OpenWrt RMM Agent 0.8.0

Signed commands and managed recovery.

Added

• The agent pins the server command-signing public key and verifies every command signature, device ID, nonce, creation time, and expiry before execution.
• Persistent result and pending markers prevent a command from running twice after a crash or lost response.
• Two-phase device-token rotation is stored atomically without interrupting normal heartbeat delivery.
• Managed encrypted cloud backup upload and guarded restore verify size, target, and SHA-256, preserve the current agent identity, and automatically roll back if a later heartbeat does not confirm cloud connectivity.

Security

• A changed server command-signing key is rejected until explicit re-enrollment.
• Explicit re-enrollment clears the old command-key pin and creates a new per-device tunnel identity.
• Interrupted state-changing commands fail closed instead of being replayed automatically.