aaaamoooo
ad18e16ac6
One credential set per customer (UUID + 32-byte root relay key + shortId)
lives on the customer record; node bindings no longer store credentials.
SS2022 user keys derive deterministically from the root key by method
length (16/24/32-byte prefix), so a single password serves every protocol,
matching 3x-ui's per-client credential model. Reality public keys stay a
node property and are shown per binding in the credentials pane.
- store: load-time convergence — first binding's set wins; a converged
password that is not a 32-byte root key is regenerated (uuid/shortId
preserved); bindings are stripped; idempotent, covered by tests
- deploy: the orchestrator stamps the customer's set onto a build copy;
subscriptions resolve the same set; the derivation applies in both the
inbound builder and the URI builder (verified live: Alice's N1 link is
byte-identical to the pre-change seed expectation, her N2 user key is
exactly the root key's 16-byte prefix)
- API: GET /api/customers/:id/credentials returns {credentials, bindings};
regenerate is now POST /api/customers/:id/credentials/regenerate and
rotates the whole set, rebuilding every deployed node of the customer
- UI: credentials pane shows the single shared set plus per-binding
node/protocol/Reality-public-key rows
- golden subscriptions fixture regenerated under one shared set (RF and
SS entries byte-identical to before; five entries audited by hand)
- golden baseline re-captured for the new shapes; difftest normalizer now
treats a base64 root key's prefix-truncation encodings and the Surge
'='-mangled variants as the same secret
Go 面板金标准回归基线（golden）
2026-10-21 起 Node 实现冻结退役、Go 单一真源，difftest（Node 差分）随之退役。 本目录把 Go 面板在种子库上的当前行为冻结为回归基线，替代 difftest 的 守门角色：
golden.mjs— 抓取/校验脚本。复用../difftest/的种子库（seed.json） 与学习式 Normalizer（../difftest/lib.mjs）：以种子副本启动一个 Go 面板， 按固定剧本驱动（登录 → 种子 agent 心跳 → 列表 → 凭据 → 订阅全格式 → 建服务器/注册 agent → 建客户/节点/分配/部署并 drain 部署任务 → 用量上报 两轮 → 呈现投影 → UI 式全量 PATCH 节点 →/api/system结构 → 备份导出 → 错误用例），全部响应归一化后存入golden.json（25 个 section）。golden.json— 冻结的行为快照（2026-10-21，基线提交时的 Go 现状， 二进制由 HEAD156a31c构建）。
用法：
node golden.mjs capture [--bin /path/to/nexusgate-panel] # 重新冻结（仅在确认行为变更为预期时）
node golden.mjs verify [--bin /path/to/nexusgate-panel] # 与基线比对，有差异退出码 1 并打印首个 diff 路径
约定：
- verify 出现 diff 时，先判定是预期变更（本版 9 项修改各自的预期 diff 在 NEXT-ROUND-REPORT.md 中逐项登记）还是回归；预期变更在对应项提交里 一并重新 capture 并在提交说明中注明 section 名。
/api/system的数值多为实时采样，脚本只保留结构与确定性计数 （nodesTotal/customersTotal/online* /connections），其余数值与 IP 压成 占位；uptime 类键同样压平。其余 section 的数值都是剧本确定性结果， 逐字比对。- 剧本对时间的依赖已被窗口设计吸收（presence 180s 窗口、心跳在线判定）， 正常复跑应恒 PASS；偶发 FAIL 先复跑一次区分抖动与真回归。