("fleet_frame_too_large");
+    /// <summary>节点现在跑的二进制和它第一次握手时绑定的不一致，也不在 CI 签名的更新清单里。</summary>
+    public static readonly ErrorCode BinaryMismatch = new("fleet_binary_mismatch");
 }
@@ -3,7 +3,7 @@ using System.Text.Json.Serialization;

 namespace Fleet.Core;

-/// <summary>节点 ID（带类型前缀的 ULID）。Monitor 中的 AgentId 就是 NodeId。</summary>
+/// <summary>节点 ID（带类型前缀的 ULID）。MoShiro 中的 AgentId 就是 NodeId。</summary>
 [JsonConverter(typeof(NodeIdJsonConverter))]
 public readonly record struct NodeId(string Value)
 {
@@ -0,0 +1,29 @@
+using System.Text.Json.Serialization;
+
+namespace Fleet.Core;
+
+/// <summary>passkey 对一段语句签出的断言（字段都是 base64url）。信任根的格式和验证在 Fleet.Identity 的 <c>OperatorTrust</c>。</summary>
+public sealed class SignedStatementDto
+{
+    [JsonPropertyName("statement")]
+    public string Statement { get; set; } = "";
+
+    [JsonPropertyName("credential_id")]
+    public string CredentialId { get; set; } = "";
+
+    [JsonPropertyName("authenticator_data")]
+    public string AuthenticatorData { get; set; } = "";
+
+    [JsonPropertyName("client_data_json")]
+    public string ClientDataJson { get; set; } = "";
+
+    [JsonPropertyName("signature")]
+    public string Signature { get; set; } = "";
+}
+
+/// <summary>操作员集合的链（创世在前）：节点注册时取来，从固定的创世指纹验过才采用。</summary>
+public sealed class TrustBundle
+{
+    [JsonPropertyName("chain")]
+    public List<SignedStatementDto> Chain { get; set; } = [];
+}
@@ -2,13 +2,17 @@ using System.Security.Cryptography;
 using System.Text;
 using System.Text.Json;
 using System.Text.Json.Nodes;
+using System.Text.Json.Serialization;
 using Fleet.Core;
 using Fleet.Hosting;
 using Fleet.Identity;

 namespace Fleet.Enrollment.Client;

-public sealed record EnrollmentResult(string NodeId, string Status, string IdentityDirectory);
+[JsonSerializable(typeof(TrustBundle))]
+internal sealed partial class TrustBundleContext : JsonSerializerContext;
+
+public sealed record EnrollmentResult(string NodeId, string Status, string IdentityDirectory, bool Pinned = false);

 /// <summary>
 /// 用加入令牌注册（供 <c>fleet-enroll</c> 使用，也可以嵌入产品自己的安装工具）：
@@ -18,7 +22,8 @@ public sealed record EnrollmentResult(string NodeId, string Status, string Ident
 public static class EnrollmentClient
 {
    public static async Task<Result<EnrollmentResult>> EnrollAsync(
-        HttpClient http, Uri server, string joinToken, string name, string identityDirectory, string nodeVersion, JsonNode? productMeta, TimeProvider time, CancellationToken ct)
+        HttpClient http, Uri server, string joinToken, string name, string identityDirectory, string nodeVersion, JsonNode? productMeta, TimeProvider time, CancellationToken ct,
+        string? genesis = null, IReadOnlyList<string>? controllers = null)
    {
        string nodeFile = Path.Combine(identityDirectory, LoadedNodeIdentity.NodeFileName);
        if (File.Exists(nodeFile))
@@ -29,9 +34,29 @@ public static class EnrollmentClient
        using NodeIdentity identity = NodeIdentity.Generate();
        byte[] pfx = NodeCertificate.CreateSelfSignedPfx(name, TimeSpan.FromDays(3650), time);
        byte[] spki;
+        byte[] tlsPublicKey;
        using (var certificate = NodeCertificate.LoadPfx(pfx))
        {
            spki = NodeCertificate.SpkiFingerprint(certificate);
+            tlsPublicKey = certificate.PublicKey.ExportSubjectPublicKeyInfo();
+        }
+
+        // 安装命令里带了创世指纹（--genesis）和属主（--controllers）：先取操作员集合链，从固定的创世验起，
+        // 属主必须是集合里的凭证；对不上就不注册，也不把自己的密钥交出去。通过之后固定到本地 trust.json，Backend 之后改不了。
+        TrustBundle? bundle = null;
+        if (genesis is not null)
+        {
+            if (controllers is not { Count: > 0 })
+            {
+                // 每个节点都必须有属主：没有属主的节点没有人能授权它的敏感操作
+                return Result<EnrollmentResult>.Fail(FleetErrors.InvalidParams, "an owner is required: pass the passkey credential ids from the panel's command (--controllers)");
+            }
+
+            Result<TrustBundle> trusted = await FetchTrustAsync(http, server, joinToken, genesis, controllers ?? [], ct);
+            if (!trusted.TryGet(out bundle, out FleetError? trustError))
+            {
+                return Result<EnrollmentResult>.Fail(trustError);
+            }
        }

        string pubkey = Convert.ToBase64String(identity.PublicKeySpki);
@@ -42,6 +67,7 @@ public static class EnrollmentClient
            ["name"] = name,
            ["pubkey"] = pubkey,
            ["tls_spki"] = Convert.ToBase64String(spki),
+            ["tls_pubkey"] = Convert.ToBase64String(tlsPublicKey),
            ["proof"] = Convert.ToBase64String(identity.Sign(SignaturePurpose.Enroll, tokenHash, pubkey)),
            ["node_version"] = nodeVersion,
            ["meta"] = productMeta,
@@ -73,10 +99,46 @@ public static class EnrollmentClient
        var store = new ConfigStore(identityDirectory);
        store.Write(LoadedNodeIdentity.KeyFileName, identity.ExportPkcs8());
        store.Write(LoadedNodeIdentity.TlsFileName, pfx);
+        if (bundle is not null)
+        {
+            TrustAnchor.Pin(identityDirectory, genesis!, bundle.Chain, controllers ?? []);
+        }
+
        // node.json 最后写：它存在就表示注册完整完成
        store.Write(
            LoadedNodeIdentity.NodeFileName,
            JsonSerializer.SerializeToUtf8Bytes(new NodeFile { NodeId = nodeId, Server = server.ToString().TrimEnd('/'), TlsSpki = Convert.ToBase64String(spki) }, NodeFileContext.Default.NodeFile));
-        return Result<EnrollmentResult>.Ok(new EnrollmentResult(nodeId, result["status"]!.GetValue<string>(), identityDirectory));
+        return Result<EnrollmentResult>.Ok(new EnrollmentResult(nodeId, result["status"]!.GetValue<string>(), identityDirectory, bundle is not null));
+    }
+
+    private static async Task<Result<TrustBundle>> FetchTrustAsync(HttpClient http, Uri server, string joinToken, string genesis, IReadOnlyList<string> controllers, CancellationToken ct)
+    {
+        static Result<TrustBundle> Refuse(string reason) => Result<TrustBundle>.Fail(FleetErrors.ProofInvalid, "refusing to enroll: " + reason);
+
+        using var request = new StringContent(new JsonObject { ["join_token"] = joinToken }.ToJsonString(), Encoding.UTF8, "application/json");
+        using HttpResponseMessage response = await http.PostAsync(new Uri(server, "/api/agent/v1/enroll/trust"), request, ct);
+        if (!response.IsSuccessStatusCode)
+        {
+            return Result<TrustBundle>.Fail(FleetErrors.JoinTokenInvalid, $"{(int)response.StatusCode}: the panel would not give the trust chain");
+        }
+
+        TrustBundle? bundle = JsonSerializer.Deserialize(await response.Content.ReadAsStringAsync(ct), TrustBundleContext.Default.TrustBundle);
+        if (bundle is null || bundle.Chain.Count == 0)
+        {
+            return Refuse("the panel has no operator trust root set up");
+        }
+
+        OperatorSet? current = OperatorTrust.VerifyChain(genesis, [.. bundle.Chain.Select(c => c.ToSigned())]);
+        if (current is null)
+        {
+            return Refuse("the panel's operator set does not match the pinned genesis fingerprint (wrong panel, or the panel was tampered with)");
+        }
+
+        if (controllers.Any(c => current.Keys.All(k => k.CredentialId != c)))
+        {
+            return Refuse("an owner passkey in the install command is not in the operator set");
+        }
+
+        return Result<TrustBundle>.Ok(bundle);
    }
 }
@@ -126,7 +126,8 @@ public static class PlatformCheck
 /// <summary>处理 Ctrl+C 和 SIGTERM：取消令牌，让各个模块有序退出。</summary>
 public static class ServiceShell
 {
-    public static async Task RunAsync(Func<CancellationToken, Task> run, INodeLog log)
+    /// <param name="restart">每天定时有序退出一次（见 <see cref="RestartController"/>），重新拉起由服务管理器负责。</param>
+    public static async Task RunAsync(Func<CancellationToken, Task> run, INodeLog log, RestartController? restart = null, TimeProvider? time = null)
    {
        using var cts = new CancellationTokenSource();
        using PosixSignalRegistration term = PosixSignalRegistration.Create(PosixSignal.SIGTERM, context =>
@@ -156,6 +157,7 @@ public static class ServiceShell
            cts.Cancel();
        });
        Task trimmer = TrimHeapAsync(cts.Token);
+        Task scheduled = restart is null ? Task.CompletedTask : WaitForRestartAsync(restart, time ?? TimeProvider.System, log, cts);
        try
        {
            await run(cts.Token);
@@ -168,6 +170,38 @@ public static class ServiceShell
        {
            await cts.CancelAsync();
            await trimmer;
+            await scheduled;
+        }
+    }
+
+    private static async Task WaitForRestartAsync(RestartController restart, TimeProvider time, INodeLog log, CancellationTokenSource cts)
+    {
+        while (!cts.IsCancellationRequested)
+        {
+            // 先取令牌、再取设置：中间被改动的话令牌会被取消，下一轮重新排
+            CancellationToken changed = restart.ChangeToken;
+            RestartSchedule? schedule = restart.Current;
+            using CancellationTokenSource wait = CancellationTokenSource.CreateLinkedTokenSource(cts.Token, changed);
+            try
+            {
+                if (schedule is null)
+                {
+                    await Task.Delay(Timeout.Infinite, wait.Token);
+                    continue;
+                }
+
+                DateTimeOffset next = schedule.NextAfter(time.GetUtcNow() + RestartSchedule.MinimumUptime);
+                log.Info("restart scheduled", ("at", next.ToString("O", System.Globalization.CultureInfo.InvariantCulture)), ("source", restart.IsLocal ? "local" : "panel"));
+                await Task.Delay(next - time.GetUtcNow(), time, wait.Token);
+            }
+            catch (OperationCanceledException)
+            {
+                continue; // 进程在退出，或者设置被改了：循环条件和下一轮会处理
+            }
+
+            log.Info("stopping", ("result", "scheduled_restart"));
+            await cts.CancelAsync();
+            return;
        }
    }

@@ -243,7 +277,8 @@ public sealed class ConfigStore
            throw new InvalidOperationException("config files must stay inside the config directory");
        }

-        Directory.CreateDirectory(_directory);
+        // 相对路径里的子目录（例如 update/）也要建：新建的命名卷里只有镜像自带的目录
+        Directory.CreateDirectory(Path.GetDirectoryName(path)!);
        string temp = path + ".tmp";
 #pragma warning disable RS0030 // 纯采集边界的唯一豁免点：ConfigStore 只写配置目录，先写临时文件再原子替换
        File.WriteAllBytes(temp, content);
@@ -296,6 +331,15 @@ public sealed class LoadedNodeIdentity : IDisposable

    public X509Certificate2 Certificate { get; }

+    /// <summary>
+    /// 对等面的签名身份：TLS 证书的那把密钥，和连服务端用的 <see cref="Identity"/> 是两把独立的密钥，
+    /// 各自只用于自己的用途（一把泄露不影响另一把）。
+    /// </summary>
+    public NodeIdentity PeerIdentity => _peerIdentity ??= NodeIdentity.FromPkcs8(
+        (Certificate.GetECDsaPrivateKey() ?? throw new InvalidDataException("the node certificate has no ECDSA private key")).ExportPkcs8PrivateKey());
+
+    private NodeIdentity? _peerIdentity;
+
    public static LoadedNodeIdentity Load(string directory)
    {
        if (!System.IO.File.Exists(Path.Combine(directory, KeyFileName)) || !System.IO.File.Exists(Path.Combine(directory, TlsFileName)))
@@ -312,6 +356,7 @@ public sealed class LoadedNodeIdentity : IDisposable
    public void Dispose()
    {
        Identity.Dispose();
+        _peerIdentity?.Dispose();
        Certificate.Dispose();
    }
 }
@@ -0,0 +1,48 @@
+using Fleet.Core;
+
+namespace Fleet.Hosting;
+
+/// <summary>
+/// 节点自己要求有属主（passkey）：Agent 和 Probe 共用这一份，启动时检查。
+/// <para>
+/// 属主是安装命令带来、注册时固定在 <c>trust.json</c> 里的 passkey 凭证 id（必须是操作员集合里的凭证）。节点据此知道自己绑定在哪个 passkey 上，
+/// 才敢把更多的接口和操作交给它（extension 会话、加密内容都只认属主的 passkey）；没有属主的节点没有人能授权它的敏感能力，所以不运行。
+/// 这是节点本地的强制，不依赖面板：面板被攻破也改不了节点已经固定的属主。
+/// </para>
+/// </summary>
+public static class OwnerGuard
+{
+    /// <summary>设为 <c>1</c> 放行没有属主的节点（只给没有信任根的老面板）。</summary>
+    public const string AllowEnvironmentVariable = "MOSHIRO_ALLOW_NO_OWNER";
+
+    /// <summary>没问题返回 null；否则是要告诉运维的原因。</summary>
+    public static string? Problem(TrustAnchor trust, bool require)
+    {
+        if (!require || Environment.GetEnvironmentVariable(AllowEnvironmentVariable) == "1")
+        {
+            return null;
+        }
+
+        if (!trust.Pinned)
+        {
+            return "this node has no owner: it was not enrolled with a trust root and owner passkeys; enroll it again with the command from the panel (or set " + AllowEnvironmentVariable + "=1 for a panel without a trust root)";
+        }
+
+        return trust.Controllers.Count == 0
+            ? "none of this node's owner passkeys is in the operator set any more; enroll it again with a command from the panel"
+            : null;
+    }
+
+    /// <summary>读身份目录里固定的信任根，检查属主；不行就记一条错误并返回 false（调用方应当退出）。</summary>
+    public static bool Check(string identityDirectory, bool require, INodeLog log)
+    {
+        TrustAnchor trust = TrustAnchor.Load(identityDirectory, log);
+        if (Problem(trust, require) is { } problem)
+        {
+            log.Error("startup failed", ("err", problem));
+            return false;
+        }
+
+        return true;
+    }
+}
@@ -0,0 +1,73 @@
+namespace Fleet.Hosting;
+
+/// <summary>
+/// 当前生效的定时重启：节点本地的设置优先；本地没有写时用面板下发的，面板改了之后立即重新排下一次，不需要重启进程。
+/// </summary>
+public sealed class RestartController : IDisposable
+{
+    private readonly RestartSchedule? _local;
+    private readonly object _gate = new();
+    private RestartSchedule? _remote;
+    private CancellationTokenSource _changed = new();
+
+    public RestartController(RestartSchedule? local = null)
+    {
+        _local = local;
+    }
+
+    /// <summary>本地有设置时为 true：面板下发的不生效。</summary>
+    public bool IsLocal => _local is not null;
+
+    public RestartSchedule? Current
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _local ?? _remote;
+            }
+        }
+    }
+
+    /// <summary>当前设置被改动时会被取消的令牌；先取令牌、再取 <see cref="Current"/>，就不会漏掉中间的改动。</summary>
+    public CancellationToken ChangeToken
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _changed.Token;
+            }
+        }
+    }
+
+    /// <summary>面板下发的设置；为空表示面板关闭了定时重启。返回 false 表示文本不合法（节点忽略它）。</summary>
+    public bool SetRemote(string? text)
+    {
+        RestartSchedule? schedule = null;
+        if (!string.IsNullOrWhiteSpace(text) && !RestartSchedule.TryParse(text, out schedule))
+        {
+            return false;
+        }
+
+        CancellationTokenSource previous;
+        lock (_gate)
+        {
+            _remote = schedule;
+            previous = _changed;
+            _changed = new CancellationTokenSource();
+        }
+
+        previous.Cancel();
+        previous.Dispose();
+        return true;
+    }
+
+    public void Dispose()
+    {
+        lock (_gate)
+        {
+            _changed.Dispose();
+        }
+    }
+}
@@ -0,0 +1,105 @@
+using System.Globalization;
+
+namespace Fleet.Hosting;
+
+/// <summary>
+/// 每天固定时刻有序退出一次，由 systemd、容器引擎或 procd 的「总是重启」拉起。写法 <c>HH:mm</c>（按 UTC）、
+/// <c>HH:mm±hh:mm</c> 或 <c>HH:mm</c> 加 <c>Z</c>：容器里没有时区数据库，所以偏移要写明，例如 <c>04:00+08:00</c>。
+/// 进程自己退出，不需要任何执行外部命令的能力。
+/// </summary>
+public sealed class RestartSchedule
+{
+    /// <summary>环境变量，设置了就覆盖配置文件里的值。</summary>
+    public const string EnvironmentVariable = "MOSHIRO_RESTART_AT";
+
+    /// <summary>刚启动的一段时间内不会触发：重启之后不会因为时刻还没过去而再重启一次，也避免重启风暴。</summary>
+    public static readonly TimeSpan MinimumUptime = TimeSpan.FromMinutes(10);
+
+    private readonly TimeSpan _time;
+    private readonly TimeSpan _offset;
+
+    private RestartSchedule(TimeSpan time, TimeSpan offset)
+    {
+        _time = time;
+        _offset = offset;
+    }
+
+    public static bool TryParse(string? text, out RestartSchedule? schedule)
+    {
+        schedule = null;
+        string value = text?.Trim() ?? "";
+        // HH:mm，后面可以跟 Z 或 ±hh:mm
+        if (value.Length < 5 || value[2] != ':' ||
+            !TryTwoDigits(value, 0, out int hour) || !TryTwoDigits(value, 3, out int minute) || hour > 23 || minute > 59)
+        {
+            return false;
+        }
+
+        TimeSpan offset = TimeSpan.Zero;
+        string rest = value[5..];
+        if (rest.Length > 0 && rest != "Z")
+        {
+            if (rest.Length != 6 || rest[0] is not ('+' or '-') || rest[3] != ':' ||
+                !TryTwoDigits(rest, 1, out int offsetHours) || !TryTwoDigits(rest, 4, out int offsetMinutes) || offsetMinutes > 59)
+            {
+                return false;
+            }
+
+            offset = new TimeSpan(offsetHours, offsetMinutes, 0);
+            if (offset > TimeSpan.FromHours(14))
+            {
+                return false;
+            }
+
+            if (rest[0] == '-')
+            {
+                offset = -offset;
+            }
+        }
+
+        schedule = new RestartSchedule(new TimeSpan(hour, minute, 0), offset);
+        return true;
+    }
+
+    private static bool TryTwoDigits(string text, int start, out int value)
+    {
+        value = 0;
+        if (!char.IsAsciiDigit(text[start]) || !char.IsAsciiDigit(text[start + 1]))
+        {
+            return false;
+        }
+
+        value = (text[start] - '0') * 10 + (text[start + 1] - '0');
+        return true;
+    }
+
+    /// <summary>
+    /// 环境变量优先，其次配置文件的值；都没有就不定时重启。写错了抛 <see cref="InvalidOperationException"/>，
+    /// 启动时就能看到，而不是悄悄不生效。
+    /// </summary>
+    public static RestartSchedule? Resolve(string? configured)
+    {
+        string? text = Environment.GetEnvironmentVariable(EnvironmentVariable);
+        if (string.IsNullOrWhiteSpace(text))
+        {
+            text = configured;
+        }
+
+        if (string.IsNullOrWhiteSpace(text))
+        {
+            return null;
+        }
+
+        return TryParse(text, out RestartSchedule? schedule)
+            ? schedule
+            : throw new InvalidOperationException($"restart_at must look like 04:00, 04:00Z or 04:00+08:00 (got '{text}')");
+    }
+
+    /// <summary>严格晚于 <paramref name="now"/> 的下一个触发时刻。</summary>
+    public DateTimeOffset NextAfter(DateTimeOffset now)
+    {
+        DateTimeOffset local = now.ToOffset(_offset);
+        DateTimeOffset candidate = new DateTimeOffset(local.Year, local.Month, local.Day, 0, 0, 0, _offset) + _time;
+        return candidate <= local ? candidate.AddDays(1) : candidate;
+    }
+}
@@ -0,0 +1,170 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Fleet.Core;
+using Fleet.Identity;
+
+namespace Fleet.Hosting;
+
+/// <summary><c>trust.json</c>：安装时固定的创世指纹和属主，加见过的最新操作员集合链。</summary>
+public sealed class TrustFile
+{
+    [JsonPropertyName("genesis")]
+    public string Genesis { get; set; } = "";
+
+    [JsonPropertyName("chain")]
+    public List<SignedStatementDto> Chain { get; set; } = [];
+
+    /// <summary>属主：允许授权本节点 extension 会话（web ssh 等）的 passkey 凭证 id，安装时固定，必须是操作员集合里的凭证。</summary>
+    [JsonPropertyName("controllers")]
+    public List<string> Controllers { get; set; } = [];
+}
+
+[JsonSerializable(typeof(TrustFile))]
+public sealed partial class TrustFileContext : JsonSerializerContext;
+
+/// <summary>
+/// 节点的信任根：安装命令里带来的创世指纹和属主，在注册时固定到本地，之后 Backend 改不了。
+/// 操作员集合的新版本随期望状态下发，节点只接受从固定的创世出发、签名完整、版本更新的链。
+/// 属主只是被固定和保存：节点现在没有 extension，等做 extension 时由节点本地强制（见 docs/access.md 第 8 节）。
+/// </summary>
+public sealed class TrustAnchor : IServerVerifier
+{
+    public const string FileName = "trust.json";
+
+    private readonly ConfigStore? _store;
+    private readonly INodeLog _log;
+    private readonly object _gate = new();
+    private readonly TrustFile? _file;
+    private OperatorSet? _current;
+
+    private TrustAnchor(ConfigStore? store, TrustFile? file, OperatorSet? current, INodeLog log)
+    {
+        _store = store;
+        _file = file;
+        _current = current;
+        _log = log;
+    }
+
+    /// <summary>没有固定的创世（旧节点，或没有指纹的安装）。</summary>
+    public static TrustAnchor None { get; } = new(null, null, null, NullNodeLog.Instance);
+
+    public bool Pinned => _file is not null;
+
+    public string? Genesis => _file?.Genesis;
+
+    /// <summary>当前生效的操作员集合版本；没有固定时为 0。</summary>
+    public int Version
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _current?.Version ?? 0;
+            }
+        }
+    }
+
+    /// <summary>当前操作员集合里登记了服务器密钥：服务器必须在认证挑战里证明自己，链路用应用层加密。</summary>
+    public bool Required
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _current?.Servers is { Count: > 0 };
+            }
+        }
+    }
+
+    /// <summary>服务器的签名是不是当前操作员集合里登记的某把服务器密钥签的。</summary>
+    public bool Verify(string nonce, ReadOnlySpan<byte> serverEphemeralSpki, ReadOnlySpan<byte> signature)
+    {
+        IReadOnlyList<byte[]> servers;
+        lock (_gate)
+        {
+            servers = _current?.Servers ?? [];
+        }
+
+        foreach (byte[] server in servers)
+        {
+            if (ServerHello.Verify(server, nonce, serverEphemeralSpki, signature))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>安装时固定的属主里，仍然在当前操作员集合里的那些（从集合里去掉的凭证不再有效）。</summary>
+    public IReadOnlyList<string> Controllers
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _file is null || _current is null ? [] : [.. _file.Controllers.Where(c => _current.Keys.Any(k => k.CredentialId == c))];
+            }
+        }
+    }
+
+    public static TrustAnchor Load(string identityDirectory, INodeLog log)
+    {
+        string path = Path.Combine(identityDirectory, FileName);
+        if (!File.Exists(path))
+        {
+            return new TrustAnchor(new ConfigStore(identityDirectory), null, null, log);
+        }
+
+        TrustFile file = NodeConfig.Load(path, TrustFileContext.Default.TrustFile);
+        OperatorSet? current = OperatorTrust.VerifyChain(file.Genesis, [.. file.Chain.Select(c => c.ToSigned())]);
+        if (current is null)
+        {
+            // 固定的创世和存下来的链对不上：不能当成「没有固定」放过，直接让节点起不来比悄悄失去保护好
+            throw new InvalidDataException($"{path} does not verify against its pinned genesis; remove the node's identity and enroll again");
+        }
+
+        return new TrustAnchor(new ConfigStore(identityDirectory), file, current, log);
+    }
+
+    /// <summary>注册时写下：固定的创世、验证过的链、属主。</summary>
+    public static void Pin(string identityDirectory, string genesis, IReadOnlyList<SignedStatementDto> chain, IReadOnlyList<string> controllers) =>
+        new ConfigStore(identityDirectory).Write(FileName, JsonSerializer.SerializeToUtf8Bytes(new TrustFile { Genesis = genesis, Chain = [.. chain], Controllers = [.. controllers] }, TrustFileContext.Default.TrustFile));
+
+    /// <summary>期望状态里带来的链：从固定的创世验起，比现有的新才采用并保存。返回当前链的版本（没有固定时为 0）。</summary>
+    public int Update(IReadOnlyList<SignedStatementDto>? chain)
+    {
+        lock (_gate)
+        {
+            if (_file is null || chain is not { Count: > 0 })
+            {
+                return _current?.Version ?? 0;
+            }
+
+            OperatorSet? candidate = OperatorTrust.VerifyChain(_file.Genesis, [.. chain.Select(c => c.ToSigned())]);
+            if (candidate is null)
+            {
+                _log.Warn("the operator set from the panel does not verify against the pinned genesis; ignoring it");
+                return _current!.Version;
+            }
+
+            if (candidate.Version > _current!.Version)
+            {
+                _file.Chain = [.. chain];
+                _current = candidate;
+                try
+                {
+                    _store?.Write(FileName, JsonSerializer.SerializeToUtf8Bytes(_file, TrustFileContext.Default.TrustFile));
+                }
+                catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+                {
+                    _log.Warn("could not save trust.json", ("err", ex.Message));
+                }
+
+                _log.Info("operator set updated", ("version", candidate.Version));
+            }
+
+            return _current.Version;
+        }
+    }
+}
@@ -0,0 +1,80 @@
+using System.Buffers.Binary;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace Fleet.Identity;
+
+/// <summary>
+/// 预握手敲门：TCP 连接建立之后、TLS 握手之前，拨号方先发 32 字节 <c>nonce(16) | tag(16)</c>，
+/// <c>tag = HMAC-SHA256(K_pair, 时间窗 | nonce)</c> 截断到 16 字节。监听方核对不过就什么都不写、直接断开，
+/// 所以扫描器拿不到证书、TLS 参数和 JARM 指纹。<c>K_pair</c> 只有名册里的成员算得出：双方身份密钥做静态 ECDH，再经 HKDF 加用途标签派生。
+/// TCP 的 SYN-ACK 由内核发出，端口在扫描器眼里仍是「开着但不说话」，不是「没监听」。
+/// </summary>
+public static class Knock
+{
+    public const int PacketBytes = 32;
+    public const int NonceBytes = 16;
+    public const int TagBytes = 16;
+
+    /// <summary>时间窗长度；接受前后各一个窗，容忍时钟偏差。</summary>
+    public const int WindowSeconds = 30;
+
+    private const string Label = "moshiro-knock-v1";
+
+    /// <summary>两把身份密钥的配对密钥。info 里的两个公钥按字节序排列，所以两边算出的是同一个值。</summary>
+    public static byte[] DeriveKey(NodeIdentity own, ReadOnlySpan<byte> peerSpki)
+    {
+        byte[] secret = own.AgreeWith(peerSpki);
+        try
+        {
+            ReadOnlySpan<byte> mine = own.PublicKeySpki;
+            bool mineFirst = mine.SequenceCompareTo(peerSpki) <= 0;
+            byte[] info = [.. Encoding.UTF8.GetBytes(Label), .. (mineFirst ? mine : peerSpki), .. (mineFirst ? peerSpki : mine)];
+            return HKDF.DeriveKey(HashAlgorithmName.SHA256, secret, 32, null, info);
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(secret);
+        }
+    }
+
+    public static byte[] Build(ReadOnlySpan<byte> key, long nowMs)
+    {
+        byte[] packet = new byte[PacketBytes];
+        RandomNumberGenerator.Fill(packet.AsSpan(0, NonceBytes));
+        Tag(key, WindowOf(nowMs), packet.AsSpan(0, NonceBytes), packet.AsSpan(NonceBytes));
+        return packet;
+    }
+
+    /// <summary>tag 在前一个、当前、后一个时间窗里有一个对得上就通过。不管重放（重放由 <see cref="KnockGate"/> 按 nonce 去重）。</summary>
+    public static bool Check(ReadOnlySpan<byte> key, ReadOnlySpan<byte> packet, long nowMs)
+    {
+        if (packet.Length != PacketBytes)
+        {
+            return false;
+        }
+
+        long window = WindowOf(nowMs);
+        Span<byte> expected = stackalloc byte[TagBytes];
+        bool ok = false;
+        for (long w = window - 1; w <= window + 1; w++)
+        {
+            Tag(key, w, packet[..NonceBytes], expected);
+            ok |= CryptographicOperations.FixedTimeEquals(expected, packet[NonceBytes..]);
+        }
+
+        return ok;
+    }
+
+    private static long WindowOf(long nowMs) => nowMs / 1000 / WindowSeconds;
+
+    private static void Tag(ReadOnlySpan<byte> key, long window, ReadOnlySpan<byte> nonce, Span<byte> destination)
+    {
+        Span<byte> data = stackalloc byte[8 + NonceBytes];
+        BinaryPrimitives.WriteInt64BigEndian(data, window);
+        nonce.CopyTo(data[8..]);
+        Span<byte> full = stackalloc byte[32];
+        HMACSHA256.HashData(key, data, full);
+        full[..TagBytes].CopyTo(destination);
+    }
+}
@@ -0,0 +1,113 @@
+using System.Collections.Concurrent;
+using System.Net;
+using System.Security.Cryptography;
+
+namespace Fleet.Identity;
+
+/// <summary>
+/// 监听方的敲门关卡：新连接的前 32 字节必须是名册里某个成员的敲门包，否则不写任何字节、直接断开。
+/// 每个来源地址限速（陌生人用随机数据也要消耗 HMAC 计算），nonce 在时间窗内去重（防重放）。
+/// 名册由调用方提供（对端公钥列表）；配对密钥按公钥缓存，名册变了自然只算新的。
+/// </summary>
+public sealed class KnockGate
+{
+    private static readonly TimeSpan s_readTimeout = TimeSpan.FromSeconds(3);
+
+    private readonly NodeIdentity _own;
+    private readonly Func<IReadOnlyList<byte[]>> _peers;
+    private readonly TimeProvider _time;
+    private readonly int _attemptsPerPeriod;
+    private readonly long _periodMs;
+    private readonly ConcurrentDictionary<string, byte[]> _keys = new();
+    private readonly object _gate = new();
+    private readonly Dictionary<string, long> _seenNonces = [];
+    private readonly Dictionary<string, (long WindowStartMs, int Count)> _sources = [];
+    private long _lastSweepMs;
+
+    public KnockGate(NodeIdentity own, Func<IReadOnlyList<byte[]>> peers, TimeProvider time, int attemptsPerPeriod = 300, TimeSpan? period = null)
+    {
+        _own = own;
+        _peers = peers;
+        _time = time;
+        _attemptsPerPeriod = attemptsPerPeriod;
+        _periodMs = (long)(period ?? TimeSpan.FromSeconds(10)).TotalMilliseconds;
+    }
+
+    /// <summary>读 32 字节并核对。通过返回 true，流从敲门包之后继续（TLS 或明文首帧）；不通过返回 false，调用方直接关闭连接，不要写任何东西。</summary>
+    public async ValueTask<bool> AdmitAsync(Stream stream, IPAddress? source, CancellationToken ct)
+    {
+        long now = _time.GetUtcNow().ToUnixTimeMilliseconds();
+        if (!TryCountSource(source, now))
+        {
+            return false;
+        }
+
+        byte[] packet = new byte[Knock.PacketBytes];
+        using var timeout = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        timeout.CancelAfter(s_readTimeout);
+        try
+        {
+            await stream.ReadExactlyAsync(packet, timeout.Token);
+        }
+        catch (Exception ex) when (ex is EndOfStreamException or OperationCanceledException or IOException or ObjectDisposedException)
+        {
+            return false;
+        }
+
+        return Accept(packet, now);
+    }
+
+    /// <summary>核对一个敲门包（不读流）：名册里有成员的密钥对得上，并且 nonce 没用过。</summary>
+    public bool Accept(ReadOnlySpan<byte> packet, long nowMs)
+    {
+        bool matched = false;
+        foreach (byte[] peer in _peers())
+        {
+            byte[] key = _keys.GetOrAdd(Convert.ToBase64String(peer), _ => Knock.DeriveKey(_own, peer));
+            matched |= Knock.Check(key, packet, nowMs);
+        }
+
+        if (!matched)
+        {
+            return false;
+        }
+
+        string nonce = Convert.ToHexString(packet[..Knock.NonceBytes]);
+        lock (_gate)
+        {
+            Sweep(nowMs);
+            return _seenNonces.TryAdd(nonce, nowMs + (Knock.WindowSeconds * 3 * 1000L));
+        }
+    }
+
+    private bool TryCountSource(IPAddress? source, long nowMs)
+    {
+        string key = source is null ? "" : source.IsIPv4MappedToIPv6 ? source.MapToIPv4().ToString() : source.ToString();
+        lock (_gate)
+        {
+            Sweep(nowMs);
+            (long start, int count) = _sources.TryGetValue(key, out var entry) && nowMs - entry.WindowStartMs < _periodMs ? entry : (nowMs, 0);
+            _sources[key] = (start, count + 1);
+            return count < _attemptsPerPeriod;
+        }
+    }
+
+    private void Sweep(long nowMs)
+    {
+        if (nowMs - _lastSweepMs < 5000 && _seenNonces.Count < 4096 && _sources.Count < 4096)
+        {
+            return;
+        }
+
+        _lastSweepMs = nowMs;
+        foreach (string nonce in _seenNonces.Where(p => p.Value <= nowMs).Select(p => p.Key).ToList())
+        {
+            _seenNonces.Remove(nonce);
+        }
+
+        foreach (string source in _sources.Where(p => nowMs - p.Value.WindowStartMs >= _periodMs).Select(p => p.Key).ToList())
+        {
+            _sources.Remove(source);
+        }
+    }
+}
@@ -22,7 +22,7 @@ public static class NodeCertificate
        return certificate.Export(X509ContentType.Pfx);
    }

