chore(cordis): persist merge.ours and isolate wavelet extras

Add a repo .gitconfig so merge=ours in .gitattributes can actually run.
Disable the Wavelet canary image workflow and keep docker-compose.yaml
as the OpenFlare default so a merge cannot ship the wrong product.

.gitattributes

@@ -3,3 +3,6 @@ backend/OpenFlare/**    merge=ours
 frontend/**             merge=ours
 docs/changelog/**       merge=ours
 docs/superpowers/**     merge=ours
+.github/workflows/build-image.yml merge=ours
+docker-compose.yml      merge=ours
+.gitconfig              merge=ours

.gitconfig

@@ -0,0 +1,10 @@
+# Repo-local Git settings. Git does not load this file automatically.
+# From the clone (or worktree) root:
+#   git config include.path ../.gitconfig
+# Worktree-safe:
+#   git config include.path "$(git rev-parse --show-toplevel)/.gitconfig"
+# Relative include.path is resolved against .git/config, so ../.gitconfig
+# is the repo root when .git is a directory (non-worktree clone).
+
+[merge "ours"]
+	driver = true

.github/workflows/build-image.yml

@@ -1,270 +1,22 @@
-name: Build Image
+name: Build Image (Wavelet upstream — isolated)
 
+# Isolated: OpenFlare publishes images via build-image-openflare.yml
+# (IMAGE_NAME: openflare). This Wavelet workflow is kept under the same
+# path so `git merge wavelet/main` cannot restore a canary wavelet image.
 on:
   workflow_dispatch:
     inputs:
-      version:
+      confirm:
-        description: "Image version/tag to publish (e.g. v1.0.0-beta). Leave empty to publish as canary."
+        description: "Disabled on OpenFlare. Use build-image-openflare.yml."
-        required: false
+        required: true
-        type: string
-  push:
-    tags: ["v*"]
-    branches: ["canary"]
-
-# One active run per ref (e.g. canary); newer runs cancel older in-progress builds.
-concurrency:
-  group: build-image-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  packages: write
-  attestations: write
-  id-token: write
-
-env:
-  IMAGE_NAME: wavelet
-  DOCKERFILE: docker/Dockerfile
 
