@calltelemetry/ct-lab-mcp 0.8.105 → 0.8.107

package/dist/src/stig/runner.d.ts

@@ -1,20 +1,20 @@
 import { type StigCounts, type StigDescriptor, type StigReceiptSummary, stigStatusPreview } from "./model.js";
-import { type StigNode, type StigNodeConfig } from "./nodes.js";
 import type { ClaimRecord, StigDeps } from "./ports.js";
+import { type StigNode, type StigNodeName } from "./nodes.js";
+import { VMID_RANGE } from "./pve.js";
+export declare const STIG_NODE_ANNOTATION = "calltelemetry.com/stig-node";
+export { VMID_RANGE };
 export declare const BUILD_CLAIM_TTL_HOURS = 6;
 export declare const DEFAULT_CLONE_TTL_HOURS = 48;
-export declare const VMID_RANGE: {
-    readonly min: 8100;
-    readonly max: 8899;
-};
+export declare const dopplerKeyFor: (cloneName: string) => string;
 export interface ClonePlan {
     mode: "plan";
-    node: StigNode;
     recreate?: {
         claim: string;
         uid: string;
         vmid: number;
     };
+    untagged: boolean;
     cloneName: string;
     claim: string;
     vmid: number;
@@ -22,6 +22,12 @@ export interface ClonePlan {
         ref: string;
         vmid: number;
     };
+    node: StigNodeName;
+    host: string;
+    claimNode: string;
+    thin: string;
+    bridge: string;
+    vlan: number | null;
     ttlHours: number;
     poolPercent: number;
     poolMaxPercent: number;
@@ -47,19 +53,30 @@ export interface BuildPlan {
 }
 export declare class StigRunner {
     private readonly d;
-    private static reencrypting;
-    readonly node: StigNodeConfig;
-    constructor(d: StigDeps, node?: StigNode);
+    /** Nodes with a clone re-encrypting in this process: one per node, nodes are independent. */
+    private static readonly reencrypting;
+    private readonly defaultNode;
+    /** `node` is the default for calls that do not name one (create_stig_claim's own `node` argument wins). */
+    constructor(d: StigDeps, node?: string);
+    get node(): StigNode;
     private log;
+    private sh;
     private listGuests;
+    /** VMIDs are per node: a live guest on the node, or a claim on the node's claim node, occupies one. */
     private pickVmid;
+    /** The canonical lab-inventory clone puts guests on vmbr0; nodes that clone onto another bridge use the root-SSH path. */
+    private providerFor;
     private poolPercent;
+    /** The node a claim lives on: its spec.node, which an explicit `node` argument must agree with. */
+    private nodeOfClaim;
     private newestTemplate;
     private step;
     private ensureDir;
     private writeSecretFile;
+    private buildNode;
     planClone(i: {
         cloneName: string;
+        node?: string;
         templateRef?: string;
         ttlHours?: number;
         dns?: string[];
@@ -70,6 +87,7 @@ export declare class StigRunner {
     }): Promise<ClonePlan>;
     createClone(i: {
         cloneName: string;
+        node?: string;
         apply?: boolean;
         planDigest?: string;
         templateRef?: string;
@@ -106,20 +124,29 @@ export declare class StigRunner {
     private annotateSummary;
     validate(i: {
         cloneName: string;
+        node?: string;
         requireDisa?: boolean;
     }): Promise<any>;
     getReceipt(i: {
         claim: string;
+        node?: string;
     }): Promise<{
         claim: string;
+        node: StigNodeName;
         descriptor: Record<string, any> | null;
         summary: StigReceiptSummary | null;
         statusPreview: ReturnType<typeof stigStatusPreview>;
     }>;
     releaseTemplate(i: {
         claim: string;
+        node?: string;
         confirmDestroy: boolean;
     }): Promise<any>;
 }
+/** The clone verification of clone.sh `verify` (FIPS, SELinux, LUKS2 + TPM2, bootstrap key, recovery test); throws unless the gate holds. */
+export declare function verifyGuestFacts(d: Pick<StigDeps, "guest" | "secrets" | "readAsset">, escrowKey: string, sudoStdin: (extra?: string) => string): Promise<{
+    kv: Record<string, string>;
+    text: string;
+}>;
 export type { StigCounts, StigDescriptor, ClaimRecord };
 //# sourceMappingURL=runner.d.ts.map

