feat: 支持链路 mTLS 证书认证及身份持久化与 AgentServer 证书注入-agent-runtime-AtomGit

Mapplications/agent_runtime/agent_runtime.server.env.example+8-0

	@@ -39,3 +39,11 @@ AGENT_RUNTIME_DEFAULT_NAMESPACE=default
39	# AGENT_RUNTIME_EVAL_LLM_MAX_TOKENS=16384	39	# AGENT_RUNTIME_EVAL_LLM_MAX_TOKENS=16384
40	# AGENT_RUNTIME_EVAL_LLM_DISABLE_THINKING=false	40	# AGENT_RUNTIME_EVAL_LLM_DISABLE_THINKING=false
41	# AGENT_RUNTIME_EVAL_POD_BUDGET=0	41	# AGENT_RUNTIME_EVAL_POD_BUDGET=0
		42	+
		43	+# ---- 内部 HTTP/SSE 链路 mTLS（默认关闭，保持现有 HTTP）----
		44	+# 未设置或 off 均不启用。仅显式 enforce 启用 HTTPS/mTLS；observe 只做预检。
		45	+# 通过配套 deploy.sh 部署时，在 .env.custom 设置同名开关，由工具注入各组件。
		46	+JIUWENSWARM_LINK_MTLS_MODE=off
		47	+# 证书、绑定 ID/epoch、AgentServer Secret、headless DNS 及挂载路径由部署层管理。
		48	+# 不需要手工填写 CA/CERT/KEY 路径，也不要通过修改 ID/epoch 实现换证。
		49	+# 使用说明：docs/zh/内部链路mTLS接入.md

Mapplications/agent_runtime/src/agent_runtime/cli.py+4-1

	@@ -40,6 +40,7 @@ def main(argv: Sequence[str] \| None = None) -> None:
40	from openjiuwen_runtime.service.config import ServiceConfig	40	from openjiuwen_runtime.service.config import ServiceConfig
41		41
42	from .config import AgentRuntimeConfig	42	from .config import AgentRuntimeConfig
		43	+ from .link_mtls import LinkMTLSConfig
43	from .logsetup import configure_logging	44	from .logsetup import configure_logging
44	from .main import create_app	45	from .main import create_app
45		46
	@@ -49,7 +50,8 @@ def main(argv: Sequence[str] \| None = None) -> None:
49		50
50	settings = ServiceConfig.from_env()	51	settings = ServiceConfig.from_env()
51	arc = AgentRuntimeConfig.from_env()	52	arc = AgentRuntimeConfig.from_env()
52	- application = create_app(settings, arc)	53	+ link_mtls = LinkMTLSConfig.from_env()
		54	+ application = create_app(settings, arc, link_mtls_config=link_mtls)
53		55
54	import uvicorn	56	import uvicorn
55		57
	@@ -58,6 +60,7 @@ def main(argv: Sequence[str] \| None = None) -> None:
58	host=settings.host,	60	host=settings.host,
59	port=settings.port,	61	port=settings.port,
60	log_level=os.getenv("AGENT_RUNTIME_LOG_LEVEL", "info").strip().lower(),	62	log_level=os.getenv("AGENT_RUNTIME_LOG_LEVEL", "info").strip().lower(),
		63	+ **link_mtls.uvicorn_ssl_kwargs(),
61	)	64	)
62		65
63		66

Aapplications/agent_runtime/src/agent_runtime/link_binding_state.py+140-0

@@ -0,0 +1,140 @@
	1	+# coding: utf-8
	2	+"""Runtime 本地证书绑定状态的持久化模型，与 Identity Center 无关。
	3	+
	4	+本模块仅映射 Runtime 的公开状态，不映射部署专用敏感列。
	5	+完整材料由部署工具保存在 Gateway 库，Runtime 库不保存各角色私钥。
	6	+"""
	7	+
	8	+from __future__ import annotations
	9	+
	10	+from pathlib import Path
	11	+from typing import Any
	12	+
	13	+from openjiuwen_runtime.foundation.db.table_def import (
	14	+ ColumnDefinition,
	15	+ IndexDefinition,
	16	+ TableDefinition,
	17	+)
	18	+from openjiuwen_runtime.foundation.security.link_material_store import (
	19	+ assert_binding_state_compatible,
	20	+ assert_managed_state,
	21	+)
	22	+
	23	+from .link_mtls import LinkMTLSConfig, LinkMTLSError, LinkMTLSMode
	24	+from .util import utc_now
	25	+
	26	+LINK_BINDING_STATE_TABLE = "link_binding_state"
	27	+LOCAL_SERVICE_ROLE = "runtime"
	28	+PROTOCOL_VERSION = "0.0.1"
	29	+
	30	+LINK_BINDING_STATE_TABLE_DEF = TableDefinition(
	31	+ table_name=LINK_BINDING_STATE_TABLE,
	32	+ columns=[
	33	+ ColumnDefinition(
	34	+ "service_role", "string", length=32, primary_key=True, nullable=False
	35	+ ),
	36	+ ColumnDefinition("mtls_deployment_id", "string", length=64, nullable=False),
	37	+ ColumnDefinition("mtls_binding_id", "string", length=64, nullable=False),
	38	+ ColumnDefinition("protocol_version", "string", length=32, nullable=False),
	39	+ ColumnDefinition("mtls_binding_epoch", "integer", nullable=False),
	40	+ ColumnDefinition("local_cert_pem", "text", nullable=False),
	41	+ ColumnDefinition(
	42	+ "local_cert_fingerprint", "string", length=128, nullable=False
	43	+ ),
	44	+ ColumnDefinition("private_key_ref", "string", length=512, nullable=False),
	45	+ ColumnDefinition("peer_trust_bundle_pem", "text", nullable=False),
	46	+ ColumnDefinition(
	47	+ "agentserver_secret_ref", "string", length=253, nullable=False
	48	+ ),
	49	+ ColumnDefinition(
	50	+ "status", "string", length=32, nullable=False, default="active"
	51	+ ),
	52	+ ColumnDefinition("created_at", "datetime", nullable=False),
	53	+ ColumnDefinition("updated_at", "datetime", nullable=False),
	54	+ ],
	55	+ indexes=[
	56	+ IndexDefinition(
	57	+ ["mtls_deployment_id"],
	58	+ unique=True,
	59	+ name="uq_link_binding_state_mtls_deployment_id",
	60	+ ),
	61	+ IndexDefinition(
	62	+ ["mtls_binding_id"],
	63	+ unique=True,
	64	+ name="uq_link_binding_state_mtls_binding_id",
	65	+ ),
	66	+ IndexDefinition(["status"], unique=False, name="ix_link_binding_state_status"),
	67	+ ],
	68	+)
	69	+
	70	+
	71	+async def sync_local_link_binding_state(db: Any, config: LinkMTLSConfig) -> Any \| None:
	72	+ """把当前生效的公开身份幂等写入 DB；``off`` 不产生任何记录。"""
	73	+ if config.mode is LinkMTLSMode.OFF:
	74	+ return None
	75	+ if not config.identity or not config.cert_file or not config.ca_file:
	76	+ # observe 允许只做不完整预检，不制造半条身份记录。
	77	+ return None
	78	+
	79	+ now = utc_now()
	80	+ payload = {
	81	+ "service_role": "runtime",
	82	+ "mtls_deployment_id": config.identity.mtls_deployment_id,
	83	+ "mtls_binding_id": config.identity.mtls_binding_id,
	84	+ "protocol_version": PROTOCOL_VERSION,
	85	+ "mtls_binding_epoch": config.identity.mtls_binding_epoch,
	86	+ "local_cert_pem": Path(config.cert_file).read_text(encoding="utf-8"),
	87	+ "local_cert_fingerprint": config.cert_fingerprint(),
	88	+ "private_key_ref": config.key_file or "",
	89	+ "peer_trust_bundle_pem": Path(config.ca_file).read_text(encoding="utf-8"),
	90	+ "agentserver_secret_ref": config.agentserver_secret,
	91	+ "status": "active",
	92	+ "updated_at": now,
	93	+ }
	94	+ row = await db.get(LINK_BINDING_STATE_TABLE, {"service_role": LOCAL_SERVICE_ROLE})
	95	+ managed = await assert_managed_state(
	96	+ db,
	97	+ LOCAL_SERVICE_ROLE,
	98	+ config.identity,
	99	+ payload["local_cert_fingerprint"],
	100	+ required=bool(
	101	+ config.profile and config.profile.current().get("persistence") == "database"
	102	+ ),
	103	+ )
	104	+ if managed:
	105	+ return (
	106	+ row # Deployment owns the authorized state; service startup is read-only.
	107	+ )
	108	+ assert_binding_state_compatible(
	109	+ row, config.identity, payload["local_cert_fingerprint"]
	110	+ )
	111	+ if row is None:
	112	+ return await db.create(
	113	+ LINK_BINDING_STATE_TABLE,
	114	+ {"created_at": now, **payload},
	115	+ )
	116	+ previous_epoch = int(getattr(row, "mtls_binding_epoch", 0) or 0)
	117	+ filters = {"service_role": LOCAL_SERVICE_ROLE}
	118	+ if hasattr(row, "mtls_binding_epoch"):
	119	+ filters["mtls_binding_epoch"] = previous_epoch
	120	+ filters["status"] = getattr(row, "status", "active")
	121	+ updated = await db.update(LINK_BINDING_STATE_TABLE, filters, payload)
	122	+ # DBHandler.update re-reads with the OLD filters, so an epoch change may
	123	+ # return None even after a successful conditional update.
	124	+ if hasattr(row, "mtls_binding_epoch"):
	125	+ updated = await db.get(
	126	+ LINK_BINDING_STATE_TABLE, {"service_role": LOCAL_SERVICE_ROLE}
	127	+ )
	128	+ checked_fields = (
	129	+ "mtls_binding_id",
	130	+ "mtls_binding_epoch",
	131	+ "status",
	132	+ "local_cert_fingerprint",
	133	+ )
	134	+ if updated is None or any(
	135	+ getattr(updated, key, None) != payload.get(key) for key in checked_fields
	136	+ ):
	137	+ raise LinkMTLSError(
	138	+ "link binding state changed concurrently; restart with the current profile"
	139	+ )
	140	+ return updated

