@fased/fased 0.1.62 → 0.1.64

package/CHANGELOG.md

@@ -4,6 +4,38 @@ This changelog starts with the public Fased Agent release line. Required
 third-party and copied-code notices are kept in [LICENSE](./LICENSE) and
 [THIRD_PARTY_NOTICES.md](./THIRD_PARTY_NOTICES.md).
 
+## 0.1.64
+
+- Make protocol-v2 `fased-signerd` authoritative for native key creation,
+  import, rotation, encrypted state, fail-closed wallet policy, durable caps,
+  idempotency, and ambiguous-broadcast reconciliation.
+- Replace the maintained Hosting broker and Gateway sudo path with an
+  independent root-managed signer service, separate application/control
+  sockets, verified release identity, and transactional update/rollback.
+- Add typed SOL, SPL, SAT Mining, Vault bond, and federation operations with
+  signer-owned semantic validation; Jupiter swaps and Trigger mutations remain
+  preview-only pending live qualification.
+- Move reviewed WebAuthn challenges into the signer, add Wallet Standard
+  hardware and Turnkey provider flows, and keep new native wallets receive-only
+  until an exact positive policy hash is acknowledged.
+- Add bounded signer, A2A, Marketplace, skill, and memory state with capacity
+  warnings, replay-safe retention, and complete-state archive/restore guidance.
+- Document clean Linux/macOS installs, Windows 10/11 through WSL2 Ubuntu,
+  independent VPS Hosting custody, Local-only Docker, wallet activation,
+  Mining, Vault, updates, and recovery.
+
+## 0.1.63
+
+- Fix maintained Hosting first-wallet setup by launching the packaged signer
+  broker through the lazy wallet CLI entry instead of importing optional
+  channel dependencies from the minimal hosted runtime.
+- Validate packaged signer-broker startup during hosted artifact creation and
+  recognize the secured `0660` app-facing broker socket used by the isolated
+  VPS signer account while retaining `0600` for single-user installs.
+- Clarify that Windows runs Fased inside WSL2 Ubuntu, with PowerShell used only
+  to install or manage WSL2, and document the public Docker image as a
+  local-only path; maintained VPS hosting remains non-Docker.
+
 ## 0.1.62
 
 - Install a version-matched, checksum-verified local wallet signer automatically

package/README.md

@@ -52,6 +52,19 @@ Use this on your own machine:
   shell.
 - **Linux:** run the command in your distro terminal.
 
