@aiwg/cockpit 2026.7.21 → 2026.7.24

package/bridge/src/server.mjs

@@ -29,6 +29,12 @@ const ALLOW_MOCK_EXECUTOR = process.env.AIWG_COCKPIT_ALLOW_MOCK_EXECUTOR === '1'
 const AUTOSTART_EXECUTOR = process.env.AIWG_COCKPIT_AUTOSTART_EXECUTOR !== '0';
 const EXECUTOR_COMMAND = process.env.AIWG_COCKPIT_EXECUTOR_COMMAND ?? '';
 const EXECUTOR_TOKEN_FILE = process.env.AIWG_COCKPIT_EXECUTOR_TOKEN_FILE ?? '';
+const MCP_TOKEN_FILE = process.env.AIWG_COCKPIT_MCP_TOKEN_FILE ?? '';
+const LOCAL_DOCKER_FALLBACK = process.env.AIWG_COCKPIT_LOCAL_DOCKER_FALLBACK === '1';
+const REQUIRE_SANDBOX_MTLS = process.env.AIWG_COCKPIT_REQUIRE_SANDBOX_MTLS === '1';
+export function localLibvirtFallbackAllowed(platform = process.platform, envValue = process.env.AIWG_COCKPIT_LOCAL_LIBVIRT_FALLBACK) {
+  return platform === 'linux' || envValue === '1';
+}
 const RUNTIME_DIR = join(homedir(), '.aiwg', 'cockpit', 'runtime');
 const auditDir = () => process.env.AIWG_COCKPIT_AUDIT_DIR || join(homedir(), '.aiwg', 'cockpit', 'audit');
 const auditLog = () => join(auditDir(), 'events.jsonl');
@@ -422,7 +428,11 @@ function isConnectionRefusedError(err) {
 }
 
 function rethrowExecutorSecurityError(err) {
-  if ([401, 403].includes(Number(err?.upstreamStatus)) || String(err?.code ?? '').startsWith('executor_credential_')) throw err;
+  if (
+    [401, 403].includes(Number(err?.upstreamStatus)) ||
+    String(err?.code ?? '').startsWith('executor_credential_') ||
+    String(err?.code ?? '').startsWith('executor_trust_')
+  ) throw err;
 }
 
 export async function fetchJsonFirst(candidates, { method = 'GET', headers, body: requestBodyOption, timeoutMs = 0 } = {}) {
@@ -507,10 +517,19 @@ async function getExecutorCapabilities(executorUrl) {
   const candidates = ['/healthz/deep', '/healthz', '/health'].map((path) => `${executorUrl}${path}`);
   try {
     const { target, body } = await fetchJsonFirst(candidates);
+    const runtimeProviders = await fetchJsonFirst([
+      `${executorUrl}/api/v2/admin/runtime/providers`,
+      `${executorUrl}/api/v2/runtime/providers`,
+      `${executorUrl}/admin/runtime/providers`,
+      `${executorUrl}/runtime/providers`,
+    ])
+      .then((result) => result.body)
+      .catch(() => undefined);
     return {
       status: 'ok',
       source: new URL(target).pathname,
       host_runtime_enabled: body.host_runtime_enabled === true || body.hostRuntimeEnabled === true,
+      runtime_providers: runtimeProviders && Array.isArray(runtimeProviders.providers) ? runtimeProviders : undefined,
       raw_status: body.status ?? body.state ?? 'unknown',
     };
   } catch (err) {
@@ -524,6 +543,120 @@ async function getExecutorCapabilities(executorUrl) {
   }
 }
 
