Flynor Management

平台长期治理入口；Management 0.3.0 Registry 已提供版本化定义、组织主体操作权限、Author/Publisher 职责分离、服务端确认、可追溯审计、签名快照及同源 Console，Codex 管理原型仅保留设计参考。

展示名称管理系统

类型control-plane-application

成熟度试点

Owner平台治理组

职责与边界

负责

维护项目、能力、流程和策略定义
维护 Project Resource、Binding、同步策略和 Resource Adapter Reference
维护 Capability Definition、Provider Binding、能力授权与确认策略
发布不可变版本指针
生成只含已发布定义的签名快照
提供组织主体操作权限、职责分离与无正文审计

不负责

不执行重型项目知识计算
不承担一次任务的实时调度
不嵌入 Flynor Server

数据与接口

拥有的数据

版本化项目、能力、流程和策略定义
项目资源定义、绑定、同步策略与 Resource Adapter 引用
Capability Definition、Provider Binding 与授权策略
发布指针
Registry 审计记录

输入

管理员配置；已验证的项目与能力定义

输出

版本化定义；Ed25519 签名发布快照；Registry-backed 权限投影视图与 Author/Publisher 确认写入界面

协议

HTTPS JSON；flynor/management-definition/v1；flynor/management-publication/v1；flynor/management-principals/v1；flynor/management-session/v1；flynor/management-snapshot/v1；flynor/management-snapshot-envelope/v1；MCP

依赖

无平台内强依赖

运行与部署

Owner / 支持

平台治理组 · pilot · active；升级路径：平台治理组 → 架构评审

交付策略

standalone · limited；正式主数据使用独立 Management Registry；Codex 插件中的管理页面仍是演示客户端，不得作为事实源。

配置

版本化 Registry/Principal JSON Schema、绝对路径组织主体目录、外部 reader/author/publisher/operator Token、外部 Ed25519 签名私钥与 Codex 插件配置

部署

Management Registry 与 Registry Console 从同一自包含版本归档安装到 /opt/flynor-management/current，使用独立 Node.js + systemd + TLS 代理；目标机不需要 Monorepo 或 npm install；Codex 管理原型独立作为设计 artifact

健康检查

0.3.0 隔离 release rehearsal、registry doctor、/health/live、带 directoryRevision 的 /health/ready、Console 静态安全头、服务端确认、组织 RBAC、Author/Publisher、重启恢复、签名/验签、Server 消费与 MCP 查询

可观测性

platform-event/v1 与无正文审计同时记录 executionId/traceId、subjectRef、principalId、organizationId、directoryRevision、operation 和 target；快照发布事件只记录 revision、keyId 和数量

升级与回滚

安装不可变版本并 rehearsal 后原子切换 current；显式 migrate、迁移前备份、Schema 失败关闭；签名快照原子替换并保留 .previous；软件、数据和快照按 Runbook 一致回滚

limited默认

Management Registry 标准部署

提供版本化项目、能力、流程与策略定义的唯一正式事实源；管理演示页和 MCP 不保存第二份主状态

management-registry-standard · management · self-contained-node-systemd-reverse-proxy · immutable-release-directory / atomic-current-link / loopback-node-service / systemd / tls-reverse-proxy / persistent-registry-file / same-origin-confirmed-write-console / server-enforced-confirmed-write / organization-principal-directory / operation-rbac / distinct-human-author-publisher / ed25519-signed-snapshot / read-only-management-mcp-adapter

查看完整部署契约

前置条件

rehearsed self-contained Management Runtime archive
Node.js 20+
dedicated flynor-management non-login user distinct from Server
TLS reverse proxy
non-secret versioned organization principal directory with immutable subjectRef
external reader, author, publisher and operator tokens
external Ed25519 signing key
persistent data directory
read-only runtime artifact group when co-located

配置与交付物

release/management-runtime.manifest.json
apps/management/config/registry.example.json
apps/management/config/principals.example.json
apps/management/schemas/registry-config.schema.json
apps/management/schemas/management-principals.schema.json
/etc/flynor/management-registry.json
/etc/flynor/management-registry.env
/etc/flynor/management-snapshot.key
/var/lib/flynor/management-releases/management-snapshot.json

健康与验收

isolated Management Runtime release rehearsal
sh bin/accept-host
management registry doctor
systemd active
/health/live
/health/ready
Console permission projection, explicit confirmation and optimistic revision markers
HTTP server-enforced confirmation
operation RBAC and service-principal definition-write denial
distinct human Author create and Publisher publish fixture
reader sees published definitions only
signed snapshot generation and verification fixture
management MCP read fixture

备份范围

immutable release archives and source commit
persistent registry data file
automatic pre-migration backup
last verified signed snapshot and public key
versioned non-secret configuration
external secret and signing key through the approved secret-management process

升级

install and rehearse an immutable compatible archive, stop Console writes, back up registry data, atomically switch current, run explicit migrate and doctor, restart, verify revision and Admin/Reader projections, regenerate the signed snapshot, then verify Server consumption

回滚

switch current to the previous compatible immutable release and restore the pre-migration registry backup when required; restore the last verified .previous snapshot when only publication is wrong; never point old code at newer unsupported state