@fased/fased 0.1.62 → 0.1.65

package/scripts/fased-signer-policy-hosting.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+umask 077
+
+if [[ "${EUID}" != "0" ]]; then
+  echo "Hosted signer policy setup must run as root from a root SSH or provider-console session." >&2
+  exit 1
+fi
+
+PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+export PATH
+NODE_BIN="$(command -v node || true)"
+HELPER="/usr/local/libexec/fased-signer-owner-policy.mjs"
+STAT_BIN="/usr/bin/stat"
+
+case "$NODE_BIN" in
+  /usr/bin/node|/usr/local/bin/node|/bin/node) ;;
+  *)
+    echo "A supported system Node.js executable is unavailable." >&2
+    exit 1
+    ;;
+esac
+
+for executable in "$NODE_BIN" "$STAT_BIN"; do
+  [[ -f "$executable" && -x "$executable" ]] || {
+    echo "Required root-controlled executable is missing: $executable" >&2
+    exit 1
+  }
+  read -r owner mode <<<"$($STAT_BIN -Lc '%u %a' "$executable")"
+  [[ "$owner" == "0" && $((8#$mode & 8#22)) -eq 0 ]] || {
+    echo "Required executable is not root-owned and non-writable: $executable" >&2
+    exit 1
+  }
+done
+
+[[ -f "$HELPER" && ! -L "$HELPER" ]] || {
+  echo "Installed Hosted signer policy helper is missing or unsafe: $HELPER" >&2
+  exit 1
+}
+read -r helper_owner helper_mode helper_links <<<"$($STAT_BIN -c '%u %a %h' "$HELPER")"
+[[ "$helper_owner" == "0" && "$helper_links" -eq 1 && $((8#$helper_mode & 8#22)) -eq 0 ]] || {
+  echo "Hosted signer policy helper must be a single-link root-owned non-writable file." >&2
+  exit 1
+}
+if [[ $# -eq 1 && "$1" == "--help" ]]; then
+  exec "$NODE_BIN" "$HELPER" --help
+fi
+
+exec "$NODE_BIN" "$HELPER" --profile hosting "$@"

package/scripts/fased-signer-policy-local.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+umask 077
+
+if [[ "${EUID}" == "0" ]]; then
+  echo "Local signer policy setup must run as the non-root user that owns the signer." >&2
+  exit 1
+fi
+
+INSTALL_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+HELPER="${INSTALL_DIR}/fased-signer-owner-policy.mjs"
+
+if [[ ! -f "$HELPER" || -L "$HELPER" ]]; then
+  echo "Installed Local signer policy helper is missing or unsafe: $HELPER" >&2
+  exit 1
+fi
+if ! command -v node >/dev/null 2>&1; then
+  echo "Node.js is required to run the Local signer policy helper." >&2
+  exit 1
+fi
+if [[ $# -eq 1 && "$1" == "--help" ]]; then
+  exec node "$HELPER" --help
+fi
+
+exec node "$HELPER" --profile local "$@"

