feat: establish v0.70 platform milestone

deploy/server/README.md

@@ -15,14 +15,25 @@
 载入同一候选版本的`data-terminal-cloud-backend`和`data-terminal-cloud-web`镜像后执行：
 
 ```sh
+chmod 0755 deploy/server/*.sh
 docker compose -f compose.yaml -f deploy/server/compose.override.yaml \
   --env-file deploy/server/.env up -d --no-build \
   postgres redis minio keycloak migrate seed mock-alert-receiver callbacks \
   mock-provider api worker web gateway
+docker compose -f compose.yaml -f deploy/server/compose.override.yaml \
+  --env-file deploy/server/.env up -d --no-build --force-recreate --no-deps gateway
 ```
 
+从Windows生成的压缩包解开后必须恢复脚本执行位。若`current`是切换到新发布目录的符号链接，还必须强制重建Gateway；否则Docker会继续使用旧发布目录已解析的Nginx绑定挂载，新增路由不会生效。
+
 安全组和主机防火墙只保留TCP 80、443以及受限来源的SSH 22。HTTP 80仅用于跳转到标准HTTPS 443。正式环境仍应配置自有域名、生产OIDC和真实外部服务，并切换到Kubernetes生产覆盖层。
 
+需要在演示机接入真实RTC、豆包语音和方舟摘要时，把凭据文件以`0600`权限放入`/etc/data-terminal-cloud/voice-runtime`，并在`deploy/server/.env`设置`RTC_TOKEN_ISSUER=volcengine`、`VOICE_PROVIDER=volcengine`、`RTC_APP_ID`、`CONTENT_GENERATOR`和`ARK_CONTENT_MODEL`。Compose只读挂载该目录，敏感值不进入源码、镜像或环境文件。
+
+设备HMAC密钥由`device_credential`表以AES-256-GCM密文保存。`deploy/server/.env`中的`DEVICE_CREDENTIAL_MASTER_KEY`只负责数据库密文的认证解密，不得写入数据库或设备；既有`DEVICE_LOCAL_SECRET`只用于首次部署升级时导入两台演示设备，确认数据库凭据记录完整后可移除。新增、轮换和吊销设备密钥使用后端镜像内的`/app/device-credential`维护命令，生成的设备明文密钥只显示一次。
+
+通话内记忆工具只通过网关精确开放`/internal/v1/tools/memory-search`，请求必须携带平台为当前通话签发的短期任务令牌。`MEMORY_TOOL_SIGNING_SECRET`必须是服务器独立随机密钥，不得与游标签名、分享签名或RTC密钥复用；网关不会开放其他`/internal`路径。
+
 ## 自动备份与恢复校验
 
 首次安装定时任务：

deploy/server/bootstrap-secrets.sh

@@ -33,9 +33,11 @@ umask 077
   printf 'KEYCLOAK_ADMIN_USERNAME=platform-admin\n'
   printf 'KEYCLOAK_ADMIN_PASSWORD=%s\n' "$(openssl rand -hex 24)"
   printf 'DEVICE_LOCAL_SECRET=%s\n' "$(openssl rand -hex 32)"
+  printf 'DEVICE_CREDENTIAL_MASTER_KEY=%s\n' "$(openssl rand -hex 32)"
   printf 'RTC_TOKEN_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
   printf 'CURSOR_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
   printf 'SHARE_TOKEN_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
+  printf 'MEMORY_TOOL_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
   printf 'PROVIDER_CALLBACK_SECRET=%s\n' "$(openssl rand -hex 32)"
   printf 'PLATFORM_HEALTH_CALLBACK_SECRET=%s\n' "$(openssl rand -hex 32)"
   printf 'MOCK_PROVIDER_API_KEY=%s\n' "$(openssl rand -hex 24)"

deploy/server/compose.override.yaml

@@ -19,6 +19,8 @@ x-server-backend-environment: &server-backend-environment
   OBJECT_STORE_PUBLIC_SECURE: "true"
   CURSOR_SIGNING_SECRET: ${CURSOR_SIGNING_SECRET}
   SHARE_TOKEN_SIGNING_SECRET: ${SHARE_TOKEN_SIGNING_SECRET}
+  MEMORY_TOOL_BASE_URL: ${PUBLIC_ORIGIN}/internal/v1/tools/memory-search
+  MEMORY_TOOL_SIGNING_SECRET: ${MEMORY_TOOL_SIGNING_SECRET}
   EMBEDDING_PROVIDER: local
   VOICE_PROVIDER: ${VOICE_PROVIDER:-mock}
 