Aapplications/agent_runtime/src/agent_runtime/link_mtls.py+218-0

@@ -0,0 +1,218 @@
	1	+# coding: utf-8
	2	+"""Runtime 内部 HTTP/SSE 链路的 mTLS 与实例绑定配置。
	3	+
	4	+默认 ``off`` 保持现有 HTTP、Pod 探针和地址生成逻辑完全不变；``observe``
	5	+只校验证书材料并记录预检结果；只有 ``enforce`` 才启用 HTTPS、双向证书校验、
	6	+绑定头校验及 AgentServer Secret 挂载。
	7	+"""
	8	+
	9	+from __future__ import annotations
	10	+
	11	+import hashlib
	12	+import logging
	13	+import os
	14	+import ssl
	15	+from dataclasses import dataclass
	16	+from pathlib import Path
	17	+from typing import Mapping
	18	+from urllib.parse import urlsplit
	19	+
	20	+from openjiuwen_runtime.foundation.security.link_mtls_config import (
	21	+ CA_FILE_ENV,
	22	+ CERT_FILE_ENV,
	23	+ KEY_FILE_ENV,
	24	+ MODE_ENV,
	25	+ LinkMTLSMode,
	26	+ MTLSDeploymentIdentity,
	27	+)
	28	+from openjiuwen_runtime.foundation.security.link_profile import (
	29	+ PROFILE_ENV,
	30	+ LinkProfile,
	31	+ LinkProfileError,
	32	+ load_service_identity,
	33	+)
	34	+
	35	+logger = logging.getLogger("agent_runtime.link_mtls")
	36	+
	37	+AGENTSERVER_SECRET_ENV = "AGENT_RUNTIME_LINK_MTLS_AGENTSERVER_SECRET"
	38	+AGENTSERVER_HEADLESS_SERVICE_ENV = "AGENT_RUNTIME_LINK_MTLS_HEADLESS_SERVICE"
	39	+CLUSTER_DOMAIN_ENV = "AGENT_RUNTIME_LINK_MTLS_CLUSTER_DOMAIN"
	40	+AGENTSERVER_MOUNT_DIR_ENV = "AGENT_RUNTIME_LINK_MTLS_MOUNT_DIR"
	41	+
	42	+DEFAULT_HEADLESS_SERVICE = "jiuwenclaw-agentserver"
	43	+DEFAULT_CLUSTER_DOMAIN = "cluster.local"
	44	+DEFAULT_MOUNT_DIR = "/etc/jiuwenswarm/link-mtls"
	45	+
	46	+
	47	+LinkMTLSError = LinkProfileError
	48	+
	49	+
	50	+def _env(name: str) -> str:
	51	+ return (os.getenv(name) or "").strip()
	52	+
	53	+
	54	+@dataclass(frozen=True)
	55	+class LinkMTLSConfig:
	56	+ mode: LinkMTLSMode
	57	+
	58	+ profile: LinkProfile \| None = None
	59	+ ca_file: str \| None = None
	60	+ cert_file: str \| None = None
	61	+ key_file: str \| None = None
	62	+ identity: MTLSDeploymentIdentity \| None = None
	63	+ agentserver_secret: str = ""
	64	+ headless_service: str = DEFAULT_HEADLESS_SERVICE
	65	+ cluster_domain: str = DEFAULT_CLUSTER_DOMAIN
	66	+ mount_dir: str = DEFAULT_MOUNT_DIR
	67	+
	68	+ @classmethod
	69	+ def from_env(cls) -> "LinkMTLSConfig":
	70	+ try:
	71	+ mode = LinkMTLSMode(_env(MODE_ENV) or "off")
	72	+ except ValueError as exc:
	73	+ raise LinkMTLSError(f"{MODE_ENV} must be off, observe or enforce") from exc
	74	+
	75	+ shared = dict(
	76	+ agentserver_secret=_env(AGENTSERVER_SECRET_ENV),
	77	+ headless_service=_env(AGENTSERVER_HEADLESS_SERVICE_ENV)
	78	+ or DEFAULT_HEADLESS_SERVICE,
	79	+ cluster_domain=_env(CLUSTER_DOMAIN_ENV) or DEFAULT_CLUSTER_DOMAIN,
	80	+ mount_dir=_env(AGENTSERVER_MOUNT_DIR_ENV) or DEFAULT_MOUNT_DIR,
	81	+ )
	82	+ if mode is LinkMTLSMode.OFF:
	83	+ return cls(mode=mode, **shared)
	84	+ try:
	85	+ profile = load_service_identity("runtime")
	86	+ except (ValueError, OSError) as exc:
	87	+ if mode is LinkMTLSMode.ENFORCE:
	88	+ raise LinkMTLSError(str(exc)) from exc
	89	+ logger.warning("link mTLS observe preflight failed: %s", exc)
	90	+ return cls(mode=mode, **shared)
	91	+ if mode is LinkMTLSMode.OBSERVE:
	92	+ logger.info(
	93	+ "link mTLS observe material preflight passed; business transport unchanged"
	94	+ )
	95	+ return cls(mode=mode, **shared)
	96	+ return cls(
	97	+ mode=mode,
	98	+ profile=profile,
	99	+ ca_file=profile.ca_file,
	100	+ cert_file=profile.cert_file,
	101	+ key_file=profile.key_file,
	102	+ identity=MTLSDeploymentIdentity(
	103	+ profile.mtls_deployment_id,
	104	+ profile.mtls_binding_id,
	105	+ profile.mtls_binding_epoch,
	106	+ ),
	107	+ **shared,
	108	+ )
	109	+
	110	+ def resolve_endpoint(self, url: str, *, role: str) -> str:
	111	+ if self.profile is not None:
	112	+ return self.profile.endpoint(url, role=role, enforced=self.enforced)
	113	+ self.require_secure_url(url, label=f"{role} URL")
	114	+ return url
	115	+
	116	+ def client_kwargs(self, *, role: str) -> dict:
	117	+ if not self.enforced:
	118	+ return {}
	119	+ if self.profile is None:
	120	+ raise LinkMTLSError("enforce requires a pinned deployment profile")
	121	+ return self.profile.client_kwargs(role=role)
	122	+
	123	+ def authorize_request(self, request) -> None:
	124	+ if self.enforced:
	125	+ if self.profile is None:
	126	+ raise LinkMTLSError("enforce requires a pinned deployment profile")
	127	+ self.profile.authorize(request.scope, request.headers)
	128	+
	129	+ @property
	130	+ def enforced(self) -> bool:
	131	+ return self.mode is LinkMTLSMode.ENFORCE
	132	+
	133	+ def client_ssl_context(self) -> ssl.SSLContext \| None:
	134	+ if not self.ca_file or not self.cert_file or not self.key_file:
	135	+ return None
	136	+ context = ssl.create_default_context(
	137	+ purpose=ssl.Purpose.SERVER_AUTH,
	138	+ cafile=self.ca_file,
	139	+ )
	140	+ context.minimum_version = ssl.TLSVersion.TLSv1_2
	141	+ context.check_hostname = True
	142	+ context.verify_mode = ssl.CERT_REQUIRED
	143	+ context.load_cert_chain(certfile=self.cert_file, keyfile=self.key_file)
	144	+ return context
	145	+
	146	+ def uvicorn_ssl_kwargs(self) -> dict[str, object]:
	147	+ if not self.enforced:
	148	+ return {}
	149	+ if self.profile is None:
	150	+ raise LinkMTLSError("enforce requires a pinned deployment profile")
	151	+ return self.profile.server_kwargs()
	152	+
	153	+ def binding_headers(self) -> dict[str, str]:
	154	+ if self.profile is not None:
	155	+ return self.profile.headers()
	156	+ return self.identity.headers() if self.identity is not None else {}
	157	+
	158	+ def route_metadata(self) -> dict[str, str \| int]:
	159	+ if not self.enforced or self.identity is None:
	160	+ return {}
	161	+ return {
	162	+ "mtls_deployment_id": self.identity.mtls_deployment_id,
	163	+ "mtls_binding_id": self.identity.mtls_binding_id,
	164	+ "mtls_binding_epoch": self.identity.mtls_binding_epoch,
	165	+ }
	166	+
	167	+ def validate_incoming(self, headers: Mapping[str, str]) -> None:
	168	+ if self.enforced:
	169	+ raise LinkMTLSError(
	170	+ "header-only validation is unsafe; use authorize_request with TLS peer scope"
	171	+ )
	172	+
	173	+ def require_secure_url(self, url: str, *, label: str) -> None:
	174	+ if self.enforced and urlsplit(url).scheme.lower() != "https":
	175	+ raise LinkMTLSError(
	176	+ f"{label} must use https:// when {MODE_ENV}=enforce: {url!r}"
	177	+ )
	178	+
	179	+ def agentserver_url(
	180	+ self,
	181	+ *,
	182	+ pod_id: str,
	183	+ namespace: str,
	184	+ port: int,
	185	+ path: str,
	186	+ pod_ip: str,
	187	+ ) -> str:
	188	+ if not self.enforced:
	189	+ return f"http://{pod_ip}:{port}{path}"
	190	+ if self.profile is not None and "agentserver" in self.profile.current().get(
	191	+ "endpoints", {}
	192	+ ):
	193	+ return (
	194	+ self.profile.endpoint("link://agentserver", role="agentserver") + path
	195	+ )
	196	+ hostname = (
	197	+ f"{pod_id}.{self.headless_service}.{namespace}.svc.{self.cluster_domain}"
	198	+ )
	199	+ return f"https://{hostname}:{port}{path}"
	200	+
	201	+ def agentserver_env(self) -> dict[str, str]:
	202	+ if not self.enforced or self.identity is None:
	203	+ return {}
	204	+ mount = self.mount_dir.rstrip("/")
	205	+ return {
	206	+ PROFILE_ENV: f"{mount}/profile.json",
	207	+ MODE_ENV: LinkMTLSMode.ENFORCE.value,
	208	+ CA_FILE_ENV: f"{mount}/ca.crt",
	209	+ CERT_FILE_ENV: f"{mount}/tls.crt",
	210	+ KEY_FILE_ENV: f"{mount}/tls.key",
	211	+ }
	212	+
	213	+ def cert_fingerprint(self) -> str:
	214	+ if not self.cert_file:
	215	+ return ""
	216	+ pem = Path(self.cert_file).read_text(encoding="utf-8")
	217	+ der = ssl.PEM_cert_to_DER_cert(pem)
	218	+ return hashlib.sha256(der).hexdigest()