package/dist/src/stig/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/stig/runner.ts"],"names":[],"mappings":"AAWA,OAAO,EAGL,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAEyB,iBAAiB,EAExG,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAY,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAe,QAAQ,EAAE,MAAM,YAAY,CAAC;AAErE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,UAAU;;;CAAoC,CAAC;AAU5D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzG,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;CACjE;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3F,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,UAAU;IAGT,OAAO,CAAC,QAAQ,CAAC,CAAC;IAF9B,OAAO,CAAC,MAAM,CAAC,YAAY,CAAS;IACpC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;gBACD,CAAC,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAkB;IAElE,OAAO,CAAC,GAAG;YAIG,UAAU;YAMV,QAAQ;YAQR,WAAW;IAQzB,OAAO,CAAC,cAAc;YAIR,IAAI;IAIlB,OAAO,CAAC,SAAS;IAEjB,OAAO,CAAC,eAAe;IAIjB,SAAS,CAAC,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IA+BjM,WAAW,CAAC,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;YAuB3N,UAAU;YA8FV,KAAK;YAML,WAAW;IAkBnB,SAAS,CAAC,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAkBzK,KAAK,CAAC,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;YA6E7N,eAAe;IASvB,QAAQ,CAAC,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAsDvE,UAAU,CAAC,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;QAAC,aAAa,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;KAAE,CAAC;IAW7L,eAAe,CAAC,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;CAcnF;AAcD,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/stig/runner.ts"],"names":[],"mappings":"AAWA,OAAO,EAGL,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAEyB,iBAAiB,EAExG,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAAE,WAAW,EAAyB,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAA4E,KAAK,QAAQ,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AACxI,OAAO,EAAE,UAAU,EAAiF,MAAM,UAAU,CAAC;AAErH,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,CAAC;AAEtB,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAK1C,eAAO,MAAM,aAAa,GAAI,WAAW,MAAM,KAAG,MAA4E,CAAC;AAE/H,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACvG,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzG,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;CACjE;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3F,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,UAAU;IAKT,OAAO,CAAC,QAAQ,CAAC,CAAC;IAJ9B,6FAA6F;IAC7F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAW;IACvC,2GAA2G;gBAC9E,CAAC,EAAE,QAAQ,EAAE,IAAI,GAAE,MAAwB;IAExE,IAAI,IAAI,IAAI,QAAQ,CAA6B;IAEjD,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,EAAE;IAEV,OAAO,CAAC,UAAU;IAElB,uGAAuG;YACzF,QAAQ;IAKtB,0HAA0H;IAC1H,OAAO,CAAC,WAAW;YAKL,WAAW;IAIzB,mGAAmG;IACnG,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,cAAc;YAIR,IAAI;IAIlB,OAAO,CAAC,SAAS;IAEjB,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,SAAS;IAEX,SAAS,CAAC,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAkChN,WAAW,CAAC,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;YAwB1O,UAAU;YAkGV,KAAK;IAMnB,OAAO,CAAC,WAAW;IAMb,SAAS,CAAC,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAkBzK,KAAK,CAAC,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;YA6E7N,eAAe;IASvB,QAAQ,CAAC,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IA4DtF,UAAU,CAAC,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;QAAC,aAAa,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;KAAE,CAAC;IAWhO,eAAe,CAAC,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;CAgBlG;AAcD,6IAA6I;AAC7I,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAc5M;AAED,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC"}

package/dist/src/stig/runner.js

@@ -7,52 +7,61 @@
  * Plans are pure. Applies need the digest of the plan they were shown.
  */
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { STIG_RECEIPT_ANNOTATION, STIG_STEP_ANNOTATION, STIG_STEPS, STIG_PINS, STIG_DATASTREAM_SHA256, DISA_BENCHMARK_SHA256, STIG_TAILORING_SHA256, STIG_DVD_ISO, STIG_TEMPLATE_PREFIX, STIG_ANNOTATION_MAX_BYTES, STIG_POOL_LIMIT_PERCENT, COUNT_KEYS, assertPoolBelow, assertSingleReencrypt, assertNoYoungStigClone, disaCountsFromKv, DISA_PROFILE_ID, assertTemplateReleaseAllowed, buildReceiptSummary, capTtl, countsFromKv, defaultDescriptor, parseKv, planTemplateRenewal, receiptGate, redact, stigDescriptor, stigStatusPreview, validateReceiptSummary, } from "./model.js";
 import { sha256File } from "./receipt.js";
-import { stigNode } from "./nodes.js";
+import { clearStage, cloneIdentity, markStage } from "./markers.js";
+import { STIG_BUILD_NODE, STIG_PROVIDER_BRIDGE, nodeForClaimNode, resolveStigNode } from "./nodes.js";
+import { VMID_RANGE, listGuests as listGuestsOn, lowestFreeVmid, parsePvesmStatus, shq } from "./pve.js";
+export const STIG_NODE_ANNOTATION = "calltelemetry.com/stig-node";
+export { VMID_RANGE };
 export const BUILD_CLAIM_TTL_HOURS = 6;
 export const DEFAULT_CLONE_TTL_HOURS = 48;
-export const VMID_RANGE = { min: 8100, max: 8899 };
 const CI_USER = "ctadmin";
 const DEFAULT_DNS = ["192.168.126.1", "192.168.68.125"];
 const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
-const shq = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
-const dopplerKeyFor = (cloneName) => `LAB_RHEL8_RECOVERY_${cloneName.toUpperCase().replace(/-/g, "_")}`;