-    public static X509Certificate2 LoadPfx(byte[] pfx) => X509CertificateLoader.LoadPkcs12(pfx, null);
+    public static X509Certificate2 LoadPfx(byte[] pfx) => X509CertificateLoader.LoadPkcs12(pfx, null, X509KeyStorageFlags.Exportable);

    /// <summary>证书公钥（SPKI）的 SHA-256：对端用它来固定这张证书。</summary>
    public static byte[] SpkiFingerprint(X509Certificate2 certificate) =>
@@ -7,6 +7,9 @@ namespace Fleet.Identity;
 public static class SignaturePurpose
 {
    public const string Auth = "auth";
+
+    /// <summary>安全链路的认证：签名同时覆盖服务器和节点的临时公钥，把这次认证和这条加密链路绑在一起。</summary>
+    public const string AuthSecure = "auth2";
    public const string Peer = "peer";
    public const string Enroll = "enroll";
 }
@@ -41,6 +44,16 @@ public sealed class NodeIdentity : IDisposable

    public byte[] ExportPkcs8() => _key.ExportPkcs8PrivateKey();

+    /// <summary>与对端公钥（SPKI）做静态 ECDH，返回原始共享秘密。只用于派生对称密钥（敲门），必须再经 KDF，不能直接当密钥用。</summary>
+    public byte[] AgreeWith(ReadOnlySpan<byte> peerSpki)
+    {
+        using ECDiffieHellman own = ECDiffieHellman.Create();
+        own.ImportPkcs8PrivateKey(_key.ExportPkcs8PrivateKey(), out _);
+        using ECDiffieHellman peer = ECDiffieHellman.Create();
+        peer.ImportSubjectPublicKeyInfo(peerSpki, out _);
+        return own.DeriveRawSecretAgreement(peer.PublicKey);
+    }
+
    public byte[] Sign(string purpose, params string[] fields) =>
        _key.SignData(Encoding.UTF8.GetBytes(SignatureString.Build(purpose, fields)), HashAlgorithmName.SHA256,
            DSASignatureFormat.IeeeP1363FixedFieldConcatenation);
@@ -0,0 +1,171 @@
+using System.Buffers.Text;
+using System.Globalization;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace Fleet.Identity;
+
+/// <summary>passkey（WebAuthn）对一段文本签出的断言：<c>challenge = SHA-256(Statement 的 UTF-8)</c>。四个字段都是 base64url。</summary>
+public sealed record SignedStatement(string Statement, string CredentialId, string AuthenticatorData, string ClientDataJson, string Signature);
+
+/// <summary>一个操作员凭证：passkey 的凭证 id 和公钥（SPKI）。</summary>
+public sealed record OperatorKey(string CredentialId, byte[] PublicKeySpki);
+
+/// <summary>
+/// 操作员集合的一个版本。<c>RpId</c> 和 <c>Origins</c> 也在里面：节点验 WebAuthn 断言要用，而它们被操作员的签名覆盖，Backend 改不了。
+/// 创世版本（1）由它自己的某把凭证签名，指纹（<see cref="OperatorTrust.Fingerprint"/>）在安装时固定到节点；之后每个版本由上一版里的凭证签名。
+/// </summary>
+/// <param name="Servers">服务器密钥（SPKI）：操作员授权的 Backend 签名密钥。集合里登记了服务器密钥之后，节点要求服务器在认证挑战里用它签名，
+/// 并在这条链路上用应用层加密，所以 DNS 或证书层面的冒充拿不出这把密钥就骗不了节点。空 = 还没有启用。</param>
+public sealed record OperatorSet(int Version, string Previous, string RpId, IReadOnlyList<string> Origins, IReadOnlyList<OperatorKey> Keys, IReadOnlyList<byte[]>? Servers = null);
+
+/// <summary>
+/// 信任根：操作员（passkey）→ 操作员集合 → 节点本地固定的属主。设计见 docs/access.md 第 7 节。
+/// 安装命令里带着创世指纹和属主（passkey 的凭证 id）：节点把它们固定在本地，之后只认从创世出发、由操作员 passkey 签过名的集合版本，
+/// 属主必须是集合里的凭证。Backend 能转发集合，但签不出新的版本，也改不了节点已经固定的东西。
+/// 全是纯函数，只用 BCL，节点和 Backend 共用。语句是 <c>key=value</c> 的文本，第一行是带版本的标题；签名覆盖整段文本。
+/// </summary>
+public static class OperatorTrust
+{
+    public const string SetHeader = "moshiro-opset-v1";
+    public const string Genesis = "0";
+
+    public static string Encode(OperatorSet set)
+    {
+        var text = new StringBuilder();
+        text.Append(SetHeader).Append('\n')
+            .Append("version=").Append(set.Version.ToString(CultureInfo.InvariantCulture)).Append('\n')
+            .Append("prev=").Append(set.Previous).Append('\n')
+            .Append("rp=").Append(set.RpId).Append('\n')
+            .Append("origins=").Append(string.Join(',', set.Origins));
+        foreach (OperatorKey key in set.Keys)
+        {
+            text.Append("\nkey=").Append(key.CredentialId).Append(':').Append(Convert.ToBase64String(key.PublicKeySpki));
+        }
+
+        foreach (byte[] server in set.Servers ?? [])
+        {
+            text.Append("\nserver=").Append(Convert.ToBase64String(server));
+        }
+
+        return text.ToString();
+    }
+
+    /// <summary>严格解析：多一行、少一行、顺序不对都算坏。</summary>
+    public static OperatorSet? ParseSet(string text)
+    {
+        string[] lines = text.Split('\n');
+        if (lines.Length < 6 || lines[0] != SetHeader || !TryValue(lines[1], "version", out string version) || !int.TryParse(version, NumberStyles.None, CultureInfo.InvariantCulture, out int number) || number < 1
+            || !TryValue(lines[2], "prev", out string previous) || !TryValue(lines[3], "rp", out string rp) || rp.Length == 0 || !TryValue(lines[4], "origins", out string origins) || origins.Length == 0)
+        {
+            return null;
+        }
+
+        var keys = new List<OperatorKey>();
+        var servers = new List<byte[]>();
+        foreach (string line in lines.Skip(5))
+        {
+            if (servers.Count == 0 && TryValue(line, "key", out string value) && value.IndexOf(':', StringComparison.Ordinal) is > 0 and int split && TryBase64(value[(split + 1)..], out byte[] spki))
+            {
+                keys.Add(new OperatorKey(value[..split], spki));
+            }
+            else if (TryValue(line, "server", out string serverText) && TryBase64(serverText, out byte[] serverKey))
+            {
+                servers.Add(serverKey);
+            }
+            else
+            {
+                return null;
+            }
+        }
+
+        return keys.Count == 0 || (number == 1) != (previous == Genesis) ? null : new OperatorSet(number, previous, rp, origins.Split(','), keys, servers);
+    }
+
+    /// <summary>一段语句的指纹（SHA-256，小写十六进制）。创世版本的指纹就是安装命令里固定的那个。</summary>
+    public static string Fingerprint(string statement) => Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(statement)));
+
+    /// <summary>
+    /// 验证操作员集合的链：第一项是创世版本（指纹等于 <paramref name="pinnedGenesis"/>，自签），其后每一项由上一版里的凭证签名、版本加一、<c>prev</c> 指向上一版的指纹、域名不变。
+    /// 返回最后一版；不对返回 null。
+    /// </summary>
+    public static OperatorSet? VerifyChain(string pinnedGenesis, IReadOnlyList<SignedStatement> chain)
+    {
+        if (chain.Count == 0 || !string.Equals(Fingerprint(chain[0].Statement), pinnedGenesis, StringComparison.OrdinalIgnoreCase))
+        {
+            return null;
+        }
+
+        OperatorSet? current = null;
+        string? previousFingerprint = null;
+        foreach (SignedStatement link in chain)
+        {
+            OperatorSet? next = ParseSet(link.Statement);
+            if (next is null)
+            {
+                return null;
+            }
+
+            if (current is null)
+            {
+                if (next.Version != 1 || !VerifyOperator(link, next))
+                {
+                    return null;
+                }
+            }
+            else if (next.Version != current.Version + 1 || next.Previous != previousFingerprint || next.RpId != current.RpId || !VerifyOperator(link, current))
+            {
+                return null;
+            }
+
+            current = next;
+            previousFingerprint = Fingerprint(link.Statement);
+        }
+
+        return current;
+    }
+
+    /// <summary>断言是不是这个集合里某把凭证对 <c>Statement</c> 签的（要求用户验证；挑战是语句的 SHA-256）。</summary>
+    public static bool VerifyOperator(SignedStatement signed, OperatorSet set)
+    {
+        OperatorKey? key = set.Keys.FirstOrDefault(k => k.CredentialId == signed.CredentialId);
+        if (key is null || !TryDecode(signed.AuthenticatorData, out byte[] authData) || !TryDecode(signed.ClientDataJson, out byte[] clientData) || !TryDecode(signed.Signature, out byte[] signature))
+        {
+            return false;
+        }
+
+        return WebAuthnAssertion.Verify(key.PublicKeySpki, authData, clientData, signature, set.RpId, SHA256.HashData(Encoding.UTF8.GetBytes(signed.Statement)), set.Origins.Contains, requireUserVerification: true, out _);
+    }
+
+    private static bool TryValue(string line, string key, out string value)
+    {
+        value = "";
+        if (!line.StartsWith(key + "=", StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        value = line[(key.Length + 1)..];
+        return true;
+    }
+
+    private static bool TryBase64(string text, out byte[] data)
+    {
+        try
+        {
+            data = Convert.FromBase64String(text);
+            return data.Length > 0;
+        }
+        catch (FormatException)
+        {
+            data = [];
+            return false;
+        }
+    }
+
+    private static bool TryDecode(string text, out byte[] data)
+    {
+        data = [];
+        return Base64Url.IsValid(text) && (data = Base64Url.DecodeFromChars(text)).Length > 0;
+    }
+}
@@ -0,0 +1,173 @@
+using System.Buffers.Binary;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace Fleet.Identity;
+
+/// <summary>
+/// 节点这一侧用来确认「对面确实是我的操作员授权过的 Backend」的校验器：<c>Required</c> 为真（当前操作员集合里登记了服务器密钥）
+/// 时，服务器的挑战必须带着对得上的签名，否则节点不继续认证、也不交出任何东西。
+/// </summary>
+public interface IServerVerifier
+{
+    bool Required { get; }
+
+    /// <summary>服务器用它的服务器密钥对「挑战随机数加它这次连接的临时公钥」的签名。</summary>
+    bool Verify(string nonce, ReadOnlySpan<byte> serverEphemeralSpki, ReadOnlySpan<byte> signature);
+}
+
+/// <summary>服务器在挑战里给出的身份证明：服务器密钥（操作员签进集合）对「随机数加临时公钥」签名。纯函数。</summary>
+public static class ServerHello
+{
+    /// <summary>被签名的内容；服务器那一侧只拿到这个、用自己的密钥签（服务器密钥不一定是 BCL 的 ECDsa，可以在别处）。</summary>
+    public static byte[] Payload(string nonce, ReadOnlySpan<byte> serverEphemeralSpki) =>
+        Encoding.UTF8.GetBytes("fleet|v1|server|" + nonce + "|" + Convert.ToBase64String(serverEphemeralSpki));
+
+    public static byte[] Sign(ECDsa serverKey, string nonce, ReadOnlySpan<byte> serverEphemeralSpki) =>
+        serverKey.SignData(Payload(nonce, serverEphemeralSpki), HashAlgorithmName.SHA256, DSASignatureFormat.IeeeP1363FixedFieldConcatenation);
+
+    public static bool Verify(ReadOnlySpan<byte> serverKeySpki, string nonce, ReadOnlySpan<byte> serverEphemeralSpki, ReadOnlySpan<byte> signature)
+    {
+        try
+        {
+            using ECDsa key = ECDsa.Create();
+            key.ImportSubjectPublicKeyInfo(serverKeySpki, out _);
+            return key.VerifyData(Payload(nonce, serverEphemeralSpki), signature, HashAlgorithmName.SHA256, DSASignatureFormat.IeeeP1363FixedFieldConcatenation);
+        }
+        catch (CryptographicException)
+        {
+            return false;
+        }
+    }
+}
+
+/// <summary>
+/// 节点和 Backend 之间控制链路的应用层加密：两边的临时 ECDH 密钥协商出会话密钥，每个方向一把，AES-256-GCM，每帧带计数器。
+/// 所以即使 TLS 在中间被终止（Cloudflare、被冒充的证书），中间人没有服务器密钥，就拿不到明文，也改不了任何一帧。
+/// 帧格式：<c>计数器(8，大端) ‖ 密文 ‖ 标签(16)</c>；明文是 <c>帧类型(1) ‖ 内容</c>；计数器必须严格递增，重放、乱序、丢帧、篡改都会解密失败。
+/// </summary>
+public sealed class LinkCipher : IDisposable
+{
+    public const int Overhead = 8 + 16;
+
+    private const byte NodeToServer = 0;
+    private const byte ServerToNode = 1;
+
+    private readonly AesGcm _send;
+    private readonly AesGcm _receive;
+    private readonly byte _sendDirection;
+    private readonly byte _receiveDirection;
+    private readonly object _gate = new();
+    private long _sendCounter;
+    private long _receiveCounter;
+
+    private LinkCipher(byte[] sendKey, byte[] receiveKey, byte sendDirection, byte receiveDirection)
+    {
+        _send = new AesGcm(sendKey, 16);
+        _receive = new AesGcm(receiveKey, 16);
+        _sendDirection = sendDirection;
+        _receiveDirection = receiveDirection;
+    }
+
+    public static LinkCipher ForNode(EphemeralKey own, ReadOnlySpan<byte> serverEphemeralSpki, string nonce)
+    {
+        (byte[] n2s, byte[] s2n) = Derive(own, serverEphemeralSpki, own.PublicKeySpki, serverEphemeralSpki, nonce);
+        return new LinkCipher(n2s, s2n, NodeToServer, ServerToNode);
+    }
+
+    public static LinkCipher ForServer(EphemeralKey own, ReadOnlySpan<byte> nodeEphemeralSpki, string nonce)
+    {
+        (byte[] n2s, byte[] s2n) = Derive(own, nodeEphemeralSpki, nodeEphemeralSpki, own.PublicKeySpki, nonce);
+        return new LinkCipher(s2n, n2s, ServerToNode, NodeToServer);
+    }
+
+    private static (byte[] NodeToServerKey, byte[] ServerToNodeKey) Derive(EphemeralKey own, ReadOnlySpan<byte> remote, ReadOnlySpan<byte> nodeEphemeral, ReadOnlySpan<byte> serverEphemeral, string nonce)
+    {
+        byte[] secret = own.AgreeRaw(remote);
+        try
+        {
+            byte[] info = [.. Encoding.UTF8.GetBytes("fleet|v1|link|"), .. SHA256.HashData(serverEphemeral), .. SHA256.HashData(nodeEphemeral)];
+            byte[] material = HKDF.DeriveKey(HashAlgorithmName.SHA256, secret, 64, Encoding.UTF8.GetBytes(nonce), info);
+            return (material[..32], material[32..]);
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(secret);
+        }
+    }
+
+    /// <summary>加密一帧。</summary>
+    public byte[] Seal(byte kind, ReadOnlySpan<byte> data)
+    {
+        long counter;
+        lock (_gate)
+        {
+            counter = _sendCounter++;
+        }
+
+        byte[] output = new byte[Overhead + 1 + data.Length];
+        BinaryPrimitives.WriteInt64BigEndian(output, counter);
+        byte[] plaintext = new byte[1 + data.Length];
+        plaintext[0] = kind;
+        data.CopyTo(plaintext.AsSpan(1));
+        _send.Encrypt(Nonce(counter), plaintext, output.AsSpan(8, plaintext.Length), output.AsSpan(8 + plaintext.Length, 16), Aad(_sendDirection, counter));
+        return output;
+    }
+
+    /// <summary>解密一帧；计数器不是期望的下一个、或者标签不对，都返回 false。</summary>
+    public bool TryOpen(ReadOnlySpan<byte> frame, out byte kind, out byte[] data)
+    {
+        kind = 0;
+        data = [];
+        if (frame.Length < Overhead + 1)
+        {
+            return false;
+        }
+
+        long counter = BinaryPrimitives.ReadInt64BigEndian(frame);
+        lock (_gate)
+        {
+            if (counter != _receiveCounter)
+            {
+                return false;
+            }
+
+            int length = frame.Length - Overhead;
+            byte[] plaintext = new byte[length];
+            try
+            {
+                _receive.Decrypt(Nonce(counter), frame.Slice(8, length), frame.Slice(8 + length, 16), plaintext, Aad(_receiveDirection, counter));
+            }
+            catch (CryptographicException)
+            {
+                return false;
+            }
+
+            _receiveCounter++;
+            kind = plaintext[0];
+            data = plaintext[1..];
+            return true;
+        }
+    }
+
+    private static byte[] Nonce(long counter)
+    {
+        byte[] nonce = new byte[12];
+        BinaryPrimitives.WriteInt64BigEndian(nonce.AsSpan(4), counter);
+        return nonce;
+    }
+
+    private static byte[] Aad(byte direction, long counter)
+    {
+        byte[] aad = new byte[9];
+        aad[0] = direction;
+        BinaryPrimitives.WriteInt64BigEndian(aad.AsSpan(1), counter);
+        return aad;
+    }
+
+    public void Dispose()
+    {
+        _send.Dispose();
+        _receive.Dispose();
+    }
+}
@@ -16,6 +16,14 @@ public sealed class EphemeralKey : IDisposable

    public byte[] PublicKeySpki => _key.ExportSubjectPublicKeyInfo();

+    /// <summary>与对端的临时公钥做 ECDH，返回原始共享秘密；必须再经 KDF 才能当密钥用。</summary>
+    public byte[] AgreeRaw(ReadOnlySpan<byte> remotePublicKeySpki)
+    {
+        using ECDiffieHellman remote = ECDiffieHellman.Create();
+        remote.ImportSubjectPublicKeyInfo(remotePublicKeySpki, out _);
+        return _key.DeriveRawSecretAgreement(remote.PublicKey);
+    }
+
    /// <summary>
    /// 与对端的临时公钥协商，再经 HKDF-SHA256 派生会话凭据。
    /// 盐是服务端的随机数，info 绑定双方的临时公钥，防止凭据被挪用到别的握手上。
@@ -0,0 +1,11 @@
+using Fleet.Core;
+
+namespace Fleet.Identity;
+
+public static class TrustMapping
+{
+    public static SignedStatement ToSigned(this SignedStatementDto dto) => new(dto.Statement, dto.CredentialId, dto.AuthenticatorData, dto.ClientDataJson, dto.Signature);
+
+    public static SignedStatementDto ToDto(this SignedStatement signed) =>
+        new() { Statement = signed.Statement, CredentialId = signed.CredentialId, AuthenticatorData = signed.AuthenticatorData, ClientDataJson = signed.ClientDataJson, Signature = signed.Signature };
+}
@@ -0,0 +1,85 @@
+using System.Buffers.Text;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+
+namespace Fleet.Identity;
+
+/// <summary>
+/// 验证一次 WebAuthn 断言（<c>navigator.credentials.get</c> 的结果）。只支持 ES256（P-256 的 ECDSA），纯函数，只用 BCL：
+/// 面板用它验证 passkey 登录，节点以后用它验证 passkey 签出的委托（docs/access.md 第 7 节）。
+/// 不解析 CBOR——注册时的 attestation 解析只在 Backend 里。
+/// </summary>
+public static class WebAuthnAssertion
+{
+    public const byte FlagUserPresent = 0x01;
+    public const byte FlagUserVerified = 0x04;
+
+    /// <param name="publicKeySpki">注册时保存的凭证公钥（SPKI）。</param>
+    /// <param name="expectedChallenge">这次请求里服务端或签名人规定的挑战原文（不是 base64url）。</param>
+    /// <param name="originAllowed">校验 <c>clientDataJSON.origin</c>。</param>
+    /// <param name="signCount">authenticatorData 里的签名计数器。</param>
+    public static bool Verify(
+        ReadOnlySpan<byte> publicKeySpki, ReadOnlySpan<byte> authenticatorData, ReadOnlySpan<byte> clientDataJson, ReadOnlySpan<byte> signature,
+        string rpId, ReadOnlySpan<byte> expectedChallenge, Func<string, bool> originAllowed, bool requireUserVerification, out uint signCount)
+    {
+        signCount = 0;
+        if (authenticatorData.Length < 37 || !CryptographicOperations.FixedTimeEquals(authenticatorData[..32], SHA256.HashData(Encoding.UTF8.GetBytes(rpId))))
+        {
+            return false;
+        }
+
+        byte flags = authenticatorData[32];
+        if ((flags & FlagUserPresent) == 0 || (requireUserVerification && (flags & FlagUserVerified) == 0))
+        {
+            return false;
+        }
+
+        if (!ClientDataValid(clientDataJson, "webauthn.get", expectedChallenge, originAllowed))
+        {
+            return false;
+        }
+
+        try
+        {
+            using ECDsa key = ECDsa.Create();
+            key.ImportSubjectPublicKeyInfo(publicKeySpki, out _);
+            byte[] signed = [.. authenticatorData, .. SHA256.HashData(clientDataJson)];
+            if (!key.VerifyData(signed, signature, HashAlgorithmName.SHA256, DSASignatureFormat.Rfc3279DerSequence))
+            {
+                return false;
+            }
+        }
+        catch (CryptographicException)
+        {
+            return false;
+        }
+
+        signCount = (uint)((authenticatorData[33] << 24) | (authenticatorData[34] << 16) | (authenticatorData[35] << 8) | authenticatorData[36]);
+        return true;
+    }
+
+    /// <summary><c>clientDataJSON</c> 的 type、challenge、origin 都要对得上。注册和登录共用。</summary>
+    public static bool ClientDataValid(ReadOnlySpan<byte> clientDataJson, string expectedType, ReadOnlySpan<byte> expectedChallenge, Func<string, bool> originAllowed)
+    {
+        try
+        {
+            using JsonDocument document = JsonDocument.Parse(clientDataJson.ToArray());
+            JsonElement root = document.RootElement;
+            if (root.ValueKind != JsonValueKind.Object
+                || root.GetProperty("type").GetString() != expectedType
+                || root.GetProperty("origin").GetString() is not { } origin || !originAllowed(origin)
+                || root.GetProperty("challenge").GetString() is not { } challenge)
+            {
+                return false;
+            }
+
+            byte[] decoded = Base64Url.DecodeFromChars(challenge);
+            return CryptographicOperations.FixedTimeEquals(decoded, expectedChallenge);
+        }
+        catch (Exception ex) when (ex is JsonException or KeyNotFoundException or FormatException or InvalidOperationException)
+        {
+            return false;
+        }
+    }
+}
@@ -49,7 +49,7 @@ public sealed class FleetLinkOptions

    public string NodeVersion { get; init; } = "0.0.0";

-    /// <summary>框架之外的能力，例如 <c>monitor.v1</c> 与 <c>monitor.kinds:udp_echo,tcp_echo</c>。</summary>
+    /// <summary>框架之外的能力，例如 <c>moshiro.v1</c> 与 <c>moshiro.kinds:udp_echo,tcp_echo</c>。</summary>
    public IReadOnlyList<string> Capabilities { get; init; } = [];

    /// <summary>附加到 <c>fleet.hello</c> 的产品元数据。</summary>
@@ -66,6 +66,15 @@ public sealed class FleetLinkOptions
    public long MaxInflightBytes { get; init; } = 4 << 20;

    public Backoff Backoff { get; init; } = new();
+
+    /// <summary>
+    /// 校验服务器身份：<see cref="IServerVerifier.Required"/> 为真（节点固定的操作员集合里登记了服务器密钥）时，
+    /// 服务器必须在挑战里证明自己，之后这条链路用应用层加密；否则按旧的方式（没有固定信任根的节点）。
+    /// </summary>
+    public IServerVerifier? ServerVerifier { get; init; }
+
+    /// <summary>握手时自述正在运行的二进制（哈希和 CI 签名的清单）；没有就不上报（旧行为）。</summary>
+    public Func<BinaryAttestation?>? Attestation { get; init; }
 }

 /// <summary>
@@ -77,6 +86,7 @@ public sealed class FleetLink
    private const string RpcPath = "/api/agent/v1/rpc";

    private readonly FleetLinkOptions _options;
+    private volatile bool _secure;
    private readonly RpcRouter<LinkContext> _router;
    private readonly Dictionary<string, IStateHandler> _handlers;
    private readonly TimeProvider _time;
@@ -105,6 +115,9 @@ public sealed class FleetLink

    public RpcSession<LinkContext>? CurrentSession => _session;

+    /// <summary>入站方法的路由器（只读，测试用它核对声明表和实际注册的处理函数）。</summary>
+    public RpcRouter<LinkContext> Router => _router;
+
    /// <summary>被服务端撤销或禁用：不会再重连。</summary>
    public bool Revoked => _stopped;

@@ -150,6 +163,9 @@ public sealed class FleetLink
        }
    }

+    /// <summary>当前这条链路是不是应用层加密的（服务器证明了身份）。</summary>
+    public bool IsSecure => _secure && IsConnected;
+
    private async Task<string> RunOnceAsync(CancellationToken ct)
    {
        using var socket = new ClientWebSocket();
@@ -157,7 +173,7 @@ public sealed class FleetLink
        socket.Options.KeepAliveTimeout = TimeSpan.FromSeconds(20); // 对端 20 秒没有回 Pong 就判定连接已死
        var builder = new UriBuilder(_options.Server) { Scheme = _options.Server.Scheme == "https" ? "wss" : "ws", Path = RpcPath };
        await socket.ConnectAsync(builder.Uri, ct);
-        await using var transport = new WsTransport(socket, _options.MaxFrameBytes);
+        await using var transport = new SecureTransport(new WsTransport(socket, _options.MaxFrameBytes));

        string? failure = await AuthenticateAsync(transport, ct);
        if (failure is not null)
@@ -165,6 +181,8 @@ public sealed class FleetLink
            return failure;
        }

+        _secure = transport.Secure;
+
        var session = new RpcSession<LinkContext>(transport, _router, new LinkContext(this), _time);
        using CancellationTokenSource sessionCts = CancellationTokenSource.CreateLinkedTokenSource(ct);
        Task run = session.RunAsync(sessionCts.Token);
@@ -208,7 +226,17 @@ public sealed class FleetLink
    }

    /// <summary>挑战 → 签名 → 认证结果。失败返回原因；服务端禁用该节点时不再重试。</summary>
-    private async Task<string?> AuthenticateAsync(WsTransport transport, CancellationToken ct)
+    private void Attest(AuthParams auth)
+    {
+        if (_options.Attestation?.Invoke() is { } attestation)
+        {
+            auth.Binary = attestation.Sha256;
+            auth.Release = attestation.Manifest;
+            auth.ReleaseSignature = attestation.Signature;
+        }
+    }
+
+    private async Task<string?> AuthenticateAsync(SecureTransport transport, CancellationToken ct)
    {
        using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(15), _time);
        using CancellationTokenSource linked = CancellationTokenSource.CreateLinkedTokenSource(ct, timeout.Token);
@@ -219,9 +247,46 @@ public sealed class FleetLink
        }

        ChallengeParams nonce = challenge.Params.Value.Deserialize(FleetRpcContext.Default.ChallengeParams)!;
-        string signature = Convert.ToBase64String(_options.Identity.Sign(SignaturePurpose.Auth, _options.NodeId.Value, nonce.Nonce));
-        RpcMessage request = RpcMessage.Request(1, FleetMethods.Auth, new AuthParams { NodeId = _options.NodeId.Value, Signature = signature }, FleetRpcContext.Default.AuthParams);
-        await transport.SendAsync(new RpcFrame(FrameKind.Text, JsonSerializer.SerializeToUtf8Bytes(request, FleetRpcContext.Default.RpcMessage)), linked.Token);
+
+        // 固定了操作员集合、而集合里登记了服务器密钥：服务器必须证明自己，否则不继续，也不交出任何东西
+        EphemeralKey? ephemeral = null;
+        AuthParams authParams;
+        try
+        {
+            if (_options.ServerVerifier is { Required: true } verifier)
+            {
+                if (!TryDecodeBase64(nonce.ServerEphemeral, out byte[] serverEphemeral) || !TryDecodeBase64(nonce.ServerSignature, out byte[] serverSignature)
+                    || !verifier.Verify(nonce.Nonce, serverEphemeral, serverSignature))
+                {
+                    return "the server could not prove its identity (it is not the server your operator set authorizes)";
+                }
+
+                ephemeral = new EphemeralKey();
+                string serverEphemeralText = Convert.ToBase64String(serverEphemeral);
+                string nodeEphemeralText = Convert.ToBase64String(ephemeral.PublicKeySpki);
+                authParams = new AuthParams
+                {
+                    NodeId = _options.NodeId.Value,
+                    Signature = Convert.ToBase64String(_options.Identity.Sign(SignaturePurpose.AuthSecure, _options.NodeId.Value, nonce.Nonce, serverEphemeralText, nodeEphemeralText)),
+                    NodeEphemeral = nodeEphemeralText,
+                };
+                Attest(authParams);
+                RpcMessage secureRequest = RpcMessage.Request(1, FleetMethods.Auth, authParams, FleetRpcContext.Default.AuthParams);
+                await transport.SendAsync(new RpcFrame(FrameKind.Text, JsonSerializer.SerializeToUtf8Bytes(secureRequest, FleetRpcContext.Default.RpcMessage)), linked.Token);
+                transport.Enable(LinkCipher.ForNode(ephemeral, serverEphemeral, nonce.Nonce));
+            }
+            else
+            {
+                authParams = new AuthParams { NodeId = _options.NodeId.Value, Signature = Convert.ToBase64String(_options.Identity.Sign(SignaturePurpose.Auth, _options.NodeId.Value, nonce.Nonce)) };
+                Attest(authParams);
+                RpcMessage request = RpcMessage.Request(1, FleetMethods.Auth, authParams, FleetRpcContext.Default.AuthParams);
+                await transport.SendAsync(new RpcFrame(FrameKind.Text, JsonSerializer.SerializeToUtf8Bytes(request, FleetRpcContext.Default.RpcMessage)), linked.Token);
+            }
+        }
+        finally
+        {
+            ephemeral?.Dispose();
+        }

        while (true)
        {
@@ -256,7 +321,26 @@ public sealed class FleetLink
        }
    }

-    private static async Task<RpcMessage?> ReceiveMessageAsync(WsTransport transport, CancellationToken ct)
+    private static bool TryDecodeBase64(string? text, out byte[] data)
+    {
+        data = [];
+        if (string.IsNullOrEmpty(text))
+        {
+            return false;
+        }
+
+        try
+        {
+            data = Convert.FromBase64String(text);
+            return true;
+        }
+        catch (FormatException)
+        {
+            return false;
+        }
+    }
+
+    private static async Task<RpcMessage?> ReceiveMessageAsync(SecureTransport transport, CancellationToken ct)
    {
        RpcFrame? frame = await transport.ReceiveAsync(ct);
        return frame is { Kind: FrameKind.Text } f ? JsonSerializer.Deserialize(f.Data.Span, FleetRpcContext.Default.RpcMessage) : null;
@@ -22,6 +22,9 @@ public sealed class PeerListenerOptions
    /// <summary>按对端 ID 查找允许连接的公钥（SPKI）。不在列表里的对端一律拒绝（期望状态里的 peers）。</summary>
    public required Func<string, byte[]?> LookupPeerKey { get; init; }

+    /// <summary>预握手敲门：每个连接先过这一关（名册里的 Probe 才算得出敲门包），不通过就直接断开，什么都不写。</summary>
+    public required KnockGate Knock { get; init; }
+
    public int MaxFrameBytes { get; init; } = 8 << 20;

    public int MaxSessions { get; init; } = 8;
@@ -57,6 +60,11 @@ public sealed class PeerListener
    public async Task RunAsync(CancellationToken ct)
    {
        var listener = new TcpListener(_options.Listen);
+        if (_options.Listen.Address.Equals(IPAddress.IPv6Any))
+        {
+            listener.Server.DualMode = true;
+        }
+
        listener.Start();
        Port = ((IPEndPoint)listener.LocalEndpoint).Port;
        Started.TrySetResult();
@@ -93,7 +101,13 @@ public sealed class PeerListener
            PeerSockets.EnableKeepAlive(client.Client);
            using var timeout = new CancellationTokenSource(_options.HandshakeTimeout, _time);
            using CancellationTokenSource linked = CancellationTokenSource.CreateLinkedTokenSource(ct, timeout.Token);
-            var tls = new SslStream(client.GetStream(), leaveInnerStreamOpen: false);
+            Stream stream = client.GetStream();
+            if (!await _options.Knock.AdmitAsync(stream, (client.Client.RemoteEndPoint as IPEndPoint)?.Address, linked.Token))
+            {
+                return;
+            }
+
+            var tls = new SslStream(stream, leaveInnerStreamOpen: false);
            await tls.AuthenticateAsServerAsync(
                new SslServerAuthenticationOptions { ServerCertificate = _options.Certificate, ClientCertificateRequired = false, EnabledSslProtocols = System.Security.Authentication.SslProtocols.Tls12 | System.Security.Authentication.SslProtocols.Tls13 },
                linked.Token);
@@ -217,17 +231,22 @@ internal static class PeerSockets
 public static class PeerConnector
 {
    public static async Task<(PeerSessionInfo Info, TlsFrameTransport Transport)> ConnectAsync(
-        string host, int port, byte[] expectedSpkiSha256, NodeIdentity identity, string peerId, string? version, int maxFrameBytes, TimeProvider time, CancellationToken ct)
+        string host, int port, byte[] agentPublicKey, NodeIdentity identity, string peerId, string? version, int maxFrameBytes, TimeProvider time, CancellationToken ct)
    {
-        var client = new TcpClient { NoDelay = true };
+        // 证书按公钥的指纹固定；敲门密钥由双方身份密钥派生
+        byte[] expectedSpkiSha256 = NodeIdentity.Fingerprint(agentPublicKey);
+        TcpClient client = IPAddress.TryParse(host, out IPAddress? address) ? new TcpClient(address.AddressFamily) : new TcpClient();
+        client.NoDelay = true;
        PeerSockets.EnableKeepAlive(client.Client);
        try
        {
            using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(10), time);
            using CancellationTokenSource linked = CancellationTokenSource.CreateLinkedTokenSource(ct, timeout.Token);
            await client.ConnectAsync(host, port, linked.Token);
+            Stream stream = client.GetStream();
+            await stream.WriteAsync(Knock.Build(Knock.DeriveKey(identity, agentPublicKey), time.GetUtcNow().ToUnixTimeMilliseconds()), linked.Token);
            var tls = new SslStream(
-                client.GetStream(), leaveInnerStreamOpen: false,
+                stream, leaveInnerStreamOpen: false,
                (_, certificate, _, _) => certificate is not null && SpkiMatches(certificate, expectedSpkiSha256));
            await tls.AuthenticateAsClientAsync(new SslClientAuthenticationOptions { TargetHost = host }, linked.Token);
            var transport = new TlsFrameTransport(tls, maxFrameBytes);
@@ -0,0 +1,57 @@
+using Fleet.Identity;
+using Fleet.Rpc;
+
+namespace Fleet.Link;
+
+/// <summary>
+/// 认证阶段是明文，认证通过之后换成应用层加密（<see cref="LinkCipher"/>）：此后每帧都是加密的二进制帧，明文帧一律拒绝。
+/// 认证阶段服务器的拒绝回复可能是明文（还没有协商好密钥），所以第一帧加密的回复到达之前允许一次明文文本帧。
+/// </summary>
+internal sealed class SecureTransport : IRpcTransport
+{
+    private readonly IRpcTransport _inner;
+    private LinkCipher? _cipher;
+    private bool _allowPlaintext = true;
+
+    public SecureTransport(IRpcTransport inner)
+    {
+        _inner = inner;
+    }
+
+    public bool Secure => _cipher is not null;
+
+    public void Enable(LinkCipher cipher) => _cipher = cipher;
+
+    public ValueTask SendAsync(RpcFrame frame, CancellationToken ct) =>
+        _cipher is null ? _inner.SendAsync(frame, ct) : _inner.SendAsync(new RpcFrame(FrameKind.Binary, _cipher.Seal((byte)frame.Kind, frame.Data.Span)), ct);
+
+    public async ValueTask<RpcFrame?> ReceiveAsync(CancellationToken ct)
+    {
+        RpcFrame? frame = await _inner.ReceiveAsync(ct);
+        if (frame is not { } received || _cipher is null)
+        {
+            return frame;
+        }
+
+        if (received.Kind == FrameKind.Binary && _cipher.TryOpen(received.Data.Span, out byte kind, out byte[] data))
+        {
+            _allowPlaintext = false;
+            return new RpcFrame((FrameKind)kind, data);
+        }
+
+        if (_allowPlaintext && received.Kind == FrameKind.Text)
+        {
+            return received; // 认证被拒绝时服务器还没有协商好密钥，回复是明文
+        }
+
+        throw new IOException("a frame on the secure link failed to authenticate");
+    }
+
+    public ValueTask CloseAsync(string reason, CancellationToken ct) => _inner.CloseAsync(reason, ct);
+
+    public async ValueTask DisposeAsync()
+    {
+        _cipher?.Dispose();
+        await _inner.DisposeAsync();
+    }
+}
@@ -15,6 +15,31 @@ public static class FleetMethods
    public const string Revoked = "fleet.revoked";
 }