Mapplications/agent_runtime/src/agent_runtime/main.py+133-39

	@@ -28,8 +28,6 @@ from openjiuwen_runtime.service.config import ServiceConfig
28		28
29	from . import errors as app_errors	29	from . import errors as app_errors
30	from .config import RM_KEY_PREFIX, SERVICE_PREFIX, SM_KEY_PREFIX, AgentRuntimeConfig	30	from .config import RM_KEY_PREFIX, SERVICE_PREFIX, SM_KEY_PREFIX, AgentRuntimeConfig
31	-from .visualization_api import register_visualization_api
32	-from .metrics import MetricsRegistry, request_metrics_middleware
33	from .evaluation.collector import (	31	from .evaluation.collector import (
34	FLUSH_INTERVAL_SEC,	32	FLUSH_INTERVAL_SEC,
35	FLUSH_TIMEOUT_SEC,	33	FLUSH_TIMEOUT_SEC,
	@@ -39,6 +37,12 @@ from .evaluation.collector import (
39	from .evaluation.evaluator import Evaluator	37	from .evaluation.evaluator import Evaluator
40	from .evaluation.llm import LLMClient	38	from .evaluation.llm import LLMClient
41	from .evaluation.state import EvaluationState	39	from .evaluation.state import EvaluationState
		40	+from .link_binding_state import (
		41	+ LINK_BINDING_STATE_TABLE_DEF,
		42	+ sync_local_link_binding_state,
		43	+)
		44	+from .link_mtls import LinkMTLSConfig, LinkMTLSError, LinkMTLSMode
		45	+from .metrics import MetricsRegistry, request_metrics_middleware
42	from .resource_manager.facade import ResourceManagerFacade	46	from .resource_manager.facade import ResourceManagerFacade
43	from .resource_manager.k8s import FakeK8sPodClient, RealK8sPodClient	47	from .resource_manager.k8s import FakeK8sPodClient, RealK8sPodClient
44	from .resource_manager.orchestrator import ResourceOrchestrator	48	from .resource_manager.orchestrator import ResourceOrchestrator
	@@ -55,6 +59,7 @@ from .session_manager.handlers import register_handlers
55	from .session_manager.orchestrator import SessionOrchestrator	59	from .session_manager.orchestrator import SessionOrchestrator
56	from .session_manager.state import SessionState	60	from .session_manager.state import SessionState
57	from .session_manager.sweeper import SessionSweeper	61	from .session_manager.sweeper import SessionSweeper
		62	+from .visualization_api import register_visualization_api
58		63
59	logger = logging.getLogger("agent_runtime")	64	logger = logging.getLogger("agent_runtime")
60		65
	@@ -83,7 +88,9 @@ TICK_TIMEOUTS = {
83		88
84		89
85	def build_resources(	90	def build_resources(
86	- settings: ServiceConfig, arc: AgentRuntimeConfig	91	+ settings: ServiceConfig,
		92	+ arc: AgentRuntimeConfig,
		93	+ link_mtls: LinkMTLSConfig \| None = None,
87	) -> tuple[Any, Any, Any]:	94	) -> tuple[Any, Any, Any]:
88	"""构造共享物理资源（redis client / db handler / k8s client）。	95	"""构造共享物理资源（redis client / db handler / k8s client）。
89		96
	@@ -98,11 +105,16 @@ def build_resources(
98		105
99	redis_client = FakeRedis()	106	redis_client = FakeRedis()
100	# 文件型 SQLite（:memory: 在连接池下会丢表；local 模式仅供开发调试）	107	# 文件型 SQLite（:memory: 在连接池下会丢表；local 模式仅供开发调试）
101	- db = SQLiteHandler(os.getenv("AGENT_RUNTIME_SQLITE_PATH", "./agent_runtime_local.db"))	108	+ db = SQLiteHandler(
		109	+ os.getenv("AGENT_RUNTIME_SQLITE_PATH", "./agent_runtime_local.db")
		110	+ )
102	k8s = FakeK8sPodClient(default_namespace=arc.default_namespace)	111	k8s = FakeK8sPodClient(default_namespace=arc.default_namespace)
103	return redis_client, db, k8s	112	return redis_client, db, k8s
104		113
105	- from openjiuwen_runtime.service.bootstrap import build_db_handler, build_redis_client	114	+ from openjiuwen_runtime.service.bootstrap import (
		115	+ build_db_handler,
		116	+ build_redis_client,
		117	+ )
106		118
107	redis_client = build_redis_client(settings)	119	redis_client = build_redis_client(settings)
108	db = build_db_handler(settings)	120	db = build_db_handler(settings)
	@@ -112,7 +124,9 @@ def build_resources(
112	"（OPENJIUWEN_SERVICE_DB_TYPE=mysql\|postgresql）"	124	"（OPENJIUWEN_SERVICE_DB_TYPE=mysql\|postgresql）"
113	)	125	)
114	k8s = RealK8sPodClient(	126	k8s = RealK8sPodClient(
115	- kubeconfig=arc.kubeconfig, default_namespace=arc.default_namespace	127	+ kubeconfig=arc.kubeconfig,
		128	+ default_namespace=arc.default_namespace,
		129	+ link_mtls_config=link_mtls,
116	)	130	)
117	return redis_client, db, k8s	131	return redis_client, db, k8s
118		132
	@@ -128,6 +142,7 @@ class OrchestratorSystemContext(SystemContext):
128	k8s: Any,	142	k8s: Any,
129	settings: ServiceConfig,	143	settings: ServiceConfig,
130	arc: AgentRuntimeConfig,	144	arc: AgentRuntimeConfig,
		145	+ link_mtls: LinkMTLSConfig \| None = None,
131	instance_id: str \| None = None,	146	instance_id: str \| None = None,
132	owns_resources: bool = True,	147	owns_resources: bool = True,
133	) -> None:	148	) -> None:
	@@ -136,9 +151,12 @@ class OrchestratorSystemContext(SystemContext):
136	db=db,	151	db=db,
137	settings=settings,	152	settings=settings,
138	key_prefix=SM_KEY_PREFIX,	153	key_prefix=SM_KEY_PREFIX,
139	- table_definitions=[SERVICE_CONFIG_TEMPLATE_TABLE_DEF,	154	+ table_definitions=[
140	- SERVICE_CONFIG_CONTAINER_TABLE_DEF,	155	+ SERVICE_CONFIG_TEMPLATE_TABLE_DEF,
141	- ROUTING_SCOPE_TABLE_DEF],	156	+ SERVICE_CONFIG_CONTAINER_TABLE_DEF,
		157	+ ROUTING_SCOPE_TABLE_DEF,
		158	+ LINK_BINDING_STATE_TABLE_DEF,
		159	+ ],
142	instance_id=instance_id,	160	instance_id=instance_id,
143	_owns_db=owns_resources,	161	_owns_db=owns_resources,
144	_owns_redis=owns_resources,	162	_owns_redis=owns_resources,
	@@ -158,6 +176,7 @@ class OrchestratorSystemContext(SystemContext):
158	_owns_redis=False,	176	_owns_redis=False,
159	)	177	)
160	self.arc = arc	178	self.arc = arc
		179	+ self.link_mtls = link_mtls or LinkMTLSConfig.from_env()
161	self.k8s = k8s	180	self.k8s = k8s
162	self._jobs: list[Any] = []	181	self._jobs: list[Any] = []
163	self._bind_modules()	182	self._bind_modules()
	@@ -175,11 +194,14 @@ class OrchestratorSystemContext(SystemContext):
175		194
176	self.sm_facade = SessionManagerFacade(sm_state)	195	self.sm_facade = SessionManagerFacade(sm_state)
177		196
178	- rm_orchestrator = ResourceOrchestrator(rm_state, self.k8s, telemetry=telemetry)	197	+ rm_orchestrator = ResourceOrchestrator(
		198	+ rm_state, self.k8s, telemetry=telemetry, link_mtls_config=self.link_mtls
		199	+ )
179	self.rm_facade = ResourceManagerFacade(rm_orchestrator)	200	self.rm_facade = ResourceManagerFacade(rm_orchestrator)
180		201
181	self.sm_config_store = ConfigStore(	202	self.sm_config_store = ConfigStore(
182	- self.db, sm_state,	203	+ self.db,
		204	+ sm_state,
183	push_pool_config=self.rm_facade.update_pool_config,	205	push_pool_config=self.rm_facade.update_pool_config,
184	known_rm_scopes=self.rm_facade.known_scope_ids,	206	known_rm_scopes=self.rm_facade.known_scope_ids,
185	bump_generation=self.rm_facade.bump_generation,	207	bump_generation=self.rm_facade.bump_generation,
	@@ -193,17 +215,25 @@ class OrchestratorSystemContext(SystemContext):
193	)	215	)
194	self.sm_sweeper = SessionSweeper(sm_state, self.rm_facade)	216	self.sm_sweeper = SessionSweeper(sm_state, self.rm_facade)
195	self.rm_sweeper = ResourceSweeper(	217	self.rm_sweeper = ResourceSweeper(
196	- rm_state, self.k8s, self.sm_facade, orchestrator=rm_orchestrator,	218	+ rm_state,
		219	+ self.k8s,
		220	+ self.sm_facade,
		221	+ orchestrator=rm_orchestrator,
197	event_sink=eval_state.bump_event,	222	event_sink=eval_state.bump_event,
198	)	223	)
199	self.eval_state = eval_state	224	self.eval_state = eval_state
200	self.eval_telemetry = telemetry	225	self.eval_telemetry = telemetry
201	self.eval_collector = EvaluationCollector(	226	self.eval_collector = EvaluationCollector(
202	- eval_state=eval_state, sm_state=sm_state, rm_state=rm_state,	227	+ eval_state=eval_state,
		228	+ sm_state=sm_state,
		229	+ rm_state=rm_state,
203	)	230	)
204	self.evaluator = Evaluator(	231	self.evaluator = Evaluator(
205	- collector=self.eval_collector, llm=LLMClient.from_arc(self.arc),	232	+ collector=self.eval_collector,
206	- state=eval_state, arc=self.arc, instance_id=self.instance_id,	233	+ llm=LLMClient.from_arc(self.arc),
		234	+ state=eval_state,
		235	+ arc=self.arc,
		236	+ instance_id=self.instance_id,
207	)	237	)
208	self._telemetry_task: asyncio.Task \| None = None	238	self._telemetry_task: asyncio.Task \| None = None
209		239
	@@ -212,43 +242,51 @@ class OrchestratorSystemContext(SystemContext):
212	arc = self.arc	242	arc = self.arc
213	jobs = [	243	jobs = [
214	self.create_single_leader_job(	244	self.create_single_leader_job(
215	- name="sm_sweep", on_tick=self.sm_sweeper.sweep_once,	245	+ name="sm_sweep",
216	- interval_sec=arc.sweep_interval, lock_key="agent_runtime:job:sm_sweep",	246	+ on_tick=self.sm_sweeper.sweep_once,
		247	+ interval_sec=arc.sweep_interval,
		248	+ lock_key="agent_runtime:job:sm_sweep",
217	tick_timeout_sec=TICK_TIMEOUTS["sm_sweep"],	249	tick_timeout_sec=TICK_TIMEOUTS["sm_sweep"],
218	),	250	),
219	self.rm_sysctx.create_single_leader_job(	251	self.rm_sysctx.create_single_leader_job(
220	- name="rm_autoscale", on_tick=self.rm_sweeper.autoscale_once,	252	+ name="rm_autoscale",
		253	+ on_tick=self.rm_sweeper.autoscale_once,
221	interval_sec=arc.autoscale_interval,	254	interval_sec=arc.autoscale_interval,
222	lock_key="agent_runtime:job:rm_autoscale",	255	lock_key="agent_runtime:job:rm_autoscale",
223	tick_timeout_sec=TICK_TIMEOUTS["rm_autoscale"],	256	tick_timeout_sec=TICK_TIMEOUTS["rm_autoscale"],
224	),	257	),
225	self.rm_sysctx.create_single_leader_job(	258	self.rm_sysctx.create_single_leader_job(
226	- name="rm_reclaim", on_tick=self.rm_sweeper.reclaim_once,	259	+ name="rm_reclaim",
		260	+ on_tick=self.rm_sweeper.reclaim_once,
227	interval_sec=arc.reclaim_interval,	261	interval_sec=arc.reclaim_interval,
228	lock_key="agent_runtime:job:rm_reclaim",	262	lock_key="agent_runtime:job:rm_reclaim",
229	tick_timeout_sec=TICK_TIMEOUTS["rm_reclaim"],	263	tick_timeout_sec=TICK_TIMEOUTS["rm_reclaim"],
230	),	264	),
231	self.rm_sysctx.create_single_leader_job(	265	self.rm_sysctx.create_single_leader_job(
232	- name="rm_watch", on_tick=self.rm_sweeper.watch_once,	266	+ name="rm_watch",
		267	+ on_tick=self.rm_sweeper.watch_once,
233	interval_sec=arc.watch_interval,	268	interval_sec=arc.watch_interval,
234	lock_key="agent_runtime:job:rm_watch",	269	lock_key="agent_runtime:job:rm_watch",
235	tick_timeout_sec=TICK_TIMEOUTS["rm_watch"],	270	tick_timeout_sec=TICK_TIMEOUTS["rm_watch"],
236	),	271	),
237	self.rm_sysctx.create_single_leader_job(	272	self.rm_sysctx.create_single_leader_job(
238	- name="rm_reconcile", on_tick=self.rm_sweeper.reconcile_once,	273	+ name="rm_reconcile",
		274	+ on_tick=self.rm_sweeper.reconcile_once,
239	interval_sec=arc.reconcile_interval,	275	interval_sec=arc.reconcile_interval,
240	lock_key="agent_runtime:job:rm_reconcile",	276	lock_key="agent_runtime:job:rm_reconcile",
241	tick_timeout_sec=TICK_TIMEOUTS["rm_reconcile"],	277	tick_timeout_sec=TICK_TIMEOUTS["rm_reconcile"],
242	),	278	),
243	# 系统自评估(sys_eval 全局单副本产报告,任意副本可读):	279	# 系统自评估(sys_eval 全局单副本产报告,任意副本可读):
244	self.create_single_leader_job(	280	self.create_single_leader_job(
245	- name="sys_sample", on_tick=self.eval_collector.sample_once,	281	+ name="sys_sample",
		282	+ on_tick=self.eval_collector.sample_once,
246	interval_sec=max(arc.eval_sample_interval, 5),	283	interval_sec=max(arc.eval_sample_interval, 5),
247	lock_key="agent_runtime:job:sys_sample",	284	lock_key="agent_runtime:job:sys_sample",
248	tick_timeout_sec=TICK_TIMEOUTS["sys_sample"],	285	tick_timeout_sec=TICK_TIMEOUTS["sys_sample"],
249	),	286	),
250	self.create_single_leader_job(	287	self.create_single_leader_job(
251	- name="sys_eval", on_tick=self.evaluator.evaluate_once,	288	+ name="sys_eval",
		289	+ on_tick=self.evaluator.evaluate_once,
252	interval_sec=max(arc.eval_interval, 30),	290	interval_sec=max(arc.eval_interval, 30),
253	lock_key="agent_runtime:job:sys_eval",	291	lock_key="agent_runtime:job:sys_eval",
254	tick_timeout_sec=TICK_TIMEOUTS["sys_eval"],	292	tick_timeout_sec=TICK_TIMEOUTS["sys_eval"],
	@@ -260,24 +298,29 @@ class OrchestratorSystemContext(SystemContext):
260		298
261	async def start(self) -> None:	299	async def start(self) -> None:
262	await super().start()	300	await super().start()
		301	+ await sync_local_link_binding_state(self.db, self.link_mtls)
263	await self.rm_sysctx.start()	302	await self.rm_sysctx.start()
264	# 启动即重建路由快照（消除首次 route 的冷启动窗口；失败降级到首次 route 重建）	303	# 启动即重建路由快照（消除首次 route 的冷启动窗口；失败降级到首次 route 重建）
265	try:	304	try:
266	await self.sm_config_store.ensure_snapshot()	305	await self.sm_config_store.ensure_snapshot()
267	except Exception: # noqa: BLE001	306	except Exception: # noqa: BLE001
268	- self.logger.exception("routing snapshot rebuild failed at startup "	307	+ self.logger.exception(
269	- "(defer to first route)")	308	+ "routing snapshot rebuild failed at startup (defer to first route)"
		309	+ )
270	try:	310	try:
271	await self.k8s.start()	311	await self.k8s.start()
272	except Exception: # noqa: BLE001 - k8s 不可用只影响扩缩容，不阻断启动	312	except Exception: # noqa: BLE001 - k8s 不可用只影响扩缩容，不阻断启动
273	- self.logger.exception("kubernetes client start failed (scale in/out degraded)")	313	+ self.logger.exception(
		314	+ "kubernetes client start failed (scale in/out degraded)"
		315	+ )
274	self._jobs = self._build_jobs()	316	self._jobs = self._build_jobs()
275	interval_by_name = self._job_intervals()	317	interval_by_name = self._job_intervals()
276	for job in self._jobs:	318	for job in self._jobs:
277	await job.start()	319	await job.start()
278	self.logger.info(	320	self.logger.info(
279	"background job registered: name=%s interval_sec=%s tick_timeout_sec=%s",	321	"background job registered: name=%s interval_sec=%s tick_timeout_sec=%s",
280	- job.name, interval_by_name.get(job.name, "?"),	322	+ job.name,
		323	+ interval_by_name.get(job.name, "?"),
281	TICK_TIMEOUTS.get(job.name),	324	TICK_TIMEOUTS.get(job.name),
282	)	325	)
283	# 计数缓冲 flusher:每副本独立(选主 job 会漏非 leader 副本的缓冲),	326	# 计数缓冲 flusher:每副本独立(选主 job 会漏非 leader 副本的缓冲),
	@@ -290,21 +333,38 @@ class OrchestratorSystemContext(SystemContext):
290	"reclaim=%ss watch=%ss reconcile=%ss "	333	"reclaim=%ss watch=%ss reconcile=%ss "
291	"default_session_ttl=%ss eval_sample=%ss eval=%ss eval_llm=%s "	334	"default_session_ttl=%ss eval_sample=%ss eval=%ss eval_llm=%s "
292	"kubeconfig=%s",	335	"kubeconfig=%s",
293	- self.arc.mode, self.arc.default_namespace,	336	+ self.arc.mode,
294	- self.arc.sweep_interval, self.arc.autoscale_interval,	337	+ self.arc.default_namespace,
295	- self.arc.reclaim_interval, self.arc.watch_interval,	338	+ self.arc.sweep_interval,
		339	+ self.arc.autoscale_interval,
		340	+ self.arc.reclaim_interval,
		341	+ self.arc.watch_interval,
296	self.arc.reconcile_interval,	342	self.arc.reconcile_interval,
297	self.arc.default_session_ttl,	343	self.arc.default_session_ttl,
298	- self.arc.eval_sample_interval, self.arc.eval_interval,	344	+ self.arc.eval_sample_interval,
299	- "enabled" if (self.arc.eval_llm_base_url and self.arc.eval_llm_model)	345	+ self.arc.eval_interval,
		346	+ "enabled"
		347	+ if (self.arc.eval_llm_base_url and self.arc.eval_llm_model)
300	else "disabled",	348	else "disabled",
301	"set" if self.arc.kubeconfig else "in-cluster",	349	"set" if self.arc.kubeconfig else "in-cluster",
302	)	350	)
303	self.logger.info(	351	self.logger.info(
304	"agent-runtime started: instance=%s mode=%s port=%s",	352	"agent-runtime started: instance=%s mode=%s port=%s",
305	- self.instance_id, self.arc.mode,	353	+ self.instance_id,
		354	+ self.arc.mode,
306	getattr(self.settings, "port", "?"),	355	getattr(self.settings, "port", "?"),
307	)	356	)
		357	+ self.logger.info(
		358	+ "link mTLS: mode=%s mtls_deployment_id=%s mtls_binding_id=%s epoch=%s",
		359	+ self.link_mtls.mode.value,
		360	+ self.link_mtls.identity.mtls_deployment_id
		361	+ if self.link_mtls.identity
		362	+ else "-",
		363	+ self.link_mtls.identity.mtls_binding_id if self.link_mtls.identity else "-",
		364	+ self.link_mtls.identity.mtls_binding_epoch
		365	+ if self.link_mtls.identity
		366	+ else "-",
		367	+ )
308		368
309	def _job_intervals(self) -> dict[str, int]:	369	def _job_intervals(self) -> dict[str, int]:
310	"""诊断用：job 名 → 调度间隔（arc）。"""	370	"""诊断用：job 名 → 调度间隔（arc）。"""
	@@ -350,7 +410,11 @@ class OrchestratorSystemContext(SystemContext):
350	lock_key = f"agent_runtime:job:{job.name}"	410	lock_key = f"agent_runtime:job:{job.name}"
351	token = await self.redis.get(lock_key)	411	token = await self.redis.get(lock_key)
352	if token:	412	if token:
353	- token = token.decode() if isinstance(token, (bytes, bytearray)) else str(token)	413	+ token = (
		414	+ token.decode()
		415	+ if isinstance(token, (bytes, bytearray))
		416	+ else str(token)
		417	+ )
354	leader = token.removeprefix(f"{job.name}:").rsplit(":", 1)[0]	418	leader = token.removeprefix(f"{job.name}:").rsplit(":", 1)[0]
355	entry["leader"] = {	419	entry["leader"] = {
356	"instance_id": leader,	420	"instance_id": leader,
	@@ -410,6 +474,7 @@ def create_app(
410	resources: tuple[Any, Any, Any] \| None = None,	474	resources: tuple[Any, Any, Any] \| None = None,
411	instance_id: str \| None = None,	475	instance_id: str \| None = None,
412	own_resources: bool = True,	476	own_resources: bool = True,
		477	+ link_mtls_config: LinkMTLSConfig \| None = None,
413	) -> App:	478	) -> App:
414	"""构造唯一 App（/api/session）并注册 5 个对外 handler。	479	"""构造唯一 App（/api/session）并注册 5 个对外 handler。
415		480
	@@ -418,19 +483,44 @@ def create_app(
418	生产路径不传，行为与原先完全一致。	483	生产路径不传，行为与原先完全一致。
419	"""	484	"""
420		485
		486	+ link_mtls = link_mtls_config or LinkMTLSConfig.from_env()
		487	+
421	def ctx_factory() -> OrchestratorSystemContext:	488	def ctx_factory() -> OrchestratorSystemContext:
422	if resources is not None:	489	if resources is not None:
423	redis_client, db, k8s = resources	490	redis_client, db, k8s = resources
424	else:	491	else:
425	- redis_client, db, k8s = build_resources(settings, arc)	492	+ redis_client, db, k8s = build_resources(settings, arc, link_mtls)
426	return OrchestratorSystemContext(	493	return OrchestratorSystemContext(
427	- redis_client=redis_client, db=db, k8s=k8s,	494	+ redis_client=redis_client,
428	- settings=settings, arc=arc,	495	+ db=db,
		496	+ k8s=k8s,
		497	+ settings=settings,
		498	+ arc=arc,
		499	+ link_mtls=link_mtls,
429	instance_id=instance_id,	500	instance_id=instance_id,
430	owns_resources=own_resources,	501	owns_resources=own_resources,
431	)	502	)
432		503
433	- app = App(ctx_factory, prefix=SERVICE_PREFIX, enable_ws=False, title="agent-runtime")	504	+ app = App(
		505	+ ctx_factory, prefix=SERVICE_PREFIX, enable_ws=False, title="agent-runtime"
		506	+ )
		507	+
		508	+ @app.asgi.middleware("http")
		509	+ async def _link_binding_guard(request: Request, call_next): # noqa: ANN001, ANN202
		510	+ try:
		511	+ link_mtls.authorize_request(request)
		512	+ except LinkMTLSError as exc:
		513	+ logger.warning("link binding rejected: %s", exc)
		514	+ return JSONResponse(
		515	+ status_code=403,
		516	+ content={
		517	+ "ok": False,
		518	+ "error_code": "LINK_BINDING_MISMATCH",
		519	+ "error_message": str(exc),
		520	+ },
		521	+ )
		522	+ return await call_next(request)
		523	+
434	# 请求汇总日志 + 指标（touch/cleanup 从此每请求一行；registry 供 /visualization/stats）	524	# 请求汇总日志 + 指标（touch/cleanup 从此每请求一行；registry 供 /visualization/stats）
435	registry = MetricsRegistry()	525	registry = MetricsRegistry()
436	app.use(request_metrics_middleware(registry))	526	app.use(request_metrics_middleware(registry))
	@@ -438,6 +528,8 @@ def create_app(
438	_register_healthz(app)	528	_register_healthz(app)
439	register_visualization_api(app, registry=registry)	529	register_visualization_api(app, registry=registry)
440	register_handlers(app)	530	register_handlers(app)
		531	+ if link_mtls.mode is LinkMTLSMode.OBSERVE:
		532	+ logger.info("link mTLS observe preflight complete; data path remains HTTP")
441	return app	533	return app
442		534
443		535
	@@ -479,7 +571,9 @@ def _collect_runtime_identity() -> dict[str, Any]:
479	except OSError:	571	except OSError:
480	ns = ""	572	ns = ""
481	if not ns:	573	if not ns:
482	- ns = (os.getenv("AGENT_RUNTIME_DEFAULT_NAMESPACE") or "default").strip() or "default"	574	+ ns = (
		575	+ os.getenv("AGENT_RUNTIME_DEFAULT_NAMESPACE") or "default"
		576	+ ).strip() or "default"
483	pod = (os.getenv("HOSTNAME") or "").strip()	577	pod = (os.getenv("HOSTNAME") or "").strip()
484	return {	578	return {
485	"namespace": ns,	579	"namespace": ns,