 jobs:
-  # Resolve version / registries once. No checkout: triggers alone determine the tag.
+  isolated:
-  prepare:
+    name: Isolated
-    name: Prepare metadata
     runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.prep.outputs.version }}
-      build_date: ${{ steps.prep.outputs.build_date }}
-      image: ${{ steps.prep.outputs.image }}
-      image_names: ${{ steps.prep.outputs.image_names }}
-      images: ${{ steps.prep.outputs.images }}
-      push_dockerhub: ${{ steps.prep.outputs.push_dockerhub }}
-      is_stable: ${{ steps.prep.outputs.is_stable }}
-      is_prerelease: ${{ steps.prep.outputs.is_prerelease }}
     steps:
-      - name: Resolve version and images
+      - name: Refuse Wavelet image publish
-        id: prep
-        env:
-          INPUT_VERSION: ${{ github.event.inputs.version }}
-          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-          DOCKERHUB_NAMESPACE: ${{ secrets.DOCKERHUB_NAMESPACE }}
         run: |
-          set -euo pipefail
+          echo "This Wavelet image workflow is isolated on OpenFlare."
-          INPUT_VERSION="${INPUT_VERSION//[[:space:]]/}"
+          echo "Use .github/workflows/build-image-openflare.yml"
-          OWNER="${GITHUB_REPOSITORY_OWNER,,}"
+          exit 1
-          BUILD_DATE="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
-
-          if [[ "${GITHUB_REF}" == refs/heads/canary ]]; then
-            VERSION="canary"
-          elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            VERSION="${GITHUB_REF_NAME}"
-          elif [[ -n "$INPUT_VERSION" ]]; then
-            VERSION="$INPUT_VERSION"
-          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
-            VERSION="canary"
-          else
-            echo "unable to determine image version/tag" >&2
-            exit 1
-          fi
-
-          if [[ "$VERSION" == "canary" ]]; then
-            IS_STABLE="false"
-            IS_PRERELEASE="false"
-          elif [[ "$VERSION" =~ (alpha|beta|rc) ]]; then
-            IS_STABLE="false"
-            IS_PRERELEASE="true"
-          else
-            IS_STABLE="true"
-            IS_PRERELEASE="false"
-          fi
-
-          IMAGE="ghcr.io/${OWNER}/${IMAGE_NAME}"
-          IMAGE_NAMES="${IMAGE}"
-          # Newline-separated list for docker/metadata-action
-          IMAGES="${IMAGE}"
-
-          DOCKERHUB_USERNAME="${DOCKERHUB_USERNAME//[[:space:]]/}"
-          DOCKERHUB_TOKEN="${DOCKERHUB_TOKEN//[[:space:]]/}"
-          DOCKERHUB_NAMESPACE="${DOCKERHUB_NAMESPACE//[[:space:]]/}"
-          PUSH_DOCKERHUB="false"
-          if [[ -n "$DOCKERHUB_USERNAME" && -n "$DOCKERHUB_TOKEN" ]]; then
-            HUB_NS="${DOCKERHUB_NAMESPACE:-$DOCKERHUB_USERNAME}"
-            HUB_NS="${HUB_NS,,}"
-            IMAGE_DOCKERHUB="${HUB_NS}/${IMAGE_NAME}"
-            IMAGE_NAMES="${IMAGE_NAMES},${IMAGE_DOCKERHUB}"
-            IMAGES="${IMAGES}"$'\n'"${IMAGE_DOCKERHUB}"
-            PUSH_DOCKERHUB="true"
-            echo "Docker Hub publish enabled: ${IMAGE_DOCKERHUB}"
-          else
-            echo "Docker Hub secrets not set; publishing to GHCR only."
-          fi
-
-          {
-            echo "version=${VERSION}"
-            echo "build_date=${BUILD_DATE}"
-            echo "image=${IMAGE}"
-            echo "image_names=${IMAGE_NAMES}"
-            echo "push_dockerhub=${PUSH_DOCKERHUB}"
-            echo "is_stable=${IS_STABLE}"
-            echo "is_prerelease=${IS_PRERELEASE}"
-            echo "images<<EOF"
-            printf '%s\n' "${IMAGES}"
-            echo "EOF"
-          } >> "$GITHUB_OUTPUT"
-
-          echo "Resolved version=${VERSION} build_date=${BUILD_DATE} stable=${IS_STABLE} prerelease=${IS_PRERELEASE}"
-
-  build:
-    name: Build (${{ matrix.arch }})
-    needs: prepare
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - arch: amd64
-            platform: linux/amd64
-            runner: ubuntu-latest
-          - arch: arm64
-            platform: linux/arm64
-            # No ubuntu-latest-arm alias from GitHub; 24.04-arm is the current stable arm64 image.
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Log into GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Log into Docker Hub
-        if: needs.prepare.outputs.push_dockerhub == 'true'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Build and push
-        id: build
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          file: ${{ env.DOCKERFILE }}
-          platforms: ${{ matrix.platform }}
-          outputs: type=image,"name=${{ needs.prepare.outputs.image_names }}",push-by-digest=true,name-canonical=true,push=true
-          build-args: |
-            VERSION=${{ needs.prepare.outputs.version }}
-            BUILD_DATE=${{ needs.prepare.outputs.build_date }}
-          cache-from: type=gha,scope=docker-${{ env.IMAGE_NAME }}-${{ matrix.arch }}
-          cache-to: type=gha,mode=max,ignore-error=true,timeout=20m,scope=docker-${{ env.IMAGE_NAME }}-${{ matrix.arch }}
-
-      - name: Export digest
-        shell: bash
-        run: |
-          mkdir -p "/tmp/${{ env.IMAGE_NAME }}-digests"
-          touch "/tmp/${{ env.IMAGE_NAME }}-digests/${DIGEST#sha256:}"
-        env:
-          DIGEST: ${{ steps.build.outputs.digest }}
-
-      - name: Upload digest
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ env.IMAGE_NAME }}-digests-${{ matrix.arch }}
-          path: /tmp/${{ env.IMAGE_NAME }}-digests/*
-          if-no-files-found: error
-          retention-days: 1
-
-      - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v3
-        with:
-          subject-name: ${{ needs.prepare.outputs.image }}
-          subject-digest: ${{ steps.build.outputs.digest }}
-          push-to-registry: true
-
-  merge:
-    name: Merge multi-arch manifest
-    runs-on: ubuntu-latest
-    needs: [prepare, build]
-    steps:
-      # No repo checkout: tags come from prepare + metadata-action.
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ needs.prepare.outputs.images }}
-          flavor: |
-            latest=false
-          tags: |
-            type=raw,value=${{ needs.prepare.outputs.version }}
-            type=raw,value=latest,enable=${{ needs.prepare.outputs.is_stable == 'true' }}
-            type=raw,value=beta,enable=${{ needs.prepare.outputs.is_prerelease == 'true' }}
-
-      - name: Download digests
-        uses: actions/download-artifact@v4
-        with:
-          path: /tmp/${{ env.IMAGE_NAME }}-digests
-          pattern: ${{ env.IMAGE_NAME }}-digests-*
-          merge-multiple: true
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Log into GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Log into Docker Hub
-        if: needs.prepare.outputs.push_dockerhub == 'true'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Create and push manifest list
-        working-directory: /tmp/${{ env.IMAGE_NAME }}-digests
-        shell: bash
-        env:
-          IMAGE: ${{ needs.prepare.outputs.image }}
-          DOCKER_METADATA_OUTPUT_JSON: ${{ steps.meta.outputs.json }}
-        run: |
-          set -euo pipefail
-          shopt -s nullglob
-          references=()
-          for digest in *; do
-            references+=("${IMAGE}@sha256:${digest}")
-          done
-
-          if [ ${#references[@]} -eq 0 ]; then
-            echo "No digests found in /tmp/${{ env.IMAGE_NAME }}-digests" >&2
-            exit 1
-          fi
-
-          # shellcheck disable=SC2046
-          docker buildx imagetools create \
-            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            "${references[@]}"
-
-      - name: Inspect image
-        run: docker buildx imagetools inspect "${{ needs.prepare.outputs.image }}:${{ needs.prepare.outputs.version }}"
-
-      - name: Trigger webhook
-        env:
-          WEBHOOK_URL: ${{ secrets.WEBHOOK_URL }}
-        run: |
-          if [ -n "$WEBHOOK_URL" ]; then
-            curl -fsSL "$WEBHOOK_URL"
-          else
-            echo "Webhook URL is not set, skipping."
-          fi