+/// <summary>
+/// 框架自己的方法声明，两个平面各一份。认证和握手阶段由连接代码直接处理的（<c>Inline</c>）不经过路由器。
+/// 同一个方法名在两个平面里可以有不同的发起方：<c>fleet.state.sync</c> 在节点面是服务端发给节点，在对等面是 Agent 发给 Probe。
+/// </summary>
+public static class FleetMethodTable
+{
+    public static readonly MethodTable Table = new(
+    [
+        // 节点面
+        MethodSpec.Notification(FleetMethods.Challenge, RpcSide.Server).AsInline(),
+        MethodSpec.Request(FleetMethods.Auth, RpcSide.Node).AsInline(),
+        MethodSpec.Request(FleetMethods.Hello, RpcSide.Node).AsInline(),
+        MethodSpec.Notification(FleetMethods.Heartbeat, RpcSide.Node).AsInline(),
+        MethodSpec.Request(FleetMethods.StateSync, RpcSide.Server),
+        MethodSpec.Notification(FleetMethods.OutboxAck, RpcSide.Server),
+        MethodSpec.Notification(FleetMethods.Revoked, RpcSide.Server),
+
+        // 对等面
+        MethodSpec.Notification(PeerMethods.Challenge, RpcSide.Listener).AsInline(),
+        MethodSpec.Request(PeerMethods.Auth, RpcSide.Dialer).AsInline(),
+        MethodSpec.Request(FleetMethods.StateSync, RpcSide.Listener),
+        MethodSpec.Notification(FleetMethods.OutboxAck, RpcSide.Listener),
+    ]);
+}
+
 /// <summary>二进制通道：0–15 保留给框架，产品从 16 开始。</summary>
 public static class FleetChannels
 {
@@ -28,6 +53,14 @@ public sealed class ChallengeParams

    [JsonPropertyName("expires_at_ms")]
    public long ExpiresAtMs { get; set; }
+
+    /// <summary>服务器这次连接的临时 ECDH 公钥（SPKI，base64）；服务器有身份密钥时才有。</summary>
+    [JsonPropertyName("server_eph")]
+    public string? ServerEphemeral { get; set; }
+
+    /// <summary>服务器密钥对「随机数加临时公钥」的签名（base64）：节点据此确认对面是操作员授权的服务器。</summary>
+    [JsonPropertyName("server_sig")]
+    public string? ServerSignature { get; set; }
 }

 public sealed class AuthParams
@@ -38,6 +71,21 @@ public sealed class AuthParams
    /// <summary>对 <c>fleet|v1|auth|{node_id}|{nonce}</c> 的签名（base64）。</summary>
    [JsonPropertyName("signature")]
    public string Signature { get; set; } = "";
+
+    /// <summary>节点的临时 ECDH 公钥（SPKI，base64）：有它就是安全链路，签名覆盖双方的临时公钥，认证结果起所有帧都是加密的。</summary>
+    [JsonPropertyName("node_eph")]
+    public string? NodeEphemeral { get; set; }
+
+    /// <summary>正在运行的二进制的 SHA-256（小写十六进制）：服务端在第一次握手时绑定，之后核对。旧节点没有这个字段。</summary>
+    [JsonPropertyName("binary")]
+    public string? Binary { get; set; }
+
+    /// <summary>安装这个二进制时宿主机更新器验过的 CI 签名清单（原文）和签名（base64）：服务端用 CI 公钥验过，才相信它列出的官方哈希。</summary>
+    [JsonPropertyName("release")]
+    public string? Release { get; set; }
+
+    [JsonPropertyName("release_sig")]
+    public string? ReleaseSignature { get; set; }
 }

 public sealed class AuthResult
@@ -58,7 +106,7 @@ public sealed class HelloParams
    [JsonPropertyName("now_utc_ms")]
    public long NowUtcMs { get; set; }

-    /// <summary>产品自定义的元数据（例如 Monitor 的 tls_spki、probe_ports、local_limits 摘要）。</summary>
+    /// <summary>产品自定义的元数据（例如 MoShiro 的 tls_spki、probe_ports、local_limits 摘要）。</summary>
    [JsonPropertyName("meta")]
    public JsonElement? Meta { get; set; }
 }
@@ -0,0 +1,120 @@
+namespace Fleet.Rpc;
+
+/// <summary>连接的哪一侧。节点面：服务端和节点；对等面：拨号方（Probe）和监听方（Agent）。</summary>
+public enum RpcSide
+{
+    Server,
+    Node,
+    Dialer,
+    Listener,
+}
+
+public enum RpcPlane
+{
+    Node,
+    Peer,
+}
+
+public enum MethodKind
+{
+    Request,
+    Notification,
+}
+
+public static class RpcSides
+{
+    public static RpcPlane PlaneOf(RpcSide side) => side is RpcSide.Server or RpcSide.Node ? RpcPlane.Node : RpcPlane.Peer;
+
+    public static RpcSide Opposite(RpcSide side) => side switch
+    {
+        RpcSide.Server => RpcSide.Node,
+        RpcSide.Node => RpcSide.Server,
+        RpcSide.Dialer => RpcSide.Listener,
+        _ => RpcSide.Dialer,
+    };
+}
+
+/// <summary>
+/// 一个方法的声明：<b>只有 <see cref="From"/> 能发起它</b>（不存在双向方法），类型是请求还是通知，哪些节点角色可以参与。
+/// <see cref="Inline"/> 表示它在认证或握手阶段由连接代码直接处理，不经过路由器。
+/// </summary>
+public sealed record MethodSpec(string Name, RpcSide From, MethodKind Kind, IReadOnlyList<string>? Roles = null, bool Inline = false)
+{
+    public RpcPlane Plane => RpcSides.PlaneOf(From);
+
+    /// <summary>接收方。</summary>
+    public RpcSide To => RpcSides.Opposite(From);
+
+    public bool AllowsRole(string? role) => Roles is null || (role is not null && Roles.Contains(role));
+
+    public static MethodSpec Request(string name, RpcSide from, params string[] roles) => new(name, from, MethodKind.Request, roles.Length == 0 ? null : roles);
+
+    public static MethodSpec Notification(string name, RpcSide from, params string[] roles) => new(name, from, MethodKind.Notification, roles.Length == 0 ? null : roles);
+
+    public MethodSpec AsInline() => this with { Inline = true };
+}
+
+/// <summary>二进制通道的声明：谁能发、哪些角色可以发。通道 0–15 保留给框架，产品从 16 开始。</summary>
+public sealed record ChannelSpec(byte Channel, RpcSide From, IReadOnlyList<string>? Roles = null)
+{
+    public RpcPlane Plane => RpcSides.PlaneOf(From);
+
+    public bool AllowsRole(string? role) => Roles is null || (role is not null && Roles.Contains(role));
+}
+
+/// <summary>
+/// 协议方法和二进制通道的声明表，单一真源。路由器用它在注册时拒绝方向、类型、角色不符的处理函数，
+/// 在收发时拒绝没有声明或不该由对方发起的方法。同一个方法名在不同平面里可以有不同的发起方，所以按（平面，名字）查找。
+/// </summary>
+public sealed class MethodTable
+{
+    private readonly Dictionary<(RpcPlane, string), MethodSpec> _methods = [];
+    private readonly Dictionary<(RpcPlane, byte), ChannelSpec> _channels = [];
+
+    public MethodTable(IEnumerable<MethodSpec> methods, IEnumerable<ChannelSpec>? channels = null)
+    {
+        foreach (MethodSpec spec in methods)
+        {
+            if (!_methods.TryAdd((spec.Plane, spec.Name), spec))
+            {
+                throw new ArgumentException($"method {spec.Name} is declared twice in the {spec.Plane} plane");
+            }
+        }
+
+        foreach (ChannelSpec spec in channels ?? [])
+        {
+            if (!_channels.TryAdd((spec.Plane, spec.Channel), spec))
+            {
+                throw new ArgumentException($"channel {spec.Channel} is declared twice in the {spec.Plane} plane");
+            }
+        }
+    }
+
+    public IEnumerable<MethodSpec> Methods => _methods.Values;
+
+    public IEnumerable<ChannelSpec> Channels => _channels.Values;
+
+    public MethodSpec? Find(RpcPlane plane, string method) => _methods.GetValueOrDefault((plane, method));
+
+    public ChannelSpec? FindChannel(RpcPlane plane, byte channel) => _channels.GetValueOrDefault((plane, channel));
+
+    /// <summary>合并多张表（框架的加产品的）。</summary>
+    public static MethodTable Combine(params MethodTable[] tables) =>
+        new(tables.SelectMany(t => t.Methods), tables.SelectMany(t => t.Channels));
+
+    /// <summary>
+    /// 对账：<paramref name="receiver"/> 这一侧、<paramref name="role"/> 这个角色应该处理、但没有注册处理函数的方法
+    /// （认证阶段直接处理的 <see cref="MethodSpec.Inline"/> 方法除外）。<paramref name="role"/> 为空表示不限角色（服务端要处理所有角色发来的）。
+    /// </summary>
+    public IReadOnlyList<string> MissingHandlers(RpcSide receiver, string? role, IEnumerable<string> registered)
+    {
+        HashSet<string> have = [.. registered];
+        return
+        [
+            .. Methods
+                .Where(m => m.To == receiver && !m.Inline && (role is null || m.AllowsRole(role)) && !have.Contains(m.Name))
+                .Select(m => m.Name)
+                .Order(StringComparer.Ordinal),
+        ];
+    }
+}
@@ -4,7 +4,17 @@ using Fleet.Core;

 namespace Fleet.Rpc;

-/// <summary>方法路由，与传输方式无关。<typeparamref name="TContext"/> 由传输层提供（例如调用方节点）。</summary>
+/// <summary>对端违反了协议：方法没有声明、方向不对、请求和通知用反了、或者角色不允许。</summary>
+public readonly record struct RpcViolation(string Method, string Reason);
+
+/// <summary>一次分发的结果：要回的响应（通知为空），以及对端有没有违规。</summary>
+public readonly record struct RpcDispatch(RpcMessage? Response, RpcViolation? Violation);
+
+/// <summary>
+/// 方法路由，与传输方式无关，也是协议方向的<b>唯一卡口</b>：节点和服务端、Probe 和 Agent 的入站分发都经过这里。
+/// <typeparamref name="TContext"/> 由传输层提供（例如调用方节点）。路由器知道自己在连接的哪一侧（<see cref="Side"/>）和声明表，
+/// 注册处理函数时核对方向、类型和角色，分发时拒绝没有声明或不该由对方发起的方法，发送时核对自己有没有资格发起。
+/// </summary>
 public sealed class RpcRouter<TContext>
 {
    private delegate ValueTask<Result<JsonElement?>> Route(TContext context, JsonElement? parameters, CancellationToken ct);
@@ -13,12 +23,28 @@ public sealed class RpcRouter<TContext>

    private readonly Dictionary<string, Route> _routes = new(StringComparer.Ordinal);
    private readonly Action<string, Exception>? _onUnhandled;
+    private readonly string? _localRole;
+    private readonly Func<TContext, string?>? _callerRole;

-    public RpcRouter(Action<string, Exception>? onUnhandled = null)
+    /// <param name="side">本路由器在连接的哪一侧。</param>
+    /// <param name="table">方法声明表。</param>
+    /// <param name="localRole">本节点的角色（节点侧和对等面用）：声明限定了角色的方法，角色不符就不能注册。</param>
+    /// <param name="callerRole">从调用上下文取出对端的角色（服务端用）：声明限定了角色的方法，角色不符就拒绝。</param>
+    public RpcRouter(RpcSide side, MethodTable table, string? localRole = null, Func<TContext, string?>? callerRole = null, Action<string, Exception>? onUnhandled = null)
    {
+        Side = side;
+        Table = table;
+        _localRole = localRole;
+        _callerRole = callerRole;
        _onUnhandled = onUnhandled;
    }

+    public RpcSide Side { get; }
+
+    public MethodTable Table { get; }
+
+    private RpcPlane Plane => RpcSides.PlaneOf(Side);
+
    public bool Has(string method) => _routes.ContainsKey(method);

    public IReadOnlyCollection<string> Methods => _routes.Keys;
@@ -29,6 +55,7 @@ public sealed class RpcRouter<TContext>
        JsonTypeInfo<TResult> resultInfo,
        Func<TContext, TParams, CancellationToken, ValueTask<Result<TResult>>> handler)
    {
+        Declare(method, MethodKind.Request);
        _routes[method] = async (context, raw, ct) =>
        {
            if (!TryDeserialize(raw, paramsInfo, out TParams? p))
@@ -49,6 +76,7 @@ public sealed class RpcRouter<TContext>
        JsonTypeInfo<TParams> paramsInfo,
        Func<TContext, TParams, CancellationToken, ValueTask> handler)
    {
+        Declare(method, MethodKind.Notification);
        _routes[method] = async (context, raw, ct) =>
        {
            if (!TryDeserialize(raw, paramsInfo, out TParams? p))
@@ -66,12 +94,26 @@ public sealed class RpcRouter<TContext>
    /// 处理一条请求或通知。请求返回响应；通知返回 null（失败时只丢弃）。
    /// 处理函数里的异常属于程序缺陷：在这个边界捕获，回复 internal 错误，并交给 <c>onUnhandled</c> 记录。
    /// </summary>
-    public async ValueTask<RpcMessage?> DispatchAsync(TContext context, RpcMessage message, CancellationToken ct)
+    public async ValueTask<RpcMessage?> DispatchAsync(TContext context, RpcMessage message, CancellationToken ct) =>
+        (await DispatchCheckedAsync(context, message, ct)).Response;
+
+    /// <summary>
+    /// 先核对声明（方向、类型、角色），再分发。违规的消息不会到达处理函数，返回的结果里带 <see cref="RpcViolation"/>，
+    /// 由会话决定怎么办（计数、超过上限就断开连接）。声明过、方向对、但这一侧没有处理函数的方法不算违规，只是不支持。
+    /// </summary>
+    public async ValueTask<RpcDispatch> DispatchCheckedAsync(TContext context, RpcMessage message, CancellationToken ct)
    {
        string method = message.Method ?? "";
+        if (Check(context, message) is { } violation)
+        {
+            return new RpcDispatch(
+                message.Id is null ? null : RpcMessage.Failure(message.Id, new FleetError(FleetErrors.ProtocolViolation, violation.Reason)),
+                violation);
+        }
+
        if (!_routes.TryGetValue(method, out Route? route))
        {
-            return message.Id is null ? null : RpcMessage.Failure(message.Id, new FleetError(FleetErrors.Unsupported, $"unknown method {method}"));
+            return new RpcDispatch(message.Id is null ? null : RpcMessage.Failure(message.Id, new FleetError(FleetErrors.Unsupported, $"unknown method {method}")), null);
        }

        Result<JsonElement?> result;
@@ -91,12 +133,90 @@ public sealed class RpcRouter<TContext>

        if (message.Id is null)
        {
-            return null;
+            return new RpcDispatch(null, null);
        }

-        return result.TryGet(out JsonElement? value, out FleetError? error)
-            ? new RpcMessage { Id = message.Id, Result = value ?? s_emptyObject }
-            : RpcMessage.Failure(message.Id, error);
+        return new RpcDispatch(
+            result.TryGet(out JsonElement? value, out FleetError? error)
+                ? new RpcMessage { Id = message.Id, Result = value ?? s_emptyObject }
+                : RpcMessage.Failure(message.Id, error),
+            null);
+    }
+
+    /// <summary>入站检查：这条消息是不是对方有资格发起的、类型对不对、对方的角色允不允许。</summary>
+    public RpcViolation? Check(TContext context, RpcMessage message)
+    {
+        string method = message.Method ?? "";
+        MethodSpec? spec = Table.Find(Plane, method);
+        if (spec is null)
+        {
+            return new RpcViolation(method, $"method {method} is not declared");
+        }
+
+        if (spec.To != Side)
+        {
+            return new RpcViolation(method, $"{method} cannot be initiated by the {RpcSides.Opposite(Side)} side");
+        }
+
+        MethodKind kind = message.Id is null ? MethodKind.Notification : MethodKind.Request;
+        if (spec.Kind != kind)
+        {
+            return new RpcViolation(method, $"{method} is a {spec.Kind.ToString().ToLowerInvariant()}");
+        }
+
+        if (_callerRole is not null && !spec.AllowsRole(_callerRole(context)))
+        {
+            return new RpcViolation(method, $"{method} is not allowed for this node role");
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// 发送前检查：本侧有没有资格发起这个方法、类型对不对、对端的角色允不允许（服务端发给节点时传入节点的角色）。
+    /// 违反是程序缺陷，抛 <see cref="InvalidOperationException"/>。
+    /// </summary>
+    public void CheckSend(string method, MethodKind kind, string? peerRole = null)
+    {
+        MethodSpec? spec = Table.Find(Plane, method);
+        if (spec is null)
+        {
+            throw new InvalidOperationException($"method {method} is not declared");
+        }
+
+        if (spec.From != Side)
+        {
+            throw new InvalidOperationException($"{method} cannot be initiated by the {Side} side");
+        }
+
+        if (spec.Kind != kind)
+        {
+            throw new InvalidOperationException($"{method} is a {spec.Kind.ToString().ToLowerInvariant()}");
+        }
+
+        if (peerRole is not null && !spec.AllowsRole(peerRole))
+        {
+            throw new InvalidOperationException($"{method} cannot be sent to a {peerRole}");
+        }
+    }
+
+    private void Declare(string method, MethodKind kind)
+    {
+        MethodSpec spec = Table.Find(Plane, method) ?? throw new InvalidOperationException($"method {method} is not declared in the method table");
+        if (spec.To != Side)
+        {
+            throw new InvalidOperationException($"{method} is initiated by the {spec.From} side and cannot be handled on the {Side} side");
+        }
+
+        if (spec.Kind != kind)
+        {
+            throw new InvalidOperationException($"{method} is declared as a {spec.Kind.ToString().ToLowerInvariant()}");
+        }
+
+        if (_localRole is not null && !spec.AllowsRole(_localRole))
+        {
+            throw new InvalidOperationException($"{method} is not for the {_localRole} role");
+        }
    }

    private static bool TryDeserialize<T>(JsonElement? raw, JsonTypeInfo<T> info, [System.Diagnostics.CodeAnalysis.NotNullWhen(true)] out T? value)
@@ -34,6 +34,9 @@ public sealed class RpcSessionOptions

    /// <summary>待处理的入站请求上限；超过时接收循环等待（背压）。</summary>
    public int InboundQueue { get; set; } = 256;
+
+    /// <summary>对端违反协议（方法没有声明、方向、类型或角色不对）的次数上限；超过就断开会话。</summary>
+    public int MaxViolations { get; set; } = 20;
 }

 /// <summary>
@@ -53,6 +56,8 @@ public sealed class RpcSession<TContext> : IAsyncDisposable
    private readonly CancellationTokenSource _stop = new();
    private long _nextId;
    private long _lastReceive;
+    private int _violations;
+    private bool _violated;

    public RpcSession(IRpcTransport transport, RpcRouter<TContext> router, TContext context, TimeProvider time, RpcSessionOptions? options = null)
    {
@@ -81,7 +86,7 @@ public sealed class RpcSession<TContext> : IAsyncDisposable
            while (!linked.IsCancellationRequested)
            {
                RpcFrame? frame = await _transport.ReceiveAsync(linked.Token);
-                if (frame is null)
+                if (frame is null || Volatile.Read(ref _violated))
                {
                    return;
                }
@@ -184,8 +189,16 @@ public sealed class RpcSession<TContext> : IAsyncDisposable
    public ValueTask NotifyAsync<TParams>(string method, TParams parameters, JsonTypeInfo<TParams> paramsInfo, CancellationToken ct) =>
        SendAsync(RpcMessage.Notification(method, parameters, paramsInfo), ct);

-    public ValueTask SendAsync(RpcMessage message, CancellationToken ct) =>
-        _transport.SendAsync(new RpcFrame(FrameKind.Text, JsonSerializer.SerializeToUtf8Bytes(message, FleetRpcContext.Default.RpcMessage)), ct);
+    public ValueTask SendAsync(RpcMessage message, CancellationToken ct)
+    {
+        if (message.Method is not null)
+        {
+            // 请求和通知只能发本侧有资格发起的方法（响应没有方法名，不检查）
+            _router.CheckSend(message.Method, message.Id is null ? MethodKind.Notification : MethodKind.Request);
+        }
+
+        return _transport.SendAsync(new RpcFrame(FrameKind.Text, JsonSerializer.SerializeToUtf8Bytes(message, FleetRpcContext.Default.RpcMessage)), ct);
+    }

    public ValueTask SendBinaryAsync(ReadOnlyMemory<byte> frame, CancellationToken ct) =>
        _transport.SendAsync(new RpcFrame(FrameKind.Binary, frame), ct);
@@ -205,10 +218,18 @@ public sealed class RpcSession<TContext> : IAsyncDisposable
        {
            await foreach (RpcMessage message in _inbound.Reader.ReadAllAsync(ct))
            {
-                RpcMessage? response = await _router.DispatchAsync(_context, message, ct);
-                if (response is not null)
+                RpcDispatch outcome = await _router.DispatchCheckedAsync(_context, message, ct);
+                if (outcome.Response is not null)
                {
-                    await SendAsync(response, ct);
+                    await SendAsync(outcome.Response, ct);
+                }
+
+                if (outcome.Violation is not null && ++_violations > _options.MaxViolations)
+                {
+                    // 只关闭传输，不取消接收：接收循环在下一次读到帧或对端确认关闭时正常结束
+                    Volatile.Write(ref _violated, true);
+                    await _transport.CloseAsync("protocol violations", CancellationToken.None);
+                    return;
                }
            }
        }
@@ -2,9 +2,12 @@ namespace Fleet.Server;

 public sealed class FleetServerOptions
 {
-    /// <summary>节点 ID 的类型前缀，Monitor 使用 <c>agt</c>。</summary>
+    /// <summary>节点 ID 的类型前缀，MoShiro 使用 <c>agt</c>。</summary>
    public string NodeIdPrefix { get; set; } = "node";

+    /// <summary>加入令牌的「种类」对应的节点 ID 前缀（例如 <c>probe</c> → <c>prb</c>）；没有列出的种类用 <see cref="NodeIdPrefix"/>。</summary>
+    public Dictionary<string, string> NodeIdPrefixes { get; } = new(StringComparer.Ordinal);
+
    public int MaxFrameBytes { get; set; } = 16 << 20;

    public TimeSpan ChallengeTtl { get; set; } = TimeSpan.FromSeconds(30);
@@ -12,4 +15,7 @@ public sealed class FleetServerOptions
    public TimeSpan HeartbeatTimeout { get; set; } = TimeSpan.FromSeconds(45);

    public TimeSpan RequestTimeout { get; set; } = TimeSpan.FromSeconds(15);
+
+    /// <summary>节点违反协议（方法没有声明、方向、类型或角色不对）的次数上限；超过就断开这条连接。</summary>
+    public int MaxViolations { get; set; } = 20;
 }
@@ -2,7 +2,7 @@ using Fleet.Core;

 namespace Fleet.Server;

-/// <summary>Fleet 服务端需要的存储。产品可以自己实现（Monitor 把它放进 monitor.db）。</summary>
+/// <summary>Fleet 服务端需要的存储。产品可以自己实现（MoShiro 把它放进 moshiro.db）。</summary>
 public interface IFleetStore
 {
    ValueTask<JoinTokenRecord?> FindJoinTokenAsync(ReadOnlyMemory<byte> tokenSha256, CancellationToken ct);
@@ -31,7 +31,10 @@ public sealed record NewNode(
    IReadOnlyList<string> Labels,
    string? MetaJson,
    string? NodeVersion,
-    long NowMs);
+    long NowMs,
+    string Kind = "",
+    byte[]? TlsPublicKey = null,
+    string? AddedBy = null);

 public sealed record JoinTokenRecord(
    string Id,
@@ -43,6 +46,8 @@ public sealed record JoinTokenRecord(
    int Uses,
    long ExpiresAtMs,
    long? RevokedAtMs,
-    long CreatedAtMs);
+    long CreatedAtMs,
+    string Kind = "",
+    string? CreatedBy = null);

 public sealed record Presence(bool Online, long AtMs, string? NodeVersion, IReadOnlyList<string> Capabilities, string? HelloMetaJson);
@@ -6,6 +6,39 @@ namespace Fleet.Server;

 public sealed record EnrollmentContext(string? RemoteIp, JsonElement? ProductMeta);

+/// <summary>
+/// 服务器的身份密钥：操作员用 passkey 把它的公钥签进操作员集合。有它的时候，认证挑战会带上服务器的签名，节点据此确认对面是真的服务器，
+/// 并在这条链路上用应用层加密。没有注册就是旧的行为（没有服务器身份）。
+/// </summary>
+public interface IServerIdentity
+{
+    byte[] PublicKeySpki { get; }
+
+    /// <summary>对一段内容签名（<c>Fleet.Identity.ServerHello.Payload</c> 给出的）。</summary>
+    byte[] Sign(ReadOnlySpan<byte> payload);
+}
+
+/// <summary>操作员集合的链（passkey 签的，创世在前）。没有初始化信任根时是空的。节点注册时用它确认「这个面板确实是我的操作员的」。</summary>
+/// <summary>节点握手时自述的二进制（旧节点没有）。</summary>
+public sealed record BinaryEvidence(string? Sha256, string? Manifest, string? Signature);
+
+/// <summary>是否让这个节点继续：不放行时 <c>Reason</c> 会原样告诉节点（这是它自己的信息，不是秘密）。</summary>
+public sealed record BinaryDecision(bool Accept, string Reason = "");
+
+/// <summary>
+/// 服务端对节点二进制的把关：节点第一次握手成功的那一刻绑定它的二进制哈希，之后哈希对不上、又不在 CI 签名的更新清单里，就不让它继续运行。
+/// 没有注册实现时不做任何检查。
+/// </summary>
+public interface IBinaryAttestor
+{
+    ValueTask<BinaryDecision> CheckAsync(NodeRecord node, BinaryEvidence evidence, CancellationToken ct);
+}
+
+public interface IOperatorTrustSource
+{
+    ValueTask<IReadOnlyList<SignedStatementDto>> ChainAsync(CancellationToken ct);
+}
+
 /// <summary>产品挂钩：节点注册成功之后调用。</summary>
 public interface IEnrollmentHook
 {
@@ -19,6 +19,13 @@ public sealed class EnrollRequest
    [JsonPropertyName("tls_spki")]
    public string TlsSpki { get; set; } = "";

+    /// <summary>
+    /// 同一把 TLS 密钥的完整公钥（SPKI，base64），必须和 <see cref="TlsSpki"/> 对得上。节点用这把密钥做对等面的签名认证
+    /// （和连服务端用的身份密钥是两把独立的密钥），对端要验签就需要完整的公钥，而不只是指纹。
+    /// </summary>
+    [JsonPropertyName("tls_pubkey")]
+    public string TlsPublicKey { get; set; } = "";
+
    /// <summary>持有证明：对 <c>fleet|v1|enroll|{sha256_hex(join_token)}|{pubkey}</c> 的签名（base64）。</summary>
    [JsonPropertyName("proof")]
    public string Proof { get; set; } = "";
@@ -30,6 +37,12 @@ public sealed class EnrollRequest
    public JsonElement? Meta { get; set; }
 }

+public sealed class TrustRequest
+{
+    [JsonPropertyName("join_token")]
+    public string JoinToken { get; set; } = "";
+}
+
 public sealed class EnrollResponse
 {
    [JsonPropertyName("node_id")]
@@ -62,5 +75,7 @@ public sealed class FleetProblem
 [JsonSourceGenerationOptions(DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull)]
 [JsonSerializable(typeof(EnrollRequest))]
 [JsonSerializable(typeof(EnrollResponse))]
+[JsonSerializable(typeof(TrustRequest))]
+[JsonSerializable(typeof(Fleet.Core.TrustBundle))]
 [JsonSerializable(typeof(FleetProblem))]
 internal sealed partial class EnrollmentJsonContext : JsonSerializerContext;
@@ -20,9 +20,42 @@ public static class FleetEnrollmentEndpoints
            .WithTags("agent")
            .WithSummary("Enroll a node with a join token")
            .DisableAntiforgery();
+        // 注册之前取信任链：节点先确认这个面板的操作员集合和委托确实是它固定的创世签出来的，再把自己的密钥交出去
+        app.MapPost(path + "/trust", HandleTrustAsync)
+            .WithName("fleet_enroll_trust")
+            .WithTags("agent")
+            .WithSummary("The operator set chain and the grant of a join token, for the node to verify before it enrolls")
+            .DisableAntiforgery();
        return app;
    }

+    private static async Task<IResult> HandleTrustAsync(HttpContext http, FleetEnrollmentService service)
+    {
+        TrustRequest? request;
+        try
+        {
+            request = await JsonSerializer.DeserializeAsync(http.Request.Body, EnrollmentJsonContext.Default.TrustRequest, http.RequestAborted);
+        }
+        catch (JsonException)
+        {
+            request = null;
+        }
+
+        if (request is null || string.IsNullOrEmpty(request.JoinToken))
+        {
+            return Problem(StatusCodes.Status400BadRequest, FleetErrors.InvalidParams, "join_token is required");
+        }
+
+        Result<TrustBundle> result = await service.GetTrustAsync(request.JoinToken, http.RequestAborted);
+        if (!result.TryGet(out TrustBundle? bundle, out FleetError? error))
+        {
+            return Problem(error.Code == FleetErrors.JoinTokenExpired ? StatusCodes.Status410Gone : StatusCodes.Status401Unauthorized, error.Code, error.Message);
+        }
+
+        http.Response.Headers.CacheControl = "no-store";
+        return Results.Json(bundle, EnrollmentJsonContext.Default.TrustBundle);
+    }
+
    private static async Task<IResult> HandleAsync(HttpContext http, FleetEnrollmentService service)
    {
        EnrollRequest? request;
@@ -9,13 +9,15 @@ public sealed partial class FleetEnrollmentService
 {
    private readonly IFleetStore _store;
    private readonly IEnumerable<IEnrollmentHook> _hooks;
+    private readonly IEnumerable<IOperatorTrustSource> _trust;
    private readonly FleetServerOptions _options;
    private readonly TimeProvider _time;

-    public FleetEnrollmentService(IFleetStore store, IEnumerable<IEnrollmentHook> hooks, FleetServerOptions options, TimeProvider time)
+    public FleetEnrollmentService(IFleetStore store, IEnumerable<IEnrollmentHook> hooks, IEnumerable<IOperatorTrustSource> trust, FleetServerOptions options, TimeProvider time)
    {
        _store = store;
        _hooks = hooks;
+        _trust = trust;
        _options = options;
        _time = time;
    }
@@ -29,9 +31,16 @@ public sealed partial class FleetEnrollmentService

        if (!TryDecode(request.PublicKey, out byte[] publicKey) || !NodeIdentity.IsValidPublicKey(publicKey)
            || !TryDecode(request.TlsSpki, out byte[] tlsSpki) || tlsSpki.Length != 32
+            || !TryDecode(request.TlsPublicKey, out byte[] tlsPublicKey) || !NodeIdentity.IsValidPublicKey(tlsPublicKey)
            || !TryDecode(request.Proof, out byte[] proof))
        {
-            return Result<EnrollResponse>.Fail(FleetErrors.InvalidParams, "pubkey, tls_spki or proof is malformed");
+            return Result<EnrollResponse>.Fail(FleetErrors.InvalidParams, "pubkey, tls_spki, tls_pubkey or proof is malformed");
+        }
+
+        // 指纹和完整公钥必须是同一把密钥，否则对端按指纹固定证书、按公钥验签，会各认各的
+        if (!System.Security.Cryptography.CryptographicOperations.FixedTimeEquals(NodeIdentity.Fingerprint(tlsPublicKey), tlsSpki))
+        {
+            return Result<EnrollResponse>.Fail(FleetErrors.InvalidParams, "tls_spki does not match tls_pubkey");
        }

        byte[] tokenHash = TokenHash.Sha256(request.JoinToken);
@@ -61,8 +70,9 @@ public sealed partial class FleetEnrollmentService
        bool nameTaken = await _store.FindEstablishedNodeByNameAsync(request.Name, ct) is not null;
        NodeStatus status = token.AutoApprove && !nameTaken ? NodeStatus.Active : NodeStatus.Pending;

+        string prefix = token.Kind.Length > 0 && _options.NodeIdPrefixes.TryGetValue(token.Kind, out string? kindPrefix) ? kindPrefix : _options.NodeIdPrefix;
        var node = new NewNode(
-            new NodeId(Ulid.NewPrefixed(_options.NodeIdPrefix, _time)),
+            new NodeId(Ulid.NewPrefixed(prefix, _time)),
            request.Name,
            status,
            publicKey,
@@ -70,7 +80,10 @@ public sealed partial class FleetEnrollmentService
            token.Labels,
            request.Meta?.GetRawText(),
            request.NodeVersion,
-            nowMs);
+            nowMs,
+            token.Kind,
+            tlsPublicKey,
+            token.CreatedBy);