Mapplications/agent_runtime/src/agent_runtime/resource_manager/k8s.py+152-1文件内容审核中，请稍后刷新重试

Mapplications/agent_runtime/src/agent_runtime/resource_manager/orchestrator.py+9-3文件内容审核中，请稍后刷新重试

Mapplications/agent_runtime/src/agent_runtime/resource_manager/sweeper.py+7-1文件内容审核中，请稍后刷新重试

Mapplications/agent_runtime/src/agent_runtime/session_manager/handlers.py+10-1文件内容审核中，请稍后刷新重试

Mapplications/agent_runtime/tests/resource_manager/test_k8s_pod_body.py+563-201文件内容审核中，请稍后刷新重试

Aapplications/agent_runtime/tests/resource_manager/test_link_material_sync.py+40-0

@@ -0,0 +1,40 @@
	1	+"""Exercise the stdlib helper as a non-root local process; no cluster needed."""
	2	+
	3	+import json
	4	+import os
	5	+
	6	+from openjiuwen_runtime.foundation.security.link_material_sync import FILES, invalidate, synchronize
	7	+
	8	+
	9	+def publish(root, sequence, status):
	10	+ generation = root / str(sequence)
	11	+ generation.mkdir()
	12	+ for name in FILES:
	13	+ (generation / name).write_text(json.dumps({"status": status}) if name == "profile.json" else name)
	14	+ pending = root / "next"
	15	+ pending.symlink_to(str(sequence), target_is_directory=True)
	16	+ os.replace(pending, root / "..data")
	17	+
	18	+
	19	+def test_private_atomic_copy_and_updates(tmp_path):
	20	+ source, target = tmp_path / "source", tmp_path / "owned" / "private"
	21	+ source.mkdir()
	22	+ publish(source, 1, "active")
	23	+ assert synchronize(source, target)
	24	+ assert not synchronize(source, target)
	25	+ assert target.stat().st_mode & 0o777 == 0o700
	26	+ for name in FILES:
	27	+ path = target / "identity" / name
	28	+ assert path.stat().st_mode & 0o777 == 0o400
	29	+ assert path.stat().st_uid == os.getuid()
	30	+ original = (target / "identity").resolve()
	31	+ publish(source, 2, "revoked")
	32	+ assert synchronize(source, target)
	33	+ assert json.loads((target / "identity" / "profile.json").read_text())["status"] == "revoked"
	34	+ assert original.exists()
	35	+ publish(source, 3, "active-again")
	36	+ assert synchronize(source, target)
	37	+ assert not original.exists()
	38	+ invalidate(target)
	39	+ assert not (target / "identity" / "profile.json").exists()
	40	+ assert synchronize(source, target) # recovery retries the same generation

Aapplications/agent_runtime/tests/resource_manager/test_link_mtls_canonical_pod.py+77-0

@@ -0,0 +1,77 @@
	1	+# Copyright (c) Huawei Technologies Co., Ltd. 2026. All rights reserved.
	2	+"""Serialize real Kubernetes SDK objects; do not contact a cluster."""
	3	+
	4	+import copy
	5	+from unittest.mock import patch
	6	+
	7	+import pytest
	8	+from agent_runtime.link_mtls import MTLSDeploymentIdentity, LinkMTLSConfig, LinkMTLSMode
	9	+from agent_runtime.resource_manager.k8s import RealK8sPodClient
	10	+
	11	+
	12	+@pytest.mark.parametrize("mode", ["off", "observe", "enforce"])
	13	+@pytest.mark.parametrize("security", [(0, None), (0, 0), (1000, 1000)])
	14	+def test_canonical_container_settings_survive_certificate_injection(mode, security):
	15	+ sdk = pytest.importorskip("kubernetes_asyncio.client")
	16	+
	17	+ uid, group = security
	18	+ shared = [
	19	+ {"claim_name": "business-data", "mount_path": "/data", "read_only": False}
	20	+ ]
	21	+ main = {
	22	+ "name": "agent",
	23	+ "image": "agentserver:21s",
	24	+ "command": ["python"],
	25	+ "args": ["-m", "agent"],
	26	+ "ports": [{"name": "sse", "container_port": 8766}],
	27	+ "env": {"BUSINESS": "unchanged", "JIUWENSWARM_LINK_MTLS_MODE": "off"},
	28	+ "env_from": [{"secret_ref": {"name": "business-secret"}}],
	29	+ "security_context": {"run_as_user": uid, "run_as_group": uid},
	30	+ "pvc_mounts": shared,
	31	+ }
	32	+ box = {"name": "jiuwenbox", "image": "box:21s", "pvc_mounts": shared}
	33	+ spec = {
	34	+ "namespace": "test",
	35	+ "main_container": main,
	36	+ "sidecars": [box],
	37	+ "fs_group": group,
	38	+ }
	39	+ original = copy.deepcopy(spec)
	40	+ config = LinkMTLSConfig(
	41	+ mode=LinkMTLSMode(mode),
	42	+ identity=MTLSDeploymentIdentity("instance", "binding", 1),
	43	+ agentserver_secret="agentserver-tls",
	44	+ )
	45	+ renderer = RealK8sPodClient(link_mtls_config=config)
	46	+ with patch.object(renderer, "_client", sdk):
	47	+ pod = renderer.build_pod_body("pod-test", spec).to_dict()["spec"]
	48	+ assert spec == original
	49	+ agent, sandbox = pod["containers"][:2]
	50	+ assert agent["command"] == main["command"] and agent["args"] == main["args"]
	51	+ assert agent["env_from"][0]["secret_ref"]["name"] == "business-secret"
	52	+ assert agent["security_context"]["run_as_user"] == uid
	53	+ assert (pod["security_context"] or {}).get("fs_group") == group
	54	+ assert len([v for v in pod["volumes"] if v["persistent_volume_claim"]]) == 1
	55	+ assert len(sandbox["volume_mounts"]) == 1 # business PVC only
	56	+ env = {item["name"]: item["value"] for item in agent["env"]}
	57	+ assert env["BUSINESS"] == "unchanged"
	58	+ assert env["JIUWENSWARM_LINK_MTLS_MODE"] == (
	59	+ "enforce" if mode == "enforce" else "off"
	60	+ )
	61	+ if mode != "enforce":
	62	+ assert len(pod["containers"]) == 2 and not pod["init_containers"]
	63	+ assert pod["hostname"] is None
	64	+ return
	65	+ assert pod["hostname"] == "pod-test"
	66	+ assert agent["readiness_probe"]["tcp_socket"]["port"] == 8766
	67	+ private_copy = uid != 0 or group is not None
	68	+ assert len(pod["containers"]) == (3 if private_copy else 2)
	69	+ secret = next(v["secret"] for v in pod["volumes"] if v["secret"])
	70	+ assert secret["default_mode"] == (0o444 if private_copy else 0o400)
	71	+ if private_copy:
	72	+ helper = pod["containers"][2]
	73	+ assert helper["env_from"] is None and helper["env"] is None
	74	+ assert helper["security_context"]["allow_privilege_escalation"] is False
	75	+ assert env["JIUWENSWARM_LINK_MTLS_KEY_FILE"].endswith(
	76	+ "/private/identity/tls.key"
	77	+ )

Aapplications/agent_runtime/tests/test_link_mtls.py+163-0

@@ -0,0 +1,163 @@
	1	+# coding: utf-8
	2	+"""mTLS 默认兼容、绑定元数据与本地身份落库测试。"""
	3	+
	4	+from __future__ import annotations
	5	+
	6	+from types import SimpleNamespace
	7	+
	8	+import pytest
	9	+from agent_runtime.link_binding_state import (
	10	+ LINK_BINDING_STATE_TABLE,
	11	+ LOCAL_SERVICE_ROLE,
	12	+ sync_local_link_binding_state,
	13	+)
	14	+from agent_runtime.link_mtls import (
	15	+ MTLSDeploymentIdentity,
	16	+ LinkMTLSConfig,
	17	+ LinkMTLSError,
	18	+ LinkMTLSMode,
	19	+)
	20	+
	21	+
	22	+class _DB:
	23	+ def __init__(self) -> None:
	24	+ self.rows: dict[str, dict] = {}
	25	+
	26	+ async def get(self, table: str, filters: dict):
	27	+ assert table == LINK_BINDING_STATE_TABLE
	28	+ row = self.rows.get(filters["service_role"])
	29	+ return SimpleNamespace(**row) if row else None
	30	+
	31	+ async def create(self, table: str, data: dict):
	32	+ assert table == LINK_BINDING_STATE_TABLE
	33	+ self.rows[data["service_role"]] = dict(data)
	34	+ return SimpleNamespace(**data)
	35	+
	36	+ async def update(self, table: str, filters: dict, data: dict):
	37	+ assert table == LINK_BINDING_STATE_TABLE
	38	+ self.rows[filters["service_role"]].update(data)
	39	+ return SimpleNamespace(**self.rows[filters["service_role"]])
	40	+
	41	+
	42	+def _clear_link_env(monkeypatch: pytest.MonkeyPatch) -> None:
	43	+ for name in (
	44	+ "JIUWENSWARM_LINK_MTLS_MODE",
	45	+ "JIUWENSWARM_LINK_MTLS_PROFILE",
	46	+ "JIUWENSWARM_LINK_MTLS_CA_FILE",
	47	+ "JIUWENSWARM_LINK_MTLS_CERT_FILE",
	48	+ "JIUWENSWARM_LINK_MTLS_KEY_FILE",
	49	+ "AGENT_RUNTIME_LINK_MTLS_AGENTSERVER_SECRET",
	50	+ ):
	51	+ monkeypatch.delenv(name, raising=False)
	52	+
	53	+
	54	+def test_default_off_keeps_plain_http(monkeypatch: pytest.MonkeyPatch) -> None:
	55	+ _clear_link_env(monkeypatch)
	56	+ config = LinkMTLSConfig.from_env()
	57	+ assert config.mode is LinkMTLSMode.OFF
	58	+ assert config.uvicorn_ssl_kwargs() == {}
	59	+ assert (
	60	+ config.agentserver_url(
	61	+ pod_id="pod-1",
	62	+ namespace="ns-a",
	63	+ port=8080,
	64	+ path="/sse",
	65	+ pod_ip="10.0.0.8",
	66	+ )
	67	+ == "http://10.0.0.8:8080/sse"
	68	+ )
	69	+ assert config.agentserver_env() == {}
	70	+ assert config.route_metadata() == {}
	71	+
	72	+
	73	+def test_enforce_requires_pinned_profile_even_with_external_certificate_paths(
	74	+ monkeypatch: pytest.MonkeyPatch, tmp_path
	75	+) -> None:
	76	+ _clear_link_env(monkeypatch)
	77	+ monkeypatch.setenv("JIUWENSWARM_LINK_MTLS_MODE", "enforce")
	78	+ for name in (
	79	+ "JIUWENSWARM_LINK_MTLS_CA_FILE",
	80	+ "JIUWENSWARM_LINK_MTLS_CERT_FILE",
	81	+ "JIUWENSWARM_LINK_MTLS_KEY_FILE",
	82	+ ):
	83	+ path = tmp_path / name
	84	+ path.write_text("placeholder", encoding="utf-8")
	85	+ monkeypatch.setenv(name, str(path))
	86	+ with pytest.raises(LinkMTLSError, match="not installed"):
	87	+ LinkMTLSConfig.from_env()
	88	+
	89	+
	90	+def test_binding_metadata_and_https_dns() -> None:
	91	+ config = LinkMTLSConfig(
	92	+ mode=LinkMTLSMode.ENFORCE,
	93	+ identity=MTLSDeploymentIdentity("deployment-1", "binding-1", 3),
	94	+ agentserver_secret="tls-secret",
	95	+ )
	96	+ assert config.route_metadata() == {
	97	+ "mtls_deployment_id": "deployment-1",
	98	+ "mtls_binding_id": "binding-1",
	99	+ "mtls_binding_epoch": 3,
	100	+ }
	101	+ assert config.agentserver_url(
	102	+ pod_id="agentserver-abc",
	103	+ namespace="tenant-a",
	104	+ port=8080,
	105	+ path="/sse",
	106	+ pod_ip="10.0.0.8",
	107	+ ) == (
	108	+ "https://agentserver-abc.jiuwenclaw-agentserver.tenant-a.svc.cluster.local:8080/sse"
	109	+ )
	110	+
	111	+
	112	+@pytest.mark.asyncio
	113	+async def test_link_binding_state_upsert_excludes_private_key(
	114	+ monkeypatch: pytest.MonkeyPatch, tmp_path
	115	+) -> None:
	116	+ cert = tmp_path / "tls.crt"
	117	+ ca = tmp_path / "ca.crt"
	118	+ cert.write_text("public certificate", encoding="utf-8")
	119	+ ca.write_text("public ca", encoding="utf-8")
	120	+ config = LinkMTLSConfig(
	121	+ mode=LinkMTLSMode.ENFORCE,
	122	+ ca_file=str(ca),
	123	+ cert_file=str(cert),
	124	+ key_file="/run/secrets/runtime/tls.key",
	125	+ identity=MTLSDeploymentIdentity("deployment-1", "binding-1", 1),
	126	+ agentserver_secret="agentserver-tls",
	127	+ )
	128	+ monkeypatch.setattr(LinkMTLSConfig, "cert_fingerprint", lambda _self: "fp-1")
	129	+ db = _DB()
	130	+
	131	+ await sync_local_link_binding_state(db, config)
	132	+ row = db.rows[LOCAL_SERVICE_ROLE]
	133	+ assert row["private_key_ref"] == "/run/secrets/runtime/tls.key"
	134	+ assert "private_key" not in row
	135	+ assert row["local_cert_pem"] == "public certificate"
	136	+ assert row["peer_trust_bundle_pem"] == "public ca"
	137	+
	138	+ updated = LinkMTLSConfig(
	139	+ **{
	140	+ **config.__dict__,
	141	+ "identity": MTLSDeploymentIdentity("deployment-1", "binding-1", 2),
	142	+ }
	143	+ )
	144	+ await sync_local_link_binding_state(db, updated)
	145	+ assert db.rows[LOCAL_SERVICE_ROLE]["mtls_binding_epoch"] == 2
	146	+ assert len(db.rows) == 1
	147	+ with pytest.raises(LinkMTLSError, match="older than persisted"):
	148	+ await sync_local_link_binding_state(db, config)
	149	+ assert db.rows[LOCAL_SERVICE_ROLE]["mtls_binding_epoch"] == 2
	150	+ db.rows[LOCAL_SERVICE_ROLE]["status"] = "revoked"
	151	+ with pytest.raises(LinkMTLSError, match="newer binding epoch"):
	152	+ await sync_local_link_binding_state(db, updated)
	153	+ assert db.rows[LOCAL_SERVICE_ROLE]["status"] == "revoked"
	154	+
	155	+
	156	+@pytest.mark.asyncio
	157	+async def test_off_does_not_write_link_binding_state() -> None:
	158	+ db = _DB()
	159	+ assert (
	160	+ await sync_local_link_binding_state(db, LinkMTLSConfig(LinkMTLSMode.OFF))
	161	+ is None
	162	+ )
	163	+ assert db.rows == {}