package/scripts/hosted-release-manifest.mjs

@@ -0,0 +1,185 @@
+import { createHash } from "node:crypto";
+import fsp from "node:fs/promises";
+
+const VERSION_PATTERN = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?$/u;
+const COMMIT_PATTERN = /^[a-f0-9]{40}$/u;
+const SHA256_PATTERN = /^[a-f0-9]{64}$/u;
+const PREFIXED_SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/u;
+
+function exactKeys(value, expected, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  if (
+    Object.keys(value).toSorted().join(",") !==
+    [...expected].toSorted((left, right) => left.localeCompare(right)).join(",")
+  ) {
+    throw new Error(`${label} contains unsupported or missing fields`);
+  }
+}
+
+function canonicalJSON(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map((entry) => canonicalJSON(entry)).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value)
+      .toSorted()
+      .map((key) => `${JSON.stringify(key)}:${canonicalJSON(value[key])}`)
+      .join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+export function sha256Bytes(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+export function capabilitiesDigest(value) {
+  return `sha256:${sha256Bytes(canonicalJSON(value))}`;
+}
+
+function parseArtifact(value, label) {
+  exactKeys(value, ["asset", "sha256"], label);
+  if (
+    typeof value.asset !== "string" ||
+    !/^[A-Za-z0-9][A-Za-z0-9._-]+$/u.test(value.asset) ||
+    !SHA256_PATTERN.test(value.sha256 || "")
+  ) {
+    throw new Error(`${label} is invalid`);
+  }
+  return Object.freeze({ asset: value.asset, sha256: value.sha256 });
+}
+
+function parseCapabilities(value, claimedDigest) {
+  exactKeys(
+    value,
+    ["protocol", "nativeFeeReservationLamports", "intentTypes", "operationStates", "features"],
+    "signer capabilities",
+  );
+  exactKeys(value.protocol, ["current", "min", "max"], "signer protocol range");
+  if (
+    value.protocol.current !== 2 ||
+    value.protocol.min !== 2 ||
+    value.protocol.max !== 2 ||
+    value.nativeFeeReservationLamports !== 5_000_000 ||
+    !Array.isArray(value.intentTypes) ||
+    !Array.isArray(value.operationStates) ||
+    !Array.isArray(value.features) ||
+    [...value.intentTypes, ...value.operationStates, ...value.features].some(
+      (entry) => typeof entry !== "string" || !entry,
+    ) ||
+    new Set(value.intentTypes).size !== value.intentTypes.length ||
+    new Set(value.operationStates).size !== value.operationStates.length ||
+    new Set(value.features).size !== value.features.length
+  ) {
+    throw new Error("signer capabilities are malformed or not protocol v2");
+  }
+  const actualDigest = capabilitiesDigest(value);
+  if (!PREFIXED_SHA256_PATTERN.test(claimedDigest || "") || actualDigest !== claimedDigest) {
+    throw new Error("signer capability digest does not match its canonical capability contract");
+  }
+  return Object.freeze({ ...value, protocol: Object.freeze({ ...value.protocol }) });
+}
+
+export function parseHostedReleaseManifestV2(value, expected = {}) {
+  exactKeys(
+    value,
+    ["schemaVersion", "release", "application", "signer"],
+    "hosted release manifest",
+  );
+  if (value.schemaVersion !== 2) {
+    throw new Error("hosted release manifest schema must be v2");
+  }
+  exactKeys(value.release, ["version", "tag", "commit"], "hosted release identity");
+  const version = String(value.release.version || "");
+  const commit = String(value.release.commit || "");
+  if (
+    !VERSION_PATTERN.test(version) ||
+    value.release.tag !== `v${version}` ||