CONTRIBUTING.md

@@ -20,6 +20,16 @@
 为提高协作效率，我们建议您在提交 PR 前，先通过 Issue 简要说明动机与背景。  
 
 
+## 合并上游
+
+`.gitattributes` 对 `backend/OpenFlare/`、`frontend/` 等路径使用 `merge=ours`。该驱动不会自动生效，请在仓库根目录执行一次：
+
+```bash
+git config include.path ../.gitconfig
+# worktree 安全写法：
+git config include.path "$(git rev-parse --show-toplevel)/.gitconfig"
+```
+
 ## 贡献步骤
 
 1. **Fork 本仓库** 并创建您的分支（建议使用有意义的分支名）。

README.md

@@ -165,6 +165,18 @@ docker run -d --name openflare-agent --restart unless-stopped \
   ghcr.io/rain-kl/openflare-agent:latest
 ```
 
+## Cordis / Wavelet upstream
+
+OpenFlare is built on Wavelet Cordis. After cloning, enable `merge=ours` from `.gitattributes` so `git merge wavelet/main` keeps OpenFlare-owned paths:
+
+```bash
+git config include.path ../.gitconfig
+# worktree-safe:
+git config include.path "$(git rev-parse --show-toplevel)/.gitconfig"
+```
+
+`docker compose` uses `docker-compose.yaml`. `docker-compose.wavelet.yml` is the upstream Wavelet stack and is not the product default. Image publishes go through `.github/workflows/build-image-openflare*.yml`; the Wavelet `build-image.yml` is isolated.
+
 ## Open Source License
 
 This project is licensed under the [Apache License 2.0](./LICENSE).

README.zh-CN.md

@@ -165,6 +165,18 @@ docker run -d --name openflare-agent --restart unless-stopped \
   ghcr.io/rain-kl/openflare-agent:latest
 ```
 
