From cb39a13b766f4a7fed6ac7dcd85ff8becb932036 Mon Sep 17 00:00:00 2001 From: Qiu Yuzhou Date: Sat, 3 Oct 2026 11:14:22 +0800 Subject: [PATCH] docs: define Runtime convergence in the domain vocabulary MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 「运行时收敛」此前只以不变量描述（有效值未变的提交不做收敛工作）散见于 各条目，现在作为独立词条定义：GUI 侧把派生运行时定义落到部署的操作—— 持久化 intent、重展开已提交目录、派生运行时文档、计划执行部署动作、验证 启动健康、失败整体回滚；派生字节未变且运行态健康时不做任何收敛工作。 顺带收录 pre-commit swift-format 对收敛脊柱文件的一处花括号重排。 --- CONTEXT.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CONTEXT.md b/CONTEXT.md index 0aaec40b..1a1ab94f 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -52,6 +52,7 @@ - **Legacy import**: The user-confirmed, read-only translation of a Legacy configuration's server records into a separate manual group in 2.0. It migrates no preferences, activates no target, and neither starts proxying nor alters the Legacy source. - **Runtime configuration file**: The derived JSON document used by the external tunnel service for the active target. It carries only connection-effective values (endpoints, credentials, encryption, plugin, listeners, ACL); user-visible display names are catalog metadata and never enter the file. Fields NG2 omits are left to the bundled `sslocal` defaults; the file is not the user-managed server configuration or subscription document. - **Prepared runtime contract**: A deployment-local value holding one runtime document, its encoded JSON bytes, and the digest of those bytes. Planning, persistence, and that deployment's health confirmation share the value; it is not a cache of disk state. +- **Runtime convergence**: The GUI-side operation that aligns the deployed runtime with one derived runtime definition: it persists the supplied intent, re-expands the committed catalog, derives the runtime document, plans and executes deployment actions, verifies launch health, and restores the previous definition as a whole on failure. A change whose derived contract bytes are unchanged against a healthy running runtime performs no convergence work: no contract write, no reload signal, no restart, no launch health re-probe, and no system-proxy reconvergence. - **Sensitive information**: Server passwords, plugin options (sensitive in their entirety), and nonempty user-provided remote URLs, including subscription URLs. - **Credential exposure boundary**: This product reduces accidental disclosure and exposure to other user accounts, but does not guarantee protection against a compromised same-user process, root access, or APFS snapshots and backups; it does not promise secure erasure. - **Credential reference**: A non-secret association from a server configuration, subscription, or remote-URL setting to its durable credential; the credential value is kept outside the configuration tree and resolved only when needed.