Aapplications/agent_runtime/tests/test_link_profile_runtime.py+113-0

@@ -0,0 +1,113 @@
	1	+"""Real Runtime ASGI security boundary; business handlers do not need K8s here."""
	2	+
	3	+import asyncio
	4	+import os
	5	+import socket
	6	+from contextlib import asynccontextmanager
	7	+from urllib.parse import urljoin
	8	+
	9	+import httpx
	10	+import pytest
	11	+import uvicorn
	12	+from agent_runtime.config import AgentRuntimeConfig
	13	+from agent_runtime.link_mtls import LinkMTLSConfig
	14	+from agent_runtime.main import create_app
	15	+from openjiuwen_runtime.foundation.security.link_certificate_bundle import (
	16	+ issue_bundle,
	17	+ materialize_role,
	18	+)
	19	+from openjiuwen_runtime.foundation.security.link_profile import LinkProfile
	20	+from openjiuwen_runtime.service.config import ServiceConfig
	21	+
	22	+
	23	+@pytest.fixture(name="bundle")
	24	+def certificate_bundle(tmp_path, monkeypatch):
	25	+ for name in tuple(os.environ):
	26	+ if name.startswith("JIUWENSWARM_LINK_"):
	27	+ monkeypatch.delenv(name)
	28	+ material = issue_bundle(
	29	+ mtls_deployment_id="test-deployment", endpoints={"runtime": "127.0.0.1:8091"}
	30	+ )
	31	+ for role in ("gateway", "runtime", "manager"):
	32	+ materialize_role(material, role, tmp_path / role)
	33	+ return tmp_path
	34	+
	35	+
	36	+def profile(bundle, role):
	37	+ return LinkProfile.load(str(bundle / role / "profile.json"))
	38	+
	39	+
	40	+@asynccontextmanager
	41	+async def serve(app, identity):
	42	+ sock = socket.socket()
	43	+ sock.bind(("127.0.0.1", 0))
	44	+ port = sock.getsockname()[1]
	45	+ server = uvicorn.Server(
	46	+ uvicorn.Config(
	47	+ app,
	48	+ lifespan="off",
	49	+ log_level="critical",
	50	+ **identity.server_kwargs(),
	51	+ )
	52	+ )
	53	+ task = asyncio.create_task(server.serve(sockets=[sock]))
	54	+ try:
	55	+ for _ in range(200):
	56	+ if server.started:
	57	+ break
	58	+ if task.done():
	59	+ await task
	60	+ await asyncio.sleep(0.01)
	61	+ assert server.started
	62	+ yield f"https://127.0.0.1:{port}"
	63	+ finally:
	64	+ server.should_exit = True
	65	+ await asyncio.wait_for(task, 5)
	66	+ sock.close()
	67	+
	68	+
	69	+@pytest.mark.parametrize("mode", ["off", "observe"])
	70	+def test_incomplete_existing_identity_does_not_break_non_enforce(monkeypatch, mode):
	71	+ monkeypatch.setenv("JIUWENSWARM_LINK_MTLS_MODE", mode)
	72	+ monkeypatch.setenv("JIUWENSWARM_LINK_MTLS_PROFILE", "/not-installed/profile.json")
	73	+ c = LinkMTLSConfig.from_env()
	74	+ assert c.client_kwargs(role="agentserver") == {} and c.uvicorn_ssl_kwargs() == {}
	75	+ assert c.binding_headers() == {}
	76	+
	77	+
	78	+def test_runtime_real_middleware_enforces_peer_roles(bundle, tmp_path, monkeypatch):
	79	+ from openjiuwen_runtime.foundation.security import link_profile as profiles
	80	+
	81	+ monkeypatch.setattr(profiles, "DEFAULT_IDENTITY_ROOT", bundle)
	82	+ monkeypatch.setenv("JIUWENSWARM_LINK_MTLS_MODE", "enforce")
	83	+
	84	+ async def run():
	85	+ runtime, manager, gateway = (
	86	+ profile(bundle, r) for r in ("runtime", "manager", "gateway")
	87	+ )
	88	+ app = create_app(
	89	+ ServiceConfig.from_env(),
	90	+ AgentRuntimeConfig(mode="local"),
	91	+ )
	92	+
	93	+ @app.asgi.get("/review-probe")
	94	+ async def probe():
	95	+ return {"ok": True}
	96	+
	97	+ # Lifespan is deliberately off: this checks the actual production
	98	+ # middleware over TLS, not database lifecycle / autoscale / model output.
	99	+ async with serve(app.asgi, runtime) as url:
	100	+ async with httpx.AsyncClient(**manager.client_kwargs(role="runtime")) as c:
	101	+ assert (
	102	+ await c.get(
	103	+ urljoin(url, "/review-probe"), headers=manager.headers()
	104	+ )
	105	+ ).status_code == 200
	106	+ async with httpx.AsyncClient(**gateway.client_kwargs(role="runtime")) as c:
	107	+ assert (
	108	+ await c.get(
	109	+ urljoin(url, "/review-probe"), headers=gateway.headers()
	110	+ )
	111	+ ).status_code == 403
	112	+
	113	+ asyncio.run(run())

Mapplications/manager/.env.example+6-0

	@@ -77,6 +77,12 @@ CLAWMANAGER_CONFIG_ENC_REQUIRED=false
77	CLAWMANAGER_CONFIG_SIGN_ENABLED=false	77	CLAWMANAGER_CONFIG_SIGN_ENABLED=false
78	CLAWMANAGER_CONFIG_SIGN_ALG=Ed25519	78	CLAWMANAGER_CONFIG_SIGN_ALG=Ed25519
79		79
		80	+# 可选 Manager 参考实现到 Gateway / Runtime 的内部 mTLS。
		81	+# 未设置或 off 均不启用；仅显式 enforce 启用。配套部署工具管理 manager 角色材料。
		82	+# 受管地址按部署配置解析为 HTTPS；外部地址须显式 https:// 并通过 CA/SAN/指纹校验。
		83	+# 当前从部署身份读取绑定 ID/epoch，不需另填证书路径或手改绑定数据库。
		84	+JIUWENSWARM_LINK_MTLS_MODE=off
		85	+
80	# 本地拉起时写入 Gateway 的数据库环境（可选）	86	# 本地拉起时写入 Gateway 的数据库环境（可选）
81	# JIUWENCLAW_GATEWAY_DB_TYPE=mysql	87	# JIUWENCLAW_GATEWAY_DB_TYPE=mysql
82	# JIUWENCLAW_GATEWAY_DB_HOST=localhost	88	# JIUWENCLAW_GATEWAY_DB_HOST=localhost

Mapplications/manager/manager_server/src/manager_server/core/instance/config_host_probe.py+19-22文件内容审核中，请稍后刷新重试

Mapplications/manager/manager_server/src/manager_server/core/instance/instance_data_lifecycle.py+2-2

	@@ -273,12 +273,12 @@ async def purge_runtime_instance_data(
273	from manager_server.core.instance_resource.runtime_config_sync import (	273	from manager_server.core.instance_resource.runtime_config_sync import (
274	sync_runtime_config,	274	sync_runtime_config,
275	)	275	)
276	- from manager_server.infrastructure.config import settings
277		276
278	jid = str(jiuwenclaw_id or "").strip()	277	jid = str(jiuwenclaw_id or "").strip()
279	if not jid:	278	if not jid:
280	return {"purged": False}	279	return {"purged": False}
281	- if not settings.agent_runtime_endpoint.strip():	280	+ from manager_server.core.instance_resource.runtime_config_sync import resolve_runtime_endpoint
		281	+ if not await resolve_runtime_endpoint(handler, jid):
282	logger.info(	282	logger.info(
283	"[InstanceDataLifecycle] runtime purge skipped jiuwenclaw_id=%s "	283	"[InstanceDataLifecycle] runtime purge skipped jiuwenclaw_id=%s "
284	"(AGENT_RUNTIME_ENDPOINT empty)",	284	"(AGENT_RUNTIME_ENDPOINT empty)",

Aapplications/manager/manager_server/src/manager_server/core/instance/link_binding_service.py+306-0