+export const dopplerKeyFor = (cloneName) => `LAB_RHEL8_RECOVERY_${cloneName.toUpperCase().replace(/-/g, "_")}`;
 export class StigRunner {
     d;
-    static reencrypting = false;
-    node;
-    constructor(d, node = "minis") {
+    /** Nodes with a clone re-encrypting in this process: one per node, nodes are independent. */
+    static reencrypting = new Set();
+    defaultNode;
+    /** `node` is the default for calls that do not name one (create_stig_claim's own `node` argument wins). */
+    constructor(d, node = STIG_BUILD_NODE) {
         this.d = d;
-        this.node = stigNode(node);
+        this.defaultNode = resolveStigNode(node);
     }
+    get node() { return this.defaultNode; }
     log(line) { this.d.log.info(redact(line)); }
     /* ------------------------------------------------------------ helpers */
-    async listGuests() {
-        const r = await this.d.pve.run("pvesh get /cluster/resources --type vm --output-format json");
-        if (r.code !== 0)
-            throw new Error("could not list Proxmox guests");
-        return JSON.parse(r.stdout);
+    sh(node) { return this.d.pveFor(node.host); }
+    listGuests(node) { return listGuestsOn(this.sh(node)); }
+    /** VMIDs are per node: a live guest on the node, or a claim on the node's claim node, occupies one. */
+    async pickVmid(node, guests) {
+        const claims = (await this.d.claims.list()).filter((c) => (c.spec?.node ?? "minis") === node.claimNode);
+        return lowestFreeVmid(guests ?? (await this.listGuests(node)), claims);
     }
-    async pickVmid(guests) {
-        const live = guests ?? (await this.listGuests());
-        const used = new Set(live.map((g) => g.vmid));
-        for (const c of await this.d.claims.list())
-            if (Number.isInteger(c.spec?.vmid) && (c.spec?.node ?? "minis") === this.node.claimNode)
-                used.add(c.spec.vmid);
-        for (let v = VMID_RANGE.min; v <= VMID_RANGE.max; v++)
-            if (!used.has(v))
-                return v;
-        throw new Error(`no free VMID in ${VMID_RANGE.min}-${VMID_RANGE.max}`);
+    /** The canonical lab-inventory clone puts guests on vmbr0; nodes that clone onto another bridge use the root-SSH path. */
+    providerFor(node, forClone = false) {
+        if (!this.d.provider)
+            return undefined;
+        return forClone && node.bridge !== STIG_PROVIDER_BRIDGE ? undefined : this.d.provider;
     }
-    async poolPercent() {
-        const r = await this.d.pve.run("pvesm status --storage local-lvm");
-        const row = r.stdout.split("\n")[1] ?? "";
-        const last = row.trim().split(/\s+/).pop() ?? "";
-        const n = Number.parseFloat(last.replace("%", ""));
-        return Number.isFinite(n) ? Math.floor(n) : Number.NaN;
+    async poolPercent(node) {
+        return parsePvesmStatus((await this.sh(node).run(`pvesm status --storage ${node.thin}`)).stdout).percent;
+    }
+    /** The node a claim lives on: its spec.node, which an explicit `node` argument must agree with. */
+    nodeOfClaim(rec, explicit) {
+        const fromClaim = nodeForClaimNode(rec.spec?.node);
+        if (!fromClaim)
+            throw new Error(`claim ${rec.metadata.name} is on node '${rec.spec?.node}', which is not in the STIG node map`);
+        if (explicit !== undefined) {
+            const want = resolveStigNode(explicit);
+            if (want.name !== fromClaim.name)
+                throw new Error(`claim ${rec.metadata.name} lives on ${fromClaim.name}, not ${want.name}`);
+        }
+        return fromClaim;
     }
     newestTemplate(guests) {
         return guests.filter((g) => g.template === 1 && g.name.startsWith(STIG_TEMPLATE_PREFIX)).sort((a, b) => (a.name < b.name ? -1 : 1)).pop();
@@ -63,7 +72,10 @@ export class StigRunner {
     ensureDir(path) { mkdirSync(path, { recursive: true, mode: 0o700 }); chmodSync(path, 0o700); return path; }
     writeSecretFile(path, content) { writeFileSync(path, content, { mode: 0o600 }); chmodSync(path, 0o600); }
     /* ------------------------------------------------------------ clone */
+    buildNode() { return resolveStigNode(STIG_BUILD_NODE); }
     async planClone(i) {
+        const node = i.node ? resolveStigNode(i.node) : this.defaultNode;
+        const untagged = i.untagged === true;
         if (!/^[a-z0-9]([a-z0-9-]{0,40}[a-z0-9])?$/.test(i.cloneName))
             throw new Error("cloneName must be a lowercase DNS label (a-z, 0-9, -)");
         const ttlHours = capTtl(i.ttlHours ?? DEFAULT_CLONE_TTL_HOURS);
@@ -84,18 +96,18 @@ export class StigRunner {
                 throw new Error(`claim ${claim} is not a STIG clone claim; refusing to recreate it`);