        Result<NodeRecord> created = await _store.CreateNodeAsync(node, ct);
        if (!created.TryGet(out NodeRecord? record, out FleetError? error))
@@ -91,6 +104,30 @@ public sealed partial class FleetEnrollmentService
        });
    }

+    /// <summary>节点注册之前取：操作员集合的链。码要是有效的；不能用的码不给。</summary>
+    public async ValueTask<Result<TrustBundle>> GetTrustAsync(string joinToken, CancellationToken ct)
+    {
+        JoinTokenRecord? token = await _store.FindJoinTokenAsync(TokenHash.Sha256(joinToken), ct);
+        long nowMs = _time.GetUtcNow().ToUnixTimeMilliseconds();
+        if (token is null || token.RevokedAtMs is not null || token.Uses >= token.MaxUses)
+        {
+            return Result<TrustBundle>.Fail(FleetErrors.JoinTokenInvalid, "join token is invalid");
+        }
+
+        if (token.ExpiresAtMs <= nowMs)
+        {
+            return Result<TrustBundle>.Fail(FleetErrors.JoinTokenExpired, "join token has expired");
+        }
+
+        var bundle = new TrustBundle();
+        foreach (IOperatorTrustSource source in _trust)
+        {
+            bundle.Chain.AddRange(await source.ChainAsync(ct));
+        }
+
+        return Result<TrustBundle>.Ok(bundle);
+    }
+
    private static bool TryDecode(string text, out byte[] data)
    {
        try
@@ -23,8 +23,12 @@ public sealed class FleetLinkHost : IFleetConnections, IStateNotifier
        IEnumerable<IStateProvider> stateProviders,
        IEnumerable<IInbox> inboxes,
        IEnumerable<INodeEventSink> sinks,
-        FleetRouter router)
+        FleetRouter router,
+        IServerIdentity? serverIdentity = null,
+        IBinaryAttestor? binaryAttestor = null)
    {
+        ServerIdentity = serverIdentity;
+        BinaryAttestor = binaryAttestor;
        Store = store;
        Options = options;
        Time = time;
@@ -33,10 +37,17 @@ public sealed class FleetLinkHost : IFleetConnections, IStateNotifier
        Inboxes = inboxes.ToDictionary(i => i.Channel);
        Sinks = [.. sinks];
        Router = router.Inner;
+        RoleOf = router.RoleOf;
    }

    internal IFleetStore Store { get; }

+    /// <summary>服务器的身份密钥；没有时节点连接用旧的明文认证。</summary>
+    internal IServerIdentity? ServerIdentity { get; }
+
+    /// <summary>节点二进制的把关；没有时不检查。</summary>
+    internal IBinaryAttestor? BinaryAttestor { get; }
+
    internal FleetServerOptions Options { get; }

    internal TimeProvider Time { get; }
@@ -51,6 +62,8 @@ public sealed class FleetLinkHost : IFleetConnections, IStateNotifier

    internal RpcRouter<NodeCallContext> Router { get; }

+    internal Func<NodeRecord, string?>? RoleOf { get; }
+
    public IReadOnlyCollection<NodeId> OnlineNodes => [.. _connections.Keys];

    public bool IsOnline(NodeId node) => _connections.ContainsKey(node);
@@ -161,10 +174,18 @@ public sealed class FleetLinkHost : IFleetConnections, IStateNotifier
 /// <summary>产品注册的 RPC 方法路由。</summary>
 public sealed class FleetRouter
 {
-    public FleetRouter(RpcRouter<NodeCallContext> inner)
+    public FleetRouter(RpcRouter<NodeCallContext> inner, Func<NodeRecord, string?>? roleOf)
    {
        Inner = inner;
+        RoleOf = roleOf;
    }

    internal RpcRouter<NodeCallContext> Inner { get; }
+
+    internal Func<NodeRecord, string?>? RoleOf { get; }
+
+    /// <summary>已注册的入站方法名（只读，测试用它核对声明表）。</summary>
+    public IReadOnlyCollection<string> Methods => Inner.Methods;
+
+    public MethodTable Table => Inner.Table;
 }
@@ -19,6 +19,9 @@ internal static partial class FleetLog
    [LoggerMessage(Level = LogLevel.Warning, Message = "state push failed node={Node} type={Type} err={Err}")]
    public static partial void StatePushFailed(ILogger logger, string node, string type, string err);

+    [LoggerMessage(Level = LogLevel.Warning, Message = "protocol violation node={Node} method={Method} reason={Reason}")]
+    public static partial void ProtocolViolation(ILogger logger, string node, string method, string reason);
+
    [LoggerMessage(Level = LogLevel.Error, Message = "unhandled error in handler method={Method}")]
    public static partial void HandlerFailed(ILogger logger, Exception exception, string method);

@@ -12,6 +12,8 @@ namespace Fleet.Server;
 public sealed class FleetServerBuilder
 {
    private readonly List<Action<RpcRouter<NodeCallContext>, IServiceProvider>> _routeConfigurators = [];
+    private MethodTable? _methods;
+    private Func<NodeRecord, string?>? _roleOf;

    internal FleetServerBuilder(IServiceCollection services)
    {
@@ -22,6 +24,21 @@ public sealed class FleetServerBuilder

    internal IReadOnlyList<Action<RpcRouter<NodeCallContext>, IServiceProvider>> RouteConfigurators => _routeConfigurators;

+    internal MethodTable Methods => _methods ?? throw new InvalidOperationException("call WithMethods(...) when adding the Fleet server: the method table is required");
+
+    internal Func<NodeRecord, string?>? RoleOf => _roleOf;
+
+    /// <summary>
+    /// 方法声明表（框架的加产品的，见 <see cref="MethodTable.Combine"/>）和节点的角色解析（例如按节点 ID 前缀区分 Agent 和 Probe）。必须设置：
+    /// 路由器据此核对每个处理函数的方向、类型和角色，并拒绝没有声明或不该由节点发起的方法。
+    /// </summary>
+    public FleetServerBuilder WithMethods(MethodTable methods, Func<NodeRecord, string?> roleOf)
+    {
+        _methods = methods;
+        _roleOf = roleOf;
+        return this;
+    }
+
    public FleetServerBuilder AddState<[DynamicallyAccessedMembers(DynamicallyAccessedMemberTypes.PublicConstructors)] TProvider>()
        where TProvider : class, IStateProvider
    {
@@ -50,7 +67,7 @@ public sealed class FleetServerBuilder
        return this;
    }

-    /// <summary>注册产品的 RPC 方法（<c>monitor.*</c> 等）。处理函数通过 <see cref="IServiceProvider"/> 在调用时解析服务，避免构造期的循环依赖。</summary>
+    /// <summary>注册产品的 RPC 方法（<c>moshiro.*</c> 等）。处理函数通过 <see cref="IServiceProvider"/> 在调用时解析服务，避免构造期的循环依赖。</summary>
    public FleetServerBuilder MapMethods(Action<RpcRouter<NodeCallContext>, IServiceProvider> configure)
    {
        _routeConfigurators.Add(configure);
@@ -71,13 +88,18 @@ public static class FleetServerExtensions
        services.AddSingleton(provider =>
        {
            ILogger logger = provider.GetRequiredService<ILoggerFactory>().CreateLogger("Fleet.Rpc");
-            var router = new RpcRouter<NodeCallContext>((method, ex) => FleetLog.HandlerFailed(logger, ex, method));
+            Func<NodeRecord, string?>? roleOf = builder.RoleOf;
+            var router = new RpcRouter<NodeCallContext>(
+                RpcSide.Server,
+                builder.Methods,
+                callerRole: roleOf is null ? null : context => roleOf(context.Node),
+                onUnhandled: (method, ex) => FleetLog.HandlerFailed(logger, ex, method));
            foreach (Action<RpcRouter<NodeCallContext>, IServiceProvider> configurator in builder.RouteConfigurators)
            {
                configurator(router, provider);
            }

-            return new FleetRouter(router);
+            return new FleetRouter(router, roleOf);
        });
        services.AddSingleton(provider => new FleetLinkHost(
            provider.GetRequiredService<IFleetStore>(),
@@ -87,7 +109,9 @@ public static class FleetServerExtensions
            provider.GetServices<IStateProvider>(),
            provider.GetServices<IInbox>(),
            provider.GetServices<INodeEventSink>(),
-            provider.GetRequiredService<FleetRouter>()));
+            provider.GetRequiredService<FleetRouter>(),
+            provider.GetService<IServerIdentity>(),
+            provider.GetService<IBinaryAttestor>()));
        services.AddSingleton<IFleetConnections>(provider => provider.GetRequiredService<FleetLinkHost>());
        services.AddSingleton<IStateNotifier>(provider => provider.GetRequiredService<FleetLinkHost>());
        return builder;
@@ -0,0 +1,131 @@
+using System.Net.WebSockets;
+using System.Security.Cryptography;
+using System.Text.Json;
+using Fleet.Core;
+using Fleet.Identity;
+using Fleet.Rpc;
+
+namespace Fleet.Server;
+
+/// <summary>认证：挑战、签名校验、拒绝。</summary>
+internal sealed partial class NodeConnection
+{
+    private async Task<bool> AuthenticateAsync(CancellationToken ct)
+    {
+        string nonce = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32));
+        long expiresAtMs = _host.Time.GetUtcNow().Add(_host.Options.ChallengeTtl).ToUnixTimeMilliseconds();
+
+        // 有服务器身份密钥：挑战里带上这次连接的临时公钥和服务器的签名，节点据此确认服务器、协商加密链路
+        using var serverEphemeral = _host.ServerIdentity is null ? null : new EphemeralKey();
+        var challenge = new ChallengeParams { Nonce = nonce, ExpiresAtMs = expiresAtMs };
+        string? serverEphemeralText = null;
+        if (_host.ServerIdentity is { } identity && serverEphemeral is not null)
+        {
+            serverEphemeralText = Convert.ToBase64String(serverEphemeral.PublicKeySpki);
+            challenge.ServerEphemeral = serverEphemeralText;
+            challenge.ServerSignature = Convert.ToBase64String(identity.Sign(ServerHello.Payload(nonce, serverEphemeral.PublicKeySpki)));
+        }
+
+        await SendAsync(RpcMessage.Notification(FleetMethods.Challenge, challenge, FleetRpcContext.Default.ChallengeParams), ct);
+
+        using var timeout = new CancellationTokenSource(s_authTimeout, _host.Time);
+        using CancellationTokenSource linked = CancellationTokenSource.CreateLinkedTokenSource(ct, timeout.Token);
+        Frame? frame;
+        try
+        {
+            frame = await ReceiveFrameAsync(linked.Token);
+        }
+        catch (OperationCanceledException) when (!ct.IsCancellationRequested)
+        {
+            await RejectAsync(null, "auth timeout", ct);
+            return false;
+        }
+
+        if (frame is not { IsText: true } || !TryParse(frame.Data, out RpcMessage? message) || message.Method != FleetMethods.Auth || message.Id is null)
+        {
+            await RejectAsync(null, "expected fleet.auth", ct);
+            return false;
+        }
+
+        AuthParams? auth = null;
+        try
+        {
+            auth = message.Params?.Deserialize(FleetRpcContext.Default.AuthParams);
+        }
+        catch (JsonException)
+        {
+            // 按缺失处理
+        }
+
+        NodeRecord? node = auth is null ? null : await _host.Store.GetNodeAsync(new NodeId(auth.NodeId), ct);
+
+        // 安全链路：节点的签名覆盖双方的临时公钥（AuthSecure），验过之后这条连接上的所有帧都是加密的
+        byte[] nodeEphemeral = [];
+        bool secure = auth?.NodeEphemeral is not null && serverEphemeral is not null && serverEphemeralText is not null && TryDecode(auth.NodeEphemeral, out nodeEphemeral);
+        bool signatureOk = node is not null
+            && _host.Time.GetUtcNow().ToUnixTimeMilliseconds() <= expiresAtMs
+            && TryDecode(auth!.Signature, out byte[] signature)
+            && (secure
+                ? NodeIdentity.Verify(node.PublicKey, signature, SignaturePurpose.AuthSecure, auth.NodeId, nonce, serverEphemeralText!, auth.NodeEphemeral!)
+                : auth.NodeEphemeral is null && NodeIdentity.Verify(node.PublicKey, signature, SignaturePurpose.Auth, auth.NodeId, nonce));
+        if (signatureOk && secure)
+        {
+            _cipher = LinkCipher.ForServer(serverEphemeral!, nodeEphemeral, nonce);
+        }
+
+        if (!signatureOk)
+        {
+            // 节点不存在与签名错误返回同样的错误，不泄露节点是否存在。
+            await RejectAsync(message.Id, "authentication failed", ct);
+            return false;
+        }
+
+        _node = node;
+        if (node!.Status == NodeStatus.Disabled)
+        {
+            await SendAsync(RpcMessage.Failure(message.Id, new FleetError(FleetErrors.NodeDisabled, "node is disabled")), ct);
+            await RevokeAsync("disabled", ct);
+            return false;
+        }
+
+        // 二进制：第一次握手成功的这一刻绑定，之后哈希对不上又不在 CI 签名的更新清单里，就不让它继续运行
+        if (_host.BinaryAttestor is { } attestor)
+        {
+            BinaryDecision decision = await attestor.CheckAsync(node, new BinaryEvidence(auth!.Binary, auth.Release, auth.ReleaseSignature), ct);
+            if (!decision.Accept)
+            {
+                await SendAsync(RpcMessage.Failure(message.Id, new FleetError(FleetErrors.BinaryMismatch, decision.Reason)), ct);
+                await RejectAsync(null, "binary mismatch: " + decision.Reason, ct);
+                return false;
+            }
+        }
+
+        _session = new NodeSessionInfo(node.Id, _host.Time.GetUtcNow().ToUnixTimeMilliseconds(), node.NodeVersion, [], null);
+        await SendAsync(
+            RpcMessage.Success(message.Id.Value, new AuthResult { Status = StatusName(node.Status) }, FleetRpcContext.Default.AuthResult),
+            ct);
+        return true;
+    }
+
+    private async Task RejectAsync(long? id, string reason, CancellationToken ct)
+    {
+        FleetLog.AuthRejected(_host.Logger, reason);
+        _closeReason ??= reason;
+        if (id is not null)
+        {
+            await SendAsync(RpcMessage.Failure(id, new FleetError(FleetErrors.Unauthorized, "authentication failed")), ct);
+        }
+
+        if (_socket.State == WebSocketState.Open)
+        {
+            try
+            {
+                await _socket.CloseOutputAsync(WebSocketCloseStatus.PolicyViolation, "unauthorized", ct);
+            }
+            catch (WebSocketException)
+            {
+                // 对端已经断开
+            }
+        }
+    }
+}
@@ -0,0 +1,240 @@
+using System.Text.Json;
+using Fleet.Core;
+using Fleet.Rpc;
+
+namespace Fleet.Server;
+
+/// <summary>接收：读帧、分发消息、hello、心跳、二进制通道（收件箱）。</summary>
+internal sealed partial class NodeConnection
+{
+    private async Task ReceiveLoopAsync(CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            using var idle = new CancellationTokenSource(_host.Options.HeartbeatTimeout, _host.Time);
+            using CancellationTokenSource linked = CancellationTokenSource.CreateLinkedTokenSource(ct, idle.Token);
+            Frame? frame;
+            try
+            {
+                frame = await ReceiveFrameAsync(linked.Token);
+            }
+            catch (OperationCanceledException) when (idle.IsCancellationRequested && !ct.IsCancellationRequested)
+            {
+                _closeReason ??= "heartbeat timeout";
+                return;
+            }
+
+            if (frame is null)
+            {
+                _closeReason ??= "closed by peer";
+                return;
+            }
+
+            if (frame.IsText)
+            {
+                if (TryParse(frame.Data, out RpcMessage? message))
+                {
+                    await HandleMessageAsync(message, ct);
+                }
+            }
+            else
+            {
+                await HandleBinaryAsync(frame.Data, ct);
+            }
+        }
+    }
+
+    private async Task HandleMessageAsync(RpcMessage message, CancellationToken ct)
+    {
+        if (message.IsResponse)
+        {
+            if (_pending.TryGetValue(message.Id!.Value, out TaskCompletionSource<RpcMessage>? waiter))
+            {
+                waiter.TrySetResult(message);
+            }
+
+            return;
+        }
+
+        switch (message.Method)
+        {
+            case FleetMethods.Hello:
+                await HandleHelloAsync(message, ct);
+                return;
+            case FleetMethods.Heartbeat:
+                await HandleHeartbeatAsync(message, ct);
+                return;
+        }
+
+        if (_node!.Status != NodeStatus.Active)
+        {
+            if (message.Id is not null)
+            {
+                await SendAsync(RpcMessage.Failure(message.Id, new FleetError(FleetErrors.NodePending, "node is not approved yet")), ct);
+            }
+
+            return;
+        }
+
+        var context = new NodeCallContext(_node, _session!, _host);
+        RpcDispatch outcome;
+        try
+        {
+            outcome = await _host.Router.DispatchCheckedAsync(context, message, ct);
+        }
+        catch (OperationCanceledException) when (ct.IsCancellationRequested)
+        {
+            throw;
+        }
+
+        if (outcome.Response is not null)
+        {
+            await SendAsync(outcome.Response, ct);
+        }
+
+        await NoteViolationAsync(outcome.Violation);
+    }
+
+    /// <summary>记录节点的违规；超过上限就断开这条连接。</summary>
+    private async Task NoteViolationAsync(RpcViolation? violation)
+    {
+        if (violation is not { } v)
+        {
+            return;
+        }
+
+        FleetLog.ProtocolViolation(_host.Logger, _node!.Id.Value, v.Method, v.Reason);
+        if (++_violations > _host.Options.MaxViolations)
+        {
+            await CloseAsync("protocol violations");
+        }
+    }
+
+    private async Task HandleHelloAsync(RpcMessage message, CancellationToken ct)
+    {
+        HelloParams? hello = null;
+        try
+        {
+            hello = message.Params?.Deserialize(FleetRpcContext.Default.HelloParams);
+        }
+        catch (JsonException)
+        {
+            // 按缺失处理
+        }
+
+        if (hello is null)
+        {
+            if (message.Id is not null)
+            {
+                await SendAsync(RpcMessage.Failure(message.Id, new FleetError(FleetErrors.InvalidParams, "invalid hello")), ct);
+            }
+
+            return;
+        }
+
+        long nowMs = _host.Time.GetUtcNow().ToUnixTimeMilliseconds();
+        _session = _session! with
+        {
+            NodeVersion = hello.NodeVersion,
+            Capabilities = hello.Capabilities,
+            HelloMetaJson = hello.Meta?.GetRawText(),
+        };
+        _node = _node! with { NodeVersion = hello.NodeVersion };
+        _helloDone = true;
+
+        await UpdatePresenceAsync(online: true, ct);
+        await FireAsync(NodeEventKind.Hello, ct, hello);
+
+        if (message.Id is not null)
+        {
+            await SendAsync(
+                RpcMessage.Success(
+                    message.Id.Value,
+                    new HelloResult { ServerTimeMs = nowMs, ClockOffsetMs = hello.NowUtcMs - nowMs },
+                    FleetRpcContext.Default.HelloResult),
+                ct);
+        }
+
+        SignalStateChanged();
+    }
+
+    private async Task HandleHeartbeatAsync(RpcMessage message, CancellationToken ct)
+    {
+        JsonElement? extra = null;
+        try
+        {
+            extra = message.Params?.Deserialize(FleetRpcContext.Default.HeartbeatParams)?.Extra;
+        }
+        catch (JsonException)
+        {
+            // 忽略格式不正确的附加字段
+        }
+
+        long now = _host.Time.GetTimestamp();
+        if (_host.Time.GetElapsedTime(Interlocked.Read(ref _lastPresenceTicks), now) >= s_presenceRefresh)
+        {
+            await UpdatePresenceAsync(online: true, ct);
+        }
+
+        await FireAsync(NodeEventKind.Heartbeat, ct, hello: null, extra);
+        if (message.Id is not null)
+        {
+            await SendAsync(new RpcMessage { Id = message.Id, Result = JsonSerializer.SerializeToElement(new EmptyObject(), FleetEmptyObject.Info) }, ct);
+        }
+    }
+
+    private async Task HandleBinaryAsync(byte[] data, CancellationToken ct)
+    {
+        if (_node!.Status != NodeStatus.Active || !OutboxFrame.TryParse(data, out byte channel, out Guid msgId, out ReadOnlyMemory<byte> payload))
+        {
+            return;
+        }
+
+        // 通道也要声明：节点只能往声明过、并且允许它的角色使用的通道发
+        ChannelSpec? spec = _host.Router.Table.FindChannel(RpcPlane.Node, channel);
+        if (spec is null || spec.From != RpcSide.Node || !spec.AllowsRole(_host.RoleOf?.Invoke(_node)))
+        {
+            await NoteViolationAsync(new RpcViolation($"channel {channel}", $"channel {channel} is not declared for this node"));
+            return;
+        }
+
+        if (!_host.Inboxes.TryGetValue(channel, out IInbox? inbox))
+        {
+            return;
+        }
+
+        InboxOutcome outcome;
+        try
+        {
+            outcome = await inbox.HandleAsync(_node, msgId, payload, ct);
+        }
+        catch (OperationCanceledException) when (ct.IsCancellationRequested)
+        {
+            throw;
+        }
+        catch (Exception ex)
+        {
+            // 没有持久化就不确认，节点会重发。
+            FleetLog.InboxFailed(_host.Logger, ex, _node.Id.Value, channel);
+            return;
+        }
+
+        if (outcome == InboxOutcome.Rejected)
+        {
+            return;
+        }
+
+        var ack = new OutboxAckParams();
+        string id = msgId.ToString();
+        if (outcome == InboxOutcome.Duplicate)
+        {
+            ack.Duplicates.Add(id);
+        }
+        else
+        {
+            ack.Ids.Add(id);
+        }
+
+        await SendAsync(RpcMessage.Notification(FleetMethods.OutboxAck, ack, FleetRpcContext.Default.OutboxAckParams), ct);
+    }
+}
@@ -0,0 +1,128 @@
+using System.Net.WebSockets;
+using System.Text.Json;
+using Fleet.Core;
+using Fleet.Rpc;
+
+namespace Fleet.Server;
+
+/// <summary>发给节点：关闭、吊销、发送一条消息、发起请求并等响应。</summary>
+internal sealed partial class NodeConnection
+{
+    /// <summary>
+    /// 服务端发起的关闭：发送 Close 帧，等对端确认之后接收循环自然结束。
+    /// 注意不能直接取消接收的令牌——取消 <c>ReceiveAsync</c> 会中止整个 WebSocket，对端拿不到关闭原因；取消只作为超时兜底。
+    /// </summary>
+    public async ValueTask CloseAsync(string reason)
+    {
+        _closeReason ??= reason;
+        try
+        {
+            await _sendLock.WaitAsync(CancellationToken.None);
+        }
+        catch (ObjectDisposedException)
+        {
+            return;
+        }
+
+        try
+        {
+            if (_socket.State == WebSocketState.Open)
+            {
+                await _socket.CloseOutputAsync(WebSocketCloseStatus.NormalClosure, reason, CancellationToken.None);
+            }
+        }
+        catch (WebSocketException)
+        {
+            // 对端已经断开
+        }
+        finally
+        {
+            _sendLock.Release();
+        }
+
+        _lifetime.CancelAfter(s_closeTimeout);
+    }
+
+    public async ValueTask RevokeAsync(string reason, CancellationToken ct)
+    {
+        await SendAsync(RpcMessage.Notification(FleetMethods.Revoked, new RevokedParams { Reason = reason }, FleetRpcContext.Default.RevokedParams), ct);
+        await CloseAsync(reason);
+    }
+
+    public async ValueTask<bool> SendAsync(RpcMessage message, CancellationToken ct)
+    {
+        if (message.Method is not null)
+        {
+            // 服务端只能发自己有资格发起的方法，并且对端的角色要允许（响应没有方法名，不检查）
+            string? peerRole = _node is null ? null : _host.RoleOf?.Invoke(_node);
+            _host.Router.CheckSend(message.Method, message.Id is null ? MethodKind.Notification : MethodKind.Request, peerRole);
+        }
+
+        byte[] bytes = JsonSerializer.SerializeToUtf8Bytes(message, FleetRpcContext.Default.RpcMessage);
+        try
+        {
+            await _sendLock.WaitAsync(ct);
+        }
+        catch (ObjectDisposedException)
+        {
+            return false;
+        }
+
+        try
+        {
+            if (_socket.State != WebSocketState.Open)
+            {
+                return false;
+            }
+
+            if (_cipher is { } cipher)
+            {
+                await _socket.SendAsync(cipher.Seal(0, bytes), WebSocketMessageType.Binary, endOfMessage: true, ct);
+            }
+            else
+            {
+                await _socket.SendAsync(bytes, WebSocketMessageType.Text, endOfMessage: true, ct);
+            }
+
+            return true;
+        }
+        catch (WebSocketException)
+        {
+            return false;
+        }
+        finally
+        {
+            _sendLock.Release();
+        }
+    }
+
+    public async ValueTask<Result<JsonElement>> RequestAsync(string method, JsonElement parameters, CancellationToken ct)
+    {
+        long id = Interlocked.Increment(ref _nextRequestId);
+        var waiter = new TaskCompletionSource<RpcMessage>(TaskCreationOptions.RunContinuationsAsynchronously);
+        _pending[id] = waiter;
+        try
+        {
+            var request = new RpcMessage { Id = id, Method = method, Params = parameters };
+            if (!await SendAsync(request, ct))
+            {
+                return Result<JsonElement>.Fail(FleetErrors.NodeOffline, "node is not connected");
+            }
+
+            using var timeout = new CancellationTokenSource(_host.Options.RequestTimeout, _host.Time);
+            using CancellationTokenSource linked = CancellationTokenSource.CreateLinkedTokenSource(ct, timeout.Token);
+            RpcMessage response = await waiter.Task.WaitAsync(linked.Token);
+            return response.Error is not null
+                ? Result<JsonElement>.Fail(response.Error.ToFleetError())
+                : Result<JsonElement>.Ok(response.Result ?? default);
+        }
+        catch (OperationCanceledException) when (!ct.IsCancellationRequested)
+        {
+            return Result<JsonElement>.Fail(FleetErrors.Timeout, $"{method} timed out");
+        }
+        finally
+        {
+            _pending.TryRemove(id, out _);
+        }
+    }
+}
@@ -0,0 +1,123 @@
+using System.Text.Json;
+using Fleet.Core;
+using Fleet.Rpc;
+
+namespace Fleet.Server;
+
+/// <summary>状态：期望状态推送、在线状态、节点事件。</summary>
+internal sealed partial class NodeConnection
+{
+    public void SignalStateChanged() => _stateSignal.Writer.TryWrite(true);
+
+
+    private async Task StatePushLoopAsync(CancellationToken ct)
+    {
+        while (await _stateSignal.Reader.WaitToReadAsync(ct))
+        {
+            _stateSignal.Reader.TryRead(out _);
+            bool complete = await PushStateAsync(ct);
+            if (!complete)
+            {
+                await Task.Delay(s_statePushRetry, _host.Time, ct);
+                SignalStateChanged();
+            }
+        }
+    }
+
+    private async Task<bool> PushStateAsync(CancellationToken ct)
+    {
+        NodeRecord? fresh = await _host.Store.GetNodeAsync(_node!.Id, ct);
+        if (fresh is null)
+        {
+            return true;
+        }
+
+        _node = fresh with { NodeVersion = _node.NodeVersion ?? fresh.NodeVersion };
+        if (fresh.Status == NodeStatus.Disabled)
+        {
+            await RevokeAsync("disabled", ct);
+            return true;
+        }
+
+        if (fresh.Status != NodeStatus.Active || !_helloDone)
+        {
+            // pending 不下发状态；还没有 hello 的连接等 hello 之后再推送。
+            return true;
+        }
+
+        bool complete = true;
+        foreach (IStateProvider provider in _host.StateProviders)
+        {
+            StateDocument? document = await provider.GetAsync(_node, ct);
+            if (document is null || (_lastPushedVersion.TryGetValue(provider.Type, out long last) && last == document.Version))
+            {
+                continue;
+            }
+
+            Result<JsonElement> raw = await RequestAsync(
+                FleetMethods.StateSync,
+                JsonSerializer.SerializeToElement(
+                    new StateSyncParams { Type = provider.Type, Version = document.Version, Doc = document.Doc },
+                    FleetRpcContext.Default.StateSyncParams),
+                ct);
+            if (!raw.TryGet(out JsonElement value, out FleetError? error))
+            {
+                FleetLog.StatePushFailed(_host.Logger, _node.Id.Value, provider.Type, error.Code.Value);
+                complete = false;
+                continue;
+            }
+
+            StateSyncResult? result = null;
+            try
+            {
+                result = value.Deserialize(FleetRpcContext.Default.StateSyncResult);
+            }
+            catch (JsonException)
+            {
+                // 按缺失处理
+            }
+
+            if (result is null)
+            {
+                complete = false;
+                continue;
+            }
+
+            _lastPushedVersion[provider.Type] = document.Version;
+            await provider.OnAppliedAsync(_node, document.Version, result, ct);
+        }
+
+        return complete;
+    }
+
+
+    private async Task UpdatePresenceAsync(bool online, CancellationToken ct)
+    {
+        Interlocked.Exchange(ref _lastPresenceTicks, _host.Time.GetTimestamp());
+        await _host.Store.UpdatePresenceAsync(
+            _node!.Id,
+            new Presence(online, _host.Time.GetUtcNow().ToUnixTimeMilliseconds(), _session?.NodeVersion, _session?.Capabilities ?? [], _session?.HelloMetaJson),
+            ct);
+    }
+
+    private async Task FireAsync(NodeEventKind kind, CancellationToken ct, HelloParams? hello = null, JsonElement? extra = null)
+    {
+        var nodeEvent = new NodeEvent(kind, _node!, _host.Time.GetUtcNow().ToUnixTimeMilliseconds(), hello, extra);
+        foreach (INodeEventSink sink in _host.Sinks)
+        {
+            try
+            {
+                await sink.OnEventAsync(nodeEvent, ct);
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested)
+            {
+                throw;
+            }
+            catch (Exception ex)
+            {
+                // 产品的事件处理失败不能影响连接。
+                FleetLog.SinkFailed(_host.Logger, ex, kind.ToString(), _node!.Id.Value);
+            }
+        }
+    }
+}
@@ -0,0 +1,98 @@
+using System.Buffers;
+using System.Net.WebSockets;
+using System.Text.Json;
+using Fleet.Rpc;
+
+namespace Fleet.Server;
+
+/// <summary>线上的帧：WebSocket 收帧、解析、状态名。</summary>
+internal sealed partial class NodeConnection
+{
+    private async ValueTask<Frame?> ReceiveFrameAsync(CancellationToken ct)
+    {
+        var writer = new ArrayBufferWriter<byte>(1024);
+        while (true)
+        {
+            Memory<byte> buffer = writer.GetMemory(4096);
+            ValueWebSocketReceiveResult result = await _socket.ReceiveAsync(buffer, ct);
+            if (result.MessageType == WebSocketMessageType.Close)
+            {
+                return null;
+            }
+
+            writer.Advance(result.Count);
+            if (writer.WrittenCount > _host.Options.MaxFrameBytes)
+            {
+                _closeReason ??= "frame too large";
+                await _socket.CloseOutputAsync(WebSocketCloseStatus.MessageTooBig, "frame too large", CancellationToken.None);
+                return null;
+            }
+
+            if (result.EndOfMessage)
+            {
+                if (_cipher is { } cipher)
+                {
+                    // 加密链路上只接受通过认证的二进制帧；明文、被改过的、重放的、乱序的一律断开
+                    if (result.MessageType != WebSocketMessageType.Binary || !cipher.TryOpen(writer.WrittenSpan, out byte kind, out byte[] plain))
+                    {
+                        _closeReason ??= "frame failed authentication";
+                        await _socket.CloseOutputAsync(WebSocketCloseStatus.PolicyViolation, "frame failed authentication", CancellationToken.None);
+                        return null;
+                    }
+
+                    return new Frame(kind == 0, plain);
+                }
+
+                return new Frame(result.MessageType == WebSocketMessageType.Text, writer.WrittenSpan.ToArray());
+            }
+        }
+    }
+
+    private static bool TryParse(byte[] data, [System.Diagnostics.CodeAnalysis.NotNullWhen(true)] out RpcMessage? message)
+    {
+        try
+        {
+            message = JsonSerializer.Deserialize(data, FleetRpcContext.Default.RpcMessage);
+            return message is not null;
+        }
+        catch (JsonException)
+        {
+            message = null;
+            return false;
+        }
+    }
+
+    private static bool TryDecode(string text, out byte[] data)
+    {
+        try
+        {
+            data = Convert.FromBase64String(text);
+            return true;
+        }
+        catch (FormatException)
+        {
+            data = [];
+            return false;
+        }
+    }
+
+    private static string StatusName(NodeStatus status) => status switch
+    {
+        NodeStatus.Active => "active",
+        NodeStatus.Pending => "pending",
+        _ => "disabled",
+    };
+
+    private sealed record Frame(bool IsText, byte[] Data);
+}
+
+
+[System.Text.Json.Serialization.JsonSerializable(typeof(EmptyObject))]
+internal sealed partial class FleetEmptyObjectContext : System.Text.Json.Serialization.JsonSerializerContext;
+
+internal sealed class EmptyObject;
+
+internal static class FleetEmptyObject
+{
+    public static System.Text.Json.Serialization.Metadata.JsonTypeInfo<EmptyObject> Info => FleetEmptyObjectContext.Default.EmptyObject;
+}
@@ -1,9 +1,6 @@
-using System.Buffers;
 using System.Collections.Concurrent;
 using System.Net.WebSockets;
-using System.Security.Cryptography;
 using System.Threading.Channels;
-using System.Text.Json;
 using Fleet.Core;
 using Fleet.Identity;
 using Fleet.Rpc;
@@ -14,7 +11,7 @@ namespace Fleet.Server;
 /// 一个节点的 WebSocket 会话：挑战 → 签名认证 → hello → 状态推送 / 收件箱 / 产品 RPC。
 /// 收到的消息按顺序处理，所以产品的处理函数不能等待“向同一个节点发起的请求”，否则会死锁。
 /// </summary>
-internal sealed class NodeConnection : IDisposable
+internal sealed partial class NodeConnection : IDisposable
 {
    private static readonly TimeSpan s_authTimeout = TimeSpan.FromSeconds(15);
    private static readonly TimeSpan s_presenceRefresh = TimeSpan.FromSeconds(60);
@@ -28,12 +25,14 @@ internal sealed class NodeConnection : IDisposable
    private readonly Channel<bool> _stateSignal = Channel.CreateBounded<bool>(new BoundedChannelOptions(1) { FullMode = BoundedChannelFullMode.DropWrite });
    private readonly Dictionary<string, long> _lastPushedVersion = new(StringComparer.Ordinal);
    private readonly CancellationTokenSource _lifetime = new();
+    private LinkCipher? _cipher;
    private long _nextRequestId;
    private long _lastPresenceTicks;
    private NodeRecord? _node;
    private NodeSessionInfo? _session;
    private string? _closeReason;
    private bool _helloDone;
+    private int _violations;