@@ -0,0 +1,306 @@
	1	+"""Gateway ↔ Runtime 实例链路绑定编排。"""
	2	+
	3	+from __future__ import annotations
	4	+
	5	+from typing import Any
	6	+from urllib.parse import urlsplit
	7	+
	8	+from openjiuwen_runtime.foundation.db.handler import DBHandler
	9	+from openjiuwen_runtime.foundation.security.link_profile import (
	10	+ LinkProfile,
	11	+ LinkProfileError,
	12	+ cert_fingerprint,
	13	+)
	14	+
	15	+from manager_server.infrastructure.utils import iso_datetime, utc_now
	16	+from manager_server.models.instance_models import INSTANCE_INFO_TABLE_DEF
	17	+from manager_server.models.link_binding_models import INSTANCE_LINK_BINDING_TABLE_DEF
	18	+from manager_server.schemas.link_binding_schemas import (
	19	+ LinkBindingCreateBody,
	20	+ LinkBindingView,
	21	+)
	22	+
	23	+_TABLE = INSTANCE_LINK_BINDING_TABLE_DEF.table_name
	24	+_INSTANCE_TABLE = INSTANCE_INFO_TABLE_DEF.table_name
	25	+_PROTOCOL_VERSION = "0.0.1"
	26	+
	27	+
	28	+class LinkBindingConflict(ValueError):
	29	+ """请求与当前有效绑定冲突。"""
	30	+
	31	+
	32	+def _view(row: Any) -> LinkBindingView:
	33	+ data = row.data if isinstance(row.data, dict) else None
	34	+ return LinkBindingView(
	35	+ jiuwenclaw_id=row.jiuwenclaw_id,
	36	+ mtls_binding_id=row.mtls_binding_id,
	37	+ mtls_binding_epoch=int(row.mtls_binding_epoch),
	38	+ protocol_version=row.protocol_version,
	39	+ mtls_gateway_endpoint=row.mtls_gateway_endpoint,
	40	+ mtls_runtime_endpoint=row.mtls_runtime_endpoint,
	41	+ manager_cert_fingerprint=str((data or {}).get("manager_cert_fingerprint", "")),
	42	+ gateway_cert_fingerprint=row.gateway_cert_fingerprint,
	43	+ runtime_cert_fingerprint=row.runtime_cert_fingerprint,
	44	+ agentserver_cert_fingerprint=row.agentserver_cert_fingerprint,
	45	+ trust_bundle_ref=row.trust_bundle_ref,
	46	+ status=row.status,
	47	+ bound_at=iso_datetime(row.bound_at) or "",
	48	+ unbound_at=iso_datetime(getattr(row, "unbound_at", None)),
	49	+ created_at=iso_datetime(row.created_at) or "",
	50	+ updated_at=iso_datetime(row.updated_at) or "",
	51	+ updated_by=row.updated_by,
	52	+ data=data,
	53	+ )
	54	+
	55	+
	56	+def _same_active_binding(
	57	+ row: Any,
	58	+ body: LinkBindingCreateBody,
	59	+ *,
	60	+ gateway_endpoint: str,
	61	+ runtime_endpoint: str,
	62	+) -> bool:
	63	+ return all(
	64	+ (
	65	+ row.mtls_gateway_endpoint == gateway_endpoint,
	66	+ row.mtls_runtime_endpoint == runtime_endpoint,
	67	+ row.mtls_binding_id == body.mtls_binding_id.strip(),
	68	+ int(row.mtls_binding_epoch) == body.mtls_binding_epoch,
	69	+ str(
	70	+ (row.data if isinstance(row.data, dict) else {}).get("manager_cert_fingerprint", "")
	71	+ )
	72	+ == body.manager_cert_fingerprint,
	73	+ row.gateway_cert_fingerprint == body.gateway_cert_fingerprint.strip(),
	74	+ row.runtime_cert_fingerprint == body.runtime_cert_fingerprint.strip(),
	75	+ row.agentserver_cert_fingerprint == body.agentserver_cert_fingerprint.strip(),
	76	+ row.trust_bundle_ref == body.trust_bundle_ref.strip(),
	77	+ )
	78	+ )
	79	+
	80	+
	81	+def _is_integrity_error(exc: Exception) -> bool:
	82	+ return "integrity" in type(exc).__name__.lower()
	83	+
	84	+
	85	+class InstanceLinkBindingService:
	86	+ def __init__(self, handler: DBHandler) -> None:
	87	+ self.handler = handler
	88	+
	89	+ async def get(self, jiuwenclaw_id: str) -> LinkBindingView \| None:
	90	+ row = await self.handler.get(_TABLE, {"jiuwenclaw_id": jiuwenclaw_id})
	91	+ return _view(row) if row is not None else None
	92	+
	93	+ async def bind(self, jiuwenclaw_id: str, body: LinkBindingCreateBody) -> LinkBindingView:
	94	+ instance = await self.handler.get(_INSTANCE_TABLE, {"jiuwenclaw_id": jiuwenclaw_id})
	95	+ if instance is None:
	96	+ raise LookupError("instance not found")
	97	+
	98	+ gateway_endpoint = self._matching_instance_endpoint(
	99	+ instance,
	100	+ column="gateway_config_host",
	101	+ supplied=body.mtls_gateway_endpoint,
	102	+ )
	103	+ runtime_endpoint = self._matching_instance_endpoint(
	104	+ instance,
	105	+ column="runtime_config_host",
	106	+ supplied=body.mtls_runtime_endpoint,
	107	+ )
	108	+ current = await self.handler.get(_TABLE, {"jiuwenclaw_id": jiuwenclaw_id})
	109	+ if current is not None and current.status == "bound":
	110	+ if _same_active_binding(
	111	+ current,
	112	+ body,
	113	+ gateway_endpoint=gateway_endpoint,
	114	+ runtime_endpoint=runtime_endpoint,
	115	+ ):
	116	+ return _view(current)
	117	+ raise LinkBindingConflict("instance already has an active link binding")
	118	+
	119	+ await self._assert_endpoint_available(
	120	+ "mtls_gateway_active_key", gateway_endpoint, jiuwenclaw_id
	121	+ )
	122	+ await self._assert_endpoint_available(
	123	+ "mtls_runtime_active_key", runtime_endpoint, jiuwenclaw_id
	124	+ )
	125	+
	126	+ now = utc_now()
	127	+ previous_epoch = int(getattr(current, "mtls_binding_epoch", 0) or 0)
	128	+ if current is not None and body.mtls_binding_epoch <= previous_epoch:
	129	+ raise LinkBindingConflict(
	130	+ "new binding epoch must be greater than the previous binding epoch"
	131	+ )
	132	+ data = dict(body.data or {})
	133	+ data["manager_cert_fingerprint"] = body.manager_cert_fingerprint
	134	+ payload = {
	135	+ "mtls_binding_id": body.mtls_binding_id.strip(),
	136	+ "mtls_binding_epoch": body.mtls_binding_epoch,
	137	+ "protocol_version": _PROTOCOL_VERSION,
	138	+ "mtls_gateway_endpoint": gateway_endpoint,
	139	+ "mtls_runtime_endpoint": runtime_endpoint,
	140	+ "mtls_gateway_active_key": gateway_endpoint,
	141	+ "mtls_runtime_active_key": runtime_endpoint,
	142	+ "gateway_cert_fingerprint": body.gateway_cert_fingerprint.strip(),
	143	+ "runtime_cert_fingerprint": body.runtime_cert_fingerprint.strip(),
	144	+ "agentserver_cert_fingerprint": (body.agentserver_cert_fingerprint.strip()),
	145	+ "trust_bundle_ref": body.trust_bundle_ref.strip(),
	146	+ "status": "bound",
	147	+ "bound_at": now,
	148	+ "unbound_at": None,
	149	+ "updated_at": now,
	150	+ "updated_by": body.updated_by.strip(),
	151	+ "data": data,
	152	+ }
	153	+ try:
	154	+ if current is None:
	155	+ row = await self.handler.create(
	156	+ _TABLE,
	157	+ {
	158	+ "jiuwenclaw_id": jiuwenclaw_id,
	159	+ "created_at": now,
	160	+ **payload,
	161	+ },
	162	+ )
	163	+ else:
	164	+ row = await self.handler.update(
	165	+ _TABLE,
	166	+ {
	167	+ "jiuwenclaw_id": jiuwenclaw_id,
	168	+ "status": current.status,
	169	+ "mtls_binding_epoch": previous_epoch,
	170	+ },
	171	+ payload,
	172	+ )
	173	+ except Exception as exc:
	174	+ if _is_integrity_error(exc):
	175	+ raise LinkBindingConflict("gateway or runtime is already actively bound") from exc
	176	+ raise
	177	+ if row is None:
	178	+ raise LinkBindingConflict("link binding changed concurrently; retry")
	179	+ return _view(row)
	180	+
	181	+ async def unbind(self, jiuwenclaw_id: str, *, updated_by: str) -> tuple[LinkBindingView, bool]:
	182	+ current = await self.handler.get(_TABLE, {"jiuwenclaw_id": jiuwenclaw_id})
	183	+ if current is None:
	184	+ raise LookupError("link binding not found")
	185	+ if current.status != "bound":
	186	+ return _view(current), False
	187	+
	188	+ now = utc_now()
	189	+ row = await self.handler.update(
	190	+ _TABLE,
	191	+ {
	192	+ "jiuwenclaw_id": jiuwenclaw_id,
	193	+ "status": "bound",
	194	+ "mtls_binding_epoch": int(current.mtls_binding_epoch),
	195	+ },
	196	+ {
	197	+ # 先在控制面递增 epoch 并释放唯一键；数据面必须按 API 返回的
	198	+ # rotation_required 轮换 Secret/信任包并重启后，旧身份才真正失效。
	199	+ "mtls_binding_epoch": int(current.mtls_binding_epoch) + 1,
	200	+ "mtls_gateway_active_key": None,
	201	+ "mtls_runtime_active_key": None,
	202	+ "status": "unbound",
	203	+ "unbound_at": now,
	204	+ "updated_at": now,
	205	+ "updated_by": updated_by.strip() or "system",
	206	+ },
	207	+ )
	208	+ if row is None:
	209	+ latest = await self.handler.get(_TABLE, {"jiuwenclaw_id": jiuwenclaw_id})
	210	+ if latest is not None and latest.status != "bound":
	211	+ return _view(latest), False
	212	+ raise LinkBindingConflict("link binding changed concurrently; retry")
	213	+ return _view(row), True
	214	+
	215	+ async def adopt_deployment_profile(
	216	+ self,
	217	+ jiuwenclaw_id: str,
	218	+ profile: LinkProfile,
	219	+ ) -> LinkBindingView:
	220	+ """Bind the co-deployed target without changing Manager's instance ID.
	221	+
	222	+ This is a narrow bootstrap path for an all-in-one deployment. It only
	223	+ adopts a profile when both instance endpoints name the exact Gateway
	224	+ and Runtime authorities declared by that profile. Other instances use
	225	+ the explicit binding API and retain their independent IDs/materials.
	226	+ """
	227	+ instance = await self.handler.get(_INSTANCE_TABLE, {"jiuwenclaw_id": jiuwenclaw_id})
	228	+ if instance is None:
	229	+ raise LookupError("instance not found")
	230	+ profile_data = profile.current()
	231	+ endpoints = profile_data.get("endpoints", {})
	232	+ for role, column in (
	233	+ ("gateway", "gateway_config_host"),
	234	+ ("runtime", "runtime_config_host"),
	235	+ ):
	236	+ configured = _endpoint_authority(getattr(instance, column, ""))
	237	+ declared = _endpoint_authority(endpoints.get(role, ""))
	238	+ if not configured or configured != declared:
	239	+ raise LinkBindingConflict(
	240	+ f"{column} does not match the installed deployment profile"
	241	+ )
	242	+ peers = profile_data.get("peers", {})
	243	+ try:
	244	+ body = LinkBindingCreateBody(
	245	+ mtls_binding_id=profile.mtls_binding_id,
	246	+ mtls_binding_epoch=profile.mtls_binding_epoch,
	247	+ mtls_gateway_endpoint=endpoints["gateway"],
	248	+ mtls_runtime_endpoint=endpoints["runtime"],
	249	+ manager_cert_fingerprint=cert_fingerprint(profile.cert_file),
	250	+ gateway_cert_fingerprint=_single_pin(peers, "gateway"),
	251	+ runtime_cert_fingerprint=_single_pin(peers, "runtime"),
	252	+ agentserver_cert_fingerprint=_single_pin(peers, "agentserver"),
	253	+ trust_bundle_ref="profile://ca",
	254	+ updated_by="deployment-profile",
	255	+ data={"binding_source": "deployment-profile"},
	256	+ )
	257	+ except (KeyError, LinkProfileError, ValueError) as exc:
	258	+ raise LinkBindingConflict("installed deployment profile is incomplete") from exc
	259	+ return await self.bind(jiuwenclaw_id, body)
	260	+
	261	+ async def _assert_endpoint_available(
	262	+ self, active_key: str, endpoint: str, jiuwenclaw_id: str
	263	+ ) -> None:
	264	+ row = await self.handler.get(_TABLE, {active_key: endpoint})
	265	+ if row is not None and row.jiuwenclaw_id != jiuwenclaw_id:
	266	+ raise LinkBindingConflict(
	267	+ f"{active_key.removesuffix('_active_key')} is already actively bound"
	268	+ )
	269	+
	270	+ @staticmethod
	271	+ def _matching_instance_endpoint(instance: Any, *, column: str, supplied: str) -> str:
	272	+ configured = _endpoint_authority(getattr(instance, column, ""))
	273	+ requested = _endpoint_authority(supplied)
	274	+ if not requested:
	275	+ raise LinkBindingConflict(f"invalid mTLS endpoint for {column}")
	276	+ if not configured or configured != requested:
	277	+ raise LinkBindingConflict(f"mTLS endpoint does not match instance {column}")
	278	+ return requested
	279	+
	280	+
	281	+def _endpoint_authority(value: str) -> str:
	282	+ text = str(value or "").strip()
	283	+ if not text:
	284	+ return ""
	285	+ parsed = urlsplit(text if "://" in text else f"//{text}")
	286	+ try:
	287	+ valid = (
	288	+ parsed.scheme in {"", "http", "https"}
	289	+ and parsed.hostname
	290	+ and parsed.port
	291	+ and not parsed.username
	292	+ and not parsed.password
	293	+ and parsed.path in {"", "/"}
	294	+ and not parsed.query
	295	+ and not parsed.fragment
	296	+ )
	297	+ except ValueError:
	298	+ return ""
	299	+ return parsed.netloc.lower() if valid else ""
	300	+
	301	+
	302	+def _single_pin(peers: dict, role: str) -> str:
	303	+ pins = peers.get(role)
	304	+ if not isinstance(pins, list) or len(pins) != 1:
	305	+ raise LinkProfileError(f"deployment profile requires one {role} certificate")
	306	+ return str(pins[0])

Mapplications/manager/manager_server/src/manager_server/core/instance/runtime_identity.py+14-9文件内容审核中，请稍后刷新重试

Mapplications/manager/manager_server/src/manager_server/core/instance_resource/runtime_config_sync.py+59-27文件内容审核中，请稍后刷新重试

Mapplications/manager/manager_server/src/manager_server/manager_config_push/client.py+31-9文件内容审核中，请稍后刷新重试

Aapplications/manager/manager_server/src/manager_server/models/link_binding_models.py+48-0

@@ -0,0 +1,48 @@
	1	+"""实例链路绑定表。
	2	+
	3	+``*_active_key`` 仅在绑定生效时有值，并带唯一索引：数据库层保证同一 Gateway
	4	+或 Runtime 不能同时绑定到两个 JiuwenClaw 实例；解绑置空后可安全重新绑定。
	5	+"""
	6	+
	7	+from __future__ import annotations
	8	+
	9	+from openjiuwen_runtime.foundation.db.table_def import (
	10	+ ColumnDefinition,
	11	+ IndexDefinition,
	12	+ TableDefinition,
	13	+)
	14	+
	15	+INSTANCE_LINK_BINDING_TABLE_DEF = TableDefinition(
	16	+ table_name="instance_link_binding",
	17	+ columns=[
	18	+ ColumnDefinition("jiuwenclaw_id", "string", length=64, primary_key=True, nullable=False),
	19	+ ColumnDefinition("mtls_binding_id", "string", length=64, nullable=False),
	20	+ ColumnDefinition("mtls_binding_epoch", "integer", nullable=False),
	21	+ ColumnDefinition("protocol_version", "string", length=32, nullable=False),
	22	+ ColumnDefinition("mtls_gateway_endpoint", "string", length=128, nullable=False),
	23	+ ColumnDefinition("mtls_runtime_endpoint", "string", length=128, nullable=False),
	24	+ ColumnDefinition("mtls_gateway_active_key", "string", length=128, nullable=True),
	25	+ ColumnDefinition("mtls_runtime_active_key", "string", length=128, nullable=True),
	26	+ ColumnDefinition("gateway_cert_fingerprint", "string", length=128, nullable=False),
	27	+ ColumnDefinition("runtime_cert_fingerprint", "string", length=128, nullable=False),
	28	+ ColumnDefinition("agentserver_cert_fingerprint", "string", length=128, nullable=False),
	29	+ ColumnDefinition("trust_bundle_ref", "string", length=512, nullable=False),
	30	+ ColumnDefinition("status", "string", length=32, nullable=False, default="bound"),
	31	+ ColumnDefinition("bound_at", "datetime", nullable=False),
	32	+ ColumnDefinition("unbound_at", "datetime", nullable=True),
	33	+ ColumnDefinition("created_at", "datetime", nullable=False),
	34	+ ColumnDefinition("updated_at", "datetime", nullable=False),
	35	+ ColumnDefinition("updated_by", "string", length=64, nullable=False),
	36	+ ColumnDefinition("data", "json", nullable=True),
	37	+ ],
	38	+ indexes=[
	39	+ IndexDefinition(["mtls_binding_id"], unique=True, name="uq_link_binding_mtls_binding_id"),
	40	+ IndexDefinition(
	41	+ ["mtls_gateway_active_key"], unique=True, name="uq_link_binding_gateway_active"
	42	+ ),
	43	+ IndexDefinition(
	44	+ ["mtls_runtime_active_key"], unique=True, name="uq_link_binding_runtime_active"
	45	+ ),
	46	+ IndexDefinition(["status"], unique=False, name="ix_link_binding_status"),
	47	+ ],
	48	+)

Mapplications/manager/manager_server/src/manager_server/models/table_init.py+15-13

	@@ -7,33 +7,34 @@ from openjiuwen_runtime.foundation.db.sqlalchemy_handler import SQLAlchemyHandle
7	from sqlalchemy import inspect, text	7	from sqlalchemy import inspect, text
8	from sqlalchemy.exc import DBAPIError	8	from sqlalchemy.exc import DBAPIError
9		9
		10	+from manager_server.models.application_config_models import (
		11	+ _MEMORY_CONFIG_TABLE_DEF,
		12	+ _TASK_MEMORY_CONFIG_TABLE_DEF,
		13	+ LOG_MASKING_RULE_TABLE_DEF,
		14	+ LOGGING_CONFIG_TABLE_DEF,
		15	+)
		16	+from manager_server.models.instance_access_models import INSTANCE_ACCESS_TABLE_DEFINITIONS
10	from manager_server.models.instance_models import INSTANCE_INFO_TABLE_DEF	17	from manager_server.models.instance_models import INSTANCE_INFO_TABLE_DEF
		18	+from manager_server.models.instance_resource_models import INSTANCE_RESOURCE_TABLE_DEFINITIONS
		19	+from manager_server.models.jid_template_ref_models import (
		20	+ JID_TEMPLATE_REF_TABLE_DEF,
		21	+)
11	from manager_server.models.key_models import (	22	from manager_server.models.key_models import (
12	INSTANCE_ENC_PUBKEY_TABLE_DEF,	23	INSTANCE_ENC_PUBKEY_TABLE_DEF,
13	MANAGER_IDENTITY_TABLE_DEF,	24	MANAGER_IDENTITY_TABLE_DEF,
14	)	25	)
15	-from manager_server.models.application_config_models import (	26	+from manager_server.models.link_binding_models import INSTANCE_LINK_BINDING_TABLE_DEF
16	- LOG_MASKING_RULE_TABLE_DEF,
17	- LOGGING_CONFIG_TABLE_DEF,
18	- _TASK_MEMORY_CONFIG_TABLE_DEF,
19	- _MEMORY_CONFIG_TABLE_DEF,
20	-)
21	-from manager_server.models.jid_template_ref_models import (
22	- JID_TEMPLATE_REF_TABLE_DEF,
23	-)
24	-from manager_server.models.instance_access_models import INSTANCE_ACCESS_TABLE_DEFINITIONS
25	-from manager_server.models.instance_resource_models import INSTANCE_RESOURCE_TABLE_DEFINITIONS
26	from manager_server.models.template_models import (	27	from manager_server.models.template_models import (
27	A2A_ACCESS_POLICY_TEMPLATE_TABLE_DEF,	28	A2A_ACCESS_POLICY_TEMPLATE_TABLE_DEF,
28	A2A_DISCOVERY_SETTINGS_TABLE_DEF,	29	A2A_DISCOVERY_SETTINGS_TABLE_DEF,
29	- A2A_OUTBOUND_TEMPLATE_TABLE_DEF,
30	A2A_OUTBOUND_DISCOVERY_TABLE_DEF,	30	A2A_OUTBOUND_DISCOVERY_TABLE_DEF,
		31	+ A2A_OUTBOUND_TEMPLATE_TABLE_DEF,
31	AGENT_TEMPLATE_TABLE_DEF,	32	AGENT_TEMPLATE_TABLE_DEF,
32	EMBEDDING_TEMPLATE_TABLE_DEF,	33	EMBEDDING_TEMPLATE_TABLE_DEF,
33	EXTENSION_CONFIG_TEMPLATE_TABLE_DEF,	34	EXTENSION_CONFIG_TEMPLATE_TABLE_DEF,
		35	+ MCP_TEMPLATE_TABLE_DEF,
34	MODEL_TEMPLATE_TABLE_DEF,	36	MODEL_TEMPLATE_TABLE_DEF,
35	PERMISSIONS_TEMPLATE_TABLE_DEF,	37	PERMISSIONS_TEMPLATE_TABLE_DEF,
36	- MCP_TEMPLATE_TABLE_DEF,
37	SERVICE_CONFIG_CONTAINER_TABLE_DEF,	38	SERVICE_CONFIG_CONTAINER_TABLE_DEF,
38	SERVICE_CONFIG_TEMPLATE_TABLE_DEF,	39	SERVICE_CONFIG_TEMPLATE_TABLE_DEF,
39	SKILL_PREBUILT_TEMPLATE_TABLE_DEF,	40	SKILL_PREBUILT_TEMPLATE_TABLE_DEF,
	@@ -41,6 +42,7 @@ from manager_server.models.template_models import (
41		42
42	ALL_TABLE_DEFINITIONS = (	43	ALL_TABLE_DEFINITIONS = (
43	INSTANCE_INFO_TABLE_DEF,	44	INSTANCE_INFO_TABLE_DEF,
		45	+ INSTANCE_LINK_BINDING_TABLE_DEF,
44	MANAGER_IDENTITY_TABLE_DEF,	46	MANAGER_IDENTITY_TABLE_DEF,
45	INSTANCE_ENC_PUBKEY_TABLE_DEF,	47	INSTANCE_ENC_PUBKEY_TABLE_DEF,
46	_TASK_MEMORY_CONFIG_TABLE_DEF,	48	_TASK_MEMORY_CONFIG_TABLE_DEF,