+Windows requires Windows 11 or Windows 10 version 2004/build 19041 or newer.
+Open PowerShell **as Administrator** only to install WSL2:
+
+```powershell
+wsl --install -d Ubuntu
+```
+
+Restart Windows if requested, open the **Ubuntu** application, create the Linux
+username/password on first launch, and run the Fased command below in that
+Ubuntu shell. Do not run the Fased installer in PowerShell, Command Prompt, Git
+Bash, or native Windows Node.js. Fased wallet signing requires Unix sockets and
+therefore runs through WSL2 on Windows.
+
 ```bash
 curl -fsSL https://raw.githubusercontent.com/fased-ai/fased/main/install.sh | bash -s -- --local
 ```
@@ -125,28 +138,23 @@ First SSH into the fresh VPS using the login your VPS provider gives you, often
 ssh root@YOUR_PUBLIC_VPS_IP
 ```
 
-Then run this on the VPS:
+Then follow the [pre-execution verified VPS bootstrap](https://docs.fased.ai/install/vps#3-install-fased-and-connect-through-tailscale).
+It downloads the exact tagged `install.sh` release asset and its attestation
+bundle, verifies repository/tag/workflow/GitHub-runner provenance with
+`gh attestation verify`, and only then runs the script as root. Do not pipe a
+moving or unverified script directly into a root shell.
 
-```bash
-curl -fsSL https://raw.githubusercontent.com/fased-ai/fased/main/install.sh | bash -s -- --hosting
-```
-
-The Fased installer bootstraps the repository itself. A fresh VPS does not need
-`git clone` first; the installer installs missing system tools, Node, and Git
-when the OS package manager supports auto-install. Hosted installs may use the
-published runtime package internally and skip the slow source build.
+The Fased installer bootstraps the attested hosted runtime itself. A fresh VPS
+does not need `git clone`; the installer installs the supported system tools and
+Node when the OS package manager supports auto-install, then activates the
+exact tagged runtime instead of building an app-owned source checkout.
 If a minimal VPS image does not have `curl`, use the OS tab in the install docs
 to install only the downloader first, then rerun the same hosted command.
 
-Current installers try a clean fast-forward update from Git before building. If
-you already started from an older installer and it stopped before creating the
-`app` runtime, update the bootstrap checkout once and rerun:
-
-```bash
-cd ~/fased
-git pull --ff-only origin main
-./install.sh --hosting
-```
+If an earlier install stopped before creating the `app` runtime, repeat the
+same verified tagged bootstrap from the provider root console. Use the
+documented `--repair-hosting` path for an existing installation; do not repair
+Hosting from a moving `main` checkout.
 
 If you SSH into a fresh VPS as `root`, the installer creates a non-root `app`
 user, copies/clones the repo to `/home/app/fased`, and continues there. The
@@ -312,11 +320,11 @@ model servers and model weights are not bundled. See
 [Core And Optional Components](./docs/install/components.md).
 
 Fresh dashboard, Gateway, and Fased Network setup do not require the native
-wallet signer. If you later choose the local signer wallet path, Fased builds
-`fased-signerd` locally when Go is available. Otherwise provide an explicit
-signer binary with `FASED_WALLET_LOCAL_SIGNER_BIN`, or an explicit signer asset
-source with `FASED_LOCAL_SIGNER_VERSION` / `FASED_LOCAL_SIGNER_BASE_URL`.
-Generated signer binaries are never committed to Git.
+wallet signer. When you create the first signer-owned wallet, Fased downloads
+the version-matched `fased-signerd` asset and verifies both its SHA-256 checksum
+and GitHub release attestation. Normal users do not need Go. A source build is a
+developer-only opt-in with `FASED_BUILD_NATIVE_SIGNER_FROM_SOURCE=1`; Fased does
+not silently replace a failed release verification with a local build.
 
 After install, open the dashboard, configure **Agent > Models**, send a first
 browser chat, then add channels, skills, services, wallets, mining, and tasks
@@ -455,11 +463,9 @@ your own machine:
 curl -fsSL https://raw.githubusercontent.com/fased-ai/fased/main/install.sh | bash -s -- --local
 ```
 
-Use the VPS Hosting profile only on the server that will run Fased all the time:
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/fased-ai/fased/main/install.sh | bash -s -- --hosting
-```
+Use the VPS Hosting profile only on the server that will run Fased all the time,
+and use the [pre-execution verified tagged bootstrap](https://docs.fased.ai/install/vps#3-install-fased-and-connect-through-tailscale)
+before executing root code.
 
 The commands below are for contributors working from the source checkout. Do
 not use plain `npm install` to install Fased from source.
@@ -508,8 +514,10 @@ The root intentionally contains both product code and build/deploy control files
 - `test/`: test fixtures and integration helpers
 - `token/`: SAT/token technical materials
 - `Dockerfile`, `docker-compose.yml`, `docker-setup.sh`, and
-  `setup-podman.sh`: primary container entrypoints
-- `deploy/`: secondary container, Fly, Render, and hosting configuration files
+  `setup-podman.sh`: Local Docker entrypoints plus an experimental Gateway-only
+  Podman helper
+- `deploy/`: sandbox/container assets and archived Fly/Render reference
+  manifests; VPS Hosting uses `install.sh --hosting`, not those manifests
 
 Root config files should stay at repository root unless the owning toolchain,
 docs publisher, installer, and CI path are updated together.