             recreate = { claim, uid: existing.metadata.uid, vmid: existing.spec?.vmid };
         }
-        const guests = await this.listGuests();
+        const guests = await this.listGuests(node);
         const tpl = i.templateRef ? guests.find((g) => g.template === 1 && g.name === i.templateRef) : this.newestTemplate(guests);
         if (!tpl)
-            throw new Error(i.templateRef ? `template ${i.templateRef} not found` : `no ${STIG_TEMPLATE_PREFIX}* template found`);
-        const vmid = await this.pickVmid(guests);
-        const poolPercent = await this.poolPercent();
+            throw new Error(i.templateRef ? `template ${i.templateRef} not found on ${node.name}` : `no ${STIG_TEMPLATE_PREFIX}* template found on ${node.name}`);
+        const vmid = await this.pickVmid(node, guests);
+        const poolPercent = await this.poolPercent(node);
         const poolMaxPercent = i.poolMaxPercent ?? STIG_POOL_LIMIT_PERCENT;
         if (!Number.isInteger(poolMaxPercent) || poolMaxPercent < 10 || poolMaxPercent > STIG_POOL_LIMIT_PERCENT)
             throw new Error(`poolMaxPercent must be 10-${STIG_POOL_LIMIT_PERCENT}`);
         let blockedBy = null;
-        if (this.node.vlan === null && !i.untagged)
-            blockedBy = `node ${this.node.claimNode}'s bridge is not VLAN-aware; a VLAN126 clone gets no network there. Pass untagged=true for an untagged clone.`;
+        if (node.vlan === null && !untagged)
+            blockedBy = `node ${node.name} has no VLAN configured for clones; a tagged clone is not possible there. Pass untagged=true for an untagged clone.`;
         try {
             if (!blockedBy)
                 assertPoolBelow(poolPercent, poolMaxPercent);
@@ -105,16 +117,17 @@ export class StigRunner {
         }
         if (!blockedBy) {
             try {
-                assertSingleReencrypt((await this.d.claims.list()).filter((c) => (c.spec?.node ?? "minis") === this.node.claimNode), claim);
+                assertSingleReencrypt(await this.d.claims.list(), claim, node.claimNode);
                 assertNoYoungStigClone(guests);
             }
             catch (e) {
                 blockedBy = e.message;
             }
         }
-        const base = { cloneName: i.cloneName, claim, vmid, template: { ref: tpl.name, vmid: tpl.vmid }, ttlHours, dns: i.dns ?? DEFAULT_DNS, ntp: i.ntp ?? [], poolMaxPercent, node: this.node.claimNode, untagged: !!i.untagged, recreate: recreate ?? null };
+        const base = { cloneName: i.cloneName, node: node.name, host: node.host, thin: node.thin, bridge: node.bridge, vlan: node.vlan, claim, vmid, template: { ref: tpl.name, vmid: tpl.vmid }, ttlHours, dns: i.dns ?? DEFAULT_DNS, ntp: i.ntp ?? [], poolMaxPercent, untagged, recreate: recreate ?? null };
         return {
-            mode: "plan", node: this.node.claimNode, ...(recreate ? { recreate } : {}), cloneName: i.cloneName, claim, vmid, template: base.template, ttlHours, poolPercent, poolMaxPercent, poolOk: blockedBy === null, blockedBy,
+            mode: "plan", ...(recreate ? { recreate } : {}), untagged, cloneName: i.cloneName, node: node.name, host: node.host, claimNode: node.claimNode, thin: node.thin, bridge: node.bridge, vlan: node.vlan,
+            claim, vmid, template: base.template, ttlHours, poolPercent, poolMaxPercent, poolOk: blockedBy === null, blockedBy,
             escrowKey: dopplerKeyFor(i.cloneName), steps: STIG_STEPS.clone, planDigest: digest({ kind: "clone", ...base }),
         };
     }
@@ -124,6 +137,7 @@ export class StigRunner {
             return plan;
         if (!i.planDigest || i.planDigest !== plan.planDigest)
             throw new Error("plan digest missing or stale; re-run the plan and apply with its planDigest");
+        const node = resolveStigNode(plan.node);
         if (plan.recreate) {
             // Release the old clone first: the operator destroys its guest when the claim is deleted.
             this.log(`recreate: releasing claim ${plan.recreate.claim} (vmid ${plan.recreate.vmid})`);
@@ -132,28 +146,29 @@ export class StigRunner {
                 await this.d.clock.sleep(10_000);
             if (await this.d.claims.get(plan.recreate.claim))
                 throw new Error(`claim ${plan.recreate.claim} is still present after release; not creating its replacement`);
-            for (let n = 0; n < 60 && (await this.listGuests()).some((g) => g.vmid === plan.recreate.vmid); n++)
+            for (let n = 0; n < 60 && (await this.listGuests(node)).some((g) => g.vmid === plan.recreate.vmid); n++)
                 await this.d.clock.sleep(10_000);
             plan = await this.planClone({ ...i, recreate: false });
         }
         // Guards run before anything is created: a refused request leaves no claim and no guest.