Mapplications/manager/manager_server/src/manager_server/routers/instance_routers.py+73-14

	@@ -5,16 +5,21 @@ Gateway / Runtime 存活由 Manager 周期探活 ``*_config_host`` 健康检查
5		5
6	from __future__ import annotations	6	from __future__ import annotations
7		7
8	-from typing import Annotated, Any	8	+from typing import Annotated
9		9
10	from fastapi import APIRouter, Depends, HTTPException, Query	10	from fastapi import APIRouter, Depends, HTTPException, Query
11	from openjiuwen_runtime.foundation.db.handler import DBHandler	11	from openjiuwen_runtime.foundation.db.handler import DBHandler
12		12
13	from manager_server.core.instance import InstanceService	13	from manager_server.core.instance import InstanceService
14	-from manager_server.infrastructure.db import get_db_handler	14	+from manager_server.core.instance.link_binding_service import (
		15	+ InstanceLinkBindingService,
		16	+ LinkBindingConflict,
		17	+)
15	from manager_server.core.instance.pod_status_cache import (	18	from manager_server.core.instance.pod_status_cache import (
16	get_pod_status_snapshot,	19	get_pod_status_snapshot,
17	)	20	)
		21	+from manager_server.infrastructure.db import get_db_handler
		22	+from manager_server.routers.deps import AdminUser
18	from manager_server.schedulers.heartbeat_scanner import scan_instance_health_once	23	from manager_server.schedulers.heartbeat_scanner import scan_instance_health_once
19	from manager_server.schemas.common_schemas import ResponseModel	24	from manager_server.schemas.common_schemas import ResponseModel
20	from manager_server.schemas.instance_schemas import (	25	from manager_server.schemas.instance_schemas import (
	@@ -22,6 +27,7 @@ from manager_server.schemas.instance_schemas import (
22	InstanceListQuery,	27	InstanceListQuery,
23	InstanceUpdateBody,	28	InstanceUpdateBody,
24	)	29	)
		30	+from manager_server.schemas.link_binding_schemas import LinkBindingCreateBody
25		31
26	instance_router = APIRouter()	32	instance_router = APIRouter()
27		33
	@@ -30,6 +36,10 @@ def _svc(handler: DBHandler) -> InstanceService:
30	return InstanceService(handler)	36	return InstanceService(handler)
31		37
32		38
		39	+def _link_svc(handler: DBHandler) -> InstanceLinkBindingService:
		40	+ return InstanceLinkBindingService(handler)
		41	+
		42	+
33	def _request_volume_value(bv: dict, key: str, legacy_key: str \| None = None) -> int:	43	def _request_volume_value(bv: dict, key: str, legacy_key: str \| None = None) -> int:
34	value = bv.get(key)	44	value = bv.get(key)
35	if value is None and legacy_key is not None:	45	if value is None and legacy_key is not None:
	@@ -41,9 +51,7 @@ def _normalize_request_volume(bv: dict) -> dict:
41	return {	51	return {
42	"gateway_queued": _request_volume_value(bv, "gateway_queued"),	52	"gateway_queued": _request_volume_value(bv, "gateway_queued"),
43	"gateway_running": _request_volume_value(bv, "gateway_running"),	53	"gateway_running": _request_volume_value(bv, "gateway_running"),
44	- "service_manager_queued": _request_volume_value(	54	+ "service_manager_queued": _request_volume_value(bv, "service_manager_queued", "sm_queued"),
45	- bv, "service_manager_queued", "sm_queued"
46	- ),
47	"service_manager_routing": _request_volume_value(	55	"service_manager_routing": _request_volume_value(
48	bv, "service_manager_routing", "sm_routing"	56	bv, "service_manager_routing", "sm_routing"
49	),	57	),
	@@ -58,16 +66,12 @@ def _normalize_request_volume(bv: dict) -> dict:
58		66
59		67
60	def _build_request_volume_summary(bv: dict) -> dict:	68	def _build_request_volume_summary(bv: dict) -> dict:
61	- queued_requests = _request_volume_value(	69	+ queued_requests = _request_volume_value(bv, "gateway_queued") + _request_volume_value(
62	- bv, "gateway_queued"
63	- ) + _request_volume_value(
64	bv, "service_manager_queued", "sm_queued"	70	bv, "service_manager_queued", "sm_queued"
65	)	71	)
66	running_requests = _request_volume_value(	72	running_requests = _request_volume_value(
67	bv, "service_manager_running", "sm_running"	73	bv, "service_manager_running", "sm_running"
68	- ) or _request_volume_value(	74	+ ) or _request_volume_value(bv, "gateway_running")
69	- bv, "gateway_running"
70	- )
71	return {	75	return {
72	"queued_requests": queued_requests,	76	"queued_requests": queued_requests,
73	"running_requests": running_requests,	77	"running_requests": running_requests,
	@@ -126,9 +130,7 @@ async def update_instance(
126		130
127		131
128	@instance_router.get("/{jiuwenclaw_id}", response_model=ResponseModel)	132	@instance_router.get("/{jiuwenclaw_id}", response_model=ResponseModel)
129	-async def get_instance(	133	+async def get_instance(jiuwenclaw_id: str, handler: Annotated[DBHandler, Depends(get_db_handler)]):
130	- jiuwenclaw_id: str, handler: Annotated[DBHandler, Depends(get_db_handler)]
131	-):
132	svc = _svc(handler)	134	svc = _svc(handler)
133	row = await svc.get(jiuwenclaw_id)	135	row = await svc.get(jiuwenclaw_id)
134	if row is None:	136	if row is None:
	@@ -150,6 +152,63 @@ async def delete_instance(
150	return ResponseModel(code=200, message="success", data={"deleted": True})	152	return ResponseModel(code=200, message="success", data={"deleted": True})
151		153
152		154
		155	+@instance_router.put("/{jiuwenclaw_id}/link-binding", response_model=ResponseModel)
		156	+async def bind_instance_link(
		157	+ jiuwenclaw_id: str,
		158	+ body: LinkBindingCreateBody,
		159	+ handler: Annotated[DBHandler, Depends(get_db_handler)],
		160	+ admin: AdminUser,
		161	+):
		162	+ """建立当前有效的 Gateway ↔ Runtime 绑定；完全相同请求幂等。"""
		163	+ _ = admin
		164	+ try:
		165	+ binding = await _link_svc(handler).bind(jiuwenclaw_id, body)
		166	+ except LookupError as exc:
		167	+ raise HTTPException(status_code=404, detail=str(exc)) from exc
		168	+ except LinkBindingConflict as exc:
		169	+ raise HTTPException(status_code=409, detail=str(exc)) from exc
		170	+ return ResponseModel(code=200, message="success", data=binding.model_dump())
		171	+
		172	+
		173	+@instance_router.get("/{jiuwenclaw_id}/link-binding", response_model=ResponseModel)
		174	+async def get_instance_link_binding(
		175	+ jiuwenclaw_id: str,
		176	+ handler: Annotated[DBHandler, Depends(get_db_handler)],
		177	+ admin: AdminUser,
		178	+):
		179	+ _ = admin
		180	+ binding = await _link_svc(handler).get(jiuwenclaw_id)
		181	+ if binding is None:
		182	+ raise HTTPException(status_code=404, detail="link binding not found")
		183	+ return ResponseModel(code=200, message="success", data=binding.model_dump())
		184	+
		185	+
		186	+@instance_router.delete("/{jiuwenclaw_id}/link-binding", response_model=ResponseModel)
		187	+async def unbind_instance_link(
		188	+ jiuwenclaw_id: str,
		189	+ handler: Annotated[DBHandler, Depends(get_db_handler)],
		190	+ admin: AdminUser,
		191	+ updated_by: str = Query("system", min_length=1, max_length=64),
		192	+):
		193	+ _ = admin
		194	+ try:
		195	+ binding, rotation_required = await _link_svc(handler).unbind(
		196	+ jiuwenclaw_id, updated_by=updated_by
		197	+ )
		198	+ except LookupError as exc:
		199	+ raise HTTPException(status_code=404, detail=str(exc)) from exc
		200	+ except LinkBindingConflict as exc:
		201	+ raise HTTPException(status_code=409, detail=str(exc)) from exc
		202	+ return ResponseModel(
		203	+ code=200,
		204	+ message="success",
		205	+ data={
		206	+ **binding.model_dump(),
		207	+ "rotation_required": rotation_required,
		208	+ },
		209	+ )
		210	+
		211	+
153	@instance_router.get("/{jiuwenclaw_id}/pods", response_model=ResponseModel)	212	@instance_router.get("/{jiuwenclaw_id}/pods", response_model=ResponseModel)
154	async def get_instance_pods(	213	async def get_instance_pods(
155	jiuwenclaw_id: str,	214	jiuwenclaw_id: str,

Aapplications/manager/manager_server/src/manager_server/schemas/link_binding_schemas.py+77-0

@@ -0,0 +1,77 @@
	1	+"""实例链路绑定 API 模型。"""
	2	+
	3	+from __future__ import annotations
	4	+
	5	+from typing import Any
	6	+
	7	+from pydantic import BaseModel, Field, field_validator, model_validator
	8	+
	9	+_SHA256_PATTERN = r"^[0-9a-f]{64}$"
	10	+
	11	+
	12	+class LinkBindingCreateBody(BaseModel):
	13	+ mtls_binding_id: str = Field(..., min_length=1, max_length=64)
	14	+ mtls_binding_epoch: int = Field(..., ge=1)
	15	+ mtls_gateway_endpoint: str = Field(..., min_length=1, max_length=128)
	16	+ mtls_runtime_endpoint: str = Field(..., min_length=1, max_length=128)
	17	+ manager_cert_fingerprint: str = Field(..., pattern=_SHA256_PATTERN)
	18	+ gateway_cert_fingerprint: str = Field(..., pattern=_SHA256_PATTERN)
	19	+ runtime_cert_fingerprint: str = Field(..., pattern=_SHA256_PATTERN)
	20	+ agentserver_cert_fingerprint: str = Field(..., pattern=_SHA256_PATTERN)
	21	+ trust_bundle_ref: str = Field(..., min_length=1, max_length=512)
	22	+ updated_by: str = Field(default="system", min_length=1, max_length=64)
	23	+ data: dict[str, Any] \| None = None
	24	+
	25	+ @field_validator(
	26	+ "mtls_binding_id",
	27	+ "mtls_gateway_endpoint",
	28	+ "mtls_runtime_endpoint",
	29	+ "trust_bundle_ref",
	30	+ "updated_by",
	31	+ mode="before",
	32	+ )
	33	+ @classmethod
	34	+ def strip_required_text(cls, value: Any) -> Any:
	35	+ if isinstance(value, str):
	36	+ value = value.strip()
	37	+ if not value:
	38	+ raise ValueError("value must not be blank")
	39	+ return value
	40	+
	41	+ @field_validator(
	42	+ "manager_cert_fingerprint",
	43	+ "gateway_cert_fingerprint",
	44	+ "runtime_cert_fingerprint",
	45	+ "agentserver_cert_fingerprint",
	46	+ mode="before",
	47	+ )
	48	+ @classmethod
	49	+ def normalize_fingerprint(cls, value: Any) -> Any:
	50	+ return value.strip().lower() if isinstance(value, str) else value
	51	+
	52	+ @model_validator(mode="after")
	53	+ def validate_distinct_endpoints(self) -> LinkBindingCreateBody:
	54	+ if self.mtls_gateway_endpoint.strip() == self.mtls_runtime_endpoint.strip():
	55	+ raise ValueError("mtls_gateway_endpoint and mtls_runtime_endpoint must differ")
	56	+ return self
	57	+
	58	+
	59	+class LinkBindingView(BaseModel):
	60	+ jiuwenclaw_id: str
	61	+ mtls_binding_id: str
	62	+ mtls_binding_epoch: int
	63	+ protocol_version: str
	64	+ mtls_gateway_endpoint: str
	65	+ mtls_runtime_endpoint: str
	66	+ manager_cert_fingerprint: str
	67	+ gateway_cert_fingerprint: str
	68	+ runtime_cert_fingerprint: str
	69	+ agentserver_cert_fingerprint: str
	70	+ trust_bundle_ref: str
	71	+ status: str
	72	+ bound_at: str
	73	+ unbound_at: str \| None = None
	74	+ created_at: str
	75	+ updated_at: str
	76	+ updated_by: str
	77	+ data: dict[str, Any] \| None = None

Aapplications/manager/manager_server/src/manager_server/security/link_mtls.py+287-0