    public NodeConnection(FleetLinkHost host, WebSocket socket)
    {
@@ -137,593 +136,8 @@ internal sealed class NodeConnection : IDisposable

    public void Dispose()
    {
+        _cipher?.Dispose();
        _lifetime.Dispose();
        _sendLock.Dispose();
    }
-
-    public void SignalStateChanged() => _stateSignal.Writer.TryWrite(true);
-
-    /// <summary>
-    /// 服务端发起的关闭：发送 Close 帧，等对端确认之后接收循环自然结束。
-    /// 注意不能直接取消接收的令牌——取消 <c>ReceiveAsync</c> 会中止整个 WebSocket，对端拿不到关闭原因；取消只作为超时兜底。
-    /// </summary>
-    public async ValueTask CloseAsync(string reason)
-    {
-        _closeReason ??= reason;
-        try
-        {
-            await _sendLock.WaitAsync(CancellationToken.None);
-        }
-        catch (ObjectDisposedException)
-        {
-            return;
-        }
-
-        try
-        {
-            if (_socket.State == WebSocketState.Open)
-            {
-                await _socket.CloseOutputAsync(WebSocketCloseStatus.NormalClosure, reason, CancellationToken.None);
-            }
-        }
-        catch (WebSocketException)
-        {
-            // 对端已经断开
-        }
-        finally
-        {
-            _sendLock.Release();
-        }
-
-        _lifetime.CancelAfter(s_closeTimeout);
-    }
-
-    public async ValueTask RevokeAsync(string reason, CancellationToken ct)
-    {
-        await SendAsync(RpcMessage.Notification(FleetMethods.Revoked, new RevokedParams { Reason = reason }, FleetRpcContext.Default.RevokedParams), ct);
-        await CloseAsync(reason);
-    }
-
-    public async ValueTask<bool> SendAsync(RpcMessage message, CancellationToken ct)
-    {
-        byte[] bytes = JsonSerializer.SerializeToUtf8Bytes(message, FleetRpcContext.Default.RpcMessage);
-        try
-        {
-            await _sendLock.WaitAsync(ct);
-        }
-        catch (ObjectDisposedException)
-        {
-            return false;
-        }
-
-        try
-        {
-            if (_socket.State != WebSocketState.Open)
-            {
-                return false;
-            }
-
-            await _socket.SendAsync(bytes, WebSocketMessageType.Text, endOfMessage: true, ct);
-            return true;
-        }
-        catch (WebSocketException)
-        {
-            return false;
-        }
-        finally
-        {
-            _sendLock.Release();
-        }
-    }
-
-    public async ValueTask<Result<JsonElement>> RequestAsync(string method, JsonElement parameters, CancellationToken ct)
-    {
-        long id = Interlocked.Increment(ref _nextRequestId);
-        var waiter = new TaskCompletionSource<RpcMessage>(TaskCreationOptions.RunContinuationsAsynchronously);
-        _pending[id] = waiter;
-        try
-        {
-            var request = new RpcMessage { Id = id, Method = method, Params = parameters };
-            if (!await SendAsync(request, ct))
-            {
-                return Result<JsonElement>.Fail(FleetErrors.NodeOffline, "node is not connected");
-            }
-
-            using var timeout = new CancellationTokenSource(_host.Options.RequestTimeout, _host.Time);
-            using CancellationTokenSource linked = CancellationTokenSource.CreateLinkedTokenSource(ct, timeout.Token);
-            RpcMessage response = await waiter.Task.WaitAsync(linked.Token);
-            return response.Error is not null
-                ? Result<JsonElement>.Fail(response.Error.ToFleetError())
-                : Result<JsonElement>.Ok(response.Result ?? default);
-        }
-        catch (OperationCanceledException) when (!ct.IsCancellationRequested)
-        {
-            return Result<JsonElement>.Fail(FleetErrors.Timeout, $"{method} timed out");
-        }
-        finally
-        {
-            _pending.TryRemove(id, out _);
-        }
-    }
-
-    // ───────────────────────── 认证 ─────────────────────────
-
-    private async Task<bool> AuthenticateAsync(CancellationToken ct)
-    {
-        string nonce = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32));
-        long expiresAtMs = _host.Time.GetUtcNow().Add(_host.Options.ChallengeTtl).ToUnixTimeMilliseconds();
-        await SendAsync(
-            RpcMessage.Notification(FleetMethods.Challenge, new ChallengeParams { Nonce = nonce, ExpiresAtMs = expiresAtMs }, FleetRpcContext.Default.ChallengeParams),
-            ct);
-
-        using var timeout = new CancellationTokenSource(s_authTimeout, _host.Time);
-        using CancellationTokenSource linked = CancellationTokenSource.CreateLinkedTokenSource(ct, timeout.Token);
-        Frame? frame;
-        try
-        {
-            frame = await ReceiveFrameAsync(linked.Token);
-        }
-        catch (OperationCanceledException) when (!ct.IsCancellationRequested)
-        {
-            await RejectAsync(null, "auth timeout", ct);
-            return false;
-        }
-
-        if (frame is not { IsText: true } || !TryParse(frame.Data, out RpcMessage? message) || message.Method != FleetMethods.Auth || message.Id is null)
-        {
-            await RejectAsync(null, "expected fleet.auth", ct);
-            return false;
-        }
-
-        AuthParams? auth = null;
-        try
-        {
-            auth = message.Params?.Deserialize(FleetRpcContext.Default.AuthParams);
-        }
-        catch (JsonException)
-        {
-            // 按缺失处理
-        }
-
-        NodeRecord? node = auth is null ? null : await _host.Store.GetNodeAsync(new NodeId(auth.NodeId), ct);
-        bool signatureOk = node is not null
-            && _host.Time.GetUtcNow().ToUnixTimeMilliseconds() <= expiresAtMs
-            && TryDecode(auth!.Signature, out byte[] signature)
-            && NodeIdentity.Verify(node.PublicKey, signature, SignaturePurpose.Auth, auth.NodeId, nonce);
-        if (!signatureOk)
-        {
-            // 节点不存在与签名错误返回同样的错误，不泄露节点是否存在。
-            await RejectAsync(message.Id, "authentication failed", ct);
-            return false;
-        }
-
-        _node = node;
-        if (node!.Status == NodeStatus.Disabled)
-        {
-            await SendAsync(RpcMessage.Failure(message.Id, new FleetError(FleetErrors.NodeDisabled, "node is disabled")), ct);
-            await RevokeAsync("disabled", ct);
-            return false;
-        }
-
-        _session = new NodeSessionInfo(node.Id, _host.Time.GetUtcNow().ToUnixTimeMilliseconds(), node.NodeVersion, [], null);
-        await SendAsync(
-            RpcMessage.Success(message.Id.Value, new AuthResult { Status = StatusName(node.Status) }, FleetRpcContext.Default.AuthResult),
-            ct);
-        return true;
-    }
-
-    private async Task RejectAsync(long? id, string reason, CancellationToken ct)
-    {
-        FleetLog.AuthRejected(_host.Logger, reason);
-        _closeReason ??= reason;
-        if (id is not null)
-        {
-            await SendAsync(RpcMessage.Failure(id, new FleetError(FleetErrors.Unauthorized, "authentication failed")), ct);
-        }
-
-        if (_socket.State == WebSocketState.Open)
-        {
-            try
-            {
-                await _socket.CloseOutputAsync(WebSocketCloseStatus.PolicyViolation, "unauthorized", ct);
-            }
-            catch (WebSocketException)
-            {
-                // 对端已经断开
-            }
-        }
-    }
-
-    // ───────────────────────── 接收循环 ─────────────────────────
-
-    private async Task ReceiveLoopAsync(CancellationToken ct)
-    {
-        while (!ct.IsCancellationRequested)
-        {
-            using var idle = new CancellationTokenSource(_host.Options.HeartbeatTimeout, _host.Time);
-            using CancellationTokenSource linked = CancellationTokenSource.CreateLinkedTokenSource(ct, idle.Token);
-            Frame? frame;
-            try
-            {
-                frame = await ReceiveFrameAsync(linked.Token);
-            }
-            catch (OperationCanceledException) when (idle.IsCancellationRequested && !ct.IsCancellationRequested)
-            {
-                _closeReason ??= "heartbeat timeout";
-                return;
-            }
-
-            if (frame is null)
-            {
-                _closeReason ??= "closed by peer";
-                return;
-            }
-
-            if (frame.IsText)
-            {
-                if (TryParse(frame.Data, out RpcMessage? message))
-                {
-                    await HandleMessageAsync(message, ct);
-                }
-            }
-            else
-            {
-                await HandleBinaryAsync(frame.Data, ct);
-            }
-        }
-    }
-
-    private async Task HandleMessageAsync(RpcMessage message, CancellationToken ct)
-    {
-        if (message.IsResponse)
-        {
-            if (_pending.TryGetValue(message.Id!.Value, out TaskCompletionSource<RpcMessage>? waiter))
-            {
-                waiter.TrySetResult(message);
-            }
-
-            return;
-        }
-
-        switch (message.Method)
-        {
-            case FleetMethods.Hello:
-                await HandleHelloAsync(message, ct);
-                return;
-            case FleetMethods.Heartbeat:
-                await HandleHeartbeatAsync(message, ct);
-                return;
-        }
-
-        if (_node!.Status != NodeStatus.Active)
-        {
-            if (message.Id is not null)
-            {
-                await SendAsync(RpcMessage.Failure(message.Id, new FleetError(FleetErrors.NodePending, "node is not approved yet")), ct);
-            }
-
-            return;
-        }
-
-        var context = new NodeCallContext(_node, _session!, _host);
-        RpcMessage? response;
-        try
-        {
-            response = await _host.Router.DispatchAsync(context, message, ct);
-        }
-        catch (OperationCanceledException) when (ct.IsCancellationRequested)
-        {
-            throw;
-        }
-
-        if (response is not null)
-        {
-            await SendAsync(response, ct);
-        }
-    }
-
-    private async Task HandleHelloAsync(RpcMessage message, CancellationToken ct)
-    {
-        HelloParams? hello = null;
-        try
-        {
-            hello = message.Params?.Deserialize(FleetRpcContext.Default.HelloParams);
-        }
-        catch (JsonException)
-        {
-            // 按缺失处理
-        }
-
-        if (hello is null)
-        {
-            if (message.Id is not null)
-            {
-                await SendAsync(RpcMessage.Failure(message.Id, new FleetError(FleetErrors.InvalidParams, "invalid hello")), ct);
-            }
-
-            return;
-        }
-
-        long nowMs = _host.Time.GetUtcNow().ToUnixTimeMilliseconds();
-        _session = _session! with
-        {
-            NodeVersion = hello.NodeVersion,
-            Capabilities = hello.Capabilities,
-            HelloMetaJson = hello.Meta?.GetRawText(),
-        };
-        _node = _node! with { NodeVersion = hello.NodeVersion };
-        _helloDone = true;
-
-        await UpdatePresenceAsync(online: true, ct);
-        await FireAsync(NodeEventKind.Hello, ct, hello);
-
-        if (message.Id is not null)
-        {
-            await SendAsync(
-                RpcMessage.Success(
-                    message.Id.Value,
-                    new HelloResult { ServerTimeMs = nowMs, ClockOffsetMs = hello.NowUtcMs - nowMs },
-                    FleetRpcContext.Default.HelloResult),
-                ct);
-        }
-
-        SignalStateChanged();
-    }
-
-    private async Task HandleHeartbeatAsync(RpcMessage message, CancellationToken ct)
-    {
-        JsonElement? extra = null;
-        try
-        {
-            extra = message.Params?.Deserialize(FleetRpcContext.Default.HeartbeatParams)?.Extra;
-        }
-        catch (JsonException)
-        {
-            // 忽略格式不正确的附加字段
-        }
-
-        long now = _host.Time.GetTimestamp();
-        if (_host.Time.GetElapsedTime(Interlocked.Read(ref _lastPresenceTicks), now) >= s_presenceRefresh)
-        {
-            await UpdatePresenceAsync(online: true, ct);
-        }
-
-        await FireAsync(NodeEventKind.Heartbeat, ct, hello: null, extra);
-        if (message.Id is not null)
-        {
-            await SendAsync(new RpcMessage { Id = message.Id, Result = JsonSerializer.SerializeToElement(new EmptyObject(), FleetEmptyObject.Info) }, ct);
-        }
-    }
-
-    private async Task HandleBinaryAsync(byte[] data, CancellationToken ct)
-    {
-        if (_node!.Status != NodeStatus.Active
-            || !OutboxFrame.TryParse(data, out byte channel, out Guid msgId, out ReadOnlyMemory<byte> payload)
-            || !_host.Inboxes.TryGetValue(channel, out IInbox? inbox))
-        {
-            return;
-        }
-
-        InboxOutcome outcome;
-        try
-        {
-            outcome = await inbox.HandleAsync(_node, msgId, payload, ct);
-        }
-        catch (OperationCanceledException) when (ct.IsCancellationRequested)
-        {
-            throw;
-        }
-        catch (Exception ex)
-        {
-            // 没有持久化就不确认，节点会重发。
-            FleetLog.InboxFailed(_host.Logger, ex, _node.Id.Value, channel);
-            return;
-        }
-
-        if (outcome == InboxOutcome.Rejected)
-        {
-            return;
-        }
-
-        var ack = new OutboxAckParams();
-        string id = msgId.ToString();
-        if (outcome == InboxOutcome.Duplicate)
-        {
-            ack.Duplicates.Add(id);
-        }
-        else
-        {
-            ack.Ids.Add(id);
-        }
-
-        await SendAsync(RpcMessage.Notification(FleetMethods.OutboxAck, ack, FleetRpcContext.Default.OutboxAckParams), ct);
-    }
-
-    // ───────────────────────── 状态推送 ─────────────────────────
-
-    private async Task StatePushLoopAsync(CancellationToken ct)
-    {
-        while (await _stateSignal.Reader.WaitToReadAsync(ct))
-        {
-            _stateSignal.Reader.TryRead(out _);
-            bool complete = await PushStateAsync(ct);
-            if (!complete)
-            {
-                await Task.Delay(s_statePushRetry, _host.Time, ct);
-                SignalStateChanged();
-            }
-        }
-    }
-
-    private async Task<bool> PushStateAsync(CancellationToken ct)
-    {
-        NodeRecord? fresh = await _host.Store.GetNodeAsync(_node!.Id, ct);
-        if (fresh is null)
-        {
-            return true;
-        }
-
-        _node = fresh with { NodeVersion = _node.NodeVersion ?? fresh.NodeVersion };
-        if (fresh.Status == NodeStatus.Disabled)
-        {
-            await RevokeAsync("disabled", ct);
-            return true;
-        }
-
-        if (fresh.Status != NodeStatus.Active || !_helloDone)
-        {
-            // pending 不下发状态；还没有 hello 的连接等 hello 之后再推送。
-            return true;
-        }
-
-        bool complete = true;
-        foreach (IStateProvider provider in _host.StateProviders)
-        {
-            StateDocument? document = await provider.GetAsync(_node, ct);
-            if (document is null || (_lastPushedVersion.TryGetValue(provider.Type, out long last) && last == document.Version))
-            {
-                continue;
-            }
-
-            Result<JsonElement> raw = await RequestAsync(
-                FleetMethods.StateSync,
-                JsonSerializer.SerializeToElement(
-                    new StateSyncParams { Type = provider.Type, Version = document.Version, Doc = document.Doc },
-                    FleetRpcContext.Default.StateSyncParams),
-                ct);
-            if (!raw.TryGet(out JsonElement value, out FleetError? error))
-            {
-                FleetLog.StatePushFailed(_host.Logger, _node.Id.Value, provider.Type, error.Code.Value);
-                complete = false;
-                continue;
-            }
-
-            StateSyncResult? result = null;
-            try
-            {
-                result = value.Deserialize(FleetRpcContext.Default.StateSyncResult);
-            }
-            catch (JsonException)
-            {
-                // 按缺失处理
-            }
-
-            if (result is null)
-            {
-                complete = false;
-                continue;
-            }
-
-            _lastPushedVersion[provider.Type] = document.Version;
-            await provider.OnAppliedAsync(_node, document.Version, result, ct);
-        }
-
-        return complete;
-    }
-
-    // ───────────────────────── 帮助方法 ─────────────────────────
-
-    private async Task UpdatePresenceAsync(bool online, CancellationToken ct)
-    {
-        Interlocked.Exchange(ref _lastPresenceTicks, _host.Time.GetTimestamp());
-        await _host.Store.UpdatePresenceAsync(
-            _node!.Id,
-            new Presence(online, _host.Time.GetUtcNow().ToUnixTimeMilliseconds(), _session?.NodeVersion, _session?.Capabilities ?? [], _session?.HelloMetaJson),
-            ct);
-    }
-
-    private async Task FireAsync(NodeEventKind kind, CancellationToken ct, HelloParams? hello = null, JsonElement? extra = null)
-    {
-        var nodeEvent = new NodeEvent(kind, _node!, _host.Time.GetUtcNow().ToUnixTimeMilliseconds(), hello, extra);
-        foreach (INodeEventSink sink in _host.Sinks)
-        {
-            try
-            {
-                await sink.OnEventAsync(nodeEvent, ct);
-            }
-            catch (OperationCanceledException) when (ct.IsCancellationRequested)
-            {
-                throw;
-            }
-            catch (Exception ex)
-            {
-                // 产品的事件处理失败不能影响连接。
-                FleetLog.SinkFailed(_host.Logger, ex, kind.ToString(), _node!.Id.Value);
-            }
-        }
-    }
-
-    private async ValueTask<Frame?> ReceiveFrameAsync(CancellationToken ct)
-    {
-        var writer = new ArrayBufferWriter<byte>(1024);
-        while (true)
-        {
-            Memory<byte> buffer = writer.GetMemory(4096);
-            ValueWebSocketReceiveResult result = await _socket.ReceiveAsync(buffer, ct);
-            if (result.MessageType == WebSocketMessageType.Close)
-            {
-                return null;
-            }
-
-            writer.Advance(result.Count);
-            if (writer.WrittenCount > _host.Options.MaxFrameBytes)
-            {
-                _closeReason ??= "frame too large";
-                await _socket.CloseOutputAsync(WebSocketCloseStatus.MessageTooBig, "frame too large", CancellationToken.None);
-                return null;
-            }
-
-            if (result.EndOfMessage)
-            {
-                return new Frame(result.MessageType == WebSocketMessageType.Text, writer.WrittenSpan.ToArray());
-            }
-        }
-    }
-
-    private static bool TryParse(byte[] data, [System.Diagnostics.CodeAnalysis.NotNullWhen(true)] out RpcMessage? message)
-    {
-        try
-        {
-            message = JsonSerializer.Deserialize(data, FleetRpcContext.Default.RpcMessage);
-            return message is not null;
-        }
-        catch (JsonException)
-        {
-            message = null;
-            return false;
-        }
-    }
-
-    private static bool TryDecode(string text, out byte[] data)
-    {
-        try
-        {
-            data = Convert.FromBase64String(text);
-            return true;
-        }
-        catch (FormatException)
-        {
-            data = [];
-            return false;
-        }
-    }
-
-    private static string StatusName(NodeStatus status) => status switch
-    {
-        NodeStatus.Active => "active",
-        NodeStatus.Pending => "pending",
-        _ => "disabled",
-    };
-
-    private sealed record Frame(bool IsText, byte[] Data);
-}
-
-[System.Text.Json.Serialization.JsonSerializable(typeof(EmptyObject))]
-internal sealed partial class FleetEmptyObjectContext : System.Text.Json.Serialization.JsonSerializerContext;
-
-internal sealed class EmptyObject;
-
-internal static class FleetEmptyObject
-{
-    public static System.Text.Json.Serialization.Metadata.JsonTypeInfo<EmptyObject> Info => FleetEmptyObjectContext.Default.EmptyObject;
 }
@@ -9,6 +9,7 @@
    <ProjectReference Include="..\..\src\Fleet.Identity\Fleet.Identity.csproj" />
    <ProjectReference Include="..\..\src\Fleet.Rpc\Fleet.Rpc.csproj" />
    <ProjectReference Include="..\..\src\Fleet.Link\Fleet.Link.csproj" />
+    <ProjectReference Include="..\..\src\Fleet.Hosting\Fleet.Hosting.csproj" />
  </ItemGroup>
  <ItemGroup>
    <Using Include="Xunit" />
@@ -67,7 +67,7 @@ public sealed class IdentityAndRpcTests
    [Fact]
    public async Task Router_DispatchesTypedRequests_AndReportsStructuredErrors()
    {
-        var router = new RpcRouter<string>()
+        var router = new RpcRouter<string>(RpcSide.Listener, TestTables.Of(TestTables.Req("test.add"), TestTables.Req("test.boom"), TestTables.Req("test.nope")))
            .On("test.add", EchoContext.Default.AddParams, EchoContext.Default.AddResult,
                (caller, p, _) => ValueTask.FromResult(p.A < 0 ? Result<AddResult>.Fail(FleetErrors.Forbidden, "negative") : Result<AddResult>.Ok(new AddResult { Sum = p.A + p.B, Caller = caller })))
            .On<AddParams, AddResult>("test.boom", EchoContext.Default.AddParams, EchoContext.Default.AddResult, (_, _, _) => throw new InvalidOperationException("secret detail"));
@@ -92,7 +92,7 @@ public sealed class IdentityAndRpcTests
    public async Task Router_HandlerExceptions_AreContained_AndNeverLeakDetails()
    {
        string? logged = null;
-        var router = new RpcRouter<string>((method, ex) => logged = method + ":" + ex.Message)
+        var router = new RpcRouter<string>(RpcSide.Listener, TestTables.Of(TestTables.Req("test.boom")), onUnhandled: (method, ex) => logged = method + ":" + ex.Message)
            .On<AddParams, AddResult>("test.boom", EchoContext.Default.AddParams, EchoContext.Default.AddResult, (_, _, _) => throw new InvalidOperationException("secret detail"));

        RpcMessage reply = (await router.DispatchAsync("a", Request(1, "test.boom", """{"a":1,"b":1}"""), CancellationToken.None))!;
@@ -105,7 +105,7 @@ public sealed class IdentityAndRpcTests
    public async Task Router_Notifications_ProduceNoResponse_EvenOnFailure()
    {
        int calls = 0;
-        var router = new RpcRouter<string>().OnNotify("test.note", EchoContext.Default.AddParams, (_, _, _) =>
+        var router = new RpcRouter<string>(RpcSide.Listener, TestTables.Of(TestTables.Note("test.note"), TestTables.Note("test.unknown"))).OnNotify("test.note", EchoContext.Default.AddParams, (_, _, _) =>
        {
            calls++;
            return ValueTask.CompletedTask;
@@ -0,0 +1,112 @@
+using System.Net;
+using Fleet.Identity;
+
+namespace Fleet.Tests;
+
+public sealed class KnockTests
+{
+    private sealed class Clock : TimeProvider
+    {
+        public DateTimeOffset Now { get; set; } = new(2026, 10, 7, 12, 0, 0, TimeSpan.Zero);
+
+        public override DateTimeOffset GetUtcNow() => Now;
+    }
+
+    [Fact]
+    public void PairKey_IsTheSameOnBothSides_AndDiffersPerPair()
+    {
+        using NodeIdentity probe = NodeIdentity.Generate();
+        using NodeIdentity agent = NodeIdentity.Generate();
+        using NodeIdentity other = NodeIdentity.Generate();
+        byte[] fromProbe = Knock.DeriveKey(probe, agent.PublicKeySpki);
+        byte[] fromAgent = Knock.DeriveKey(agent, probe.PublicKeySpki);
+        Assert.Equal(fromProbe, fromAgent);
+        Assert.Equal(32, fromProbe.Length);
+        Assert.NotEqual(fromProbe, Knock.DeriveKey(other, agent.PublicKeySpki));
+    }
+
+    [Fact]
+    public void Packet_IsAcceptedWithinTheWindowAndOneWindowOfSkew_ButNotBeyond()
+    {
+        byte[] key = new byte[32];
+        long now = new DateTimeOffset(2026, 10, 7, 12, 0, 15, TimeSpan.Zero).ToUnixTimeMilliseconds();
+        byte[] packet = Knock.Build(key, now);
+        Assert.Equal(Knock.PacketBytes, packet.Length);
+        Assert.True(Knock.Check(key, packet, now));
+        Assert.True(Knock.Check(key, packet, now + (Knock.WindowSeconds * 1000)));
+        Assert.True(Knock.Check(key, packet, now - (Knock.WindowSeconds * 1000)));
+        Assert.False(Knock.Check(key, packet, now + (3 * Knock.WindowSeconds * 1000)));
+        Assert.False(Knock.Check(key, packet, now - (3 * Knock.WindowSeconds * 1000)));
+    }
+
+    [Fact]
+    public void Packet_WithAWrongKeyATamperedByteOrTheWrongLength_IsRejected()
+    {
+        byte[] key = new byte[32];
+        long now = 1_700_000_000_000;
+        byte[] packet = Knock.Build(key, now);
+        Assert.False(Knock.Check(new byte[32] { 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, packet, now));
+        foreach (int index in new[] { 0, 15, 16, 31 })
+        {
+            byte[] tampered = (byte[])packet.Clone();
+            tampered[index] ^= 0x01;
+            Assert.False(Knock.Check(key, tampered, now), $"byte {index}");
+        }
+
+        Assert.False(Knock.Check(key, packet.AsSpan(0, 31), now));
+        Assert.False(Knock.Check(key, [], now));
+    }
+
+    [Fact]
+    public void Gate_AdmitsRosterMembersOnce_AndRejectsReplaysStrangersAndExpiredPackets()
+    {
+        using NodeIdentity agent = NodeIdentity.Generate();
+        using NodeIdentity probe = NodeIdentity.Generate();
+        using NodeIdentity stranger = NodeIdentity.Generate();
+        var roster = new List<byte[]> { probe.PublicKeySpki };
+        var gate = new KnockGate(agent, () => roster, new Clock());
+        long now = 1_700_000_000_000;
+
+        byte[] packet = Knock.Build(Knock.DeriveKey(probe, agent.PublicKeySpki), now);
+        Assert.True(gate.Accept(packet, now));
+        Assert.False(gate.Accept(packet, now), "the same nonce cannot be used twice");
+        Assert.False(gate.Accept(Knock.Build(Knock.DeriveKey(stranger, agent.PublicKeySpki), now), now), "not on the roster");
+        Assert.False(gate.Accept(Knock.Build(Knock.DeriveKey(probe, agent.PublicKeySpki), now - 10 * 60_000), now), "expired");
+
+        // 名册变了：新成员马上能进，被移除的马上进不来
+        using NodeIdentity second = NodeIdentity.Generate();
+        roster.Add(second.PublicKeySpki);
+        Assert.True(gate.Accept(Knock.Build(Knock.DeriveKey(second, agent.PublicKeySpki), now), now));
+        roster.RemoveAt(0);
+        Assert.False(gate.Accept(Knock.Build(Knock.DeriveKey(probe, agent.PublicKeySpki), now), now));
+    }
+
+    [Fact]
+    public async Task Gate_RateLimitsEachSource_AndReadsAtMost32Bytes()
+    {
+        using NodeIdentity agent = NodeIdentity.Generate();
+        using NodeIdentity probe = NodeIdentity.Generate();
+        var clock = new Clock();
+        var gate = new KnockGate(agent, () => [probe.PublicKeySpki], clock, attemptsPerPeriod: 3);
+        IPAddress noisy = IPAddress.Parse("203.0.113.9");
+        IPAddress quiet = IPAddress.Parse("203.0.113.10");
+        byte[] key = Knock.DeriveKey(probe, agent.PublicKeySpki);
+
+        for (int i = 0; i < 3; i++)
+        {
+            Assert.False(await gate.AdmitAsync(new MemoryStream(new byte[Knock.PacketBytes]), noisy, default));
+        }
+
+        // 超过限额：连有效的敲门包也不读、不算
+        byte[] valid = Knock.Build(key, clock.Now.ToUnixTimeMilliseconds());
+        Assert.False(await gate.AdmitAsync(new MemoryStream(valid), noisy, default));
+        Assert.True(await gate.AdmitAsync(new MemoryStream(valid), quiet, default));
+
+        // 过了统计周期，恢复
+        clock.Now += TimeSpan.FromSeconds(11);
+        Assert.True(await gate.AdmitAsync(new MemoryStream(Knock.Build(key, clock.Now.ToUnixTimeMilliseconds())), noisy, default));
+
+        // 流在 32 字节之前就结束：拒绝，不抛异常
+        Assert.False(await gate.AdmitAsync(new MemoryStream(new byte[10]), quiet, default));
+    }
+}
@@ -227,8 +227,9 @@ public sealed class LinkTests
    {
        (TlsFrameTransport left, TlsFrameTransport right) = await PairAsync();
        RpcSession<string>? rightSession = null;
-        var leftRouter = new RpcRouter<string>().On("left.double", LinkJson.Default.Number, LinkJson.Default.Number, (_, p, _) => ValueTask.FromResult(Result<Number>.Ok(new Number { Value = p.Value * 2 })));
-        var rightRouter = new RpcRouter<string>().On(
+        MethodTable table = TestTables.Of(TestTables.Req("left.double", RpcSide.Listener), TestTables.Req("right.relay"), TestTables.Req("right.unhandled"));
+        var leftRouter = new RpcRouter<string>(RpcSide.Dialer, table).On("left.double", LinkJson.Default.Number, LinkJson.Default.Number, (_, p, _) => ValueTask.FromResult(Result<Number>.Ok(new Number { Value = p.Value * 2 })));
+        var rightRouter = new RpcRouter<string>(RpcSide.Listener, table).On(
            "right.relay", LinkJson.Default.Number, LinkJson.Default.Number,
            async (_, p, ct) =>
            {
@@ -248,7 +249,7 @@ public sealed class LinkTests
            Result<Number> result = await leftSession.RequestAsync("right.relay", new Number { Value = 21 }, LinkJson.Default.Number, LinkJson.Default.Number, default);
            Assert.Equal(43, result.Value.Value);

-            Result<JsonElement> unknown = await leftSession.RequestAsync("nope", null, default);
+            Result<JsonElement> unknown = await leftSession.RequestAsync("right.unhandled", null, default);
            Assert.Equal("fleet_unsupported", unknown.Error.Code.Value);

            await leftSession.CloseAsync("bye", default);
@@ -262,13 +263,13 @@ public sealed class LinkTests
    {
        (TlsFrameTransport left, TlsFrameTransport right) = await PairAsync();
        await using var silent = right; // 对端不读也不回
-        await using var session = new RpcSession<string>(left, new RpcRouter<string>(), "x", TimeProvider.System, new RpcSessionOptions { RequestTimeout = TimeSpan.FromMilliseconds(200) });
+        await using var session = new RpcSession<string>(left, new RpcRouter<string>(RpcSide.Dialer, TestTables.Of(TestTables.Req("test.any"))), "x", TimeProvider.System, new RpcSessionOptions { RequestTimeout = TimeSpan.FromMilliseconds(200) });
        Task run = session.RunAsync(default);

-        Result<JsonElement> timedOut = await session.RequestAsync("any", null, default);
+        Result<JsonElement> timedOut = await session.RequestAsync("test.any", null, default);
        Assert.Equal(FleetErrors.Timeout, timedOut.Error.Code);

-        Task<Result<JsonElement>> pending = session.RequestAsync("any", null, default, TimeSpan.FromSeconds(30)).AsTask();
+        Task<Result<JsonElement>> pending = session.RequestAsync("test.any", null, default, TimeSpan.FromSeconds(30)).AsTask();
        await silent.CloseAsync("gone", default);
        Assert.Equal(FleetErrors.Timeout, (await pending.WaitAsync(TimeSpan.FromSeconds(5))).Error.Code);
        await run.WaitAsync(TimeSpan.FromSeconds(5));
@@ -279,12 +280,20 @@ public sealed class LinkTests
    private sealed class PeerFixture : IAsyncDisposable
    {
        private readonly CancellationTokenSource _stop = new();
+        private readonly NodeIdentity _identity;

        public PeerFixture(Func<string, byte[]?> lookup, Func<PeerSessionInfo, IRpcTransport, CancellationToken, Task>? onSession = null)
        {
            Certificate = NodeCertificate.LoadPfx(NodeCertificate.CreateSelfSignedPfx("agent", TimeSpan.FromDays(30), TimeProvider.System));
+            _identity = NodeIdentity.FromPkcs8(Certificate.GetECDsaPrivateKey()!.ExportPkcs8PrivateKey());
            Listener = new PeerListener(
-                new PeerListenerOptions { Listen = new IPEndPoint(IPAddress.Loopback, 0), Certificate = Certificate, LookupPeerKey = lookup },
+                new PeerListenerOptions
+                {
+                    Listen = new IPEndPoint(IPAddress.Loopback, 0),
+                    Certificate = Certificate,
+                    LookupPeerKey = lookup,
+                    Knock = new KnockGate(_identity, () => KnockPeers, TimeProvider.System),
+                },
                onSession ?? ((_, transport, ct) => KeepOpenAsync(transport, ct)),
                NullNodeLog.Instance, TimeProvider.System);
            Task = Listener.RunAsync(_stop.Token);
@@ -298,10 +307,17 @@ public sealed class LinkTests

        public byte[] Spki => NodeCertificate.SpkiFingerprint(Certificate);

+        /// <summary>Agent 的 TLS 证书公钥：Probe 用它固定证书、派生敲门密钥。</summary>
+        public byte[] PublicKey => Certificate.PublicKey.ExportSubjectPublicKeyInfo();
+
+        /// <summary>名册：能敲开门的 Probe 公钥。</summary>
+        public List<byte[]> KnockPeers { get; } = [];
+
        public async ValueTask DisposeAsync()
        {
            await _stop.CancelAsync();
            await Task;
+            _identity.Dispose();
            Certificate.Dispose();
            _stop.Dispose();
        }
@@ -324,9 +340,10 @@ public sealed class LinkTests
            seen.TrySetResult(info);
            return Task.Delay(Timeout.Infinite, ct).ContinueWith(_ => { }, CancellationToken.None);
        });
+        agent.KnockPeers.Add(probe.PublicKeySpki);
        await agent.Listener.Started.Task;

-        (PeerSessionInfo client, TlsFrameTransport transport) = await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, agent.Spki, probe, "prb_1", null, 1 << 20, TimeProvider.System, default);
+        (PeerSessionInfo client, TlsFrameTransport transport) = await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, agent.PublicKey, probe, "prb_1", null, 1 << 20, TimeProvider.System, default);
        await using (transport)
        {
            PeerSessionInfo server = await seen.Task.WaitAsync(TimeSpan.FromSeconds(5));
@@ -342,17 +359,18 @@ public sealed class LinkTests
        using NodeIdentity probe = NodeIdentity.Generate();
        using NodeIdentity impostor = NodeIdentity.Generate();
        await using var agent = new PeerFixture(id => id == "prb_1" ? probe.PublicKeySpki : null);
+        agent.KnockPeers.AddRange([probe.PublicKeySpki, impostor.PublicKeySpki]); // 敲门通过之后，名册外的 ID 和伪造的签名仍然被拒绝
        await agent.Listener.Started.Task;

