ANET DOCUMENTATIONANET 文档
Build private links
between independent nodes.在独立节点之间
建立私有连接。
This guide is the stable entrance to Anet. The detailed engineering wiki is generated from the repository, so protocol and operational documentation stay close to implementation.这里是 Anet 的稳定文档入口。详细工程 Wiki 直接从仓库生成，使协议与运维文档始终贴近实现。
What Anet solves and where its security boundary begins.Anet 解决什么问题，以及安全边界从哪里开始。
Read section →阅读本节 →02Architecture架构Identity, packets, transports, stores, acknowledgements, and routing.身份、Packet、传输、存储、确认与路由。
Read section →阅读本节 →03Operations运维Node lifecycle, pairing, recovery, release gates, and diagnostics.节点生命周期、配对、恢复、发布门禁和诊断。
Read section →阅读本节 →04Integrations集成Use the CLI as control plane and scoped MCP as the data plane.使用 CLI 作为控制平面，用窄权限 MCP 作为数据平面。
Read section →阅读本节 →QUICKSTART快速开始
Two nodes. Two homes. One explicit trust relationship.两个节点。两个私有目录。一段明确的信任关系。
identity.json, tls-key.pem, SQLite state, or an entire node home between runtimes.绝不要在不同 runtime 之间复制 identity.json、tls-key.pem、SQLite 状态或整个节点目录。python -m pip install -e .
anet --home .\demo\a init --label node_a --host 127.0.0.1 --port 43101
anet --home .\demo\b init --label node_b --host 127.0.0.1 --port 43102
anet --home .\demo\a card --out .\demo\a.card.json
anet --home .\demo\b card --out .\demo\b.card.json
anet --home .\demo\a peer-add .\demo\b.card.json
anet --home .\demo\b peer-add .\demo\a.card.jsonLoopback is only for a same-host demo. Physical devices need reachable LAN addresses, distinct ports, distinct Node IDs, and distinct private homes.回环地址只适合单机演示。物理设备需要可达的局域网地址、不同端口、不同 Node ID 和各自独立的私有目录。
ARCHITECTURE架构
A small set of boundaries that stay true.少数始终成立的边界。
A complete cryptographic Node ID, not a label, profile, IP address, or platform account.完整的加密 Node ID，而不是标签、profile、IP 地址或平台账号。
An immutable sealed object with visible routing metadata and encrypted sender identity and payload.不可变的密封对象；路由元数据可见，发送者身份与载荷保持加密。
Direct TLS, asynchronous carriers, relays, or offline bundles move the same packet.TLS 直连、异步 Carrier、中继或离线 Bundle 都搬运同一个 Packet。
Local SQLite persistence tracks queues, inbox, leases, receipts, prekeys, path health, and deduplication.本地 SQLite 持久化队列、Inbox、租约、回执、预密钥、路径健康与去重状态。
SECURITY安全
Authenticated input is still input.通过认证的输入，依然只是输入。
Anet establishes who signed an object. Local policy still decides whether that principal may cause an effect. Persistent identity creation, trust changes, and service registration remain explicit operator actions.Anet 确认对象由谁签名。本地策略仍要决定该主体是否可以产生实际效果。创建持久身份、修改信任和注册服务始终需要操作者明确授权。
Safe to exchange for review and explicit pinning.可以安全交换，用于审核与显式固定。
Identity keys, TLS key, database, configuration, and runtime state.身份密钥、TLS 密钥、数据库、配置与 runtime 状态。
Capabilities, allowed peers, durable consumer scope, and approval.Capability、允许的 Peer、持久 Consumer 范围与审批。
OPERATIONS运维
Lifecycle before convenience.生命周期先于便利。
- Locate the deployment-owned home before repair.修复前先定位部署实际拥有的节点目录。
- Use signed cards and challenge-response pairing.使用签名 Card 与挑战响应配对。
- Change addresses through signed locator configuration.通过签名 Locator 配置修改地址。
- Back up and restore only within one runtime’s ownership boundary.仅在同一个 runtime 的所有权边界内备份与恢复。
- Revoke locally with the complete Node ID.使用完整 Node ID 执行本地撤销。
INTEGRATIONS集成
Give agents the narrowest useful surface.只给 Agent 最窄且够用的能力面。
Use the CLI for sparse install, identity, trust, configuration, diagnostics, and recovery. Use a scoped stdio MCP session for repeated messaging, durable claims, and typed tasks. Ephemeral workers receive no persistent Anet node by default.安装、身份、信任、配置、诊断与恢复使用 CLI；重复消息、持久 Claim 与类型化任务使用受限的 stdio MCP。临时 Worker 默认不获得持久 Anet 节点。
CONTRIBUTING参与贡献
Documentation lives with the code.文档与代码共同存在。
OpenWiki generates the recurring engineering reference. Change source and reviewed docs together; do not create a second truth in a detached wiki.OpenWiki 持续生成工程参考文档。源码与受审文档应一起修改，不要在独立 Wiki 中制造第二套真相。