20260701 add validation-update-03 VRS mode

deploy/arm64-installer/.env.example

@@ -63,6 +63,10 @@ PERIODIC_SNAPSHOT_RESET=0
 PERIODIC_SNAPSHOT_MAX_DELTAS=100
 DB_STATS_EXACT_EVERY=0
 
+# Resource certificate validation mode passed to the rpki child process.
+# Options: validation-update-03 | rfc6487
+RESOURCE_VALIDATION_MODE=validation-update-03
+
 # Validation and performance options aligned with current optimized soak defaults.
 ENABLE_CHILD_CERTIFICATE_VALIDATION_CACHE=1
 RPKI_ANALYZE=1

deploy/arm64-installer/docs/README.en.md

@@ -33,6 +33,7 @@ Defaults:
 - `MAX_RUNS=-1`
 - `INTERVAL_SECS=600`
 - `TAL_INPUT_MODE=file-live-ta`
+- `RESOURCE_VALIDATION_MODE=validation-update-03`
 - `LIVE_TA_REFRESH_BEFORE_SNAPSHOT=1`
 - `PERIODIC_SNAPSHOT_RESET=0`
 - `PERIODIC_SNAPSHOT_MAX_DELTAS=100`
@@ -57,6 +58,22 @@ Container/image mapping:
 
 The first snapshot refreshes live TA certificates before starting the RP process.
 
+## Resource Validation Mode
+
+New knob:
+
+```bash
+RESOURCE_VALIDATION_MODE=validation-update-03
+```
+
+Supported values:
+
+- `validation-update-03`: default behavior, using the current validation-update draft semantics;
+- `rfc6487`: switch back to the original RFC 6487 resource containment behavior.
+
+The installer / soak runner passes `--resource-validation-mode` to every `rpki` child start.
+When an upgraded deployment reuses an older `.env` that does not contain this key, the installer appends the new default `validation-update-03` automatically.
+
 ## Architecture Guardrails
 
 The key scripts read:

deploy/arm64-installer/docs/README.zh-CN.md

@@ -33,6 +33,7 @@ vim .env
 - `MAX_RUNS=-1`
 - `INTERVAL_SECS=600`
 - `TAL_INPUT_MODE=file-live-ta`
+- `RESOURCE_VALIDATION_MODE=validation-update-03`
 - `LIVE_TA_REFRESH_BEFORE_SNAPSHOT=1`
 - `PERIODIC_SNAPSHOT_RESET=0`
 - `PERIODIC_SNAPSHOT_MAX_DELTAS=100`
@@ -57,6 +58,22 @@ vim .env
 
 第一轮 snapshot 会先拉取 live TA，避免 clean state 使用旧 fixture TA。
 
+## 资源验证模式
+
+新增配置：
+
+```bash
+RESOURCE_VALIDATION_MODE=validation-update-03
+```
+
+可选值：
+
+- `validation-update-03`：默认，按当前 validation update draft 语义运行；
+- `rfc6487`：切换为 RFC 6487 原始资源包含判定语义。
+
+installer / soak runner 每次启动 `rpki` 子进程时都会显式传入 `--resource-validation-mode`。
+如果升级时复用旧 `.env` 且缺少该变量，installer 会自动补入默认值 `validation-update-03`，不会破坏旧 `.env` 复用流程。
+
 ## 架构检查
 
 关键脚本会读取：

deploy/arm64-installer/scripts/common.sh

@@ -203,12 +203,14 @@ load_env() {
   GRAFANA_IMAGE="${GRAFANA_IMAGE:-grafana/grafana:11.3.1}"
   METRICS_INSTANCE="${METRICS_INSTANCE:-${PACKAGE_ARCH}-installer}"
   ALLOW_CROSS_ARCH="${ALLOW_CROSS_ARCH:-0}"
+  RESOURCE_VALIDATION_MODE="${RESOURCE_VALIDATION_MODE:-validation-update-03}"
   FIRST_RUN_WAIT_TIMEOUT_SECS="${FIRST_RUN_WAIT_TIMEOUT_SECS:-7200}"
 
   persist_env_default "$ENV_FILE" "METRICS_IMAGE" "$METRICS_IMAGE"
   persist_env_default "$ENV_FILE" "METRICS_PLATFORM" "$METRICS_PLATFORM"
   persist_env_default "$ENV_FILE" "RTR_REPORT_DIR" "$RTR_REPORT_DIR"
   persist_env_default "$ENV_FILE" "RTR_REPORT_CONTAINER_DIR" "$RTR_REPORT_CONTAINER_DIR"
+  persist_env_default "$ENV_FILE" "RESOURCE_VALIDATION_MODE" "$RESOURCE_VALIDATION_MODE"
 }
 
 compose_cmd() {