+async function getMcpDiscovery(executorUrl) {
+  try {
+    const { target, body } = await fetchJsonFirst([
+      `${executorUrl}/api/v2/admin/mcp/discovery`,
+      `${executorUrl}/admin/mcp/discovery`,
+    ]);
+    return {
+      source: executorUrl,
+      discovery_path: new URL(target).pathname,
+      fetched_at: new Date().toISOString(),
+      ...normalizeMcpDiscovery(body, executorUrl),
+    };
+  } catch (err) {
+    rethrowExecutorSecurityError(err);
+    return normalizeMcpDiscovery({
+      enabled: false,
+      status: 'disabled',
+      reason_code: 'mcp.discovery_unavailable',
+      error: String(err?.message ?? err),
+    }, executorUrl);
+  }
+}
+
+function normalizeMcpDiscovery(body, source) {
+  const endpoint = body?.endpoint && typeof body.endpoint === 'object' ? body.endpoint : {};
+  const auth = body?.auth && typeof body.auth === 'object' ? body.auth : {};
+  return {
+    source: source ?? body?.source,
+    enabled: body?.enabled === true,
+    status: body?.status ?? (body?.enabled === true ? 'enabled' : 'disabled'),
+    reason_code: body?.reason_code ?? body?.reasonCode ?? null,
+    error: body?.error,
+    endpoint: {
+      path: endpoint.path ?? '/mcp',
+      methods: Array.isArray(endpoint.methods) ? endpoint.methods : ['POST'],
+      transport: endpoint.transport ?? 'streamable-http',
+      stateless: endpoint.stateless !== false,
+      get_behavior: endpoint.get_behavior ?? endpoint.getBehavior ?? '405_method_not_allowed',
+      mcp_session_id: endpoint.mcp_session_id ?? endpoint.mcpSessionId ?? false,
+    },
+    protocol: body?.protocol ?? { latest: '2025-11-25', supported: [] },
+    auth: {
+      scheme: auth.scheme ?? 'bearer',
+      required: auth.required !== false,
+      principal_config: auth.principal_config ?? auth.principalConfig ?? 'mcp-principals.toml',
+      principals: Array.isArray(auth.principals) ? auth.principals.map((principal) => ({
+        client_id: principal.client_id ?? principal.clientId ?? '',
+        scopes: Array.isArray(principal.scopes) ? principal.scopes : [],
+      })).filter((principal) => principal.client_id) : [],
+      scopes: Array.isArray(auth.scopes) ? auth.scopes : [],
+    },
+    capabilities: body?.capabilities ?? {},
+    tools: Array.isArray(body?.tools) ? body.tools : [],
+    resources: Array.isArray(body?.resources) ? body.resources : [],
+    resource_templates: Array.isArray(body?.resource_templates)
+      ? body.resource_templates
+      : Array.isArray(body?.resourceTemplates) ? body.resourceTemplates : [],
+    errors: Array.isArray(body?.errors) ? body.errors : [],
+    notes: Array.isArray(body?.notes) ? body.notes : [],
+  };
+}
+
+async function proxyMcpRequest(req, res, executorUrl, mcpTokenFile) {
+  if (!mcpTokenFile) {
+    await appendAudit('sandbox.mcp.proxy', {
+      result: 'blocked',
+      reason: 'mcp_token_file_unconfigured',
+    });
+    return json(res, 503, {
+      error: 'mcp_token_file_unconfigured',
+      message: 'Bridge MCP proxy requires AIWG_COCKPIT_MCP_TOKEN_FILE.',
+    });
+  }
+  const parsed = await readJsonBody(req);
+  if (parsed.error) return json(res, 400, { error: parsed.error });
+  const body = parsed.body || {};
+  const rpcMethod = typeof body.method === 'string' ? body.method : 'unknown';
+  const target = `${executorUrl}/mcp`;
+  let status = 502;
+  try {
+    const token = await resolveExecutorBearer(mcpTokenFile);
+    const headers = {
+      authorization: `Bearer ${token}`,
+      'content-type': 'application/json',
+      accept: 'application/json, text/event-stream',
+    };
+    const protocolVersion = req.headers['mcp-protocol-version'];
+    if (typeof protocolVersion === 'string' && protocolVersion.trim()) {
+      headers['mcp-protocol-version'] = protocolVersion.trim();
+    }
+    const response = await fetch(target, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(body),
+    });
+    status = response.status;
+    const responseBody = await response.json().catch(() => ({}));
+    await appendAudit('sandbox.mcp.proxy', {
+      result: response.ok ? 'ok' : 'error',
+      method: rpcMethod,
+      status,
+    });
+    return json(res, status, responseBody);
+  } catch (err) {
+    await appendAudit('sandbox.mcp.proxy', {
+      result: 'error',
+      method: rpcMethod,
+      status,
+      error: String(err?.code ?? err?.message ?? err),
+    });
+    throw err;
+  }
+}
+
 function defaultExecutorCommand() {
   if (EXECUTOR_COMMAND) return EXECUTOR_COMMAND.split(/\s+/).filter(Boolean);
   const candidates = [
@@ -580,6 +713,110 @@ async function proxyFirst(res, candidates, options) {
   }
 }
 