        InvalidOperationException unknown = await Assert.ThrowsAsync<InvalidOperationException>(async () =>
-            await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, agent.Spki, probe, "prb_unknown", null, 1 << 20, TimeProvider.System, default));
+            await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, agent.PublicKey, probe, "prb_unknown", null, 1 << 20, TimeProvider.System, default));
        InvalidOperationException forged = await Assert.ThrowsAsync<InvalidOperationException>(async () =>
-            await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, agent.Spki, impostor, "prb_1", null, 1 << 20, TimeProvider.System, default));
+            await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, agent.PublicKey, impostor, "prb_1", null, 1 << 20, TimeProvider.System, default));
        Assert.Equal(unknown.Message, forged.Message);
        Assert.Contains("fleet_unauthorized", forged.Message);

        // 正主仍然可以连接
-        (_, TlsFrameTransport ok) = await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, agent.Spki, probe, "prb_1", null, 1 << 20, TimeProvider.System, default);
+        (_, TlsFrameTransport ok) = await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, agent.PublicKey, probe, "prb_1", null, 1 << 20, TimeProvider.System, default);
        await ok.DisposeAsync();
    }

@@ -361,18 +379,21 @@ public sealed class LinkTests
    {
        using NodeIdentity probe = NodeIdentity.Generate();
        await using var agent = new PeerFixture(_ => probe.PublicKeySpki);
+        agent.KnockPeers.Add(probe.PublicKeySpki);
        await agent.Listener.Started.Task;

-        byte[] wrong = SHA256.HashData("another certificate"u8);
-        await Assert.ThrowsAnyAsync<AuthenticationException>(async () =>
-            await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, wrong, probe, "prb_1", null, 1 << 20, TimeProvider.System, default));
+        // 公钥不对：敲门密钥对不上，Agent 直接断开（拿到的不是证书，连不是它的证书都看不到）
+        using NodeIdentity another = NodeIdentity.Generate();
+        await Assert.ThrowsAnyAsync<Exception>(async () =>
+            await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, another.PublicKeySpki, probe, "prb_1", null, 1 << 20, TimeProvider.System, default));
    }

    [Fact]
    public async Task PeerSession_CarriesRpcBothWays_AfterTheHandshake()
    {
        using NodeIdentity probe = NodeIdentity.Generate();
-        var router = new RpcRouter<string>().On("agent.echo", LinkJson.Default.Number, LinkJson.Default.Number, (_, p, _) => ValueTask.FromResult(Result<Number>.Ok(new Number { Value = p.Value + 1 })));
+        MethodTable table = TestTables.Of(TestTables.Req("agent.echo"));
+        var router = new RpcRouter<string>(RpcSide.Listener, table).On("agent.echo", LinkJson.Default.Number, LinkJson.Default.Number, (_, p, _) => ValueTask.FromResult(Result<Number>.Ok(new Number { Value = p.Value + 1 })));
        await using var agent = new PeerFixture(
            _ => probe.PublicKeySpki,
            async (info, transport, ct) =>
@@ -380,10 +401,11 @@ public sealed class LinkTests
                await using var session = new RpcSession<string>(transport, router, info.PeerId, TimeProvider.System);
                await session.RunAsync(ct);
            });
+        agent.KnockPeers.Add(probe.PublicKeySpki);
        await agent.Listener.Started.Task;

-        (_, TlsFrameTransport transport) = await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, agent.Spki, probe, "prb_1", null, 1 << 20, TimeProvider.System, default);
-        await using var client = new RpcSession<string>(transport, new RpcRouter<string>(), "probe", TimeProvider.System);
+        (_, TlsFrameTransport transport) = await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, agent.PublicKey, probe, "prb_1", null, 1 << 20, TimeProvider.System, default);
+        await using var client = new RpcSession<string>(transport, new RpcRouter<string>(RpcSide.Dialer, table), "probe", TimeProvider.System);
        Task run = client.RunAsync(default);
        Result<Number> result = await client.RequestAsync("agent.echo", new Number { Value = 41 }, LinkJson.Default.Number, LinkJson.Default.Number, default);
        Assert.Equal(42, result.Value.Value);
@@ -396,6 +418,7 @@ public sealed class LinkTests
    {
        using NodeIdentity probe = NodeIdentity.Generate();
        await using var agent = new PeerFixture(_ => probe.PublicKeySpki);
+        agent.KnockPeers.Add(probe.PublicKeySpki);
        await agent.Listener.Started.Task;

        // 不说 TLS 的连接：握手失败，监听继续
@@ -405,7 +428,45 @@ public sealed class LinkTests
            await garbage.GetStream().WriteAsync("GET / HTTP/1.1\r\n\r\n"u8.ToArray());
        }

-        (_, TlsFrameTransport ok) = await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, agent.Spki, probe, "prb_1", null, 1 << 20, TimeProvider.System, default);
+        (_, TlsFrameTransport ok) = await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, agent.PublicKey, probe, "prb_1", null, 1 << 20, TimeProvider.System, default);
+        await ok.DisposeAsync();
+    }
+
+    [Fact]
+    public async Task PeerListener_WritesNothingToStrangers_NotEvenATlsServerHello()
+    {
+        using NodeIdentity probe = NodeIdentity.Generate();
+        await using var agent = new PeerFixture(_ => probe.PublicKeySpki);
+        agent.KnockPeers.Add(probe.PublicKeySpki);
+        await agent.Listener.Started.Task;
+
+        // 一个像样的 TLS ClientHello 开头、随机数据、什么都不发：都拿不到任何字节（连接被直接关闭）
+        foreach (byte[] payload in new[] { new byte[] { 0x16, 0x03, 0x01, 0x00, 0x05, 0x01, 0x00, 0x00, 0x01, 0x00 }.Concat(RandomNumberGenerator.GetBytes(64)).ToArray(), RandomNumberGenerator.GetBytes(32), [] })
+        {
+            using var scanner = new TcpClient();
+            await scanner.ConnectAsync(IPAddress.Loopback, agent.Listener.Port);
+            NetworkStream stream = scanner.GetStream();
+            if (payload.Length > 0)
+            {
+                await stream.WriteAsync(payload);
+            }
+
+            byte[] buffer = new byte[64];
+            int read;
+            try
+            {
+                read = await stream.ReadAsync(buffer).AsTask().WaitAsync(TimeSpan.FromSeconds(10));
+            }
+            catch (IOException)
+            {
+                read = 0; // 连接被重置也是「什么都没收到」
+            }
+
+            Assert.Equal(0, read);
+        }
+
+        // 名册里的 Probe 仍然进得来
+        (_, TlsFrameTransport ok) = await PeerConnector.ConnectAsync("127.0.0.1", agent.Listener.Port, agent.PublicKey, probe, "prb_1", null, 1 << 20, TimeProvider.System, default);
        await ok.DisposeAsync();
    }

@@ -0,0 +1,200 @@
+using System.Text.Json;
+using System.Threading.Channels;
+using Fleet.Core;
+using Fleet.Rpc;
+
+namespace Fleet.Tests;
+
+/// <summary>协议方向声明：路由器是唯一卡口，注册、分发、发送三处都核对声明表。</summary>
+public sealed class MethodDirectionTests
+{
+    private static readonly MethodTable s_table = TestTables.Of(
+        MethodSpec.Request("t.ping", RpcSide.Node),
+        MethodSpec.Notification("t.note", RpcSide.Node, "agent"),
+        MethodSpec.Request("t.push", RpcSide.Server),
+        MethodSpec.Request("t.inline", RpcSide.Node).AsInline(),
+        // 同一个方法名在对等面里另有发起方：按（平面，名字）区分
+        MethodSpec.Request("t.ping", RpcSide.Listener));
+
+    private static readonly JsonElement s_empty = JsonDocument.Parse("{}").RootElement.Clone();
+
+    private static RpcMessage Request(string method) => new() { Id = 1, Method = method, Params = s_empty };
+
+    private static RpcMessage Notification(string method) => new() { Method = method, Params = s_empty };
+
+    private static RpcRouter<string> Server(string? localRole = null) => new(RpcSide.Server, s_table, localRole, callerRole: role => role);
+
+    [Fact]
+    public void Registration_RefusesUndeclaredMethods_WrongDirection_WrongKind_AndWrongRole()
+    {
+        RpcRouter<string> server = Server();
+        Assert.Throws<InvalidOperationException>(() => server.On("t.unknown", EchoContext.Default.AddParams, EchoContext.Default.AddResult, (_, _, _) => throw new NotSupportedException()));
+        // t.push 是服务端发给节点的：服务端这一侧不能处理它
+        Assert.Throws<InvalidOperationException>(() => server.On("t.push", EchoContext.Default.AddParams, EchoContext.Default.AddResult, (_, _, _) => throw new NotSupportedException()));
+        // t.ping 声明成请求：不能按通知注册
+        Assert.Throws<InvalidOperationException>(() => server.OnNotify("t.ping", EchoContext.Default.AddParams, (_, _, _) => ValueTask.CompletedTask));
+
+        // 节点这一侧：t.note 只给 agent 角色，probe 注册不了；t.push 是它该处理的
+        var probe = new RpcRouter<string>(RpcSide.Node, s_table, "probe");
+        probe.On("t.push", EchoContext.Default.AddParams, EchoContext.Default.AddResult, (_, _, _) => throw new NotSupportedException());
+        Assert.Throws<InvalidOperationException>(() => new RpcRouter<string>(RpcSide.Server, s_table, "probe").OnNotify("t.note", EchoContext.Default.AddParams, (_, _, _) => ValueTask.CompletedTask));
+
+        server.On("t.ping", EchoContext.Default.AddParams, EchoContext.Default.AddResult, (_, _, _) => ValueTask.FromResult(Result<AddResult>.Ok(new AddResult())));
+    }
+
+    [Fact]
+    public async Task Dispatch_RefusesWhatThePeerMayNotInitiate_AndReportsAViolation()
+    {
+        int calls = 0;
+        RpcRouter<string> server = Server()
+            .On("t.ping", EchoContext.Default.AddParams, EchoContext.Default.AddResult, (_, _, _) =>
+            {
+                calls++;
+                return ValueTask.FromResult(Result<AddResult>.Ok(new AddResult()));
+            })
+            .OnNotify("t.note", EchoContext.Default.AddParams, (_, _, _) =>
+            {
+                calls++;
+                return ValueTask.CompletedTask;
+            });
+
+        // 正常
+        RpcDispatch ok = await server.DispatchCheckedAsync("agent", Request("t.ping"), default);
+        Assert.Null(ok.Violation);
+        Assert.NotNull(ok.Response!.Result);
+
+        // 没有声明的方法
+        RpcDispatch undeclared = await server.DispatchCheckedAsync("agent", Request("t.nope"), default);
+        Assert.NotNull(undeclared.Violation);
+        Assert.Equal("fleet_protocol_violation", undeclared.Response!.Error!.Data!.Code);
+
+        // 节点冒充服务端：t.push 只能由服务端发起
+        RpcDispatch backwards = await server.DispatchCheckedAsync("agent", Request("t.push"), default);
+        Assert.NotNull(backwards.Violation);
+        Assert.Equal("fleet_protocol_violation", backwards.Response!.Error!.Data!.Code);
+
+        // 请求和通知用反了
+        Assert.NotNull((await server.DispatchCheckedAsync("agent", Notification("t.ping"), default)).Violation);
+        RpcDispatch asRequest = await server.DispatchCheckedAsync("agent", Request("t.note"), default);
+        Assert.NotNull(asRequest.Violation);
+        Assert.NotNull(asRequest.Response);
+
+        // 违规的消息到不了处理函数；通知违规不回响应
+        Assert.Equal(1, calls);
+        RpcDispatch silentViolation = await server.DispatchCheckedAsync("agent", Notification("t.nope"), default);
+        Assert.NotNull(silentViolation.Violation);
+        Assert.Null(silentViolation.Response);
+    }
+
+    [Fact]
+    public async Task Dispatch_ADeclaredMethodWithoutAHandler_IsUnsupported_NotAViolation()
+    {
+        RpcDispatch outcome = await Server().DispatchCheckedAsync("agent", Request("t.ping"), default);
+        Assert.Null(outcome.Violation);
+        Assert.Equal("fleet_unsupported", outcome.Response!.Error!.Data!.Code);
+    }
+
+    [Fact]
+    public async Task Dispatch_ChecksTheCallersRole()
+    {
+        RpcRouter<string> server = Server().OnNotify("t.note", EchoContext.Default.AddParams, (_, _, _) => ValueTask.CompletedTask);
+        Assert.Null((await server.DispatchCheckedAsync("agent", Notification("t.note"), default)).Violation);
+        Assert.NotNull((await server.DispatchCheckedAsync("probe", Notification("t.note"), default)).Violation);
+        Assert.NotNull((await server.DispatchCheckedAsync(null!, Notification("t.note"), default)).Violation);
+    }
+
+    [Fact]
+    public void CheckSend_RefusesWhatThisSideMayNotInitiate()
+    {
+        RpcRouter<string> server = Server();
+        server.CheckSend("t.push", MethodKind.Request);
+        Assert.Throws<InvalidOperationException>(() => server.CheckSend("t.ping", MethodKind.Request)); // 那是节点发起的
+        Assert.Throws<InvalidOperationException>(() => server.CheckSend("t.push", MethodKind.Notification)); // 类型不对
+        Assert.Throws<InvalidOperationException>(() => server.CheckSend("t.unknown", MethodKind.Request));
+
+        // 对端的角色也要允许
+        var node = new RpcRouter<string>(RpcSide.Node, s_table, "agent");
+        node.CheckSend("t.note", MethodKind.Notification, "agent");
+        Assert.Throws<InvalidOperationException>(() => node.CheckSend("t.note", MethodKind.Notification, "probe"));
+    }
+
+    [Fact]
+    public void MethodTable_RefusesDuplicates_AndReportsMissingHandlers()
+    {
+        Assert.Throws<ArgumentException>(() => TestTables.Of(TestTables.Req("a"), TestTables.Note("a")));
+        Assert.Throws<ArgumentException>(() => new MethodTable([], [new ChannelSpec(16, RpcSide.Node), new ChannelSpec(16, RpcSide.Server)]));
+
+        // 服务端要处理 t.ping 和 t.note；t.inline 在握手阶段直接处理，不算缺
+        Assert.Equal(["t.note", "t.ping"], s_table.MissingHandlers(RpcSide.Server, null, []));
+        Assert.Equal(["t.ping"], s_table.MissingHandlers(RpcSide.Server, "probe", []));
+        Assert.Equal(["t.note"], s_table.MissingHandlers(RpcSide.Server, "agent", ["t.ping"]));
+        Assert.Empty(s_table.MissingHandlers(RpcSide.Server, "agent", ["t.ping", "t.note"]));
+        // 同名方法在对等面的接收方是拨号方？不：t.ping 在对等面由监听方发起，拨号方处理
+        Assert.Equal(["t.ping"], s_table.MissingHandlers(RpcSide.Dialer, null, []));
+    }
+
+    [Fact]
+    public async Task Session_ClosesTheConnection_AfterTooManyViolations()
+    {
+        (ChannelTransport a, ChannelTransport b) = ChannelTransport.Pair();
+        RpcRouter<string> server = Server().On("t.ping", EchoContext.Default.AddParams, EchoContext.Default.AddResult, (_, _, _) => ValueTask.FromResult(Result<AddResult>.Ok(new AddResult())));
+        await using var session = new RpcSession<string>(b, server, "agent", TimeProvider.System, new RpcSessionOptions { MaxViolations = 3 });
+        Task run = session.RunAsync(default);
+
+        for (int i = 1; i <= 6; i++)
+        {
+            await a.SendAsync(new RpcFrame(FrameKind.Text, JsonSerializer.SerializeToUtf8Bytes(new RpcMessage { Id = i, Method = "t.nope", Params = s_empty }, FleetRpcContext.Default.RpcMessage)), default);
+        }
+
+        // 违规的请求先收到失败响应，超过上限之后连接被关闭
+        int failures = 0;
+        while (await a.ReceiveAsync(default).AsTask().WaitAsync(TimeSpan.FromSeconds(5)) is { } frame)
+        {
+            if (JsonSerializer.Deserialize(frame.Data.Span, FleetRpcContext.Default.RpcMessage)?.Error?.Data?.Code == "fleet_protocol_violation")
+            {
+                failures++;
+            }
+        }
+
+        Assert.InRange(failures, 3, 6);
+        await a.CloseAsync("done", default); // 对端确认关闭之后，会话的接收循环正常结束
+        await run.WaitAsync(TimeSpan.FromSeconds(5));
+    }
+
+    /// <summary>进程内的一对传输：一端发的帧从另一端收到；关闭时对端收到 null。</summary>
+    private sealed class ChannelTransport : IRpcTransport
+    {
+        private readonly Channel<RpcFrame?> _in;
+        private readonly Channel<RpcFrame?> _out;
+
+        private ChannelTransport(Channel<RpcFrame?> input, Channel<RpcFrame?> output)
+        {
+            _in = input;
+            _out = output;
+        }
+
+        public static (ChannelTransport A, ChannelTransport B) Pair()
+        {
+            Channel<RpcFrame?> ab = Channel.CreateUnbounded<RpcFrame?>();
+            Channel<RpcFrame?> ba = Channel.CreateUnbounded<RpcFrame?>();
+            return (new ChannelTransport(ba, ab), new ChannelTransport(ab, ba));
+        }
+
+        public ValueTask SendAsync(RpcFrame frame, CancellationToken ct)
+        {
+            _out.Writer.TryWrite(frame);
+            return ValueTask.CompletedTask;
+        }
+
+        public async ValueTask<RpcFrame?> ReceiveAsync(CancellationToken ct) =>
+            await _in.Reader.WaitToReadAsync(ct) && _in.Reader.TryRead(out RpcFrame? frame) ? frame : null;
+
+        public ValueTask CloseAsync(string reason, CancellationToken ct)
+        {
+            _out.Writer.TryWrite(null);
+            return ValueTask.CompletedTask;
+        }
+
+        public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+    }
+}
@@ -0,0 +1,123 @@
+using System.Buffers.Text;
+using System.Security.Cryptography;
+using System.Text;
+using Fleet.Identity;
+
+namespace Fleet.Tests;
+
+/// <summary>软件 passkey：只做断言（navigator.credentials.get 的结果），用来测信任链。</summary>
+internal sealed class TestAuthenticator : IDisposable
+{
+    public const string RpId = "panel.example.com";
+    public const string Origin = "https://panel.example.com";
+
+    private readonly ECDsa _key = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+    private uint _counter;
+
+    public string CredentialId { get; } = Base64Url.EncodeToString(RandomNumberGenerator.GetBytes(32));
+
+    public OperatorKey Key => new(CredentialId, _key.ExportSubjectPublicKeyInfo());
+
+    public SignedStatement Sign(string statement, byte flags = 0x05, string origin = Origin)
+    {
+        byte[] challenge = SHA256.HashData(Encoding.UTF8.GetBytes(statement));
+        _counter++;
+        byte[] authData = [.. SHA256.HashData(Encoding.UTF8.GetBytes(RpId)), flags, (byte)(_counter >> 24), (byte)(_counter >> 16), (byte)(_counter >> 8), (byte)_counter];
+        byte[] clientData = Encoding.UTF8.GetBytes($"{{\"type\":\"webauthn.get\",\"challenge\":\"{Base64Url.EncodeToString(challenge)}\",\"origin\":\"{origin}\",\"crossOrigin\":false}}");
+        byte[] signature = _key.SignData([.. authData, .. SHA256.HashData(clientData)], HashAlgorithmName.SHA256, DSASignatureFormat.Rfc3279DerSequence);
+        return new SignedStatement(statement, CredentialId, Base64Url.EncodeToString(authData), Base64Url.EncodeToString(clientData), Base64Url.EncodeToString(signature));
+    }
+
+    public void Dispose() => _key.Dispose();
+}
+
+public sealed class OperatorTrustTests : IDisposable
+{
+    private readonly TestAuthenticator _alice = new();
+    private readonly TestAuthenticator _bob = new();
+
+    public void Dispose()
+    {
+        _alice.Dispose();
+        _bob.Dispose();
+    }
+
+    private OperatorSet Genesis(params TestAuthenticator[] keys) =>
+        new(1, OperatorTrust.Genesis, TestAuthenticator.RpId, [TestAuthenticator.Origin], [.. keys.Select(k => k.Key)]);
+
+    private SignedStatement SignedGenesis(OperatorSet set, TestAuthenticator signer) => signer.Sign(OperatorTrust.Encode(set));
+
+    [Fact]
+    public void TheGenesis_IsPinnedByItsFingerprint_AndMustBeSelfSigned()
+    {
+        OperatorSet set = Genesis(_alice);
+        SignedStatement genesis = SignedGenesis(set, _alice);
+        string pin = OperatorTrust.Fingerprint(genesis.Statement);
+
+        Assert.NotNull(OperatorTrust.VerifyChain(pin, [genesis]));
+        Assert.Null(OperatorTrust.VerifyChain(new string('0', 64), [genesis])); // 指纹对不上：Backend 换了一份创世
+        Assert.Null(OperatorTrust.VerifyChain(pin, [SignedGenesis(set, _bob)])); // 不是集合里的凭证签的（也改不了指纹）
+        Assert.Null(OperatorTrust.VerifyChain(pin, []));
+    }
+
+    [Fact]
+    public void ABackendThatSwapsTheKeys_CannotMakeAChainTheNodeAccepts()
+    {
+        SignedStatement real = SignedGenesis(Genesis(_alice), _alice);
+        string pin = OperatorTrust.Fingerprint(real.Statement);
+
+        using var attacker = new TestAuthenticator();
+        SignedStatement forged = SignedGenesis(Genesis(attacker), attacker); // 自洽的假创世，但指纹不同
+        Assert.Null(OperatorTrust.VerifyChain(pin, [forged]));
+
+        // 在真创世后面接一个攻击者签的更新：上一版里没有他的凭证
+        var update = new OperatorSet(2, OperatorTrust.Fingerprint(real.Statement), TestAuthenticator.RpId, [TestAuthenticator.Origin], [_alice.Key, attacker.Key]);
+        Assert.Null(OperatorTrust.VerifyChain(pin, [real, attacker.Sign(OperatorTrust.Encode(update))]));
+    }
+
+    [Fact]
+    public void AnUpdate_NeedsAKeyOfThePreviousVersion_AndFollowsTheChain()
+    {
+        SignedStatement genesis = SignedGenesis(Genesis(_alice), _alice);
+        string pin = OperatorTrust.Fingerprint(genesis.Statement);
+        var second = new OperatorSet(2, OperatorTrust.Fingerprint(genesis.Statement), TestAuthenticator.RpId, [TestAuthenticator.Origin], [_alice.Key, _bob.Key]);
+        SignedStatement signedSecond = _alice.Sign(OperatorTrust.Encode(second));
+
+        OperatorSet? current = OperatorTrust.VerifyChain(pin, [genesis, signedSecond]);
+        Assert.Equal(2, current?.Version);
+        Assert.Equal(2, current?.Keys.Count);
+
+        // 新加的 bob 可以签下一版（上一版里有他）
+        var third = new OperatorSet(3, OperatorTrust.Fingerprint(signedSecond.Statement), TestAuthenticator.RpId, [TestAuthenticator.Origin], [_bob.Key]);
+        Assert.Equal(3, OperatorTrust.VerifyChain(pin, [genesis, signedSecond, _bob.Sign(OperatorTrust.Encode(third))])?.Version);
+
+        // 版本号跳了、prev 不对、域名换了：都不行
+        var skipped = second with { Version = 3 };
+        Assert.Null(OperatorTrust.VerifyChain(pin, [genesis, _alice.Sign(OperatorTrust.Encode(skipped))]));
+        var wrongPrev = second with { Previous = new string('a', 64) };
+        Assert.Null(OperatorTrust.VerifyChain(pin, [genesis, _alice.Sign(OperatorTrust.Encode(wrongPrev))]));
+        var otherRp = second with { RpId = "evil.example" };
+        Assert.Null(OperatorTrust.VerifyChain(pin, [genesis, _alice.Sign(OperatorTrust.Encode(otherRp))]));
+    }
+
+    [Fact]
+    public void AnAssertion_NeedsUserVerification_TheRightOrigin_AndTheExactStatement()
+    {
+        OperatorSet set = Genesis(_alice);
+        Assert.True(OperatorTrust.VerifyOperator(_alice.Sign("hello"), set));
+        Assert.False(OperatorTrust.VerifyOperator(_alice.Sign("hello", flags: 0x01), set)); // 没有用户验证
+        Assert.False(OperatorTrust.VerifyOperator(_alice.Sign("hello", origin: "https://evil.example"), set));
+        Assert.False(OperatorTrust.VerifyOperator(_alice.Sign("hello") with { Statement = "hellO" }, set)); // 语句被改
+        Assert.False(OperatorTrust.VerifyOperator(_bob.Sign("hello"), set)); // 不在集合里
+    }
+
+    [Fact]
+    public void Parsing_IsStrict()
+    {
+        Assert.Null(OperatorTrust.ParseSet("moshiro-opset-v2\nversion=1"));
+        OperatorSet set = Genesis(_alice);
+        Assert.Equal(set.Keys[0].CredentialId, OperatorTrust.ParseSet(OperatorTrust.Encode(set))!.Keys[0].CredentialId);
+        Assert.Null(OperatorTrust.ParseSet(OperatorTrust.Encode(set with { Previous = "abc" }))); // 创世的 prev 必须是 0
+        Assert.Null(OperatorTrust.ParseSet(OperatorTrust.Encode(set) + "\nnot-a-key"));
+    }
+}
@@ -0,0 +1,70 @@
+using Fleet.Core;
+using Fleet.Hosting;
+using Fleet.Identity;
+
+namespace Fleet.Tests;
+
+/// <summary>节点自己要求有属主（passkey）：Agent 和 Probe 共用这一份，没有属主就不运行。</summary>
+public sealed class OwnerGuardTests : IDisposable
+{
+    private readonly TestAuthenticator _alice = new();
+    private readonly string _directory = Path.Combine(Path.GetTempPath(), "moshiro-owner-" + Guid.NewGuid().ToString("N"));
+
+    public OwnerGuardTests()
+    {
+        Directory.CreateDirectory(_directory);
+    }
+
+    public void Dispose()
+    {
+        _alice.Dispose();
+        Directory.Delete(_directory, recursive: true);
+    }
+
+    private void Pin(params string[] controllers)
+    {
+        var set = new OperatorSet(1, OperatorTrust.Genesis, TestAuthenticator.RpId, [TestAuthenticator.Origin], [_alice.Key]);
+        SignedStatement genesis = _alice.Sign(OperatorTrust.Encode(set));
+        TrustAnchor.Pin(_directory, OperatorTrust.Fingerprint(genesis.Statement), [genesis.ToDto()], controllers);
+    }
+
+    [Fact]
+    public void ANodeEnrolledWithoutATrustRoot_HasNoOwner_AndDoesNotRun()
+    {
+        TrustAnchor none = TrustAnchor.Load(_directory, NullNodeLog.Instance);
+
+        Assert.NotNull(OwnerGuard.Problem(none, require: true));
+        Assert.False(OwnerGuard.Check(_directory, require: true, NullNodeLog.Instance));
+    }
+
+    [Fact]
+    public void ANodePinnedToAnOwnerPasskey_Runs()
+    {
+        Pin(_alice.CredentialId);
+
+        TrustAnchor pinned = TrustAnchor.Load(_directory, NullNodeLog.Instance);
+
+        Assert.Null(OwnerGuard.Problem(pinned, require: true));
+        Assert.True(OwnerGuard.Check(_directory, require: true, NullNodeLog.Instance));
+        Assert.Equal([_alice.CredentialId], pinned.Controllers);
+    }
+
+    [Fact]
+    public void APinnedNodeWhoseOwnerIsNoLongerInTheOperatorSet_DoesNotRun()
+    {
+        Pin("some-passkey-that-is-not-in-the-set");
+
+        TrustAnchor pinned = TrustAnchor.Load(_directory, NullNodeLog.Instance);
+
+        Assert.Empty(pinned.Controllers);
+        Assert.NotNull(OwnerGuard.Problem(pinned, require: true));
+    }
+
+    [Fact]
+    public void TheRequirementCanBeTurnedOff_ForAPanelWithoutATrustRoot()
+    {
+        TrustAnchor none = TrustAnchor.Load(_directory, NullNodeLog.Instance);
+
+        Assert.Null(OwnerGuard.Problem(none, require: false));
+    }
+}
@@ -0,0 +1,266 @@
+using Fleet.Core;
+using Fleet.Hosting;
+
+namespace Fleet.Tests;
+
+public sealed class RestartScheduleTests
+{
+    private static RestartSchedule Parse(string text)
+    {
+        Assert.True(RestartSchedule.TryParse(text, out RestartSchedule? schedule), text);
+        return schedule!;
+    }
+
+    [Theory]
+    [InlineData("04:00")]
+    [InlineData("04:00Z")]
+    [InlineData("04:00+08:00")]
+    [InlineData("23:59-05:30")]
+    [InlineData(" 00:00 ")]
+    public void Parse_AcceptsTimeWithOptionalOffset(string text) => Parse(text);
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("4:00")]
+    [InlineData("24:00")]
+    [InlineData("04:60")]
+    [InlineData("04:00+8:00")]
+    [InlineData("04:00+15:00")]
+    [InlineData("04:00 UTC")]
+    [InlineData("0400")]
+    [InlineData("04:00+08:60")]
+    public void Parse_RejectsEverythingElse(string text) => Assert.False(RestartSchedule.TryParse(text, out _));
+
+    [Fact]
+    public void NextAfter_IsStrictlyLater_AndRollsToTomorrow()
+    {
+        RestartSchedule utc = Parse("04:00");
+        Assert.Equal(new DateTimeOffset(2026, 10, 7, 4, 0, 0, TimeSpan.Zero), utc.NextAfter(new DateTimeOffset(2026, 10, 7, 3, 59, 59, TimeSpan.Zero)));
+        Assert.Equal(new DateTimeOffset(2026, 10, 8, 4, 0, 0, TimeSpan.Zero), utc.NextAfter(new DateTimeOffset(2026, 10, 7, 4, 0, 0, TimeSpan.Zero)));
+        Assert.Equal(new DateTimeOffset(2026, 10, 8, 4, 0, 0, TimeSpan.Zero), utc.NextAfter(new DateTimeOffset(2026, 10, 7, 20, 0, 0, TimeSpan.Zero)));
+    }
+
+    [Fact]
+    public void NextAfter_UsesTheWrittenOffset()
+    {
+        // 04:00+08:00 就是 UTC 前一天 20:00
+        RestartSchedule china = Parse("04:00+08:00");
+        Assert.Equal(new DateTimeOffset(2026, 10, 6, 20, 0, 0, TimeSpan.Zero), china.NextAfter(new DateTimeOffset(2026, 10, 6, 19, 0, 0, TimeSpan.Zero)));
+        Assert.Equal(new DateTimeOffset(2026, 10, 7, 20, 0, 0, TimeSpan.Zero), china.NextAfter(new DateTimeOffset(2026, 10, 6, 20, 0, 0, TimeSpan.Zero)));
+    }
+
+    [Fact]
+    public void NextAfter_WithMinimumUptime_DoesNotRestartAgainRightAfterARestart()
+    {
+        RestartSchedule schedule = Parse("04:00");
+        // 04:00:03 重启后启动：加上最短运行时间再算，下一次是明天，而不是几秒后
+        var started = new DateTimeOffset(2026, 10, 7, 4, 0, 3, TimeSpan.Zero);
+        Assert.Equal(new DateTimeOffset(2026, 10, 8, 4, 0, 0, TimeSpan.Zero), schedule.NextAfter(started + RestartSchedule.MinimumUptime));
+        // 03:55 启动：离 04:00 只有 5 分钟，不够最短运行时间，顺延到明天
+        var early = new DateTimeOffset(2026, 10, 7, 3, 55, 0, TimeSpan.Zero);
+        Assert.Equal(new DateTimeOffset(2026, 10, 8, 4, 0, 0, TimeSpan.Zero), schedule.NextAfter(early + RestartSchedule.MinimumUptime));
+    }
+
+    [Fact]
+    public void Resolve_ReportsABadValueInsteadOfIgnoringIt()
+    {
+        Assert.Null(RestartSchedule.Resolve(null));
+        Assert.Null(RestartSchedule.Resolve("  "));
+        InvalidOperationException error = Assert.Throws<InvalidOperationException>(() => RestartSchedule.Resolve("tomorrow"));
+        Assert.Contains("restart_at", error.Message);
+    }
+
+    [Fact]
+    public async Task ServiceShell_StopsAtTheScheduledTime()
+    {
+        var time = new ImmediateTimeProvider(new DateTimeOffset(2026, 10, 7, 12, 0, 0, TimeSpan.Zero));
+        var log = new ListLog();
+        bool stoppedByToken = false;
+
+        // 业务循环只在被取消时返回；定时重启到点以后令牌被取消，RunAsync 正常返回
+        await ServiceShell.RunAsync(async ct =>
+        {
+            try
+            {
+                await Task.Delay(Timeout.Infinite, ct);
+            }
+            catch (OperationCanceledException)
+            {
+                stoppedByToken = true;
+                throw;
+            }
+        }, log, new RestartController(Parse("04:00")), time).WaitAsync(TimeSpan.FromSeconds(10));
+
+        Assert.True(stoppedByToken);
+        Assert.Contains(log.Lines, l => l.Contains("scheduled_restart", StringComparison.Ordinal));
+        Assert.Contains(log.Lines, l => l.Contains("restart scheduled", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ServiceShell_PicksUpAScheduleThePanelSendsLater()
+    {
+        var time = new ImmediateTimeProvider(new DateTimeOffset(2026, 10, 7, 12, 0, 0, TimeSpan.Zero));
+        var log = new ListLog();
+        using var controller = new RestartController();
+
+        Task shell = ServiceShell.RunAsync(ct => Task.Delay(Timeout.Infinite, ct), log, controller, time);
+        await Task.Delay(300);
+        Assert.False(shell.IsCompleted, "no schedule yet: the node keeps running");
+
+        Assert.True(controller.SetRemote("04:30+08:00"));
+        await shell.WaitAsync(TimeSpan.FromSeconds(10));
+        Assert.Contains(log.Lines, l => l.Contains("scheduled_restart", StringComparison.Ordinal));
+        Assert.Contains(log.Lines, l => l.Contains("source=panel", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ServiceShell_ClearingTheScheduleCancelsTheRestart()
+    {
+        var time = new ManualTimeProvider(new DateTimeOffset(2026, 10, 7, 12, 0, 0, TimeSpan.Zero));
+        var log = new ListLog();
+        using var controller = new RestartController();
+
+        controller.SetRemote("04:30+08:00");
+
+        Task shell = ServiceShell.RunAsync(ct => Task.Delay(Timeout.Infinite, ct), log, controller, time);
+        await Task.Delay(300);
+        controller.SetRemote(null); // 面板关掉了
+        await Task.Delay(300);
+        Assert.False(shell.IsCompleted);
+        Assert.Contains(log.Lines, l => l.Contains("restart scheduled", StringComparison.Ordinal));
+        Assert.DoesNotContain(log.Lines, l => l.Contains("scheduled_restart", StringComparison.Ordinal));
+        // 清理：把进程停掉
+        Assert.True(controller.SetRemote("04:30+08:00"));
+        // 新的计时器是异步注册的：反复推进，直到进程退出
+        for (int i = 0; i < 100 && !shell.IsCompleted; i++)
+        {
+            time.Advance();
+            await Task.Delay(50);
+        }
+
+        await shell.WaitAsync(TimeSpan.FromSeconds(10));
+    }
+
+    [Fact]
+    public void Controller_LocalSettingWinsOverThePanel_AndBadTextIsRejected()
+    {
+        using var controller = new RestartController(Parse("04:00"));
+        Assert.True(controller.IsLocal);
+        Assert.True(controller.SetRemote("05:00"));
+        Assert.Equal(new DateTimeOffset(2026, 10, 7, 4, 0, 0, TimeSpan.Zero), controller.Current!.NextAfter(new DateTimeOffset(2026, 10, 7, 0, 0, 0, TimeSpan.Zero)));
+
+        using var remoteOnly = new RestartController();
+        Assert.Null(remoteOnly.Current);
+        Assert.False(remoteOnly.SetRemote("whenever"));
+        Assert.Null(remoteOnly.Current);
+        Assert.True(remoteOnly.SetRemote("05:00"));
+        Assert.NotNull(remoteOnly.Current);
+        Assert.True(remoteOnly.SetRemote(null));
+        Assert.Null(remoteOnly.Current);
+    }
+
+    /// <summary>计时器马上触发：用来验证「到点」之后的行为，不用真的等。</summary>
+    private sealed class ImmediateTimeProvider : TimeProvider
+    {
+        private readonly DateTimeOffset _now;
+
+        public ImmediateTimeProvider(DateTimeOffset now) => _now = now;
+
+        public override DateTimeOffset GetUtcNow() => _now;
+
+        public override ITimer CreateTimer(TimerCallback callback, object? state, TimeSpan dueTime, TimeSpan period)
+        {
+            // TrimHeapAsync 这类每 30 秒一次的循环也会走到这里；只让「很长」的延迟（定时重启，至少 10 分钟）马上触发
+            var timer = new ImmediateTimer(callback, state);
+            if (dueTime >= RestartSchedule.MinimumUptime)
+            {
+                ThreadPool.QueueUserWorkItem(_ => timer.Fire());
+            }
+
+            return timer;
+        }
+    }
+
+    /// <summary>计时器只在 <see cref="Advance"/> 时触发：用来验证「还没到点」时不会退出。</summary>
+    private sealed class ManualTimeProvider : TimeProvider
+    {
+        private readonly DateTimeOffset _now;
+        private readonly List<ImmediateTimer> _timers = [];
+
+        public ManualTimeProvider(DateTimeOffset now) => _now = now;
+
+        public override DateTimeOffset GetUtcNow() => _now;
+
+        public override ITimer CreateTimer(TimerCallback callback, object? state, TimeSpan dueTime, TimeSpan period)
+        {
+            var timer = new ImmediateTimer(callback, state);
+            lock (_timers)
+            {
+                _timers.Add(timer);
+            }
+
+            return timer;
+        }
+
+        public void Advance()
+        {
+            ImmediateTimer[] due;
+            lock (_timers)
+            {
+                due = [.. _timers];
+                _timers.Clear();
+            }
+
+            foreach (ImmediateTimer timer in due)
+            {
+                timer.Fire();
+            }
+        }
+    }
+
+    private sealed class ImmediateTimer : ITimer
+    {
+        private readonly TimerCallback _callback;
+        private readonly object? _state;
+
+        public ImmediateTimer(TimerCallback callback, object? state)
+        {
+            _callback = callback;
+            _state = state;
+        }
+
+        public void Fire() => _callback(_state);
+
+        public bool Change(TimeSpan dueTime, TimeSpan period) => true;
+
+        public void Dispose()
+        {
+        }
+
+        public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+    }
+
+    private sealed class ListLog : INodeLog
+    {
+        private readonly List<string> _lines = [];
+
+        public IReadOnlyList<string> Lines
+        {
+            get
+            {
+                lock (_lines)
+                {
+                    return [.. _lines];
+                }
+            }
+        }
+
+        public void Write(NodeLogLevel level, string message, params (string Key, object? Value)[] fields)
+        {
+            lock (_lines)
+            {
+                _lines.Add(message + " " + string.Join(' ', fields.Select(f => f.Key + "=" + f.Value)));
+            }
+        }
+    }
+}
@@ -0,0 +1,114 @@
+using System.Security.Cryptography;
+using Fleet.Identity;
+
+namespace Fleet.Tests;
+
+public sealed class SecureChannelTests
+{
+    private const string Nonce = "n0nce-from-the-server";
+
+    private static (LinkCipher Node, LinkCipher Server) Pair(string nodeNonce = Nonce, string serverNonce = Nonce)
+    {
+        using var node = new EphemeralKey();
+        using var server = new EphemeralKey();
+        return (LinkCipher.ForNode(node, server.PublicKeySpki, nodeNonce), LinkCipher.ForServer(server, node.PublicKeySpki, serverNonce));
+    }
+
+    [Fact]
+    public void TheServerProof_VerifiesOnlyForTheRightKey_Nonce_AndEphemeralKey()
+    {
+        using ECDsa serverKey = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        using ECDsa other = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        using var eph = new EphemeralKey();
+        using var otherEph = new EphemeralKey();
+        byte[] spki = serverKey.ExportSubjectPublicKeyInfo();
+        byte[] proof = ServerHello.Sign(serverKey, Nonce, eph.PublicKeySpki);
+
+        Assert.True(ServerHello.Verify(spki, Nonce, eph.PublicKeySpki, proof));
+        Assert.False(ServerHello.Verify(other.ExportSubjectPublicKeyInfo(), Nonce, eph.PublicKeySpki, proof)); // 别人的服务器密钥
+        Assert.False(ServerHello.Verify(spki, "another-nonce", eph.PublicKeySpki, proof)); // 挪到别的挑战上
+        Assert.False(ServerHello.Verify(spki, Nonce, otherEph.PublicKeySpki, proof)); // 中间人换了自己的临时公钥
+        Assert.False(ServerHello.Verify(spki, Nonce, eph.PublicKeySpki, proof.AsSpan(0, proof.Length - 1)));
+        Assert.False(ServerHello.Verify([1, 2, 3], Nonce, eph.PublicKeySpki, proof)); // 公钥不合法也不抛异常
+    }
+
+    [Fact]
+    public void BothDirections_RoundTrip_AndKeepTheFrameKind()
+    {
+        (LinkCipher node, LinkCipher server) = Pair();
+        using LinkCipher n = node;
+        using LinkCipher s = server;
+
+        byte[] toServer = n.Seal(0, "hello server"u8);
+        Assert.True(s.TryOpen(toServer, out byte kind, out byte[] data));
+        Assert.Equal(0, kind);
+        Assert.Equal("hello server"u8.ToArray(), data);
+
+        byte[] big = RandomNumberGenerator.GetBytes(300_000);
+        byte[] toNode = s.Seal(1, big);
+        Assert.True(n.TryOpen(toNode, out kind, out data));
+        Assert.Equal(1, kind);
+        Assert.Equal(big, data);
+        Assert.Equal(big.Length + LinkCipher.Overhead + 1, toNode.Length);
+    }
+
+    [Fact]
+    public void AReplayedReorderedTamperedOrReflectedFrame_IsRefused()
+    {
+        (LinkCipher node, LinkCipher server) = Pair();
+        using LinkCipher n = node;
+        using LinkCipher s = server;
+
+        byte[] first = n.Seal(0, "one"u8);
+        byte[] second = n.Seal(0, "two"u8);
+        Assert.False(s.TryOpen(second, out _, out _)); // 乱序（丢了第一帧）
+        Assert.True(s.TryOpen(first, out _, out _));
+        Assert.False(s.TryOpen(first, out _, out _)); // 重放
+        Assert.True(s.TryOpen(second, out _, out _));
+
+        byte[] tampered = n.Seal(0, "three"u8);
+        tampered[12] ^= 0x01;
+        Assert.False(s.TryOpen(tampered, out _, out _)); // 改了一位
+
+        byte[] fromNode = n.Seal(0, "four"u8);
+        (LinkCipher otherNode, LinkCipher otherServer) = Pair();
+        using LinkCipher on = otherNode;
+        using LinkCipher os = otherServer;
+        Assert.False(os.TryOpen(fromNode, out _, out _)); // 另一条连接的密钥打不开
+
+        byte[] fromServer = s.Seal(0, "reflected"u8);
+        Assert.False(s.TryOpen(fromServer, out _, out _)); // 方向不同：服务器发的东西不能原样塞回给服务器
+        Assert.False(n.TryOpen([1, 2, 3], out _, out _));
+    }
+
+    [Fact]
+    public void ADifferentNonce_GivesDifferentKeys()
+    {
+        (LinkCipher node, LinkCipher server) = Pair("nonce-a", "nonce-b"); // 两边对不上：没人能解开对方的东西
+        using LinkCipher n = node;
+        using LinkCipher s = server;
+        Assert.False(s.TryOpen(n.Seal(0, "x"u8), out _, out _));
+    }
+
+    [Fact]
+    public void AnOperatorSet_CarriesTheServerKeys_ThroughTheChain()
+    {
+        using var alice = new TestAuthenticator();
+        using ECDsa serverKey = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        byte[] spki = serverKey.ExportSubjectPublicKeyInfo();
+        var set = new OperatorSet(1, OperatorTrust.Genesis, TestAuthenticator.RpId, [TestAuthenticator.Origin], [alice.Key], [spki]);
+        string text = OperatorTrust.Encode(set);
+
+        OperatorSet parsed = OperatorTrust.ParseSet(text)!;
+        Assert.Equal(spki, Assert.Single(parsed.Servers!));
+        Assert.Equal(text, OperatorTrust.Encode(parsed)); // 编码和解析互逆，指纹稳定
+
+        SignedStatement genesis = alice.Sign(text);
+        OperatorSet verified = OperatorTrust.VerifyChain(OperatorTrust.Fingerprint(text), [genesis])!;
+        Assert.Equal(spki, Assert.Single(verified.Servers!));
+
+        // 服务器密钥只能写在凭证后面；顺序不对、内容不是 base64 都算坏
+        Assert.Null(OperatorTrust.ParseSet(text + "\nkey=late:AAAA"));
+        Assert.Null(OperatorTrust.ParseSet(text + "\nserver=***"));
+    }
+}
@@ -0,0 +1,13 @@
+using Fleet.Rpc;
+
+namespace Fleet.Tests;
+
+/// <summary>测试里用的方法声明：除非另有说明，方法都由拨号方发给监听方。</summary>
+internal static class TestTables
+{
+    public static MethodTable Of(params MethodSpec[] specs) => new(specs);
+
+    public static MethodSpec Req(string name, RpcSide from = RpcSide.Dialer) => MethodSpec.Request(name, from);
+
+    public static MethodSpec Note(string name, RpcSide from = RpcSide.Dialer) => MethodSpec.Notification(name, from);
+}
@@ -2,7 +2,7 @@ using System.Text.Json.Nodes;
 using Fleet.Core;
 using Fleet.Enrollment.Client;