package/config/dependency-ownership.json

@@ -48,7 +48,7 @@
       "label": "Wallet And Mining Core",
       "delivery": "core",
       "target": "keep",
-      "dependencies": ["@solana/web3.js"]
+      "dependencies": ["@solana/web3.js", "@turnkey/sdk-server"]
     },
     {
       "id": "fased-network",

package/config/signer-policies/README.md

@@ -0,0 +1,49 @@
+# Native signer owner-policy templates
+
+These files are deliberately inactive templates. Every `REPLACE_WITH_...` value
+is invalid, so an unreviewed template cannot unlock a wallet. Copy one template
+to a new owner-only file, set `walletId` to the canonical signer wallet ID
+returned by native setup (lowercase with separators normalized to underscores,
+not the friendly Gateway/registry ID; the template value is only the
+conventional role name), replace every placeholder with an exact address or a
+canonical positive raw-unit cap, review every line, then set the file to mode
+`0600` before running
+`fased-signer-policy --initial-install`.
+
+Fresh signer-owned wallets remain at their version-1 deny-all policy until that
+owner-confirmed command succeeds. Merely installing Fased or copying a template
+does not enable signing.
+
+Every policy that permits an on-chain operation must include a
+`solana:native` asset whose `maxPerTx` and `maxDaily` are each at least
+`5000000` lamports. The native signer reserves that fixed, signer-controlled
+ceiling atomically for network fees and explicitly validated rent; for a native
+SOL transfer, the principal and this reserve must fit inside the same cap.
+Existing custom policies below that minimum intentionally become locked after
+the signer-v2 upgrade. Review the new limit and install a new version explicitly
+with `fased-signer-policy`; installation and update never widen it automatically.
+
+- Agent permits only typed native SOL and exact-mint SPL transfers to listed
+  destination owners. The signer derives the canonical source and destination
+  token accounts. When the destination account is absent, it may add exactly
+  one idempotent Associated Token Account instruction and charges the fixed
+  signer-controlled native fee/rent reservation against the same atomic policy
+  decision. The policy must therefore grant the Associated Token program, the
+  exact token program, the mint, destination owner, positive token caps, and a
+  positive `solana:native` cap. No caller-selected token account or arbitrary
+  account-creation instruction is accepted.
+- Mining permits program-bound typed SAT mining actions. The native signer
+  forces generic SOL/SAT transfers through reviewed authorization for a Mining
+  wallet; it never treats them as autonomous mining actions. Exact SAT codecs
+  that genuinely use associated-token-account instructions retain that program
+  grant.
+- Vault operations always require signer-owned reviewed authorization. The
+  starter omits Jupiter and Trigger permissions. Treat both as preview in this
+  release: do not add them to a production policy until an exact generated
+  RouteV2/Trigger codec and a live Jupiter qualification are published for the
+  same release. The signer also rejects their execution by default; normal
+  installers never enable the qualification-only live switch.
+
+Receiving SOL or SAT does not require a signing permission. Do not add a
+receive-only address as a destination unless the signer should also be allowed
+to send to it.

package/config/signer-policies/agent.json.template

@@ -0,0 +1,32 @@
+{
+  "walletId": "agent",
+  "role": "agent",
+  "operations": [
+    "solana.nativeTransfer",
+    "solana.splTransferChecked"
+  ],
+  "programs": [
+    "11111111111111111111111111111111",
+    "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL",
+    "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr",
+    "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA"
+  ],
+  "assets": [
+    {
+      "asset": "solana:native",
+      "destinations": [
+        "REPLACE_WITH_APPROVED_SOL_RECIPIENT"
+      ],
+      "maxPerTx": "REPLACE_WITH_POSITIVE_LAMPORTS_PER_TX",
+      "maxDaily": "REPLACE_WITH_POSITIVE_LAMPORTS_PER_UTC_DAY"
+    },
+    {
+      "asset": "solana:spl:REPLACE_WITH_SAT_MINT",
+      "destinations": [
+        "REPLACE_WITH_APPROVED_SAT_RECIPIENT_OWNER"
+      ],
+      "maxPerTx": "REPLACE_WITH_POSITIVE_SAT_RAW_UNITS_PER_TX",
+      "maxDaily": "REPLACE_WITH_POSITIVE_SAT_RAW_UNITS_PER_UTC_DAY"
+    }
+  ]
+}