+function normalizedInstanceName(value, fallback = 'cockpit-fast-start') {
+  const cleaned = String(value || fallback)
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, '-')
+    .replace(/-+$/g, '')
+    .slice(0, 63);
+  const prefixed = /^[a-z]/.test(cleaned) ? cleaned : `a-${cleaned.replace(/^-+/, '')}`;
+  return prefixed && prefixed.length >= 2 ? prefixed.slice(0, 63) : fallback;
+}
+
+function instanceVmName(instance, instanceId) {
+  return instance?.launch_context?.name
+    ?? instance?.launchContext?.name
+    ?? instance?.name
+    ?? instance?.id
+    ?? instanceId;
+}
+
+function defaultAssetRef(instanceId, action) {
+  return `${normalizedInstanceName(instanceId, 'cockpit-vm')}-${action}-${Date.now().toString(36)}`.slice(0, 96);
+}
+
+function upstreamBridgeError(err) {
+  rethrowExecutorSecurityError(err);
+  return { status: 502, body: { error: 'bridge_upstream_error', message: String(err?.message ?? err) } };
+}
+
+async function providerFastStartAction(upstreamUrl, instanceId, action, body = {}) {
+  let inventory;
+  try { inventory = await getInventory(upstreamUrl); }
+  catch (err) { rethrowExecutorSecurityError(err); inventory = { instances: [] }; }
+  const inst = inventory.instances.find((i) => String(i.id) === String(instanceId));
+  if (!inst) return { status: 404, body: { error: 'instance_not_found', instance_id: instanceId } };
+  const runtime = String(inst.runtime_posture?.kind ?? inst.runtime ?? '').toLowerCase();
+  if (!['vm', 'qemu', 'kvm'].includes(runtime)) {
+    return { status: 422, body: { error: 'unsupported_runtime', message: 'fast-start actions are valid only for VM instances' } };
+  }
+  const provider = String(inst.provider ?? '').trim();
+  if (!provider) return { status: 422, body: { error: 'provider_required', message: 'executor inventory did not report an effective VM provider' } };
+
+  const vmName = instanceVmName(inst, instanceId);
+  const rawAsset = body.asset_ref ?? body.assetRef ?? body.snapshot_id ?? body.snapshotId ?? body.checkpoint_id ?? body.checkpointId ?? body.pool;
+  const assetRef = String(rawAsset ?? '').trim();
+  const restoreMode = String(body.restore_mode ?? body.restoreMode ?? 'ondemand').trim() || 'ondemand';
+  const childName = normalizedInstanceName(
+    body.name ?? body.child_name ?? body.childName,
+    `${normalizedInstanceName(vmName, 'cockpit-vm')}-${action === 'warm-pool' ? 'warm' : action}`,
+  );
+
+  if (action === 'snapshot' || action === 'checkpoint') {
+    const newAssetRef = assetRef || defaultAssetRef(vmName, provider === 'libvirt' ? 'checkpoint' : 'snapshot');
+    if (provider === 'cloud-hypervisor') {
+      return fetchJsonFirst([{
+        target: `${upstreamUrl}/api/v2/admin/cloud-hypervisor/snapshots`,
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          vm: vmName,
+          snapshot_id: newAssetRef,
+          pre_enrollment: body.pre_enrollment ?? body.preEnrollment ?? true,
+        }),
+      }]).catch(upstreamBridgeError);
+    }
+    if (provider === 'libvirt') {
+      return fetchJsonFirst([{
+        target: `${upstreamUrl}/api/v2/admin/libvirt/checkpoints`,
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          vm: vmName,
+          checkpoint_id: newAssetRef,
+          pre_enrollment: true,
+        }),
+      }]).catch(upstreamBridgeError);
+    }
+    return { status: 422, body: { error: 'unsupported_provider_action', provider, action } };
+  }
+
+  if (!assetRef) {
+    return { status: 400, body: { error: 'asset_ref_required', message: 'restore, fork, and warm-pool actions require an opaque asset_ref' } };
+  }
+  const mode = action === 'warm-pool' ? 'warm_pool' : action;
+  return fetchJsonFirst([{
+    target: `${upstreamUrl}/api/v2/admin/instances`,
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({
+      name: childName,
+      runtime: 'qemu',
+      provider,
+      runtime_options: {
+        kind: 'vm',
+        provider,
+        launch_strategy: {
+          mode,
+          prefer_fast_start: true,
+          asset_ref: assetRef,
+          ...(provider === 'cloud-hypervisor' ? { restore_mode: restoreMode } : {}),
+        },
+      },
+    }),
+  }]).catch(upstreamBridgeError);
+}
+
 async function destroyInstance(upstreamUrl, instanceId) {
   let inventory;
   try { inventory = await getInventory(upstreamUrl); }
@@ -596,7 +833,7 @@ async function destroyInstance(upstreamUrl, instanceId) {
   try {
     const result = await fetchJsonFirst(candidates);
     if (result.status < 400) {
-      if (['docker', 'container'].includes(runtime) && dockerName) {
+      if (LOCAL_DOCKER_FALLBACK && ['docker', 'container'].includes(runtime) && dockerName) {
         try {
           await spawnCollect('docker', ['rm', '-f', dockerName]);
           return {
@@ -648,6 +885,18 @@ async function destroyInstance(upstreamUrl, instanceId) {
       body: { error: 'instance_not_destroyable', message: `No destroyable runtime record for ${instanceId}` },
     };
   }
+  if (!LOCAL_DOCKER_FALLBACK) {
+    return {
+      target: `${upstreamUrl}/api/v2/admin/instances/${encodeURIComponent(instanceId)}/destroy`,
+      status: 409,
+      body: {
+        error: 'local_docker_fallback_disabled',
+        message: 'Sandbox management did not accept this destroy request. Local docker rm fallback is disabled unless AIWG_COCKPIT_LOCAL_DOCKER_FALLBACK=1 is set for local development.',
+        runtime,
+        docker_name: dockerName,
+      },
+    };
+  }
 