+    !COMMIT_PATTERN.test(commit) ||
+    (expected.version && version !== expected.version) ||
+    (expected.commit && commit !== expected.commit)
+  ) {
+    throw new Error("hosted release version, tag, or commit is malformed or mismatched");
+  }
+
+  exactKeys(value.application, ["linux"], "hosted application platforms");
+  exactKeys(value.application.linux, ["x64", "arm64"], "hosted Linux architectures");
+  const application = { linux: {} };
+  for (const architecture of ["x64", "arm64"]) {
+    const entry = value.application.linux[architecture];
+    exactKeys(entry, ["artifact", "dependencies"], `hosted Linux ${architecture} entry`);
+    exactKeys(
+      entry.dependencies,
+      ["asset", "sha256", "dependencyHash"],
+      `hosted Linux ${architecture} dependencies`,
+    );
+    if (!SHA256_PATTERN.test(entry.dependencies.dependencyHash || "")) {
+      throw new Error(`hosted Linux ${architecture} dependency hash is invalid`);
+    }
+    application.linux[architecture] = Object.freeze({
+      artifact: parseArtifact(entry.artifact, `hosted Linux ${architecture} app artifact`),
+      dependencies: Object.freeze({
+        ...parseArtifact(
+          { asset: entry.dependencies.asset, sha256: entry.dependencies.sha256 },
+          `hosted Linux ${architecture} dependency artifact`,
+        ),
+        dependencyHash: entry.dependencies.dependencyHash,
+      }),
+    });
+  }
+
+  exactKeys(
+    value.signer,
+    ["release", "capabilities", "capabilitiesDigest", "platforms"],
+    "hosted signer release",
+  );
+  exactKeys(
+    value.signer.release,
+    ["version", "commit", "buildInputDigest", "development"],
+    "hosted signer build identity",
+  );
+  if (
+    value.signer.release.version !== version ||
+    value.signer.release.commit !== commit ||
+    !PREFIXED_SHA256_PATTERN.test(value.signer.release.buildInputDigest || "") ||
+    value.signer.release.development !== false
+  ) {
+    throw new Error("hosted app and signer release identities do not match");
+  }
+  exactKeys(
+    value.signer.platforms,
+    ["linux-amd64", "linux-arm64", "darwin-amd64", "darwin-arm64"],
+    "hosted signer platforms",
+  );
+  const platforms = {};
+  for (const platform of ["linux-amd64", "linux-arm64", "darwin-amd64", "darwin-arm64"]) {
+    platforms[platform] = parseArtifact(value.signer.platforms[platform], `signer ${platform}`);
+  }
+  return Object.freeze({
+    schemaVersion: 2,
+    release: Object.freeze({ version, tag: `v${version}`, commit }),
+    application: Object.freeze({ linux: Object.freeze(application.linux) }),
+    signer: Object.freeze({
+      release: Object.freeze({ ...value.signer.release }),
+      capabilities: parseCapabilities(value.signer.capabilities, value.signer.capabilitiesDigest),
+      capabilitiesDigest: value.signer.capabilitiesDigest,
+      platforms: Object.freeze(platforms),
+    }),
+  });
+}
+
+export async function readHostedReleaseManifestV2(filePath, expected = {}) {
+  const bytes = await fsp.readFile(filePath);
+  const manifest = parseHostedReleaseManifestV2(JSON.parse(bytes.toString("utf8")), expected);
+  return { manifest, digest: `sha256:${sha256Bytes(bytes)}` };
+}
+
+export async function verifyManifestArtifact(filePath, artifact, label = artifact?.asset) {
+  const actual = sha256Bytes(await fsp.readFile(filePath));
+  if (actual !== artifact?.sha256) {
+    throw new Error(`${label || "release artifact"} does not match the attested release manifest`);
+  }
+  return actual;
+}