package/config/signer-policies/mining.json.template

@@ -0,0 +1,69 @@
+{
+  "walletId": "mining",
+  "role": "mining",
+  "operations": [
+    "sat.cleanupBatch@REPLACE_WITH_SAT_PROGRAM_ID",
+    "sat.claimCycleRewards@REPLACE_WITH_SAT_PROGRAM_ID",
+    "sat.claimCycleRewardsBatch@REPLACE_WITH_SAT_PROGRAM_ID",
+    "sat.commitCycle@REPLACE_WITH_SAT_PROGRAM_ID",
+    "sat.depositMinerCapital@REPLACE_WITH_SAT_PROGRAM_ID",
+    "sat.initMinerCapital@REPLACE_WITH_SAT_PROGRAM_ID",
+    "sat.revealCycle@REPLACE_WITH_SAT_PROGRAM_ID",
+    "sat.setActiveCommit@REPLACE_WITH_SAT_PROGRAM_ID",
+    "sat.withdrawMinerCapital@REPLACE_WITH_SAT_PROGRAM_ID",
+    "solana.nativeTransfer",
+    "solana.splTransferChecked"
+  ],
+  "programs": [
+    "11111111111111111111111111111111",
+    "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL",
+    "REPLACE_WITH_CLAIM_VERIFICATION_PROGRAM_ID",
+    "REPLACE_WITH_SAT_PROGRAM_ID",
+    "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA"
+  ],
+  "assets": [
+    {
+      "asset": "sat:action",
+      "destinations": [
+        "REPLACE_WITH_MINING_WALLET_PUBLIC_KEY",
+        "REPLACE_WITH_MINER_CAPITAL_PDA",
+        "REPLACE_WITH_SAT_PROGRAM_ID"
+      ],
+      "maxPerTx": "REPLACE_WITH_POSITIVE_TYPED_ACTIONS_PER_TX",
+      "maxDaily": "REPLACE_WITH_POSITIVE_TYPED_ACTIONS_PER_UTC_DAY"
+    },
+    {
+      "asset": "sat:capital:lamports",
+      "destinations": [
+        "REPLACE_WITH_MINER_CAPITAL_PDA"
+      ],
+      "maxPerTx": "REPLACE_WITH_POSITIVE_ACTIVE_CAPITAL_LAMPORTS_PER_TX",
+      "maxDaily": "REPLACE_WITH_POSITIVE_ACTIVE_CAPITAL_LAMPORTS_PER_UTC_DAY"
+    },
+    {
+      "asset": "sat:mint:REPLACE_WITH_SAT_MINT",
+      "destinations": [
+        "REPLACE_WITH_MINING_WALLET_PUBLIC_KEY"
+      ],
+      "maxPerTx": "REPLACE_WITH_POSITIVE_REWARD_ACTIONS_PER_TX",
+      "maxDaily": "REPLACE_WITH_POSITIVE_REWARD_ACTIONS_PER_UTC_DAY"
+    },
+    {
+      "asset": "solana:native",
+      "destinations": [
+        "REPLACE_WITH_APPROVED_REVIEWED_SOL_RECIPIENT",
+        "REPLACE_WITH_MINER_CAPITAL_PDA"
+      ],
+      "maxPerTx": "REPLACE_WITH_POSITIVE_LAMPORTS_PER_TX",
+      "maxDaily": "REPLACE_WITH_POSITIVE_LAMPORTS_PER_UTC_DAY"
+    },
+    {
+      "asset": "solana:spl:REPLACE_WITH_SAT_MINT",
+      "destinations": [
+        "REPLACE_WITH_APPROVED_REVIEWED_SAT_RECIPIENT_OWNER"
+      ],
+      "maxPerTx": "REPLACE_WITH_POSITIVE_SAT_RAW_UNITS_PER_TX",
+      "maxDaily": "REPLACE_WITH_POSITIVE_SAT_RAW_UNITS_PER_UTC_DAY"
+    }
+  ]
+}