-        if (plan.blockedBy && /VLAN-aware/.test(plan.blockedBy))
+        if (plan.blockedBy && /no VLAN configured/.test(plan.blockedBy))
             throw new Error(plan.blockedBy);
         assertPoolBelow(plan.poolPercent, plan.poolMaxPercent);
-        assertSingleReencrypt((await this.d.claims.list()).filter((c) => (c.spec?.node ?? "minis") === this.node.claimNode), plan.claim);
-        assertNoYoungStigClone(await this.listGuests());
-        if (StigRunner.reencrypting)
-            throw new Error("another clone is re-encrypting in this process; only one at a time");
-        StigRunner.reencrypting = true;
+        assertSingleReencrypt(await this.d.claims.list(), plan.claim, node.claimNode);
+        assertNoYoungStigClone(await this.listGuests(node));
+        if (StigRunner.reencrypting.has(node.name))
+            throw new Error(`another clone is re-encrypting on ${node.name} in this process; only one at a time per node`);
+        StigRunner.reencrypting.add(node.name);
         try {
             return await this.applyClone(plan, i);
         }
         finally {
-            StigRunner.reencrypting = false;
+            StigRunner.reencrypting.delete(node.name);
         }
     }
     async applyClone(plan, i) {
         const { cloneName, claim, vmid, template, ttlHours, escrowKey } = plan;
+        const node = resolveStigNode(plan.node);
         const state = this.ensureDir(join(this.d.baseDir, `clone-${cloneName}`));
         this.ensureDir(join(state, "evidence"));
         const keys = await this.d.materials.sshKeypair(state, `claim-${claim}`);
@@ -162,55 +177,58 @@ export class StigRunner {
         this.writeSecretFile(join(state, "ctadmin_password"), adminPassword);
         writeFileSync(join(state, "vmid"), `${vmid}\n`);
         writeFileSync(join(state, "template"), `${template.ref}\n`);
-        writeFileSync(join(state, "node"), `${this.node.claimNode}\n`);
+        writeFileSync(join(state, "node"), `${node.name}\n`);
         const knownHosts = join(state, "known_hosts");
         this.d.guest.configure({ user: CI_USER, keyFile: keys.privateKeyFile, knownHostsFile: knownHosts });
         const sudoStdin = (extra = "") => `${adminPassword}\n${extra}`;
         // 1. claim first, wait for the operator, then (and only then) touch Proxmox.
-        this.log(`claim ${claim}: creating (vmid ${vmid}, ${ttlHours}h)`);
+        this.log(`claim ${claim}: creating (vmid ${vmid}, ${ttlHours}h) on ${node.name}`);
         // The descriptor is spec.stig, set at creation: immutable and part of the claim's custody request.
         const descriptor = defaultDescriptor("clone", { template, adminKeyRef: `doppler:${escrowKey}`, dns: i.dns ?? DEFAULT_DNS, ntp: i.ntp ?? [], tailoringSha256: STIG_TAILORING_SHA256 });
-        await this.d.claims.create({ name: claim, vmid, vmName: cloneName, ttlHours, node: this.node.claimNode, stig: descriptor });
+        await this.d.claims.create({ name: claim, vmid, vmName: cloneName, ttlHours, node: node.claimNode, stig: descriptor });
         await this.d.claims.waitReady(claim);
-        await this.d.claims.annotate(claim, { [STIG_STEP_ANNOTATION]: "claim" });
+        // The node rides on the claim so later verbs (validate, receipt, release) resolve it without being told.
+        await this.d.claims.annotate(claim, { [STIG_STEP_ANNOTATION]: "claim", [STIG_NODE_ANNOTATION]: node.name });
         await this.step(claim, "pool-guard");
         // 2. clone, fresh TPM, cloud-init, VLAN126 (the canonical lab-inventory verb, or root-SSH qm as the fallback)
         await this.step(claim, "clone");
-        this.log(`proxmox: full clone of ${template.ref} (${template.vmid}) to ${vmid}`);
-        if (this.d.provider) {
-            const others = (await this.d.claims.list()).filter((c) => c.metadata.name !== claim && (c.spec?.node ?? "minis") === this.node.claimNode).map((c) => c.spec?.vmid).filter((v) => Number.isInteger(v));
-            await this.d.provider.clone({ operationId: `stig-clone-${claim}-${this.d.clock.now()}`, hostAssetId: this.node.hostAssetId, untagged: this.node.vlan === null, name: cloneName, templateName: template.ref, vmid, claimedVmids: others, sshPublicKey: keys.publicKey, passwordHash: adminHash, dns: i.dns ?? DEFAULT_DNS });
+        this.log(`proxmox ${node.name}: full clone of ${template.ref} (${template.vmid}) to ${vmid}`);
+        // The canonical lab-inventory stig verbs address the build node only; the other nodes use the root-SSH fallback.
+        const provider = this.providerFor(node, true);
+        if (provider) {
+            const others = (await this.d.claims.list()).filter((c) => c.metadata.name !== claim && (c.spec?.node ?? "minis") === node.claimNode).map((c) => c.spec?.vmid).filter((v) => Number.isInteger(v));
+            await provider.clone({ operationId: `stig-clone-${claim}-${this.d.clock.now()}`, hostAssetId: node.hostAssetId, untagged: plan.untagged || node.vlan === null, name: cloneName, templateName: template.ref, vmid, claimedVmids: others, sshPublicKey: keys.publicKey, passwordHash: adminHash, dns: i.dns ?? DEFAULT_DNS });
             await this.step(claim, "tpm");
             await this.step(claim, "cloud-init");
         }
         else {
-            await this.pveOk(`set -e\nqm clone ${template.vmid} ${vmid} --name ${cloneName} --full 1 --storage local-lvm --description ${shq(`Claim ${claim}; clone of ${template.ref} (RHEL 8.10 STIG)`)}`);
+            await this.pveOk(`set -e\nqm clone ${template.vmid} ${vmid} --name ${cloneName} --full 1 --storage ${node.thin} --description ${shq(`Claim ${claim}; clone of ${template.ref} (RHEL 8.10 STIG)`)}`, undefined, node);
             await this.step(claim, "tpm");
             // Never shared with the template or another clone.