package/scripts/install-fased-signerd.sh

@@ -5,138 +5,213 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 INSTALL_DIR_DEFAULT="${HOME}/.fased/bin"
 INSTALL_DIR="${FASED_LOCAL_SIGNER_BIN_DIR:-$INSTALL_DIR_DEFAULT}"
 VERSION="${FASED_LOCAL_SIGNER_VERSION:-}"
+POLICY_TEMPLATE_DIR="${FASED_LOCAL_SIGNER_POLICY_TEMPLATE_DIR:-$(dirname "$INSTALL_DIR")/share/signer-policies}"
+UPDATER="$ROOT/scripts/fased-managed-updater.mjs"
+ACTION="install"
+DEFER_COMMIT=0
+CONFIRM_DOWNGRADE=""
+EXPECTED_COMMIT="${FASED_LOCAL_SIGNER_EXPECTED_COMMIT:-}"
 
-OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
-ARCH="$(uname -m)"
-case "$ARCH" in
-  x86_64|amd64) ARCH="amd64" ;;
-  aarch64|arm64) ARCH="arm64" ;;
-esac
+usage() {
+  cat <<'EOF'
+Usage: install-fased-signerd.sh [options]
+
+Installs the exact version-matched native signer for Local Linux, WSL2, or
+native macOS using an offline snapshot and crash-recoverable transaction.
+
+Options:
+  --version vX.Y.Z              Exact signer release (defaults to package version)
+  --expected-commit SHA         Require the signer release to match this app commit
+  --defer-commit                Leave the verified candidate open for paired app health
+  --confirm-downgrade X.Y.Z     Explicitly confirm one exact reviewed downgrade target
+  --verify                      Verify the exact running binary, release, and protocol-v2 health
+  --commit                      Commit a deferred verified transaction
+  --rollback                    Restore the exact verified pre-update snapshot
+  --recover                     Recover an interrupted transaction deterministically
+  --status                      Print the current signer transaction journal
+  -h, --help                    Show this help
+
+Native Windows is unsupported. Run this installer inside Ubuntu on WSL2.
+Official installs require gh with `gh attestation verify`; Go is not required.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --version)
+      VERSION="${2:-}"
+      shift 2
+      ;;
+    --expected-commit)
+      EXPECTED_COMMIT="${2:-}"
+      shift 2
+      ;;
+    --defer-commit)
+      DEFER_COMMIT=1
+      shift
+      ;;
+    --confirm-downgrade)
+      CONFIRM_DOWNGRADE="${2:-}"
+      shift 2
+      ;;
+    --commit)
+      ACTION="commit"
+      shift
+      ;;
+    --verify)
+      ACTION="verify"
+      shift
+      ;;
+    --rollback)
+      ACTION="rollback"
+      shift
+      ;;
+    --recover)
+      ACTION="recover"
+      shift
+      ;;
+    --status)
+      ACTION="status"
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown signer installer option: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
 
+OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
 case "$OS" in
   linux|darwin) ;;
+  mingw*|msys*|cygwin*)
+    echo "Native Windows is unsupported. Install and run Fased inside Ubuntu on WSL2." >&2
+    exit 1
+    ;;
   *)
-    echo "Unsupported OS: $OS" >&2
+    echo "Unsupported OS for fased-signerd: $OS" >&2
     exit 1
     ;;
 esac
 
-mkdir -p "$INSTALL_DIR"
-BIN_PATH="${INSTALL_DIR}/fased-signerd"
-TMP="$(mktemp -d)"
-trap 'rm -rf "$TMP"' EXIT
-
-DEFAULT_RELEASE_DOWNLOAD_BASE="https://github.com/fased-ai/fased/releases/download"
-BASE_URL="${FASED_LOCAL_SIGNER_BASE_URL:-}"
-if [[ -z "$BASE_URL" ]]; then
-  BASE_URL="$DEFAULT_RELEASE_DOWNLOAD_BASE"
-fi
-if [[ -z "$VERSION" || "$VERSION" == "latest" ]]; then
-  VERSION_TAG="${FASED_LOCAL_SIGNER_LATEST_TAG:-}"
-else
-  VERSION_TAG="$VERSION"
-fi
+command -v node >/dev/null 2>&1 || {
+  echo "Node.js is required to run the transactional signer installer." >&2
+  exit 1
+}
+[[ -f "$UPDATER" && ! -L "$UPDATER" ]] || {
+  echo "Packaged transactional signer updater is missing: $UPDATER" >&2
+  exit 1
+}
 
-if [[ "$BASE_URL" == "$DEFAULT_RELEASE_DOWNLOAD_BASE" && ( -z "$VERSION_TAG" || "$VERSION_TAG" == "latest" ) ]]; then
-  if command -v node >/dev/null 2>&1 && [[ -f "${ROOT}/package.json" ]]; then
-    PACKAGE_VERSION="$(cd "$ROOT" && node -p "require('./package.json').version" 2>/dev/null || true)"
-    if [[ "$PACKAGE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$ ]]; then
-      VERSION_TAG="v${PACKAGE_VERSION}"
-    fi
+if [[ "$ACTION" == "install" || "$ACTION" == "verify" ]]; then
+  if [[ -z "$VERSION" || "$VERSION" == "latest" ]]; then
+    VERSION="$(node -p "require(process.argv[1]).version" "$ROOT/package.json" 2>/dev/null || true)"
+  fi
+  VERSION="${VERSION#v}"
+  if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?$ ]]; then
+    echo "An exact signer release version X.Y.Z is required; latest is not accepted." >&2
+    exit 1
   fi
 fi
 