   let alreadyGone = false;
   try {
@@ -730,6 +979,18 @@ async function reconnectInstance(upstreamUrl, instanceId) {
   }
 
   if (['docker', 'container'].includes(runtime) && dockerName) {
+    if (!LOCAL_DOCKER_FALLBACK) {
+      return {
+        target: `${upstreamUrl}/api/v2/admin/instances/${encodeURIComponent(instanceId)}/reconnect`,
+        status: 409,
+        body: {
+          error: 'local_docker_fallback_disabled',
+          message: 'Sandbox management did not accept this reconnect request. Local docker exec fallback is disabled unless AIWG_COCKPIT_LOCAL_DOCKER_FALLBACK=1 is set for local development.',
+          runtime,
+          docker_name: dockerName,
+        },
+      };
+    }
     try {
       const output = await spawnCollect('docker', ['exec', dockerName, 'agent-reconnect']);
       return {
@@ -759,6 +1020,19 @@ async function reconnectInstance(upstreamUrl, instanceId) {
   }
 
   if (VM_RUNTIME_KINDS.includes(runtime)) {
+    if (!localLibvirtFallbackAllowed()) {
+      return {
+        target: `${upstreamUrl}/api/v2/admin/instances/${encodeURIComponent(instanceId)}/reconnect`,
+        status: 409,
+        body: {
+          error: 'local_libvirt_fallback_disabled',
+          message: 'Sandbox management did not accept this reconnect request. Local virsh fallback is only automatic on Linux; set AIWG_COCKPIT_LOCAL_LIBVIRT_FALLBACK=1 for explicit local development on this host.',
+          runtime,
+          platform: process.platform,
+          arch: process.arch,
+        },
+      };
+    }
     // For VM instances the agent_id doubles as the libvirt domain name
     // (agentic-sandbox provision-vm.sh registers agent_id = $vm_name).
     const domain = dockerName ?? inst?.name ?? String(instanceId);
@@ -933,6 +1207,109 @@ function normalizeTransport(posture) {
   };
 }
 