-// fleet-enroll --server https://panel --join jt_xxx --name jp-1 --identity-dir /etc/monitor [--meta '{"probe_tcp_port":7443,...}'] [--version 1.0]
+// fleet-enroll --server https://panel --join jt_xxx --name jp-1 --identity-dir /etc/moshiro [--meta '{"probe_tcp_port":7443,...}'] [--version 1.0]
 // 一次性运行：生成身份、注册、写入身份目录，然后退出。
 string? Arg(string name) => args.SkipWhile(a => a != name).Skip(1).FirstOrDefault();

@@ -12,7 +12,7 @@ string? name = Arg("--name");
 string? directory = Arg("--identity-dir");
 if (server is null || join is null || name is null || directory is null)
 {
-    Console.Error.WriteLine("usage: fleet-enroll --server <url> --join <token> --name <node name> --identity-dir <dir> [--meta <json>] [--version <v>]");
+    Console.Error.WriteLine("usage: fleet-enroll --server <url> --join <token> --name <node name> --identity-dir <dir> [--meta <json>] [--version <v>] [--genesis <trust root fingerprint> --controllers <passkey credential ids, comma separated>]");
    return 2;
 }

@@ -30,14 +30,23 @@ if (Arg("--meta") is { } metaText)
    }
 }

+string? genesis = Arg("--genesis");
+string[] controllers = (Arg("--controllers") ?? "").Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+
+if (genesis is not null && controllers.Length == 0)
+{
+    Console.Error.WriteLine("--genesis needs --controllers: every node has an owner (the passkey credential ids from the panel's command)");
+    return 2;
+}
+
 using var http = new HttpClient { Timeout = TimeSpan.FromSeconds(30) };
 Result<EnrollmentResult> result = await EnrollmentClient.EnrollAsync(
-    http, new Uri(server), join, name, directory, Arg("--version") ?? "0.0.0", meta, TimeProvider.System, CancellationToken.None);
+    http, new Uri(server), join, name, directory, Arg("--version") ?? "0.0.0", meta, TimeProvider.System, CancellationToken.None, genesis, controllers);
 if (!result.TryGet(out EnrollmentResult? enrolled, out FleetError? error))
 {
    Console.Error.WriteLine($"enrollment failed ({error.Code}): {error.Message}");
    return 1;
 }

-Console.WriteLine($"enrolled as {enrolled.NodeId} ({enrolled.Status}); identity written to {enrolled.IdentityDirectory}");
+Console.WriteLine($"enrolled as {enrolled.NodeId} ({enrolled.Status}); identity written to {enrolled.IdentityDirectory}" + (enrolled.Pinned ? "; operator trust pinned" : "; operator trust NOT pinned (no --genesis)"));
 return 0;
@@ -1,17 +1,36 @@
 <Project>
  <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
  <Import Project="Sdk.props" Sdk="StuDev.AotAnywhere"
-          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
+          Condition="'$(UseAotAnywhere)' == 'true'" />
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <AssemblyName>fleet-enroll</AssemblyName>
    <RootNamespace>FleetEnroll</RootNamespace>
    <IsAotCompatible>true</IsAotCompatible>
+    <PublishAot>true</PublishAot>
+    <PublishTrimmed>true</PublishTrimmed>
+    <TrimMode>full</TrimMode>
+    <StripSymbols>true</StripSymbols>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <MetadataUpdaterSupport>false</MetadataUpdaterSupport>
+    <OptimizationPreference>Size</OptimizationPreference>
+    <UseSystemResourceKeys>true</UseSystemResourceKeys>
+    <StackTraceSupport>false</StackTraceSupport>
+    <EventSourceSupport>false</EventSourceSupport>
+    <DebuggerSupport>false</DebuggerSupport>
+    <HttpActivityPropagationSupport>false</HttpActivityPropagationSupport>
+    <Http3Support>false</Http3Support>
+    <MetricsSupport>false</MetricsSupport>
+    <UseSizeOptimizedLinq>true</UseSizeOptimizedLinq>
+    <JsonSerializerIsReflectionEnabledByDefault>false</JsonSerializerIsReflectionEnabledByDefault>
+    <IlcFoldIdenticalMethodBodies>true</IlcFoldIdenticalMethodBodies>
+    <ServerGarbageCollection>false</ServerGarbageCollection>
+    <ConcurrentGarbageCollection>false</ConcurrentGarbageCollection>
  </PropertyGroup>
  <ItemGroup>
    <ProjectReference Include="..\..\src\Fleet.Enrollment.Client\Fleet.Enrollment.Client.csproj" />
  </ItemGroup>
  <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
  <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
-          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
+          Condition="'$(UseAotAnywhere)' == 'true'" />
 </Project>
@@ -8,6 +8,10 @@
    <EventSourceSupport>false</EventSourceSupport>
    <DebuggerSupport>false</DebuggerSupport>
    <HttpActivityPropagationSupport>false</HttpActivityPropagationSupport>
+    <Http3Support>false</Http3Support>
+    <MetricsSupport>false</MetricsSupport>
+    <UseSizeOptimizedLinq>true</UseSizeOptimizedLinq>
+    <JsonSerializerIsReflectionEnabledByDefault>false</JsonSerializerIsReflectionEnabledByDefault>
    <ServerGarbageCollection>false</ServerGarbageCollection>
    <ConcurrentGarbageCollection>false</ConcurrentGarbageCollection>
  </PropertyGroup>
@@ -1,46 +1,59 @@
-# Monitor Probe
+# MoShiro Probe

-Probe 是网络测量的发起端，通常运行在家宽或其他需要观测的网络出口。它连接 Agent、执行线路任务，并把本端采集的原始数据交给 Agent 汇总上报。Probe 不直接连接 Backend，也不提供远程命令或文件管理功能。
+Probe 是网络测量的发起端，通常运行在家宽或其他需要观测的网络出口。它连接 Backend（身份、Agent 列表、状态）和 Agent（测量），执行线路任务，并把本端采集的原始数据交给 Agent 汇总上报。Probe 不提供远程命令或文件管理功能。

 ## 工作流程

 ```text
-Backend ──任务与节点列表──> Agent <──测量会话──> Probe
-                              │                     │
-                              └──汇总并上报数据 <───┘
+Backend ──任务──> Agent <──测量会话──> Probe
+   │  ▲           │                     │
+   │  └──汇总并上报数据 <───┘                     │
+   └─────Agent 列表、状态（Fleet 长连接）───────────┘
 ```

-Probe 使用面板生成的 `probe.json` 读取自身身份、首次连接用的 Agent 地址和本地测试限制。成功连接后，Agent 会同步可用节点列表；Probe 将列表缓存到同目录的 `agents.json`。`probe.json` 含私钥，请限制文件访问权限，不要提交到版本控制。
+Probe 用 `probe.json` 读取面板地址（`fleet.server`）、身份目录（`fleet.identity_dir`，由 `fleet-enroll` 注册时生成）和本地测试限制。连上面板之后，面板下发要连接的 Agent 列表；Probe 将列表缓存到同目录的 `agents.json`，面板暂时连不上时靠它继续测量。身份目录里有私钥，请限制访问权限，不要提交到版本控制。
+
+容器节点的运行方式（podman + systemd）和宿主机更新器见 [`../../docs/deployment.md`](../../docs/deployment.md)；Probe 也可以用 OCI 镜像 `registry.oeo.one/moshiro/moshiro-probe:<version>`，容器默认读取 `/etc/moshiro/probe.json`，命名 volume 保存身份配置和缓存，镜像以 UID/GID 1654 运行。

 ## 构建

-需要 .NET SDK 10。为应用 `backend/global.json` 的 SDK 设置，请从 `backend/` 目录构建：
+需要 .NET SDK 10。为应用 根目录的 `global.json` 的 SDK 设置，请从 `backend/` 目录构建：

 ```sh
 cd backend
-dotnet build probe/src/Monitor.Probe -c Release
+dotnet build probe/src/MoShiro.Probe -c Release
 ```

 发布 NativeAOT 程序需要对应平台的 C/C++ 工具链；`<RID>` 应与构建环境和目标平台匹配：

 ```sh
-dotnet publish probe/src/Monitor.Probe -c Release -r <RID> -p:PublishAot=true
+dotnet publish probe/src/MoShiro.Probe -c Release -r <RID> -p:PublishAot=true
 ```

 也可在仓库根目录运行 `bash scripts/publish.sh probe <RID>`，再使用 `scripts/package.sh probe <RID>` 生成部署包。支持平台和安装流程见 [`../../docs/deployment.md`](../../docs/deployment.md)。

 ## 配置与运行

-在管理端创建 Probe 并下载一次性身份配置，将文件保存为目标机上的 `/etc/monitor/probe.json`。随后运行：
+在管理端添加 Probe（生成 probe 角色的加入令牌），在目标机上注册（密钥由 Probe 自己生成）：

 ```sh
-monitor-probe --config /etc/monitor/probe.json
+fleet-enroll --server https://panel.example.com --join <加入令牌> --name home --identity-dir /etc/moshiro
 ```

-不传 `--config` 时默认读取 `/etc/monitor/probe.json`。配置中的 `limits` 是本地硬上限，Backend 无法远程放宽；路由器等低性能设备可调低测试码率和包速率，避免 Probe 自身成为测量瓶颈。部署时可使用仓库的 `packaging/` 文件和安装脚本。
+写 `/etc/moshiro/probe.json`：`{"fleet":{"server":"https://panel.example.com","identity_dir":"/etc/moshiro"}}`（`install.sh probe --server … --join … --name …` 会一并完成）。随后运行：
+
+```sh
+moshiro-probe --config /etc/moshiro/probe.json
+```
+
+不传 `--config` 时默认读取 `/etc/moshiro/probe.json`。配置中的 `limits` 是本地硬上限，Backend 无法远程放宽；路由器等低性能设备可调低测试码率和包速率，避免 Probe 自身成为测量瓶颈。部署时可使用仓库的 `packaging/` 文件和安装脚本。
+
+也可使用 OCI 镜像 `registry.oeo.one/moshiro/moshiro-probe:<version>`，自动选择 Linux amd64 或 arm64 镜像。容器默认读取 `/etc/moshiro/probe.json`，并在同一目录维护 `agents.json` 缓存，配置与缓存存放在命名 volume 中。建议使用宿主网络；当前独立 ICMP 目标任务由 Agent 执行。

 ## 设计说明

- Probe 只执行编译进程序的测量模块。它不认识 Backend，不落盘测量数据，也不能执行命令或自行更新。
- 测量模块由 `backend/shared/Monitor.Measurement/` 与 Agent 共用；Probe 负责发起连接、调度任务和记录本端数据。
+- Probe 只执行编译进程序的测量模块。它不落盘测量数据，也不能执行命令或自行更新（更新由宿主机上的更新器完成，Probe 只写清单和请求文件）。
+- 测量模块由 `backend/shared/MoShiro.Measurement/` 与 Agent 共用；Probe 负责发起连接、调度任务和记录本端数据。
 - 测量模型和协议细节见 [`../../docs/measurement.md`](../../docs/measurement.md) 与 [`../../docs/protocol.md`](../../docs/protocol.md)；整体架构见 [`../../docs/architecture.md`](../../docs/architecture.md)。
+
+Docker 与 rootless/rootful Podman 共用 `packaging/compose/probe/compose.yaml`，配置、身份和缓存放在命名 volume 中，无需宿主配置目录、keep-id 或手动 chown。首次导入和自动更新见部署文档。
@@ -6,16 +6,16 @@ using Fleet.Core;
 using Fleet.Identity;
 using Fleet.Link;
 using Fleet.Rpc;
-using Monitor.Measurement;
-using Monitor.Protocol;
+using MoShiro.Measurement;
+using MoShiro.Protocol;

-namespace Monitor.Probe;
+namespace MoShiro.Probe;

 /// <summary>所有连接共用的东西。</summary>
 public sealed record ConnectionEnv(NodeIdentity Identity, string ProbeId, ProbeLimits Limits, AgentDirectory Directory, MonoClock Clock, TimeProvider Time, INodeLog Log);

 /// <summary>
-/// 与一个 Agent 的点对点会话：认证握手 → 同步时钟 → 取 Agent 列表 → 按 Agent 下发的 <c>line_task_set</c> 运行角色 →
+/// 与一个 Agent 的点对点会话：认证握手 → 同步时钟 → 按 Agent 下发的 <c>line_task_set</c> 运行角色 →
 /// 每 10 秒把已完成的行切成列块放进发件箱 → 响应按需测试的阶段。会话断开时所有角色停止（凭据属于会话），按退避重连。
 /// 会话内的所有状态（套接字、发件箱、角色）随会话一起创建和释放。
 /// </summary>
@@ -25,16 +25,19 @@ public sealed class AgentConnection
    private static readonly TimeSpan s_clockInterval = TimeSpan.FromSeconds(30);
    private static readonly RpcRouter<ConnectionSession> s_router = BuildRouter();

+    /// <summary>对等面入站方法的路由器（只读，测试用）。</summary>
+    public static RpcRouter<ConnectionSession> Router => s_router;
+
    private readonly ConnectionEnv _env;
    private volatile ConnectionSession? _session;

-    public AgentConnection(BootstrapAgent endpoint, ConnectionEnv env)
+    public AgentConnection(KnownAgent endpoint, ConnectionEnv env)
    {
        Endpoint = endpoint;
        _env = env;
    }

-    public BootstrapAgent Endpoint { get; }
+    public KnownAgent Endpoint { get; }

    public bool IsConnected => _session is not null;

@@ -74,8 +77,21 @@ public sealed class AgentConnection

    private async Task<string> RunOnceAsync(Backoff backoff, CancellationToken ct)
    {
+        AddressFamily family = Endpoint.IpVersion == IpVersions.V6 ? AddressFamily.InterNetworkV6 : AddressFamily.InterNetwork;
+        using var resolveTimeout = new CancellationTokenSource(TimeSpan.FromSeconds(10), _env.Time);
+        using CancellationTokenSource resolveCt = CancellationTokenSource.CreateLinkedTokenSource(ct, resolveTimeout.Token);
+        IPAddress[] addresses = IPAddress.TryParse(Endpoint.Host, out IPAddress? literal)
+            ? [literal]
+            : await Dns.GetHostAddressesAsync(Endpoint.Host, family, resolveCt.Token);
+        IPAddress? address = addresses.FirstOrDefault(a => a.AddressFamily == family && !a.IsIPv4MappedToIPv6);
+        if (address is null)
+        {
+            throw new SocketException((int)SocketError.HostNotFound);
+        }
+
+        byte[] agentKey = Convert.FromBase64String(Endpoint.PublicKey);
        (PeerSessionInfo info, TlsFrameTransport transport) = await PeerConnector.ConnectAsync(
-            Endpoint.Host, Endpoint.TcpPort, Convert.FromBase64String(Endpoint.Spki), _env.Identity, _env.ProbeId, ProbeApp.Version, 8 << 20, _env.Time, ct);
+            address.ToString(), Endpoint.TcpPort, agentKey, _env.Identity, _env.ProbeId, ProbeApp.Version, 8 << 20, _env.Time, ct);
        var remote = (IPEndPoint)info.Remote!;
        var data = new DataSession(info.Credentials.SessionIdValue, info.Credentials.Key);
        using var udp = new UdpMux(new SingleSession(data), null, _env.Clock, new DataPlaneCounters(), _env.Log, remote.AddressFamily == AddressFamily.InterNetworkV6 ? IPAddress.IPv6Any : IPAddress.Any, []);
@@ -90,7 +106,8 @@ public sealed class AgentConnection
            Session = () => data,
            Udp = udp,
            PeerAddress = remote.Address,
-            PeerSpkiSha256 = Convert.FromBase64String(Endpoint.Spki),
+            PeerSpkiSha256 = NodeIdentity.Fingerprint(agentKey),
+            KnockKey = Knock.DeriveKey(_env.Identity, agentKey),
            Fragments = shipper,
            MaxPacketsPerSecond = _env.Limits.MaxTotalPps,
            MaxBulkMbps = _env.Limits.MaxTestMbps,
@@ -105,12 +122,11 @@ public sealed class AgentConnection
        Task pump = PumpAsync(rpc, outbox, cts.Token);
        try
        {
-            // 先同步时钟（块头里要带偏移），再取 Agent 列表；Agent 随后推送线路任务集
+            // 先同步时钟（块头里要带偏移）；Agent 随后推送线路任务集
            await SyncClockAsync(rpc, clock, rounds: 5, cts.Token);
            backoff.Reset();
            _session = session;
            _env.Log.Info("agent session up", ("agent", Endpoint.AgentId), ("offset_us", clock.OffsetUs));
-            await RefreshDirectoryAsync(rpc, cts.Token);
            Task maintenance = MaintainAsync(rpc, session, clock, cts.Token);
            Task finished = await Task.WhenAny(run, receive, pump, maintenance);
            await cts.CancelAsync();
@@ -155,7 +171,7 @@ public sealed class AgentConnection
        for (int i = 0; i < rounds; i++)
        {
            long sent = _env.Clock.NowUs();
-            Result<ClockResult> reply = await rpc.RequestAsync(MonitorMethods.Clock, new ClockParams { ProbeMonoUs = sent }, MonitorJsonContext.Default.ClockParams, MonitorJsonContext.Default.ClockResult, ct);
+            Result<ClockResult> reply = await rpc.RequestAsync(MoShiroMethods.Clock, new ClockParams { ProbeMonoUs = sent }, MoShiroJsonContext.Default.ClockParams, MoShiroJsonContext.Default.ClockResult, ct);
            if (reply.TryGet(out ClockResult? value, out _))
            {
                clock.Add(sent, value.AgentMonoUs, _env.Clock.NowUs());
@@ -163,20 +179,6 @@ public sealed class AgentConnection
        }
    }

-    private async Task RefreshDirectoryAsync(RpcSession<ConnectionSession> rpc, CancellationToken ct)
-    {
-        Result<ProbeAgentsResult> list = await rpc.RequestAsync(
-            MonitorMethods.ProbeAgents, new ProbeAgentsParams { HaveVersion = _env.Directory.Version }, MonitorJsonContext.Default.ProbeAgentsParams, MonitorJsonContext.Default.ProbeAgentsResult, ct);
-        if (list.TryGet(out ProbeAgentsResult? agents, out FleetError? error))
-        {
-            _env.Directory.Apply(agents);
-        }
-        else
-        {
-            _env.Log.Warn("could not fetch the agent list", ("agent", Endpoint.AgentId), ("err", error.Code));
-        }
-    }
-
    /// <summary>切块（每 10 秒）和时钟同步（每 30 秒）。</summary>
    private async Task MaintainAsync(RpcSession<ConnectionSession> rpc, ConnectionSession session, ClockEstimator clock, CancellationToken ct)
    {
@@ -194,7 +196,7 @@ public sealed class AgentConnection
    }

    private static RpcRouter<ConnectionSession> BuildRouter() =>
-        new RpcRouter<ConnectionSession>()
+        new RpcRouter<ConnectionSession>(RpcSide.Dialer, MoShiroMethodTable.Table)
            .On(
                FleetMethods.StateSync,
                FleetRpcContext.Default.StateSyncParams,
@@ -204,7 +206,7 @@ public sealed class AgentConnection
                    var result = new StateSyncResult { AppliedVersion = sync.Version };
                    if (sync.Type == LineTaskSet.StateType)
                    {
-                        LineTaskSet? set = sync.Doc.Deserialize(MonitorJsonContext.Default.LineTaskSet);
+                        LineTaskSet? set = sync.Doc.Deserialize(MoShiroJsonContext.Default.LineTaskSet);
                        if (set is null)
                        {
                            return Result<StateSyncResult>.Fail(FleetErrors.InvalidParams, "line_task_set could not be parsed");
@@ -216,27 +218,19 @@ public sealed class AgentConnection
                    return Result<StateSyncResult>.Ok(result);
                })
            .On(
-                MonitorMethods.TestPhase,
-                MonitorJsonContext.Default.TestPhaseStartParams,
-                MonitorJsonContext.Default.TestPhaseStartResult,
+                MoShiroMethods.TestPhase,
+                MoShiroJsonContext.Default.TestPhaseStartParams,
+                MoShiroJsonContext.Default.TestPhaseStartResult,
                (session, start, _) => ValueTask.FromResult(Result<TestPhaseStartResult>.Ok(new TestPhaseStartResult { Accepted = session.StartPhase(start) })))
            .On(
-                MonitorMethods.TestPhaseEnd,
-                MonitorJsonContext.Default.TestPhaseEndParams,
-                MonitorJsonContext.Default.TestPhaseEndResult,
+                MoShiroMethods.TestPhaseEnd,
+                MoShiroJsonContext.Default.TestPhaseEndParams,
+                MoShiroJsonContext.Default.TestPhaseEndResult,
                async (session, end, ct) => Result<TestPhaseEndResult>.Ok(new TestPhaseEndResult { Fragments = await session.EndPhaseAsync(end, ct) }))
            .OnNotify(
-                MonitorMethods.TestAbort,
-                MonitorJsonContext.Default.TestAbortParams,
+                MoShiroMethods.TestAbort,
+                MoShiroJsonContext.Default.TestAbortParams,
                async (session, abort, _) => await session.AbortAsync(abort.TestId))
-            .OnNotify(
-                MonitorMethods.ProbeAgentsChanged,
-                MonitorJsonContext.Default.ProbeAgentsResult,
-                (session, list, _) =>
-                {
-                    session.Env.Directory.Apply(list);
-                    return ValueTask.CompletedTask;
-                })
            .OnNotify(
                FleetMethods.OutboxAck,
                FleetRpcContext.Default.OutboxAckParams,
@@ -1,13 +1,12 @@
 using System.Text.Json;
 using Fleet.Core;
 using Fleet.Hosting;
-using Monitor.Protocol;
+using MoShiro.Protocol;

-namespace Monitor.Probe;
+namespace MoShiro.Probe;

 /// <summary>
-/// Probe 要连接的 Agent 列表。Probe 不认识 Backend：列表先取自 <c>probe.json</c> 的 bootstrap（或上一次保存的 <c>agents.json</c>），
-/// 连上任意一个 Agent 之后，由它代为向 Backend 查询（<c>monitor.probe.agents</c>），之后的变化由 Agent 推送（<c>agents_changed</c>）。
+/// Probe 要连接的 Agent 列表：由面板作为期望状态（<c>probe_agents</c>）直接下发；面板连不上时用上一次保存的 <c>agents.json</c>。
 /// 列表变化时用 <see cref="ConfigStore"/> 写回 <c>agents.json</c>（这是配置，不是测量数据；只在变化时写，保护路由器的闪存）。
 /// </summary>
 public sealed class AgentDirectory
@@ -17,29 +16,27 @@ public sealed class AgentDirectory
    private readonly object _gate = new();
    private readonly ConfigStore _store;
    private readonly INodeLog _log;
-    private List<BootstrapAgent> _agents;
+    private readonly TrustAnchor _trust;
+    private List<KnownAgent> _agents = [];
    private long _version;

-    public AgentDirectory(ConfigStore store, string configDirectory, ProbeFile file, INodeLog log)
+    public AgentDirectory(ConfigStore store, string configDirectory, INodeLog log, TrustAnchor? trust = null)
    {
+        _trust = trust ?? TrustAnchor.None;
        _store = store;
        _log = log;
-        _agents = [.. file.Bootstrap];
        string cache = Path.Combine(configDirectory, FileName);
        if (File.Exists(cache))
        {
            try
            {
                AgentsCache saved = NodeConfig.Load(cache, ProbeConfigContext.Default.AgentsCache);
-                if (saved.Agents.Count > 0)
-                {
-                    _agents = saved.Agents;
-                    _version = saved.Version;
-                }
+                _agents = saved.Agents;
+                _version = saved.Version;
            }
            catch (Exception ex) when (ex is IOException or InvalidDataException or JsonException or InvalidOperationException)
            {
-                _log.Warn("agents.json is unreadable, using the bootstrap list", ("err", ex.Message));
+                _log.Warn("agents.json is unreadable, waiting for the panel", ("err", ex.Message));
            }
        }
    }
@@ -58,7 +55,7 @@ public sealed class AgentDirectory
        }
    }