package/config/signer-policies/network.json.template

@@ -0,0 +1,5 @@
+{
+  "schemaVersion": 1,
+  "primaryRpcUrl": "https://REPLACE_WITH_PRIMARY_SOLANA_RPC",
+  "fallbackRpcUrl": "https://REPLACE_WITH_INDEPENDENT_FALLBACK_RPC"
+}

package/config/signer-policies/vault.json.template

@@ -0,0 +1,70 @@
+{
+  "walletId": "vault",
+  "role": "vault",
+  "operations": [
+    "federation.bondChallenge",
+    "solana.nativeTransfer",
+    "solana.splTransferChecked",
+    "vaultBond.cancelBondUnlock@REPLACE_WITH_SAT_BOND_PROGRAM_ID",
+    "vaultBond.claimBondStakingRewards@REPLACE_WITH_SAT_BOND_PROGRAM_ID",
+    "vaultBond.claimUnallocatedStakingRewards@REPLACE_WITH_SAT_BOND_PROGRAM_ID",
+    "vaultBond.finalizeBondUnlock@REPLACE_WITH_SAT_BOND_PROGRAM_ID",
+    "vaultBond.increaseBondPosition@REPLACE_WITH_SAT_BOND_PROGRAM_ID",
+    "vaultBond.openBondPosition@REPLACE_WITH_SAT_BOND_PROGRAM_ID",
+    "vaultBond.requestBondUnlock@REPLACE_WITH_SAT_BOND_PROGRAM_ID",
+    "vaultBond.syncBondStakingPosition@REPLACE_WITH_SAT_BOND_PROGRAM_ID",
+    "vaultBond.syncBondStakingRewards@REPLACE_WITH_SAT_BOND_PROGRAM_ID"
+  ],
+  "programs": [
+    "11111111111111111111111111111111",
+    "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL",
+    "REPLACE_WITH_SAT_BOND_PROGRAM_ID",
+    "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA",
+    "domain:fased:federation-bond-challenge-v1"
+  ],
+  "assets": [
+    {
+      "asset": "federation:bond-challenge",
+      "destinations": [
+        "REPLACE_WITH_VAULT_WALLET_PUBLIC_KEY"
+      ],
+      "maxPerTx": "1",
+      "maxDaily": "REPLACE_WITH_POSITIVE_FEDERATION_CHALLENGES_PER_UTC_DAY"
+    },
+    {
+      "asset": "sat:action",
+      "destinations": [
+        "REPLACE_WITH_SAT_BOND_PROGRAM_ID"
+      ],
+      "maxPerTx": "REPLACE_WITH_POSITIVE_REVIEWED_BOND_ACTIONS_PER_TX",
+      "maxDaily": "REPLACE_WITH_POSITIVE_REVIEWED_BOND_ACTIONS_PER_UTC_DAY"
+    },
+    {
+      "asset": "sat:mint:REPLACE_WITH_SAT_MINT",
+      "destinations": [
+        "REPLACE_WITH_VAULT_WALLET_PUBLIC_KEY",
+        "REPLACE_WITH_APPROVED_REVIEWED_SAT_RECIPIENT_OWNER",
+        "REPLACE_WITH_SAT_BOND_PROGRAM_ID"
+      ],
+      "maxPerTx": "REPLACE_WITH_POSITIVE_REWARD_ACTIONS_PER_TX",
+      "maxDaily": "REPLACE_WITH_POSITIVE_REWARD_ACTIONS_PER_UTC_DAY"
+    },
+    {
+      "asset": "solana:native",
+      "destinations": [
+        "REPLACE_WITH_APPROVED_REVIEWED_SOL_RECIPIENT"
+      ],
+      "maxPerTx": "REPLACE_WITH_POSITIVE_LAMPORTS_PER_TX",
+      "maxDaily": "REPLACE_WITH_POSITIVE_LAMPORTS_PER_UTC_DAY"
+    },
+    {
+      "asset": "solana:spl:REPLACE_WITH_SAT_MINT",
+      "destinations": [
+        "REPLACE_WITH_APPROVED_REVIEWED_SAT_RECIPIENT_OWNER",
+        "REPLACE_WITH_BOND_POSITION_PDA"
+      ],
+      "maxPerTx": "REPLACE_WITH_POSITIVE_SAT_RAW_UNITS_PER_TX",
+      "maxDaily": "REPLACE_WITH_POSITIVE_SAT_RAW_UNITS_PER_UTC_DAY"
+    }
+  ]
+}