+function safeRef(value) {
+  const ref = typeof value === 'string' ? value.trim() : '';
+  if (!ref) return undefined;
+  if (/-----BEGIN|PRIVATE KEY|TOKEN|SECRET|PASSWORD|[\r\n]/i.test(ref)) return '[redacted]';
+  return ref.slice(0, 160);
+}
+
+function normalizeBootstrapTrustReadiness(body, executorUrl, { available = true } = {}) {
+  const ca = body?.ca_provider && typeof body.ca_provider === 'object' ? body.ca_provider : {};
+  const bootstrap = body?.bootstrap && typeof body.bootstrap === 'object' ? body.bootstrap : {};
+  const status = String(body?.status ?? (available ? 'unknown' : 'disabled')).toLowerCase();
+  const normalizedStatus = ['secure', 'degraded', 'disabled'].includes(status)
+    ? status
+    : (ca.configured === true || ca.available === true ? 'degraded' : 'disabled');
+  const trustFresh = ca.trust_bundle_fresh ?? ca.trustBundleFresh ?? ca.fresh;
+  const tokenStoreConfigured = bootstrap.token_store_configured ?? bootstrap.tokenStoreConfigured;
+  const caConfigured = ca.configured ?? ca.available;
+  const missing = [];
+  if (caConfigured === false) missing.push('ca_provider');
+  if (tokenStoreConfigured === false) missing.push('bootstrap_token_store');
+  if (trustFresh === false) missing.push('fresh_trust_bundle');
+  const plaintextDev = new URL(executorUrl).protocol === 'http:' && isLocalHostName(new URL(executorUrl).hostname);
+  const recovery = normalizedStatus === 'secure'
+    ? 'Sandbox CA and bootstrap trust are ready.'
+    : normalizedStatus === 'degraded'
+      ? 'Refresh sandbox CA/bootstrap readiness, rotate stale trust material, then reload Cockpit.'
+      : plaintextDev
+        ? 'Plaintext local development mode only; enable sandbox mTLS before using remote or shared executors.'
+        : 'Configure sandbox CA provider and client trust refs before connecting Cockpit.';
+  return {
+    status: normalizedStatus,
+    mode: normalizedStatus === 'secure' ? 'mtls' : (plaintextDev ? 'plaintext-dev' : 'disabled'),
+    label: normalizedStatus === 'secure'
+      ? 'Sandbox mTLS ready'
+      : normalizedStatus === 'degraded'
+        ? 'Sandbox trust degraded'
+        : (plaintextDev ? 'Plaintext dev mode' : 'Sandbox trust disabled'),
+    source: body?.source ?? '/api/v2/admin/bootstrap/readiness',
+    ca_provider_ref: safeRef(ca.provider_ref ?? ca.providerRef ?? ca.provider ?? ca.id ?? ca.name),
+    trust_bundle_ref: safeRef(ca.trust_bundle_ref ?? ca.trustBundleRef ?? ca.bundle_ref ?? ca.bundleRef),
+    client_identity_ref: safeRef(ca.client_identity_ref ?? ca.clientIdentityRef ?? ca.identity_ref ?? ca.identityRef),
+    rotation_state: safeRef(ca.rotation_state ?? ca.rotationState ?? ca.state),
+    expires_at: safeRef(ca.expires_at ?? ca.expiresAt ?? ca.not_after ?? ca.notAfter),
+    trust_bundle_fresh: trustFresh === undefined ? undefined : Boolean(trustFresh),
+    token_store_configured: tokenStoreConfigured === undefined ? undefined : Boolean(tokenStoreConfigured),
+    missing_required_material: missing,
+    recovery,
+  };
+}
+
+function assertRequiredBootstrapTrust(posture) {
+  if (posture.status === 'secure' && posture.missing_required_material.length === 0) return;
+  const err = executorAuthError(
+    'executor_trust_required',
+    `sandbox mTLS is required but bootstrap trust is ${posture.status}: ${posture.recovery}`,
+  );
+  err.upstreamStatus = 503;
+  err.recovery = posture.recovery;
+  throw err;
+}
+
+async function getBootstrapTrustPosture(executorUrl, { requireSandboxMtls = false } = {}) {
+  try {
+    const { target, body } = await fetchJsonFirst([
+      `${executorUrl}/api/v2/admin/bootstrap/readiness`,
+      `${executorUrl}/admin/bootstrap/readiness`,
+    ]);
+    const posture = normalizeBootstrapTrustReadiness({ ...body, source: new URL(target).pathname }, executorUrl);
+    if (requireSandboxMtls) assertRequiredBootstrapTrust(posture);
+    return posture;
+  } catch (err) {
+    rethrowExecutorSecurityError(err);
+    const posture = normalizeBootstrapTrustReadiness({
+      status: 'disabled',
+      source: '/api/v2/admin/bootstrap/readiness',
+      ca_provider: { configured: false },
+      bootstrap: { token_store_configured: false },
+    }, executorUrl, { available: false });
+    if (requireSandboxMtls) assertRequiredBootstrapTrust(posture);
+    return posture;
+  }
+}
+
+function normalizeStoragePosture(posture) {
+  const raw = posture && typeof posture === 'object' ? posture : {};
+  return {
+    persistent: Boolean(raw.persistent ?? raw.persists ?? raw.persistence === 'persistent'),
+    delete_on_destroy: Boolean(raw.delete_on_destroy ?? raw.deleteOnDestroy),
+    scope: raw.scope ?? raw.storage_scope ?? raw.storageScope,
+    reason: raw.reason ?? raw.detail,
+  };
+}
+
+function normalizeLifecycle(lifecycle) {
+  const raw = lifecycle && typeof lifecycle === 'object' ? lifecycle : {};
+  return {
+    destroy: raw.destroy ?? raw.delete ?? raw.remove,
+    reconnect: raw.reconnect,
+    start: raw.start,
+    stop: raw.stop,
+  };
+}
+
 function normalizeSessionBackends(backends, runtimeKind, state = 'unknown', agentReady = false) {
   const list = Array.isArray(backends) ? backends : [];
   if (!list.length && runtimeKind === 'host') {
@@ -984,6 +1361,10 @@ function normalizeInstance(executorUrl, i) {
   return {
     id,
     runtime,
+    provider: i.provider ?? i.runtime_provider ?? i.runtimeProvider ?? i.runtime?.provider,
+    capabilities: Array.isArray(i.capabilities) ? i.capabilities : i.runtime?.capabilities,
+    capability_constraints: i.capability_constraints ?? i.capabilityConstraints ?? i.runtime?.capability_constraints ?? i.runtime?.capabilityConstraints,
+    gpu: i.gpu ?? i.gpu_posture ?? i.gpuPosture ?? i.runtime?.gpu,
     loadout,
     state: i.state ?? i.status ?? 'unknown',
     tenant: i.tenant_id ?? i.tenant ?? i.tenantId ?? 'default',
@@ -1005,6 +1386,8 @@ function normalizeInstance(executorUrl, i) {
       image_ref: i.image_ref ?? i.imageRef ?? i.runtime_extension?.image_ref ?? i.runtimeExtension?.imageRef,
       source: i.runtime_extension ? 'agent-card runtime extension' : i.launch_context?.source ?? i.launchContext?.source,
     },
+    storage: normalizeStoragePosture(i.storage ?? i.storage_posture ?? i.storagePosture ?? i.lifecycle?.storage),
+    lifecycle: normalizeLifecycle(i.lifecycle ?? i.lifecycle_support ?? i.lifecycleSupport),
     agent_ready: agentReady,
     registered_agent_id: i.registered_agent_id ?? i.registeredAgentId,
     session_backends: normalizeSessionBackends(i.session_backends ?? i.sessionBackends ?? i.session_host?.backends ?? i.sessionHost?.backends ?? i.capabilities?.session_backends ?? i.capabilities?.sessionBackends, runtimePosture.kind, i.state ?? i.status, agentReady),
@@ -1154,7 +1537,8 @@ async function getAgentBackedHostInventory(executorUrl, degradedDetail) {
 }
 