@@ -0,0 +1,287 @@
	1	+"""Optional multi-instance Manager client for authenticated internal links.
	2	+
	3	+The installed certificate identifies the Manager service. Target instance
	4	+identity, binding ID, epoch and peer pin come from ``instance_link_binding``;
	5	+they are deliberately not inferred from the Manager certificate profile's
	6	+deployment bootstrap ID.
	7	+"""
	8	+
	9	+from __future__ import annotations
	10	+
	11	+import logging
	12	+import os
	13	+import ssl
	14	+from dataclasses import dataclass
	15	+from pathlib import Path
	16	+from typing import Any
	17	+from urllib.parse import urlsplit
	18	+
	19	+from openjiuwen_runtime.foundation.db.handler import DBHandler
	20	+from openjiuwen_runtime.foundation.security.link_mtls_config import (
	21	+ MODE_ENV,
	22	+ MTLS_BINDING_EPOCH_HEADER,
	23	+ MTLS_BINDING_ID_HEADER,
	24	+)
	25	+from openjiuwen_runtime.foundation.security.link_mtls_config import (
	26	+ LinkMTLSMode as ManagerLinkMTLSMode,
	27	+)
	28	+from openjiuwen_runtime.foundation.security.link_profile import (
	29	+ LinkProfile,
	30	+ LinkProfileError,
	31	+ load_service_identity,
	32	+)
	33	+
	34	+from manager_server.models.link_binding_models import INSTANCE_LINK_BINDING_TABLE_DEF
	35	+
	36	+logger = logging.getLogger(__name__)
	37	+
	38	+ManagerLinkMTLSError = LinkProfileError
	39	+
	40	+
	41	+@dataclass(frozen=True)
	42	+class ManagerLinkTarget:
	43	+ endpoint: str
	44	+ headers: dict[str, str]
	45	+ client_kwargs: dict[str, Any]
	46	+
	47	+
	48	+def _env(name: str) -> str:
	49	+ return (os.getenv(name) or "").strip()
	50	+
	51	+
	52	+@dataclass(frozen=True)
	53	+class ManagerLinkMTLSConfig:
	54	+ mode: ManagerLinkMTLSMode
	55	+ profile: LinkProfile \| None = None
	56	+ ca_file: str \| None = None
	57	+ cert_file: str \| None = None
	58	+ key_file: str \| None = None
	59	+
	60	+ @classmethod
	61	+ def from_env(cls) -> ManagerLinkMTLSConfig:
	62	+ try:
	63	+ mode = ManagerLinkMTLSMode(_env(MODE_ENV) or "off")
	64	+ except ValueError as exc:
	65	+ raise ManagerLinkMTLSError("invalid link mTLS mode") from exc
	66	+ if mode is ManagerLinkMTLSMode.OFF:
	67	+ return cls(mode=mode)
	68	+ try:
	69	+ profile = load_service_identity("manager")
	70	+ except (ValueError, OSError) as exc:
	71	+ if mode is ManagerLinkMTLSMode.ENFORCE:
	72	+ raise ManagerLinkMTLSError(str(exc)) from exc
	73	+ logger.warning("manager observe preflight failed: %s", exc)
	74	+ return cls(mode=mode)
	75	+ if mode is ManagerLinkMTLSMode.OBSERVE:
	76	+ return cls(mode=mode)
	77	+ return cls(
	78	+ mode=mode,
	79	+ profile=profile,
	80	+ ca_file=profile.ca_file,
	81	+ cert_file=profile.cert_file,
	82	+ key_file=profile.key_file,
	83	+ )
	84	+
	85	+ def resolve_endpoint(self, url: str, *, role: str) -> str:
	86	+ if self.profile is not None:
	87	+ return self.profile.endpoint(url, role=role)
	88	+ self.require_secure_url(url, label=role)
	89	+ return url
	90	+
	91	+ def client_kwargs(self, *, role: str) -> dict:
	92	+ if not self.enforced:
	93	+ return {}
	94	+ if self.profile is None:
	95	+ raise ManagerLinkMTLSError("enforce requires a pinned manager profile")
	96	+ return self.profile.client_kwargs(role=role)
	97	+
	98	+ def health_client_kwargs(self) -> dict:
	99	+ """mTLS preflight before a Manager instance/binding row exists.
	100	+
	101	+ Health checks authenticate the shared trust chain and hostname and
	102	+ present the Manager certificate, but cannot pin a target leaf until
	103	+ the instance-specific binding has been registered. Configuration
	104	+ writes always use :meth:`target` and its exact database fingerprint.
	105	+ """
	106	+ if not self.enforced:
	107	+ return {}
	108	+ if self.profile is None:
	109	+ raise ManagerLinkMTLSError("enforce requires a pinned manager profile")
	110	+ self.profile.current()
	111	+ return {"verify": self.profile.ssl_context()}
	112	+
	113	+ @property
	114	+ def enforced(self) -> bool:
	115	+ return self.mode is ManagerLinkMTLSMode.ENFORCE
	116	+
	117	+ def client_ssl_context(self) -> ssl.SSLContext \| None:
	118	+ if not self.ca_file or not self.cert_file or not self.key_file:
	119	+ return None
	120	+ context = ssl.create_default_context(
	121	+ purpose=ssl.Purpose.SERVER_AUTH,
	122	+ cafile=self.ca_file,
	123	+ )
	124	+ context.minimum_version = ssl.TLSVersion.TLSv1_2
	125	+ context.check_hostname = True
	126	+ context.verify_mode = ssl.CERT_REQUIRED
	127	+ context.load_cert_chain(self.cert_file, self.key_file)
	128	+ return context
	129	+
	130	+ def require_secure_url(self, url: str, *, label: str) -> None:
	131	+ if self.enforced and urlsplit(url).scheme.lower() != "https":
	132	+ raise ManagerLinkMTLSError(
	133	+ f"{label} must use https:// when {MODE_ENV}=enforce: {url!r}"
	134	+ )
	135	+
	136	+ async def binding_headers(
	137	+ self, handler: DBHandler \| None, jiuwenclaw_id: str
	138	+ ) -> dict[str, str]:
	139	+ if not self.enforced:
	140	+ return {}
	141	+ jid = str(jiuwenclaw_id or "").strip()
	142	+ if handler is None:
	143	+ raise ManagerLinkMTLSError("binding database is required in enforce mode")
	144	+ row = await self._binding_row(handler, jid)
	145	+ return self._headers(row)
	146	+
	147	+ async def target(
	148	+ self,
	149	+ handler: DBHandler \| None,
	150	+ jiuwenclaw_id: str,
	151	+ *,
	152	+ role: str,
	153	+ endpoint: str,
	154	+ ) -> ManagerLinkTarget:
	155	+ """Resolve one instance without coupling the Manager cert to its ID."""
	156	+ if role not in {"gateway", "runtime"}:
	157	+ raise ManagerLinkMTLSError("Manager target role must be gateway or runtime")
	158	+ resolved = self.resolve_endpoint(endpoint, role=role)
	159	+ if not self.enforced:
	160	+ return ManagerLinkTarget(resolved, {}, {})
	161	+ if self.profile is None:
	162	+ raise ManagerLinkMTLSError("enforce requires a pinned manager profile")
	163	+ if handler is None:
	164	+ raise ManagerLinkMTLSError("binding database is required in enforce mode")
	165	+ jid = str(jiuwenclaw_id or "").strip()
	166	+ row = await self._binding_row(handler, jid)
	167	+ bound_endpoint = str(getattr(row, f"mtls_{role}_endpoint", "") or "").strip()
	168	+ if _endpoint_authority(resolved) != _endpoint_authority(bound_endpoint):
	169	+ raise ManagerLinkMTLSError(
	170	+ f"{role} endpoint does not match the active mTLS link binding"
	171	+ )
	172	+ fingerprint_field = f"{role}_cert_fingerprint"
	173	+ expected_fingerprint = str(getattr(row, fingerprint_field, "") or "").strip()
	174	+ if not expected_fingerprint:
	175	+ raise ManagerLinkMTLSError(f"active link binding has no {role} certificate fingerprint")
	176	+ ca_file = self._trust_bundle_file(row)
	177	+ return ManagerLinkTarget(
	178	+ resolved,
	179	+ self._headers(row),
	180	+ self.profile.client_kwargs(
	181	+ role=role,
	182	+ expected_fingerprints={expected_fingerprint},
	183	+ ca_file=ca_file,
	184	+ ),
	185	+ )
	186	+
	187	+ async def _binding_row(self, handler: DBHandler, jid: str) -> Any:
	188	+ if not jid:
	189	+ raise ManagerLinkMTLSError("jiuwenclaw_id is required")
	190	+ row: Any = await handler.get(
	191	+ INSTANCE_LINK_BINDING_TABLE_DEF.table_name,
	192	+ {"jiuwenclaw_id": jid},
	193	+ )
	194	+ if row is None and self.profile is not None:
	195	+ from manager_server.core.instance.link_binding_service import (
	196	+ InstanceLinkBindingService,
	197	+ LinkBindingConflict,
	198	+ )
	199	+
	200	+ try:
	201	+ await InstanceLinkBindingService(handler).adopt_deployment_profile(
	202	+ jid, self.profile
	203	+ )
	204	+ except (LinkBindingConflict, LookupError) as exc:
	205	+ # Two Manager workers can observe the missing row together.
	206	+ # Accept the winner's committed row; preserve real endpoint or
	207	+ # uniqueness conflicts when no row was created for this ID.
	208	+ concurrent = await handler.get(
	209	+ INSTANCE_LINK_BINDING_TABLE_DEF.table_name,
	210	+ {"jiuwenclaw_id": jid},
	211	+ )
	212	+ if concurrent is None:
	213	+ raise ManagerLinkMTLSError(str(exc)) from exc
	214	+ row = await handler.get(
	215	+ INSTANCE_LINK_BINDING_TABLE_DEF.table_name,
	216	+ {"jiuwenclaw_id": jid},
	217	+ )
	218	+ if row is None or str(getattr(row, "status", "")) != "bound":
	219	+ raise ManagerLinkMTLSError(f"no active link binding for jiuwenclaw_id={jid!r}")
	220	+ self._validate_manager_identity(row)
	221	+ return row
	222	+
	223	+ def _validate_manager_identity(self, row: Any) -> None:
	224	+ if self.profile is None:
	225	+ raise ManagerLinkMTLSError("enforce requires a pinned manager profile")
	226	+ data = row.data if isinstance(getattr(row, "data", None), dict) else {}
	227	+ expected = str(data.get("manager_cert_fingerprint", "") or "").strip()
	228	+ if not expected:
	229	+ raise ManagerLinkMTLSError("active link binding has no Manager certificate fingerprint")
	230	+ from openjiuwen_runtime.foundation.security.link_profile import cert_fingerprint
	231	+
	232	+ if cert_fingerprint(self.profile.cert_file) != expected:
	233	+ raise ManagerLinkMTLSError(
	234	+ "installed Manager certificate is not authorized for this instance binding"
	235	+ )
	236	+
	237	+ @staticmethod
	238	+ def _headers(row: Any) -> dict[str, str]:
	239	+ epoch = int(getattr(row, "mtls_binding_epoch", 0) or 0)
	240	+ mtls_binding_id = str(getattr(row, "mtls_binding_id", "") or "").strip()
	241	+ if not mtls_binding_id or epoch <= 0:
	242	+ raise ManagerLinkMTLSError("invalid active mTLS link binding")
	243	+ return {
	244	+ MTLS_BINDING_ID_HEADER: mtls_binding_id,
	245	+ MTLS_BINDING_EPOCH_HEADER: str(epoch),
	246	+ }
	247	+
	248	+ def _trust_bundle_file(self, row: Any) -> str:
	249	+ if self.profile is None:
	250	+ raise ManagerLinkMTLSError("enforce requires a pinned manager profile")
	251	+ reference = str(getattr(row, "trust_bundle_ref", "") or "").strip()
	252	+ if reference == "profile://ca":
	253	+ return self.profile.ca_file
	254	+ if reference.startswith("file://"):
	255	+ path = Path(reference.removeprefix("file://"))
	256	+ if not path.is_absolute() or not path.is_file():
	257	+ raise ManagerLinkMTLSError("binding trust bundle file is unavailable")
	258	+ return str(path)
	259	+ raise ManagerLinkMTLSError(
	260	+ "unsupported trust bundle reference; mount it and use file:///absolute/path"
	261	+ )
	262	+
	263	+
	264	+def httpx_verify(config: ManagerLinkMTLSConfig) -> ssl.SSLContext \| bool:
	265	+ """Return an httpx ``verify`` value without changing the default off path."""
	266	+ return config.client_ssl_context() or True
	267	+
	268	+
	269	+def _endpoint_authority(value: str) -> str:
	270	+ text = str(value or "").strip()
	271	+ if not text:
	272	+ return ""
	273	+ parsed = urlsplit(text if "://" in text else f"//{text}")
	274	+ try:
	275	+ valid = (
	276	+ parsed.scheme in {"", "http", "https"}
	277	+ and parsed.hostname
	278	+ and parsed.port
	279	+ and not parsed.username
	280	+ and not parsed.password
	281	+ and parsed.path in {"", "/"}
	282	+ and not parsed.query
	283	+ and not parsed.fragment
	284	+ )
	285	+ except ValueError:
	286	+ return ""
	287	+ return parsed.netloc.lower() if valid else ""

Mapplications/manager/manager_server/tests/unit_tests/manager/test_instance_data_lifecycle_purge.py+1-0

	@@ -75,6 +75,7 @@ async def test_purge_runtime_pushes_empty_projection():
75	@pytest.mark.asyncio	75	@pytest.mark.asyncio
76	async def test_purge_runtime_skips_when_endpoint_empty():	76	async def test_purge_runtime_skips_when_endpoint_empty():
77	handler = AsyncMock()	77	handler = AsyncMock()
		78	+ handler.get = AsyncMock(return_value=None) # Neither instance-specific nor global endpoint.
78	with (	79	with (
79	patch(	80	patch(
80	"manager_server.infrastructure.config.settings.agent_runtime_endpoint",	81	"manager_server.infrastructure.config.settings.agent_runtime_endpoint",

Aapplications/manager/manager_server/tests/unit_tests/manager/test_link_binding_service.py+251-0

Aapplications/manager/manager_server/tests/unit_tests/manager/test_link_profile_manager.py+192-0

Aapplications/manager/manager_server/tests/unit_tests/manager/test_runtime_config_sync_link.py+22-0

Adocs/zh/内部链路mTLS接入.md+49-0

Afoundation/openjiuwen_runtime/foundation/security/link_certificate_bundle.py+297-0

Afoundation/openjiuwen_runtime/foundation/security/link_material_deploy.py+353-0

Afoundation/openjiuwen_runtime/foundation/security/link_material_store.py+372-0

Afoundation/openjiuwen_runtime/foundation/security/link_material_sync.py+90-0

Afoundation/openjiuwen_runtime/foundation/security/link_mtls_config.py+53-0

Afoundation/openjiuwen_runtime/foundation/security/link_profile.py+436-0

Afoundation/openjiuwen_runtime/foundation/security/link_stream_guard.py+128-0

Afoundation/openjiuwen_runtime/foundation/security/link_transport.py+110-0

Mfoundation/pyproject.toml+11-3

Afoundation/tests/link_mtls_helpers.py+62-0

Afoundation/tests/unit_tests/test_link_material_deploy.py+187-0

Afoundation/tests/unit_tests/test_link_material_store.py+264-0

Afoundation/tests/unit_tests/test_link_profile.py+334-0

Afoundation/tests/unit_tests/test_link_profile_atomic_update.py+84-0

Afoundation/tests/unit_tests/test_link_stream_guard.py+140-0