-            await this.pveOk(`set -e\nif qm config ${vmid} | grep -q '^tpmstate0'; then qm set ${vmid} --delete tpmstate0; fi\nqm set ${vmid} --tpmstate0 local-lvm:1,version=v2.0`);
+            await this.pveOk(`set -e\nif qm config ${vmid} | grep -q '^tpmstate0'; then qm set ${vmid} --delete tpmstate0; fi\nqm set ${vmid} --tpmstate0 ${node.thin}:1,version=v2.0`, undefined, node);
             await this.step(claim, "cloud-init");
             const dns = (i.dns ?? DEFAULT_DNS).join(" ");
             // The password hash and the public key arrive on stdin; PVE would otherwise hash with sha256-crypt (STIG wants sha512).
             await this.pveOk(`set -e\numask 077\nP=/tmp/${claim}.pub; W=/tmp/${claim}.pw\ncat > "$P" <<'KEY'\n${keys.publicKey}\nKEY\nIFS= read -r HASH\nprintf '%s' "$HASH" > "$W"\n` +
                 `qm set ${vmid} --ciuser ${CI_USER} --cipassword "$(cat "$W")" --sshkeys "$P" --ipconfig0 ip=dhcp --nameserver ${shq(dns)} --agent 1 --tags rhel8-stig-clone >/dev/null\n` +
-                `qm set ${vmid} --net0 "$(qm config ${vmid} | sed -n 's/^net0: \\([^,]*\\),.*/\\1/p'),bridge=vmbr0${this.node.vlan ? `,tag=${this.node.vlan}` : ""}"\nrm -f "$P" "$W"`, { stdin: `${adminHash}\n` });
+                `qm set ${vmid} --net0 "$(qm config ${vmid} | sed -n 's/^net0: \\([^,]*\\),.*/\\1/p'),bridge=${node.bridge}${plan.untagged || node.vlan === null ? "" : `,tag=${node.vlan}`}"\nrm -f "$P" "$W"`, { stdin: `${adminHash}\n` }, node);
         }
         // 3. boot, first-boot re-key, TPM bind
         await this.step(claim, "boot");
-        if (!this.d.provider)
-            await this.pveOk(`qm start ${vmid}`);
+        if (!provider)
+            await this.pveOk(`qm start ${vmid}`, undefined, node);
         let ip = "";
         for (let n = 0; n < 60 && !ip; n++) {
-            if (this.d.provider) {
+            if (provider) {
                 try {
-                    ip = await this.d.provider.guestIp(vmid, this.node.hostAssetId);
+                    ip = await provider.guestIp(vmid, node.hostAssetId);
                 }
                 catch {
                     ip = "";
                 }
             }
             else {
-                const r = await this.d.pve.run(`qm guest cmd ${vmid} network-get-interfaces`);
+                const r = await this.sh(node).run(`qm guest cmd ${vmid} network-get-interfaces`);
                 if (r.code === 0)
                     ip = guestIp(r.stdout);
             }
@@ -254,34 +272,21 @@ export class StigRunner {
         writeFileSync(join(state, "verify.txt"), verify.text);
         // 6. fstrim: re-encryption fully allocates the thin disk
         await this.step(claim, "trim");
-        const before = await this.poolPercent();
+        const before = await this.poolPercent(node);
         await this.d.guest.runScript(this.d.readAsset("guest/trim.sh"), { sudo: true, stdin: sudoStdin() });
-        const after = await this.poolPercent();
+        const after = await this.poolPercent(node);
         this.log(`pool before trim ${before}%, after ${after}%`);
         await this.step(claim, "complete");
-        return { ok: true, claim, vmid, name: cloneName, ip, template: template.ref, escrowKey, verify: verify.kv, poolBefore: before, poolAfter: after, stateDir: state };
+        return { ok: true, node: node.name, claim, vmid, name: cloneName, ip, template: template.ref, escrowKey, verify: verify.kv, poolBefore: before, poolAfter: after, stateDir: state };
     }
-    async pveOk(script, opts) {
-        const r = await this.d.pve.run(script, opts);
+    async pveOk(script, opts, node = this.buildNode()) {
+        const r = await this.sh(node).run(script, opts);
         if (r.code !== 0)
             throw new Error(`proxmox command failed (exit ${r.code}): ${redact(r.stderr).slice(0, 200)}`);
         return r;
     }
-    async verifyGuest(escrowKey, sudoStdin) {
-        const user = await this.d.guest.runScript(this.d.readAsset("guest/verify-user.sh"));