 /** Normalize the executor's admin inventory into the Bridge's UI shape. */
-async function getInventory(executorUrl) {
+async function getInventory(executorUrl, { requireSandboxMtls = false } = {}) {
+  const bootstrapTrust = await getBootstrapTrustPosture(executorUrl, { requireSandboxMtls });
   const { target, status, body } = await fetchJsonFirst([
     `${executorUrl}/admin/instances`,
     `${executorUrl}/api/v2/admin/instances`,
@@ -1176,6 +1560,7 @@ async function getInventory(executorUrl) {
         count: 0,
         degraded_admin_inventory: detail,
         admin_error: body,
+        bootstrap_trust: bootstrapTrust,
         instances: [],
       };
     }
@@ -1190,6 +1575,8 @@ async function getInventory(executorUrl) {
     admin_path: new URL(target).pathname,
     fetched_at: new Date().toISOString(),
     count: normalized.length,
+    bootstrap_trust: bootstrapTrust,
+    degraded_providers: body?.degraded_providers,
     instances: normalized,
   };
 }
@@ -1240,6 +1627,8 @@ async function getLoadouts(executorUrl) {
       label: l.label ?? l.display_name ?? l.displayName ?? id,
       description: l.description ?? l.summary,
       runtimes: l.runtimes ?? l.runtime_kinds ?? l.supported_runtimes,
+      runtime_options: l.runtime_options ?? l.runtimeOptions,
+      compatibility: l.compatibility,
     };
   }).filter((l) => l.id);
   return { source: executorUrl, loadouts_path: new URL(target).pathname, count: loadouts.length, loadouts };
@@ -1854,6 +2243,7 @@ export function createBridge({
   allowMockExecutor = ALLOW_MOCK_EXECUTOR,
   token,
   executorTokenFile = EXECUTOR_TOKEN_FILE,
+  requireSandboxMtls = REQUIRE_SANDBOX_MTLS,
 } = {}) {
   const upstreamUrl = executorUrl;
   const TOKEN = token ?? randomBytes(24).toString('hex');
@@ -1891,8 +2281,11 @@ export function createBridge({
       if (url.pathname.startsWith('/api/')) {
         try {
           await assertRealExecutor(upstreamUrl, allowMockExecutor);
+          if (requireSandboxMtls) {
+            await getBootstrapTrustPosture(upstreamUrl, { requireSandboxMtls: true });
+          }
         } catch (err) {
-          return json(res, 502, { error: err.code ?? 'executor_refused', message: String(err?.message ?? err) });
+          return json(res, Number(err?.upstreamStatus) || 502, { error: err.code ?? 'executor_refused', message: String(err?.message ?? err), recovery: err?.recovery });
         }
       }
       if (url.pathname === '/api/events' && req.method === 'GET') {
@@ -1910,8 +2303,13 @@ export function createBridge({
         req.on('close', () => clearInterval(timer));
         return;
       }
-      if (url.pathname === '/api/inventory') return json(res, 200, await getInventory(upstreamUrl));
+      if (url.pathname === '/api/inventory') return json(res, 200, await getInventory(upstreamUrl, { requireSandboxMtls }));
       if (url.pathname === '/api/executor/capabilities') return json(res, 200, await getExecutorCapabilities(upstreamUrl));
+      if (url.pathname === '/api/bootstrap/readiness' && req.method === 'GET') {
+        return json(res, 200, await getBootstrapTrustPosture(upstreamUrl, { requireSandboxMtls }));
+      }
+      if (url.pathname === '/api/mcp/discovery' && req.method === 'GET') return json(res, 200, await getMcpDiscovery(upstreamUrl));
+      if (url.pathname === '/api/mcp' && req.method === 'POST') return proxyMcpRequest(req, res, upstreamUrl, MCP_TOKEN_FILE);
       if (url.pathname === '/api/running') return json(res, 200, await getRunning(upstreamUrl));
       if (url.pathname === '/api/missions') return json(res, 200, await getMissions(upstreamUrl));
       if (url.pathname === '/api/events/snapshot') return json(res, 200, await getEventSnapshot(upstreamUrl));
@@ -2175,6 +2573,29 @@ export function createBridge({
       }
 