@@ -92,10 +94,15 @@ services:
     environment:
       <<: *server-backend-environment
       HTTP_ADDR: 0.0.0.0:8080
-      DEVICE_LOCAL_SECRET: ${DEVICE_LOCAL_SECRET}
+      DEVICE_LOCAL_SECRET: ${DEVICE_LOCAL_SECRET:-}
+      DEVICE_CREDENTIAL_MASTER_KEY: ${DEVICE_CREDENTIAL_MASTER_KEY}
       RTC_TOKEN_SIGNING_SECRET: ${RTC_TOKEN_SIGNING_SECRET}
       RTC_TOKEN_ISSUER: ${RTC_TOKEN_ISSUER:-local}
       RTC_APP_ID: ${RTC_APP_ID:-local-public-rtc-app}
+      RTC_APP_KEY: ""
+      RTC_APP_KEY_FILE: ${RTC_APP_KEY_FILE:-/run/secrets/voice-runtime/rtc-app-key}
+    volumes:
+      - /etc/data-terminal-cloud/voice-runtime:/run/secrets/voice-runtime:ro
     restart: unless-stopped
 
   callbacks:
@@ -122,8 +129,21 @@ services:
       MOCK_PROVIDER_API_KEY: ${MOCK_PROVIDER_API_KEY}
       ALERT_WEBHOOK_URL: http://mock-alert-receiver:8084/webhooks/alerts
       ALERT_WEBHOOK_SECRET: ${ALERT_WEBHOOK_SECRET}
-      CONTENT_GENERATOR: local
+      RTC_APP_ID: ${RTC_APP_ID:-local-public-rtc-app}
+      VOLC_ACCESS_KEY_ID: ""
+      VOLC_ACCESS_KEY_ID_FILE: ${VOLC_ACCESS_KEY_ID_FILE:-/run/secrets/voice-runtime/volc-access-key-id}
+      VOLC_SECRET_ACCESS_KEY: ""
+      VOLC_SECRET_ACCESS_KEY_FILE: ${VOLC_SECRET_ACCESS_KEY_FILE:-/run/secrets/voice-runtime/volc-secret-access-key}
+      VOLC_RTC_REGION: ${VOLC_RTC_REGION:-cn-north-1}
+      VOLC_RTC_API_VERSION: ${VOLC_RTC_API_VERSION:-2024-12-01}
+      VOLC_VOICE_CHAT_TEMPLATE_FILE: ${VOLC_VOICE_CHAT_TEMPLATE_FILE:-/run/secrets/voice-runtime/voice-chat-template.json}
+      CONTENT_GENERATOR: ${CONTENT_GENERATOR:-local}
+      ARK_API_KEY: ""
+      ARK_API_KEY_FILE: ${ARK_API_KEY_FILE:-/run/secrets/voice-runtime/ark-api-key}
+      ARK_CONTENT_MODEL: ${ARK_CONTENT_MODEL:-}
       CONTENT_SAFETY_PROVIDER: local
+    volumes:
+      - /etc/data-terminal-cloud/voice-runtime:/run/secrets/voice-runtime:ro
     restart: unless-stopped
 
   mock-provider:

deploy/server/nginx.conf

@@ -44,6 +44,14 @@ server {
         proxy_buffering off;
     }
 
+    # The voice provider can call only this signed, conversation-scoped tool.
+    # Do not expose the rest of the /internal namespace.
+    location = /internal/v1/tools/memory-search {
+        proxy_pass $api_backend;
+        proxy_buffering off;
+        proxy_request_buffering off;
+    }
+
     location /callbacks/ {
         proxy_pass $callbacks_backend;
         proxy_buffering off;