-        const root = await this.d.guest.runScript(this.d.readAsset("guest/verify-root.sh"), { sudo: true, stdin: sudoStdin() });
-        let text = `${user.stdout.trim()}\n${root.stdout.trim()}`;
-        const rec = await this.d.secrets.get(escrowKey);
-        if (rec) {
-            const t = await this.d.guest.runScript(this.d.readAsset("guest/test-recovery.sh"), { sudo: true, stdin: sudoStdin(rec) });
-            text += `\nrecovery_passphrase_test=${t.stdout.trim().split("\n").pop() ?? ""}`;
-        }
-        text += "\n";
-        const kv = parseKv(text);
-        const okGate = kv.fips_enabled === "1" && kv.selinux === "Enforcing" && kv.tpm_bound === "1" && kv.bootstrap_key_file === "absent";
-        if (!okGate)
-            throw new Error("VERIFY FAILED: fips/selinux/tpm/bootstrap-key checks did not all pass");
-        return { kv, text };
+    verifyGuest(escrowKey, sudoStdin) {
+        return verifyGuestFacts(this.d, escrowKey, sudoStdin);
     }
     /* ------------------------------------------------------------ build */
     async planBuild(i) {
@@ -296,7 +301,7 @@ export class StigRunner {
         const dvd = iso.code === 0 && iso.stdout.includes(STIG_DVD_ISO.split("/").pop());
         if (!dvd)
             throw new Error(`RHEL 8.10 DVD ${STIG_DVD_ISO} is not present on Proxmox storage`);
-        const vmid = await this.pickVmid();
+        const vmid = await this.pickVmid(this.buildNode());
         const date = (i.now ?? new Date(this.d.clock.now()).toISOString().slice(0, 10)).replace(/-/g, "");
         const name = i.name ?? `${STIG_TEMPLATE_PREFIX}${date}-${vmid}`;
         if (!/^rhel810-stig-\d{8}-\d{4}$/.test(name))
@@ -323,7 +328,7 @@ export class StigRunner {
         // claim first
         this.log(`claim ${claim}: creating (vmid ${vmid}, ${BUILD_CLAIM_TTL_HOURS}h)`);
         const descriptor = defaultDescriptor("build-template", { adminKeyRef: "doppler:LAB_PROXMOX_MINIS_API_TOKEN", tailoringSha256: STIG_TAILORING_SHA256, dns: i.dns, ntp: i.ntp });
-        await this.d.claims.create({ name: claim, vmid, vmName: name, ttlHours: BUILD_CLAIM_TTL_HOURS, node: this.node.claimNode, stig: descriptor });
+        await this.d.claims.create({ name: claim, vmid, vmName: name, ttlHours: BUILD_CLAIM_TTL_HOURS, node: this.buildNode().claimNode, stig: descriptor });
         await this.d.claims.waitReady(claim);
         await this.d.claims.annotate(claim, { [STIG_STEP_ANNOTATION]: "claim" });
         // secrets by NAME, straight into the Packer environment
@@ -408,6 +413,7 @@ export class StigRunner {
         const rec = await this.d.claims.get(claim);
         if (!rec)
             throw new Error(`claim ${claim} not found`);
+        const node = this.nodeOfClaim(rec, i.node); // the scan runs over SSH to the guest; the node is checked, not contacted
         const pw = readFileSync(join(state, "ctadmin_password"), "utf8");
         const ip = readFileSync(join(state, "ip"), "utf8").trim();
         const tpl = readFileSync(join(state, "template"), "utf8").trim();
@@ -422,8 +428,14 @@ export class StigRunner {
         this.log(`oscap DISA V2R8 benchmark scan on ${i.cloneName} (skipped on templates that predate the dual-scan recipe)`);
         await this.d.guest.runScript(this.d.readAsset("guest/scan-disa.sh"), { sudo: true, stdin: sudoStdin(), timeoutMs: 30 * 60_000 });
         const evDir = join(state, "evidence");
+        clearStage(state, "scan");
+        clearStage(state, "keyhash");
+        rmSync(evDir, { recursive: true, force: true }); // never mix this scan with a predecessor's files (clone.sh scan clears it too)
         await this.d.guest.fetchDir("/var/tmp/ct-scan", evDir);
         await this.d.guest.runScript("rm -rf /var/tmp/ct-scan\n", { sudo: true, stdin: sudoStdin() });
+        // The same markers evidence.sh keeps: collect_stig_evidence skips a scan that is current for this guest.