       // --- management surface (UC-012): lifecycle + task cancel ---
+      if ((m = url.pathname.match(/^\/api\/instances\/([^/]+)\/(snapshot|checkpoint|restore|fork|warm-pool)$/)) && req.method === 'POST') {
+        const parsed = await readJsonBody(req);
+        if (parsed.error) return json(res, 400, { error: parsed.error });
+        const instanceId = decodeURIComponent(m[1]);
+        const action = m[2];
+        const body = parsed.body || {};
+        const before = await appendAudit('instance.fast_start.requested', {
+          instance_id: instanceId,
+          action,
+          asset_ref: body.asset_ref ?? body.assetRef ?? body.snapshot_id ?? body.snapshotId ?? body.checkpoint_id ?? body.checkpointId ?? body.pool,
+          name: body.name ?? body.child_name ?? body.childName,
+        });
+        const result = await providerFastStartAction(upstreamUrl, instanceId, action, body);
+        await appendAudit('instance.fast_start.accepted', {
+          request_ts: before.ts,
+          instance_id: instanceId,
+          action,
+          status: result.status,
+          operation_id: result.body?.id ?? result.body?.operation?.id,
+          result: result.body,
+        });
+        return json(res, result.status, result.body);
+      }
       if ((m = url.pathname.match(/^\/api\/instances\/([^/]+)\/(start|stop)$/)) && req.method === 'POST') {
         const result = await fetchJsonFirst([
           `${upstreamUrl}/admin/instances/${encodeURIComponent(m[1])}/${m[2]}`,

package/bridge/src/smoke.mjs

@@ -2,8 +2,8 @@
 // Self-contained (own ports); no deps. Exits non-zero on failure.
 import assert from 'node:assert/strict';
 import { fileURLToPath } from 'node:url';
-import { createExecutor } from '../../mock-executor/src/server.mjs';
-import { createBridge, normalizeSessionRows } from './server.mjs';
+import { createExecutor, DEFAULT_INSTANCE } from '../../mock-executor/src/server.mjs';
+import { createBridge, localLibvirtFallbackAllowed, normalizeSessionRows } from './server.mjs';
 
 const mock = createExecutor();
 await new Promise((r) => mock.listen(0, '127.0.0.1', r));
@@ -34,6 +34,8 @@ try {
   assert.equal(inv.instances.find((i) => i.transport?.mode === 'shared-secret')?.transport.trust, 'compatibility', 'legacy secret transport is compatibility posture');
   const i0 = inv.instances[0];
   for (const k of ['id', 'runtime', 'loadout', 'state', 'tenant', 'card_url', 'runtime_posture', 'host_daemon', 'transport', 'launch_context', 'session_backends']) assert.ok(k in i0, `field ${k}`);
+  assert.equal(i0.storage?.persistent, true, 'storage persistence surfaced');
+  assert.equal(i0.storage?.delete_on_destroy, true, 'storage delete-on-destroy surfaced');
   assert.ok(['vm', 'container', 'host', 'wasm-edge'].includes(i0.runtime), 'runtime kind');
 