package/config/signer-protocol-v2.json

@@ -0,0 +1,76 @@
+{
+  "protocol": { "current": 2, "min": 2, "max": 2 },
+  "nativeFeeReservationLamports": 5000000,
+  "intentTypes": [
+    "solana.nativeTransfer",
+    "solana.splTransferChecked",
+    "solana.satAction",
+    "solana.vaultBondAction",
+    "federation.bondChallenge",
+    "solana.jupiter.swap",
+    "solana.jupiter.trigger.create",
+    "solana.jupiter.trigger.cancel"
+  ],
+  "operationStates": ["reserved", "broadcast", "confirmed", "failed", "unknown"],
+  "features": [
+    "failClosedPolicies",
+    "policyHashes",
+    "applicationPolicyTightening",
+    "vaultReviewedOnly",
+    "durableCaps",
+    "atomicMultiAssetCaps",
+    "signerControlledNativeFeeCaps",
+    "atomicIdempotency",
+    "ambiguousBroadcastReconciliation",
+    "signerOwnedKeys",
+    "signerOwnedSuccessorRotation",
+    "permanentRetiredWalletPolicies",
+    "signerOwnedRPC",
+    "typedSolanaTransactions",
+    "typedA2aPaymentMemos",
+    "typedA2aRefundMemos",
+    "idempotentAssociatedTokenCreation",
+    "typedSATActions",
+    "typedVaultBondActions",
+    "domainSeparatedFederationBondChallenges",
+    "federationBondChallengeWrapperV2",
+    "signerOwnedWebAuthn",
+    "signerOwnedWebAuthnCredentialRevocation",
+    "singleUseReviewedAuthorization",
+    "typedJupiterSemantics",
+    "signerOwnedReviewPrepareExecute",
+    "exactPreparedTransactions",
+    "legacyOnlyJupiterTransactions",
+    "reviewedVaultBondActions",
+    "reviewedFederationBondChallenges",
+    "signerOwnedStateRecheck",
+    "durableReviewAuthorization",
+    "signerOwnedJupiterTriggerV2",
+    "signerOwnedJupiterTriggerHistory",
+    "jupiterTriggerSecretsNeverCrossSocket",
+    "jupiterTriggerDurablePhases"
+  ],
+  "clientRequiredFeatures": [
+    "failClosedPolicies",
+    "policyHashes",
+    "applicationPolicyTightening",
+    "durableCaps",
+    "atomicMultiAssetCaps",
+    "signerControlledNativeFeeCaps",
+    "atomicIdempotency",
+    "ambiguousBroadcastReconciliation",
+    "signerOwnedKeys",
+    "signerOwnedRPC",
+    "typedSolanaTransactions",
+    "typedA2aPaymentMemos",
+    "typedA2aRefundMemos",
+    "signerOwnedWebAuthn",
+    "singleUseReviewedAuthorization",
+    "typedJupiterSemantics",
+    "signerOwnedJupiterTriggerV2",
+    "signerOwnedJupiterTriggerHistory",
+    "signerOwnedReviewPrepareExecute",
+    "exactPreparedTransactions",
+    "legacyOnlyJupiterTransactions"
+  ]
+}