## Prompt Boundaries

正向提示词: Deliver a secure single-file Run distribution flow for 服务器管理, where generated Run artifacts are raw executables with compile-time platform URL and authorization, self-update accepts raw executables, and server-list run-key reset is available with confirmation.

方向提示词: Preserve existing platform/run/platform_web boundaries; use platform distribution build input and Run Go `-ldflags -X` injection; keep Client Manager packaging unchanged; verify with focused Go/frontend tests, OpenSpec validation, and `scripts/check-structure.sh`.

任务边界: Do not add device authorization binding, billing, cloud host sales, AI-provider changes, plugin marketplace expansion, Client Manager packaging changes, raw credential exposure in APIs/UI, or unrelated visual-system changes.

## 1. OpenSpec

- [x] 1.1 Define proposal, design, requirements, and task boundaries for single-file Run distribution.
- [x] 1.2 Validate the OpenSpec change before implementation completion.

## 2. Platform

- [x] 2.1 Add Run-only raw executable package format, artifact filename/content-type presentation, and build-input platform URL.
- [x] 2.2 Generate longer Run component keys without changing global token generation.
- [x] 2.3 Revoke active Run control sessions when Run key reset succeeds.
- [x] 2.4 Update platform tests for raw Run artifacts, key length, build input, reset revocation, and self-update input.

## 3. Run

- [x] 3.1 Add compile-time config variables with environment override precedence.
- [x] 3.2 Inject Run identity and authorization through Go `-ldflags -X` and upload raw executable bytes for Run builds.
- [x] 3.3 Support raw executable self-update staging while preserving archive handling for compatibility/tests where needed.
- [x] 3.4 Update Run tests for raw build output, compiled smoke identity, config precedence, and raw self-update.

## 4. platform_web

- [x] 4.1 Add run-key reset to the server-list `运行操作` dangerous menu with confirmation and API execution.
- [x] 4.2 Update frontend tests and fixtures for raw Run download metadata and reset action coverage.

## 5. Verification

- [x] 5.1 Run focused `run`, `platform`, and `platform_web` verification.
- [x] 5.2 Run `scripts/check-structure.sh`.


## Verification Evidence

- `openspec validate secure-single-file-run-distribution --strict`: passed
- `cd platform && go test ./service -run 'TestCoreService(ResetRunKey|GeneratesRun|RunDistribution|DistributionBuild)' -count=1`: passed
- `cd platform && go test ./validator ./domain ./dto -count=1`: passed
- `cd run && go test ./config ./protocol ./runtime -run 'TestLoad|TestWorkerDistribution|TestDistributionBuild|TestValidateDistribution|TestRunSelfUpdate|TestPrepareSelfUpdate|TestWorkerDispatchesSelfUpdate' -count=1`: passed
- `cd platform_web && npm test -- --run pages/ConsolePages.test.tsx api/client.test.ts`: passed, 2 files / 25 tests
- `scripts/check-structure.sh`: passed
- Note: full `run/runtime` suite still needs network bind permissions for unrelated Source RCON/httptest fixtures; focused distribution/self-update coverage was used for this change.