   // A transient executor outage must not poison Bridge state or require a
@@ -101,6 +103,45 @@ try {
   assert.ok(Array.isArray(lo.loadouts) && lo.loadouts.length >= 3, 'loadout catalog returned');
   assert.ok(lo.loadouts.every((l) => typeof l.id === 'string' && typeof l.label === 'string'), 'loadouts carry id+label');
   assert.ok(lo.loadouts.some((l) => l.id === 'security-audit'), 'catalog includes a non-default loadout');
+  const gpuLoadout = lo.loadouts.find((l) => l.id === 'gpu-vfio');
+  assert.ok(gpuLoadout?.runtime_options?.required_capabilities?.includes('device.vfio'), 'loadout runtime_options preserve VFIO requirement');
+  assert.ok(gpuLoadout?.compatibility?.[0]?.excluded_capabilities?.includes('instance.restore'), 'loadout compatibility preserves fast-start exclusion');
+
+  const caps = await (await f('/api/executor/capabilities')).json();
+  assert.ok(caps.runtime_providers?.providers?.some((p) => p.provider === 'cloud-hypervisor'), 'runtime providers discovered');
+  assert.ok(caps.runtime_providers.providers.find((p) => p.provider === 'cloud-hypervisor')?.capability_constraints?.[0]?.excludes?.includes('instance.restore'), 'provider VFIO constraint preserved');
+  const hostProvider = caps.runtime_providers.providers.find((p) => p.provider === 'host');
+  const dockerProvider = caps.runtime_providers.providers.find((p) => p.provider === 'docker');
+  assert.ok(hostProvider?.platforms?.includes('darwin/arm64'), 'Apple Silicon host runtime discovery is proxied');
+  assert.equal(hostProvider?.posture?.host_architecture, 'arm64', 'Apple Silicon host architecture is preserved');
+  assert.equal(dockerProvider?.engine, 'Docker Desktop', 'Docker Desktop runtime posture is proxied');
+  assert.equal(dockerProvider?.posture?.host_platform, 'darwin', 'Docker Desktop host platform is preserved');
+  assert.equal(localLibvirtFallbackAllowed('darwin', undefined), false, 'virsh fallback is not automatic on macOS');
+  assert.equal(localLibvirtFallbackAllowed('darwin', '1'), true, 'virsh fallback can be explicitly enabled for local development');
+  assert.equal(localLibvirtFallbackAllowed('linux', undefined), true, 'Linux bridge hosts retain local virsh fallback');
+
+  const vm = inv.instances.find((i) => i.provider === 'cloud-hypervisor');
+  assert.ok(vm, 'provider-aware VM inventory row present');
+  const fastStartAccepted = await (await f(`/api/instances/${encodeURIComponent(vm.id)}/snapshot`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ asset_ref: 'cockpit-smoke-snapshot' }),
+  })).json();
+  assert.ok(fastStartAccepted.id, 'fast-start proxy returns operation id');
+  const fastStartTerminal = await (await f(`/api/operations/${encodeURIComponent(fastStartAccepted.id)}`)).json();
+  assert.equal(fastStartTerminal.state, 'succeeded', 'fast-start operation reaches terminal state');
+  assert.equal(fastStartTerminal.result.provider, 'cloud-hypervisor', 'fast-start operation preserves provider');
+
+  const mcp = await (await f('/api/mcp/discovery')).json();
+  assert.equal(mcp.enabled, true, 'MCP discovery enabled');
+  assert.equal(mcp.endpoint?.path, '/mcp', 'MCP endpoint path surfaced');
+  assert.equal(mcp.endpoint?.mcp_session_id, false, 'MCP discovery is stateless/no session id');
+  assert.ok(mcp.tools.some((tool) => tool.name === 'list_sandboxes'), 'MCP tools surfaced');
+  assert.ok(mcp.resource_templates.some((template) => template.uriTemplate === 'sandbox://sessions/{session_id}/screen'), 'MCP resource templates surfaced');
+  assert.equal((await f('/api/mcp', { method: 'POST', body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }) })).status, 503, 'MCP proxy fail-closed without token file');
+  const gatedReconnect = await f(`/api/instances/${DEFAULT_INSTANCE}/reconnect`, { method: 'POST' });
+  assert.equal(gatedReconnect.status, 409, 'Docker reconnect fallback is gated unless local dev flag is set');
+  assert.equal((await gatedReconnect.json()).error, 'local_docker_fallback_disabled', 'Docker reconnect fallback error is explicit');
 
   // registry binding: discover + show through the aiwg CLI (#1592)
   const cap = await (await f("/api/capabilities?q=" + encodeURIComponent("deploy production") + "&limit=4")).json();
@@ -196,7 +237,7 @@ try {
     assert.equal((await fetch(base + asset[1].replace(/^\.\//, '/'))).status, 200, 'built React bundle served');
   }
 
-  console.log(`SMOKE OK — inventory(4) + running(${run.count}) + sessions(demo-shell) + registry(discover→${cap.results.length}) + contrib(${contrib.actions.length}) + shell(${shell})`);
+  console.log(`SMOKE OK — inventory(4) + running(${run.count}) + sessions(demo-shell) + mcp(${mcp.tools.length} tools) + registry(discover→${cap.results.length}) + contrib(${contrib.actions.length}) + shell(${shell})`);
 } finally {
   bridge.close();
   mock.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cockpit",
-  "version": "2026.7.21",
+  "version": "2026.7.24",
   "description": "AIWG Cockpit — UX-first control plane over AIWG + multi-stack agentic sessions. Opt-in, separately published; NOT shipped in the base aiwg npm package (guarded by test/smoke/cockpit-base-footprint.test.js).",
   "type": "module",
   "license": "MIT",