+        const identity = cloneIdentity(tpl, readFileSync(join(state, "vmid"), "utf8").trim(), rec.metadata.uid);
+        markStage(state, "scan", identity);
         const counts = countsFromKv(parseKv(readFileSync(join(evDir, "clone-summary.txt"), "utf8")));
         let disa;
         if (!existsSync(join(evDir, "clone-disa-absent")) && existsSync(join(evDir, "clone-disa-summary.txt"))) {
@@ -443,8 +455,10 @@ export class StigRunner {
             if (/^[a-f0-9]{64}$/.test(hex))
                 keyDigest = hex;
         }
-        if (keyDigest)
+        if (keyDigest) {
             writeFileSync(join(state, "keyhash.txt"), `${keyDigest}\n`, { mode: 0o600 });
+            markStage(state, "keyhash", identity);
+        }
         const verifyKv = existsSync(join(state, "verify.txt")) ? parseKv(readFileSync(join(state, "verify.txt"), "utf8")) : {};
         const rhel = /(\d+\.\d+) \(/.exec(verifyKv.PRETTY_NAME ?? "")?.[1] ?? "8.10";
         const summary = buildReceiptSummary({
@@ -456,7 +470,7 @@ export class StigRunner {
         await this.annotateSummary(claim, summary);
         await this.step(claim, "complete");
         const ok = gate.failZero && !(i.requireDisa && disaMissing);
-        return { ok, claim, counts, gate, disa: disa ?? null, disaScan: disa ? "ran" : "unavailable (template predates the DISA dual-scan recipe)", keyDigest, summary, evidenceDir: evDir };
+        return { ok, node: node.name, claim, counts, gate, disa: disa ?? null, disaScan: disa ? "ran" : "unavailable (template predates the DISA dual-scan recipe)", keyDigest, summary, evidenceDir: evDir };
     }
     async getReceipt(i) {
         const rec = await this.d.claims.get(i.claim);
@@ -472,27 +486,29 @@ export class StigRunner {
                 summary = null;
             }
         }
-        return { claim: i.claim, descriptor: stigDescriptor(rec), summary, statusPreview: stigStatusPreview(rec) };
+        return { claim: i.claim, node: this.nodeOfClaim(rec, i.node).name, descriptor: stigDescriptor(rec), summary, statusPreview: stigStatusPreview(rec) };
     }
     /* ---------------------------------------------------------- release */
     async releaseTemplate(i) {
         const rec = await this.d.claims.get(i.claim);
         if (!rec)
             throw new Error(`claim ${i.claim} not found`);
+        const node = this.nodeOfClaim(rec, i.node);
         const vmid = rec.spec?.vmid;
-        const guest = (await this.listGuests()).find((g) => g.vmid === vmid);
+        const guest = (await this.listGuests(node)).find((g) => g.vmid === vmid);
         if (!guest)
-            throw new Error(`no Proxmox guest ${vmid} for claim ${i.claim}`);
+            throw new Error(`no Proxmox guest ${vmid} on ${node.name} for claim ${i.claim}`);
         assertTemplateReleaseAllowed({ guest: guest, claim: rec, destroyConfirmed: i.confirmDestroy });
-        this.log(`destroying template ${guest.name} (${guest.vmid}) before releasing claim ${i.claim}`);
-        if (this.d.provider)
-            await this.d.provider.destroyTemplate({ operationId: `stig-destroy-${i.claim}-${this.d.clock.now()}`, hostAssetId: this.node.hostAssetId, name: guest.name, vmid: guest.vmid });
+        this.log(`destroying template ${guest.name} (${guest.vmid}) on ${node.name} before releasing claim ${i.claim}`);
+        const provider = this.providerFor(node);
+        if (provider)
+            await provider.destroyTemplate({ operationId: `stig-destroy-${i.claim}-${this.d.clock.now()}`, hostAssetId: node.hostAssetId, name: guest.name, vmid: guest.vmid });
         else
-            await this.pveOk(`qm destroy ${guest.vmid} --purge 1 --destroy-unreferenced-disks 1`);
-        if ((await this.listGuests()).some((g) => g.vmid === guest.vmid))
+            await this.pveOk(`qm destroy ${guest.vmid} --purge 1 --destroy-unreferenced-disks 1`, undefined, node);
+        if ((await this.listGuests(node)).some((g) => g.vmid === guest.vmid))
             throw new Error(`template ${guest.vmid} still exists after destroy; claim retained`);
         await this.d.claims.delete(i.claim, rec.metadata.uid);
-        return { ok: true, destroyed: { vmid: guest.vmid, name: guest.name }, claimDeleted: i.claim };
+        return { ok: true, node: node.name, destroyed: { vmid: guest.vmid, name: guest.name }, claimDeleted: i.claim };
     }
 }
 function guestIp(stdout) {
@@ -509,4 +525,21 @@ function guestIp(stdout) {
     catch { /* not ready yet */ }
     return "";
 }
+/** The clone verification of clone.sh `verify` (FIPS, SELinux, LUKS2 + TPM2, bootstrap key, recovery test); throws unless the gate holds. */
+export async function verifyGuestFacts(d, escrowKey, sudoStdin) {
+    const user = await d.guest.runScript(d.readAsset("guest/verify-user.sh"));
+    const root = await d.guest.runScript(d.readAsset("guest/verify-root.sh"), { sudo: true, stdin: sudoStdin() });
+    let text = `${user.stdout.trim()}\n${root.stdout.trim()}`;
+    const rec = await d.secrets.get(escrowKey);
+    if (rec) {
+        const t = await d.guest.runScript(d.readAsset("guest/test-recovery.sh"), { sudo: true, stdin: sudoStdin(rec) });
+        text += `\nrecovery_passphrase_test=${t.stdout.trim().split("\n").pop() ?? ""}`;
+    }
+    text += "\n";
+    const kv = parseKv(text);
+    const okGate = kv.fips_enabled === "1" && kv.selinux === "Enforcing" && kv.tpm_bound === "1" && kv.bootstrap_key_file === "absent";
+    if (!okGate)
+        throw new Error("VERIFY FAILED: fips/selinux/tpm/bootstrap-key checks did not all pass");
+    return { kv, text };
+}
 //# sourceMappingURL=runner.js.map