-    public IReadOnlyList<BootstrapAgent> Agents
+    public IReadOnlyList<KnownAgent> Agents
    {
        get
        {
@@ -69,10 +66,23 @@ public sealed class AgentDirectory
        }
    }

-    /// <summary>应用 Agent 转来的列表。版本不比当前新的忽略（乱序到达的旧推送）。</summary>
-    public void Apply(ProbeAgentsResult result)
+    /// <summary>应用面板下发的列表。版本不比当前新的忽略（乱序到达的旧推送）。</summary>
+    public void Apply(ProbeAgentList result)
    {
-        var next = result.Agents.Select(a => new BootstrapAgent { AgentId = a.AgentId.Value, Host = a.Host, TcpPort = a.TcpPort, Spki = a.Spki }).ToList();
+        var next = new List<KnownAgent>();
+        _trust.Update(result.TrustChain);
+        foreach (AgentEndpoint agent in result.Agents)
+        {
+            if (!string.IsNullOrWhiteSpace(agent.Host))
+            {
+                next.Add(new KnownAgent { AgentId = agent.AgentId.Value, Host = agent.Host, TcpPort = agent.TcpPort, PublicKey = agent.PublicKey });
+            }
+
+            if (!string.IsNullOrWhiteSpace(agent.Ipv6Host))
+            {
+                next.Add(new KnownAgent { AgentId = agent.AgentId.Value, Host = agent.Ipv6Host, TcpPort = agent.TcpPort, PublicKey = agent.PublicKey, IpVersion = IpVersions.V6 });
+            }
+        }
        lock (_gate)
        {
            if (result.Version < _version || (result.Version == _version && Same(next, _agents)))
@@ -97,9 +107,9 @@ public sealed class AgentDirectory
        Changed?.Invoke();
    }

-    private static bool Same(List<BootstrapAgent> a, List<BootstrapAgent> b) =>
+    private static bool Same(List<KnownAgent> a, List<KnownAgent> b) =>
        a.Count == b.Count && a.Zip(b).All(p => Equal(p.First, p.Second));

-    public static bool Equal(BootstrapAgent a, BootstrapAgent b) =>
-        a.AgentId == b.AgentId && a.Host == b.Host && a.TcpPort == b.TcpPort && a.Spki == b.Spki;
+    public static bool Equal(KnownAgent a, KnownAgent b) =>
+        a.AgentId == b.AgentId && a.IpVersion == b.IpVersion && a.Host == b.Host && a.TcpPort == b.TcpPort && a.PublicKey == b.PublicKey;
 }
@@ -1,13 +1,13 @@
 using System.Text.Json;
 using Fleet.Core;
 using Fleet.Link;
-using Monitor.Measurement;
-using Monitor.Protocol;
+using MoShiro.Measurement;
+using MoShiro.Protocol;

-namespace Monitor.Probe;
+namespace MoShiro.Probe;

 /// <summary>
-/// 估计 Agent 单调时钟 − Probe 单调时钟：每次 <c>monitor.clock</c> 往返取中点，在最近 8 次里取往返最短的一次
+/// 估计 Agent 单调时钟 − Probe 单调时钟：每次 <c>moshiro.clock</c> 往返取中点，在最近 8 次里取往返最短的一次
 /// （往返越短，对称性假设的误差越小）。Probe 的列块头里带着这个偏移，Backend 据此对齐两端的时间戳。
 /// </summary>
 public sealed class ClockEstimator
@@ -82,6 +82,6 @@ public sealed class FragmentShipper : IFragmentSink
            }
        }

-        _outbox.Enqueue(MonitorChannels.ColumnBlock, header.ChunkId.Value, RawChunkCodec.Encode(new RawChunk(header, streams)));
+        _outbox.Enqueue(MoShiroChannels.ColumnBlock, header.ChunkId.Value, RawChunkCodec.Encode(new RawChunk(header, streams)));
    }
 }
@@ -0,0 +1,26 @@
+<Project>
+  <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.props" Sdk="StuDev.AotAnywhere"
+          Condition="'$(UseAotAnywhere)' == 'true'" />
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <AssemblyName>moshiro-probe</AssemblyName>
+    <RootNamespace>MoShiro.Probe</RootNamespace>
+    <IsAotCompatible>true</IsAotCompatible>
+    <PublishAot>true</PublishAot>
+    <PublishTrimmed>true</PublishTrimmed>
+    <TrimMode>full</TrimMode>
+    <StripSymbols>true</StripSymbols>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <MetadataUpdaterSupport>false</MetadataUpdaterSupport>
+  </PropertyGroup>
+  <ItemGroup>
+    <InternalsVisibleTo Include="MoShiro.Backend.Tests" />
+    <ProjectReference Include="..\..\..\fleet\src\Fleet.Link\Fleet.Link.csproj" />
+    <ProjectReference Include="..\..\..\fleet\src\Fleet.Hosting\Fleet.Hosting.csproj" />
+    <ProjectReference Include="..\..\..\shared\MoShiro.Measurement\MoShiro.Measurement.csproj" />
+  </ItemGroup>
+  <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
+          Condition="'$(UseAotAnywhere)' == 'true'" />
+</Project>
@@ -0,0 +1,209 @@
+using Fleet.Core;
+using Fleet.Hosting;
+using System.Text.Json;
+using Fleet.Identity;
+using Fleet.Link;
+using Fleet.Rpc;
+using MoShiro.Measurement;
+using MoShiro.Protocol;
+
+namespace MoShiro.Probe;
+
+/// <summary>
+/// Probe 的组装点：到面板的长连接（身份、Agent 列表、状态）+ 每个 Agent 一个测量连接（认证、重连、角色）。没有全局状态，测试可以在同一进程里启动多个。
+/// Agent 列表变化时只调和连接：新增的建立，移除的断开，地址或证书指纹变化的重建，其余不受影响。
+/// </summary>
+public sealed class ProbeApp : IDisposable
+{
+    public const string Version = MoShiro.Protocol.BuildInfo.Version;
+
+    private readonly ConnectionEnv _env;
+    private readonly Dictionary<string, Running> _connections = [];
+    private readonly SemaphoreSlim _changed = new(0);
+    private readonly INodeLog _log;
+    private readonly FleetLink _link;
+
+    /// <param name="identity">注册时由节点自己生成：<c>Identity</c> 用来连面板，<c>PeerIdentity</c> 是另一把独立的密钥，只用来连 Agent。</param>
+    public ProbeApp(ProbeFile file, LoadedNodeIdentity identity, string configDirectory, TimeProvider time, INodeLog log, RestartController? restart = null)
+    {
+        _log = log;
+        var trust = TrustAnchor.Load(file.Fleet.IdentityDir, log);
+        var directory = new AgentDirectory(new ConfigStore(configDirectory), configDirectory, log, trust);
+        _env = new ConnectionEnv(identity.PeerIdentity, identity.NodeId.Value, file.Limits, directory, new MonoClock(time), time, log);
+        directory.Changed += () => _changed.Release();
+
+        var update = new UpdateBridge(configDirectory, new ConfigStore(configDirectory).Write, log);
+        NodeBinary.Prime(); // 正在运行的二进制的哈希：先在后台算好，握手时用
+        var options = new FleetLinkOptions
+        {
+            Server = new Uri(file.Fleet.Server),
+            Identity = identity.Identity,
+            ServerVerifier = trust,
+            Attestation = update.Attest,
+            NodeId = identity.NodeId,
+            NodeVersion = Version,
+            Capabilities = [MoShiroCapabilities.Base],
+            HeartbeatExtra = () => JsonSerializer.SerializeToElement(new ProbeHeartbeatExtra { Update = update.ReadStatus(), Ipv6 = Ipv6Diagnostics.Sample(null, Environment.GetEnvironmentVariable("MOSHIRO_NETWORK_SCOPE"), Environment.GetEnvironmentVariable("HOST_PROC")) }, MoShiroJsonContext.Default.ProbeHeartbeatExtra),
+            HelloMeta = () => JsonSerializer.SerializeToElement(new ProbeHelloMeta { Owners = [.. trust.Controllers], Platform = PlatformDetector.Detect(), Ipv6 = Ipv6Diagnostics.Sample(null, Environment.GetEnvironmentVariable("MOSHIRO_NETWORK_SCOPE"), Environment.GetEnvironmentVariable("HOST_PROC")) }, MoShiroJsonContext.Default.ProbeHelloMeta),
+        };
+        var list = new StateHandler<ProbeAgentList>(
+            ProbeAgentList.StateType,
+            MoShiroJsonContext.Default.ProbeAgentList,
+            (version, doc, _) =>
+            {
+                directory.Apply(doc);
+                return ValueTask.FromResult(new StateSyncResult { AppliedVersion = version });
+            });
+        var router = new RpcRouter<LinkContext>(RpcSide.Node, MoShiroMethodTable.Table, NodeRoles.Probe)
+            .OnNotify(MoShiroMethods.UpdateOffer, MoShiroJsonContext.Default.UpdateOfferParams, (_, offer, _) =>
+            {
+                update.WriteOffer(offer);
+                return ValueTask.CompletedTask;
+            })
+            .OnNotify(MoShiroMethods.UpdateApply, MoShiroJsonContext.Default.UpdateOfferParams, (_, _, _) =>
+            {
+                update.RequestApply();
+                return ValueTask.CompletedTask;
+            })
+            .OnNotify(MoShiroMethods.Schedule, MoShiroJsonContext.Default.ScheduleParams, (_, schedule, _) =>
+            {
+                if (restart is not null && !restart.SetRemote(schedule.RestartAt))
+                {
+                    log.Warn("ignoring an invalid restart schedule from the panel");
+                }
+
+                return ValueTask.CompletedTask;
+            });
+        _link = new FleetLink(options, router, [list], new Outbox(1 << 20), time, log);
+    }
+
+    /// <summary>到面板的连接（测试和状态查看用）。</summary>
+    public FleetLink Link => _link;
+
+    public AgentDirectory Directory => _env.Directory;
+
+    /// <summary>某个 Agent 的会话是否已经建立（测试和状态查看用）。</summary>
+    public bool IsConnected(string agentId, string ipVersion = IpVersions.V4)
+    {
+        lock (_connections)
+        {
+            return _connections.TryGetValue(agentId + "~" + ipVersion, out Running? running) && running.Connection.IsConnected;
+        }
+    }
+
+    public AgentConnection? Connection(string agentId, string ipVersion = IpVersions.V4)
+    {
+        lock (_connections)
+        {
+            return _connections.TryGetValue(agentId + "~" + ipVersion, out Running? running) ? running.Connection : null;
+        }
+    }
+
+    public async Task RunAsync(CancellationToken ct)
+    {
+        if (_env.Directory.Agents.Count == 0)
+        {
+            _log.Info("no agents known yet, waiting for the panel to send the list");
+        }
+
+        Task link = _link.RunAsync(ct);
+        try
+        {
+            while (!ct.IsCancellationRequested)
+            {
+                await ReconcileAsync(_env.Directory.Agents, ct);
+                await _changed.WaitAsync(ct);
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            // 停止
+        }
+        finally
+        {
+            await ReconcileAsync([], CancellationToken.None);
+            await Task.WhenAny(link, Task.Delay(TimeSpan.FromSeconds(5), CancellationToken.None));
+        }
+    }
+
+    public void Dispose()
+    {
+        _env.Identity.Dispose();
+        _changed.Dispose();
+    }
+
+    private async Task ReconcileAsync(IReadOnlyList<KnownAgent> agents, CancellationToken ct)
+    {
+        var wanted = agents.ToDictionary(a => a.PathKey);
+        var stopped = new List<Running>();
+        lock (_connections)
+        {
+            foreach ((string id, Running running) in _connections.ToList())
+            {
+                if (!wanted.TryGetValue(id, out KnownAgent? endpoint) || !AgentDirectory.Equal(endpoint, running.Connection.Endpoint))
+                {
+                    stopped.Add(running);
+                    _connections.Remove(id);
+                }
+            }
+        }
+
+        foreach (Running running in stopped)
+        {
+            await running.StopAsync();
+        }
+
+        if (ct.IsCancellationRequested)
+        {
+            return;
+        }
+
+        lock (_connections)
+        {
+            foreach ((string id, KnownAgent endpoint) in wanted)
+            {
+                if (!_connections.ContainsKey(id))
+                {
+                    _connections[id] = Running.Start(new AgentConnection(endpoint, _env));
+                }
+            }
+        }
+    }
+
+    private sealed class Running : IDisposable
+    {
+        private readonly CancellationTokenSource _cts = new();
+        private Task _run = Task.CompletedTask;
+
+        private Running(AgentConnection connection)
+        {
+            Connection = connection;
+        }
+
+        public AgentConnection Connection { get; }
+
+        public static Running Start(AgentConnection connection)
+        {
+            var running = new Running(connection);
+            running._run = Task.Run(() => connection.RunAsync(running._cts.Token), CancellationToken.None);
+            return running;
+        }
+
+        public async Task StopAsync()
+        {
+            await _cts.CancelAsync();
+            try
+            {
+                await _run.WaitAsync(TimeSpan.FromSeconds(10));
+            }
+            catch (Exception ex) when (ex is OperationCanceledException or TimeoutException)
+            {
+                // 没有及时退出：不再等
+            }
+
+            Dispose();
+        }
+
+        public void Dispose() => _cts.Dispose();
+    }
+}
@@ -0,0 +1,83 @@
+using System.Text.Json.Serialization;
+using MoShiro.Protocol;
+
+namespace MoShiro.Probe;
+
+/// <summary>
+/// <c>probe.json</c>：本地配置，和 Agent 一样由 <c>fleet-enroll</c> 注册之后写出身份目录（节点自己生成的两把密钥），这里只放面板地址和本地硬上限。
+/// <c>limits</c> 是本地硬上限，面板无法修改；在路由器上建议调低，避免 Probe 自己的 CPU 成为瓶颈、反过来影响测量。
+/// </summary>
+public sealed class ProbeFile
+{
+    [JsonPropertyName("fleet")]
+    public ProbeFleetSection Fleet { get; set; } = new();
+
+    /// <summary>每天定时重启一次，例如 <c>04:00+08:00</c>（不写偏移按 UTC）；不写就不重启。环境变量 <c>MOSHIRO_RESTART_AT</c> 优先；这里是本地配置，从面板重新下载 probe.json 会丢掉它，所以容器里推荐用环境变量。</summary>
+    [JsonPropertyName("restart_at")]
+    public string? RestartAt { get; set; }
+
+    [JsonPropertyName("limits")]
+    public ProbeLimits Limits { get; set; } = new();
+}
+
+public sealed class ProbeFleetSection
+{
+    /// <summary>面板的地址（http 或 https）。Probe 直接连它：身份、Agent 列表、更新都从这里来。</summary>
+    [JsonPropertyName("server")]
+    public string Server { get; set; } = "";
+
+    /// <summary><c>fleet-enroll</c> 写出的身份目录：<c>node.json</c>、<c>node.key</c>（连面板的密钥）、<c>tls.pfx</c>（对等面的密钥）。</summary>
+    [JsonPropertyName("identity_dir")]
+    public string IdentityDir { get; set; } = "/etc/moshiro/probe-id";
+
+    /// <summary>节点自己要求有属主（passkey）：没有就不运行。见 <c>OwnerGuard</c>（Agent 和 Probe 共用）。</summary>
+    [JsonPropertyName("require_owner")]
+    public bool RequireOwner { get; set; } = true;
+}
+
+public sealed class KnownAgent
+{
+    [JsonPropertyName("ip_version")]
+    public string IpVersion { get; set; } = IpVersions.V4;
+
+    [JsonIgnore]
+    public string PathKey => AgentId + "~" + IpVersion;
+
+    [JsonPropertyName("agent_id")]
+    public string AgentId { get; set; } = "";
+
+    [JsonPropertyName("host")]
+    public string Host { get; set; } = "";
+
+    [JsonPropertyName("tcp_port")]
+    public int TcpPort { get; set; }
+
+    /// <summary>Agent 的 TLS 证书公钥（SPKI，base64）：证书按它的 SHA-256 指纹固定，敲门密钥由它派生。</summary>
+    [JsonPropertyName("public_key")]
+    public string PublicKey { get; set; } = "";
+}
+
+public sealed class ProbeLimits
+{
+    /// <summary>按需测试里单个阶段允许的最大码率（Mbit/s）。</summary>
+    [JsonPropertyName("max_test_mbps")]
+    public double MaxTestMbps { get; set; } = 100;
+
+    /// <summary>按需测试里单个阶段允许的最大包速率。</summary>
+    [JsonPropertyName("max_total_pps")]
+    public long MaxTotalPps { get; set; } = 20_000;
+}
+
+[JsonSerializable(typeof(ProbeFile))]
+[JsonSerializable(typeof(AgentsCache))]
+public sealed partial class ProbeConfigContext : JsonSerializerContext;
+
+/// <summary><c>agents.json</c>：最近一次从面板同步到的 Agent 列表（配置，不是测量数据）；面板连不上时 Probe 靠它继续测量。</summary>
+public sealed class AgentsCache
+{
+    [JsonPropertyName("version")]
+    public long Version { get; set; }
+
+    [JsonPropertyName("agents")]
+    public List<KnownAgent> Agents { get; set; } = [];
+}
@@ -0,0 +1,62 @@
+using Fleet.Core;
+using Fleet.Hosting;
+using MoShiro.Probe;
+
+TimeProvider time = TimeProvider.System;
+INodeLog log = new ConsoleNodeLog(time);
+
+if (PlatformCheck.VerifyCrypto() is { } problem)
+{
+    log.Error("startup failed", ("err", problem));
+    return 1;
+}
+
+string configPath = "/etc/moshiro/probe.json";
+for (int i = 0; i < args.Length - 1; i++)
+{
+    if (args[i] == "--config")
+    {
+        configPath = args[i + 1];
+    }
+}
+
+ProbeFile file;
+LoadedNodeIdentity identity;
+RestartController restart;
+try
+{
+    file = NodeConfig.Load(configPath, ProbeConfigContext.Default.ProbeFile);
+    restart = new RestartController(RestartSchedule.Resolve(file.RestartAt));
+    if (!Uri.TryCreate(file.Fleet.Server, UriKind.Absolute, out _))
+    {
+        throw new InvalidOperationException("probe.json needs fleet.server (the panel address)");
+    }
+
+    identity = LoadedNodeIdentity.Load(file.Fleet.IdentityDir);
+    if (!identity.NodeId.Value.StartsWith(MoShiro.Protocol.ProbeId.Prefix, StringComparison.Ordinal))
+    {
+        identity.Dispose();
+        throw new InvalidOperationException($"the identity in {file.Fleet.IdentityDir} is not a probe's: enroll with a probe join token");
+    }
+
+    if (!OwnerGuard.Check(file.Fleet.IdentityDir, file.Fleet.RequireOwner, log))
+    {
+        identity.Dispose();
+        return 1;
+    }
+}
+catch (Exception ex) when (ex is IOException or InvalidDataException or InvalidOperationException or System.Text.Json.JsonException or System.Security.Cryptography.CryptographicException)
+{
+    log.Error("startup failed", ("err", ex.Message));
+    return 1;
+}
+
+using var restartScope = restart;
+string directory = Path.GetDirectoryName(Path.GetFullPath(configPath))!;
+using (identity)
+{
+    using var app = new ProbeApp(file, identity, directory, time, log, restart);
+    await ServiceShell.RunAsync(app.RunAsync, log, restart, time);
+}
+
+return 0;
@@ -1,20 +0,0 @@
-<Project>
-  <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
-  <Import Project="Sdk.props" Sdk="StuDev.AotAnywhere"
-          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
-  <PropertyGroup>
-    <OutputType>Exe</OutputType>
-    <AssemblyName>monitor-probe</AssemblyName>
-    <RootNamespace>Monitor.Probe</RootNamespace>
-    <IsAotCompatible>true</IsAotCompatible>
-  </PropertyGroup>
-  <ItemGroup>
-    <InternalsVisibleTo Include="Monitor.Backend.Tests" />
-    <ProjectReference Include="..\..\..\fleet\src\Fleet.Link\Fleet.Link.csproj" />
-    <ProjectReference Include="..\..\..\fleet\src\Fleet.Hosting\Fleet.Hosting.csproj" />
-    <ProjectReference Include="..\..\..\shared\Monitor.Measurement\Monitor.Measurement.csproj" />
-  </ItemGroup>
-  <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
-  <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
-          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
-</Project>
@@ -1,154 +0,0 @@
-using Fleet.Core;
-using Fleet.Hosting;
-using Fleet.Identity;
-using Monitor.Measurement;
-
-namespace Monitor.Probe;
-
-/// <summary>
-/// Probe 的组装点：Agent 列表 → 每个 Agent 一个连接（认证、重连、角色）。没有全局状态，测试可以在同一进程里启动多个。
-/// 列表变化时只调和连接：新增的建立，移除的断开，地址或证书指纹变化的重建，其余不受影响。
-/// </summary>
-public sealed class ProbeApp : IDisposable
-{
-    public const string Version = "0.1.0";
-
-    private readonly ConnectionEnv _env;
-    private readonly Dictionary<string, Running> _connections = [];
-    private readonly SemaphoreSlim _changed = new(0);
-    private readonly INodeLog _log;
-
-    public ProbeApp(ProbeFile file, string configDirectory, TimeProvider time, INodeLog log)
-    {
-        _log = log;
-        var directory = new AgentDirectory(new ConfigStore(configDirectory), configDirectory, file, log);
-        NodeIdentity identity = NodeIdentity.FromPkcs8(Convert.FromBase64String(file.PrivateKey));
-        _env = new ConnectionEnv(identity, file.ProbeId, file.Limits, directory, new MonoClock(time), time, log);
-        directory.Changed += () => _changed.Release();
-    }
-
-    public AgentDirectory Directory => _env.Directory;
-
-    /// <summary>某个 Agent 的会话是否已经建立（测试和状态查看用）。</summary>
-    public bool IsConnected(string agentId)
-    {
-        lock (_connections)
-        {
-            return _connections.TryGetValue(agentId, out Running? running) && running.Connection.IsConnected;
-        }
-    }
-
-    public AgentConnection? Connection(string agentId)
-    {
-        lock (_connections)
-        {
-            return _connections.TryGetValue(agentId, out Running? running) ? running.Connection : null;
-        }
-    }
-
-    public async Task RunAsync(CancellationToken ct)
-    {
-        if (_env.Directory.Agents.Count == 0)
-        {
-            _log.Warn("no agents known yet: probe.json has an empty bootstrap list");
-        }
-
-        try
-        {
-            while (!ct.IsCancellationRequested)
-            {
-                await ReconcileAsync(_env.Directory.Agents, ct);
-                await _changed.WaitAsync(ct);
-            }
-        }
-        catch (OperationCanceledException)
-        {
-            // 停止
-        }
-        finally
-        {
-            await ReconcileAsync([], CancellationToken.None);
-        }
-    }
-
-    public void Dispose()
-    {
-        _env.Identity.Dispose();
-        _changed.Dispose();
-    }
-
-    private async Task ReconcileAsync(IReadOnlyList<BootstrapAgent> agents, CancellationToken ct)
-    {
-        var wanted = agents.ToDictionary(a => a.AgentId);
-        var stopped = new List<Running>();
-        lock (_connections)
-        {
-            foreach ((string id, Running running) in _connections.ToList())
-            {
-                if (!wanted.TryGetValue(id, out BootstrapAgent? endpoint) || !AgentDirectory.Equal(endpoint, running.Connection.Endpoint))
-                {
-                    stopped.Add(running);
-                    _connections.Remove(id);
-                }
-            }
-        }
-
-        foreach (Running running in stopped)
-        {
-            await running.StopAsync();
-        }
-
-        if (ct.IsCancellationRequested)
-        {
-            return;
-        }
-
-        lock (_connections)
-        {
-            foreach ((string id, BootstrapAgent endpoint) in wanted)
-            {
-                if (!_connections.ContainsKey(id))
-                {
-                    _connections[id] = Running.Start(new AgentConnection(endpoint, _env));
-                }
-            }
-        }
-    }
-
-    private sealed class Running : IDisposable
-    {
-        private readonly CancellationTokenSource _cts = new();
-        private Task _run = Task.CompletedTask;
-
-        private Running(AgentConnection connection)
-        {
-            Connection = connection;
-        }
-
-        public AgentConnection Connection { get; }
-
-        public static Running Start(AgentConnection connection)
-        {
-            var running = new Running(connection);
-            running._run = Task.Run(() => connection.RunAsync(running._cts.Token), CancellationToken.None);
-            return running;
-        }
-
-        public async Task StopAsync()
-        {
-            await _cts.CancelAsync();
-            try
-            {
-                await _run.WaitAsync(TimeSpan.FromSeconds(10));
-            }
-            catch (Exception ex) when (ex is OperationCanceledException or TimeoutException)
-            {
-                // 没有及时退出：不再等
-            }
-
-            Dispose();
-        }
-
-        public void Dispose() => _cts.Dispose();
-    }
-}
@@ -1,65 +0,0 @@
-using System.Text.Json.Serialization;
-
-namespace Monitor.Probe;
-
-/// <summary>
-/// <c>probe.json</c>：面板 <c>POST /api/admin/probe/identity</c> 生成的文件（只能下载一次）。
-/// <c>limits</c> 是本地硬上限，面板无法修改；在路由器上建议调低，避免 Probe 自己的 CPU 成为瓶颈、反过来影响测量。
-/// </summary>
-public sealed class ProbeFile
-{
-    [JsonPropertyName("probe_id")]
-    public string ProbeId { get; set; } = "";
-
-    /// <summary>PKCS#8，base64。</summary>
-    [JsonPropertyName("private_key")]
-    public string PrivateKey { get; set; } = "";
-
-    /// <summary>首次连接用的 Agent；连上之后以 <c>agents.json</c>（最新的列表）为准。</summary>
-    [JsonPropertyName("bootstrap")]
-    public List<BootstrapAgent> Bootstrap { get; set; } = [];
-
-    [JsonPropertyName("limits")]
-    public ProbeLimits Limits { get; set; } = new();
-}
-
-public sealed class BootstrapAgent
-{
-    [JsonPropertyName("agent_id")]
-    public string AgentId { get; set; } = "";
-
-    [JsonPropertyName("host")]
-    public string Host { get; set; } = "";
-
-    [JsonPropertyName("tcp_port")]
-    public int TcpPort { get; set; }
-
-    /// <summary>Agent 的 TLS 证书指纹（SHA-256，base64）。</summary>
-    [JsonPropertyName("spki")]
-    public string Spki { get; set; } = "";
-}
-
-public sealed class ProbeLimits
-{
-    /// <summary>按需测试里单个阶段允许的最大码率（Mbit/s）。</summary>
-    [JsonPropertyName("max_test_mbps")]
-    public double MaxTestMbps { get; set; } = 100;
-
-    /// <summary>按需测试里单个阶段允许的最大包速率。</summary>
-    [JsonPropertyName("max_total_pps")]
-    public long MaxTotalPps { get; set; } = 20_000;
-}
-
-[JsonSerializable(typeof(ProbeFile))]
-[JsonSerializable(typeof(AgentsCache))]
-public sealed partial class ProbeConfigContext : JsonSerializerContext;
-
-/// <summary><c>agents.json</c>：最近一次从 Agent 同步到的列表（配置，不是测量数据）。</summary>
-public sealed class AgentsCache
-{
-    [JsonPropertyName("version")]
-    public long Version { get; set; }
-
-    [JsonPropertyName("agents")]
-    public List<BootstrapAgent> Agents { get; set; } = [];
-}
@@ -1,50 +0,0 @@
-using Fleet.Core;
-using Fleet.Hosting;
-using Monitor.Probe;
-
-TimeProvider time = TimeProvider.System;
-INodeLog log = new ConsoleNodeLog(time);
-
-if (PlatformCheck.VerifyCrypto() is { } problem)
-{
-    log.Error("startup failed", ("err", problem));
-    return 1;
-}
-
-string configPath = "/etc/monitor/probe.json";
-for (int i = 0; i < args.Length - 1; i++)
-{
-    if (args[i] == "--config")
-    {
-        configPath = args[i + 1];
-    }
-}
-
-ProbeFile file;
-try
-{
-    file = NodeConfig.Load(configPath, ProbeConfigContext.Default.ProbeFile);
-    if (file.ProbeId.Length == 0 || file.PrivateKey.Length == 0)
-    {
-        throw new InvalidOperationException("probe.json needs probe_id and private_key (download it from the panel: POST /api/admin/probe/identity)");
-    }
-}
-catch (Exception ex) when (ex is IOException or InvalidDataException or InvalidOperationException or System.Text.Json.JsonException)
-{
-    log.Error("startup failed", ("err", ex.Message));
-    return 1;
-}
-
-string directory = Path.GetDirectoryName(Path.GetFullPath(configPath))!;
-try
-{
-    using var app = new ProbeApp(file, directory, time, log);
-    await ServiceShell.RunAsync(app.RunAsync, log);
-}
-catch (Exception ex) when (ex is FormatException or System.Security.Cryptography.CryptographicException)
-{
-    log.Error("startup failed", ("err", "private_key is not a valid PKCS#8 key: " + ex.Message));
-    return 1;
-}
-
-return 0;
@@ -5,7 +5,7 @@
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="xunit.v3" />
-    <ProjectReference Include="..\..\src\Monitor.Probe\Monitor.Probe.csproj" />
+    <ProjectReference Include="..\..\src\MoShiro.Probe\MoShiro.Probe.csproj" />
  </ItemGroup>
  <ItemGroup>
    <Using Include="Xunit" />
@@ -1,11 +1,36 @@
 using Fleet.Core;
 using Fleet.Hosting;
-using Monitor.Protocol;
+using MoShiro.Protocol;

-namespace Monitor.Probe.Tests;
+namespace MoShiro.Probe.Tests;

 public sealed class ProbeTests
 {
+    [Fact]
+    public void AgentDirectory_DualStack_PersistsBothPaths_AndRemovingIpv6KeepsIpv4()
+    {
+        string directory = NewDirectory();
+        try
+        {
+            var agents = new AgentDirectory(new ConfigStore(directory), directory, NullNodeLog.Instance);
+            ProbeAgentList list = List(1, "agt_dual");
+            list.Agents[0].Ipv6Host = "2001:db8::1";
+            agents.Apply(list);
+            Assert.Equal(new[] { "ipv4", "ipv6" }, agents.Agents.Select(a => a.IpVersion));
+            var reloaded = new AgentDirectory(new ConfigStore(directory), directory, NullNodeLog.Instance);
+            Assert.Equal(2, reloaded.Agents.Count);
+            Assert.Equal("2001:db8::1", reloaded.Agents[1].Host);
+            list.Version = 2;
+            list.Agents[0].Ipv6Host = null;
+            reloaded.Apply(list);
+            Assert.Equal("ipv4", Assert.Single(reloaded.Agents).IpVersion);
+        }
+        finally
+        {
+            Directory.Delete(directory, recursive: true);
+        }
+    }
+
    [Fact]
    public void ClockEstimator_UsesTheSampleWithTheShortestRoundTrip()
    {
@@ -30,23 +55,22 @@ public sealed class ProbeTests
        return path;
    }

-    private static ProbeAgentsResult List(long version, params string[] ids) => new()
+    private static ProbeAgentList List(long version, params string[] ids) => new()
    {
        Version = version,
-        Agents = [.. ids.Select(id => new AgentEndpoint { AgentId = new NodeId(id), Host = id + ".example", TcpPort = 7443, Spki = "c3BraQ==" })],
+        Agents = [.. ids.Select(id => new AgentEndpoint { AgentId = new NodeId(id), Host = id + ".example", TcpPort = 7443, PublicKey = "c3BraQ==" })],
    };

    [Fact]
-    public void AgentDirectory_StartsFromBootstrap_IgnoresStaleLists_PersistsChanges_AndReloadsThem()
+    public void AgentDirectory_StartsEmpty_IgnoresStaleLists_PersistsChanges_AndReloadsThem()
    {
        string directory = NewDirectory();
        try
        {
-            var file = new ProbeFile { ProbeId = "prb_x", Bootstrap = [new BootstrapAgent { AgentId = "agt_boot", Host = "boot.example", TcpPort = 7443, Spki = "c3BraQ==" }] };
-            var directoryA = new AgentDirectory(new ConfigStore(directory), directory, file, NullNodeLog.Instance);
+            var directoryA = new AgentDirectory(new ConfigStore(directory), directory, NullNodeLog.Instance);
            int changes = 0;
            directoryA.Changed += () => changes++;
-            Assert.Equal(["agt_boot"], directoryA.Agents.Select(a => a.AgentId));
+            Assert.Empty(directoryA.Agents);

            directoryA.Apply(List(5, "agt_1", "agt_2"));
            Assert.Equal(1, changes);
@@ -57,8 +81,8 @@ public sealed class ProbeTests
            Assert.Equal(1, changes);
            Assert.Equal(5, directoryA.Version);

-            // The next start uses the saved list, not the bootstrap one
-            var directoryB = new AgentDirectory(new ConfigStore(directory), directory, file, NullNodeLog.Instance);
+            // The next start uses the saved list while the panel is not reachable yet
+            var directoryB = new AgentDirectory(new ConfigStore(directory), directory, NullNodeLog.Instance);
            Assert.Equal(["agt_1", "agt_2"], directoryB.Agents.Select(a => a.AgentId));
            Assert.Equal(5, directoryB.Version);
        }
@@ -69,15 +93,30 @@ public sealed class ProbeTests
    }

    [Fact]
-    public void AgentDirectory_FallsBackToBootstrap_WhenTheSavedFileIsCorrupt()
+    public void AgentDirectory_StartsEmpty_WhenTheSavedFileIsCorrupt()
    {
        string directory = NewDirectory();
        try
        {
            new ConfigStore(directory).Write(AgentDirectory.FileName, "{ not json"u8.ToArray());
-            var file = new ProbeFile { Bootstrap = [new BootstrapAgent { AgentId = "agt_boot", Host = "h", TcpPort = 1, Spki = "AA==" }] };
-            var loaded = new AgentDirectory(new ConfigStore(directory), directory, file, NullNodeLog.Instance);
-            Assert.Equal(["agt_boot"], loaded.Agents.Select(a => a.AgentId));
+            var loaded = new AgentDirectory(new ConfigStore(directory), directory, NullNodeLog.Instance);
+            Assert.Empty(loaded.Agents);
+        }
+        finally
+        {
+            Directory.Delete(directory, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void ConfigStore_CreatesSubdirectories_ForFreshVolumes()
+    {
+        // 新建的命名卷里没有 update/：面板转来的更新清单要能写进去
+        string directory = NewDirectory();
+        try
+        {
+            new ConfigStore(directory).Write("update/offer.manifest", "{}"u8.ToArray());
+            Assert.True(File.Exists(Path.Combine(directory, "update", "offer.manifest")));
        }
        finally
        {
@@ -1,7 +1,7 @@
 using System.Net;
-using Monitor.Protocol;
+using MoShiro.Protocol;

-namespace Monitor.Measurement;
+namespace MoShiro.Measurement;

 /// <summary>积木的公共部分：环境、参数、把行切成列块交出去。</summary>
 public abstract class BlockBase : IBlock