+## Cordis / Wavelet 上游
+
+OpenFlare 构建在 Wavelet Cordis 之上。克隆后请启用 `.gitattributes` 中的 `merge=ours`，这样 `git merge wavelet/main` 会保留 OpenFlare 自有路径：
+
+```bash
+git config include.path ../.gitconfig
+# worktree 安全写法：
+git config include.path "$(git rev-parse --show-toplevel)/.gitconfig"
+```
+
+`docker compose` 使用 `docker-compose.yaml`。`docker-compose.wavelet.yml` 是上游 Wavelet 编排，不是本产品的默认栈。镜像发布走 `.github/workflows/build-image-openflare*.yml`；Wavelet 的 `build-image.yml` 已隔离。
+
 ## 开源协议
 
 本项目采用 [Apache License 2.0](./LICENSE) 开源。

backend/OpenFlare/README.md

@@ -5,6 +5,9 @@
 （`backend/{core,pkg,plugins}`）通过 `git fetch wavelet && git merge wavelet/main`
 吸收（第一次接线已 merge `wavelet/feat/cordis-alignment`，待该分支合入上游 main
 后改走 `wavelet/main`）。本目录、`frontend/` 与 `backend/cmd` 由本仓库持有。
+合并前请 `git config include.path ../.gitconfig`（或 worktree 安全写法
+`git config include.path "$(git rev-parse --show-toplevel)/.gitconfig"`），
+以启用 `.gitattributes` 的 `merge=ours`。
 
 ```
 backend/OpenFlare/

docker-compose.wavelet.yml

@@ -1,3 +1,5 @@
+# Upstream Wavelet stack. Not the OpenFlare default.
+# Use docker-compose.yaml (or `docker compose up`) for the product.
 services:
   wavelet:
     build:

docker-compose.yaml

@@ -1,3 +1,5 @@
+# OpenFlare default compose file (`docker compose` / `docker-compose.yaml`).
+# The Wavelet upstream stack is in docker-compose.wavelet.yml and is not used here.
 services:
   openflare:
     build:

docker-compose.yml

@@ -0,0 +1,6 @@
+# Isolated Wavelet compose filename.
+# OpenFlare's default stack is docker-compose.yaml (`docker compose` prefers
+# that name over this one). This stub is kept so `git merge wavelet/main`
+# cannot restore a wavelet product stack under the default compose name.
+include:
+  - path: docker-compose.yaml

docs/changelog/index.md

@@ -12,6 +12,7 @@ sidebar: false
 
 ### 💄 其他/体验
 
+- 内嵌前端拷贝目标改为 `backend/plugins/drivers/driver_http/dist`，与上游 `//go:embed all:dist` 对齐；发布工作流改为读取 `backend/go.mod`。仓库内 `.gitconfig` 提供 `merge.ours` 驱动，合并上游时保留 OpenFlare 自有路径；Wavelet 的 `build-image.yml` 与 `docker-compose.yml` 已隔离，避免 canary 发布成 wavelet 镜像。
 - 后端代码整体迁入 `backend/`，与上游 Wavelet 的仓库布局对齐（Cordis 插件化改造第一阶段），模块名保持 `Wavelet` 以保证上游包路径逐字一致。构建、测试、镜像与发布链路已同步调整，`make build-all` / `make dev` / `make swagger` 等本地命令用法不变；HTTP 接口与控制台行为均无变化。
 - 引入上游 Cordis 微内核与平台插件到 `backend/{core,pkg,plugins}`（与上游逐字一致，可用 `scripts/sync-upstream.sh` 重复同步），并新增 `backend/OpenFlare/share/` 承载多插件共享资源（控制消息协议、GeoIP、边缘日志）。此阶段仅落位结构与共享层，尚未改变运行时行为。
 - 下游代码按功能职责拆为 `server`/`agent`/`relay`/`flared` 四个插件与 `backend/OpenFlare/share` 共享层；三个边缘守护进程改由 Cordis 内核装配启动（profile `agent`/`relay`/`flared`），`-config` 旗标、默认配置路径、退出码与启动日志保持原样。