-if [[ "$BASE_URL" == "$DEFAULT_RELEASE_DOWNLOAD_BASE" && ( -z "$VERSION_TAG" || "$VERSION_TAG" == "latest" ) ]]; then
-  cat >&2 <<'EOF'
-Could not determine the version-matched fased-signerd release asset.
-
-Normal Fased install, dashboard, Gateway, and Fased Network startup do not need fased-signerd.
-The wallet setup wizard normally supplies the installed Fased version automatically.
-
-For a manual install, set one of:
-  FASED_LOCAL_SIGNER_VERSION=vX.Y.Z
-  FASED_LOCAL_SIGNER_BASE_URL=file:///path/to/release FASED_LOCAL_SIGNER_LATEST_TAG=
-  FASED_LOCAL_SIGNER_BASE_URL=https://example.invalid/releases/download FASED_LOCAL_SIGNER_VERSION=vX.Y.Z
-EOF
+if [[ -n "$EXPECTED_COMMIT" && ! "$EXPECTED_COMMIT" =~ ^[a-f0-9]{40}$ ]]; then
+  echo "--expected-commit must be one exact 40-character Git commit." >&2
   exit 1
 fi
 
-ASSET="fased-signerd-${OS}-${ARCH}"
-if [[ "${VERSION_TAG}" == "latest" && "$BASE_URL" == */releases/download ]]; then
-  RELEASES_ROOT="${BASE_URL%/download}"
-  URL="${RELEASES_ROOT}/latest/download/${ASSET}"
-  SUMS_URL="${RELEASES_ROOT}/latest/download/fased-signerd-checksums.txt"
-elif [[ -n "${VERSION_TAG}" ]]; then
-  URL="${BASE_URL}/${VERSION_TAG}/${ASSET}"
-  SUMS_URL="${BASE_URL}/${VERSION_TAG}/fased-signerd-checksums.txt"
-else
-  URL="${BASE_URL}/${ASSET}"
-  SUMS_URL="${BASE_URL}/fased-signerd-checksums.txt"
-fi
+mkdir -p "$INSTALL_DIR"
+chmod 700 "$INSTALL_DIR" 2>/dev/null || true
+export FASED_LOCAL_SIGNER_BIN_DIR="$INSTALL_DIR"
+export FASED_WALLET_LOCAL_SIGNER_BIN="$INSTALL_DIR/fased-signerd"
 
-download() {
-  if command -v curl >/dev/null 2>&1; then
-    curl -fsSL "$URL" -o "${TMP}/fased-signerd"
-    return
+args=(local-signer "$ACTION")
+if [[ "$ACTION" == "install" || "$ACTION" == "verify" ]]; then
+  args+=(--version "$VERSION")
+  if [[ -n "$EXPECTED_COMMIT" ]]; then
+    args+=(--expected-commit "$EXPECTED_COMMIT")
   fi
-  if command -v wget >/dev/null 2>&1; then
-    wget -O "${TMP}/fased-signerd" "$URL"
-    return
+fi
+if [[ "$ACTION" == "install" ]]; then
+  # Keep the candidate read-only and the rollback journal open until all
+  # packaged policy helpers/templates are installed successfully.
+  args+=(--defer-commit)
+  if [[ -n "$CONFIRM_DOWNGRADE" ]]; then
+    args+=(--confirm-downgrade "${CONFIRM_DOWNGRADE#v}")
   fi
-  echo "Need curl or wget to download fased-signerd" >&2
-  exit 1
-}
+fi
 
-download_to() {
-  local src="$1"
-  local dst="$2"
-  if command -v curl >/dev/null 2>&1; then
-    curl -fsSL "$src" -o "$dst"
-    return
+TRANSACTION_OPEN=0
+rollback_failed_install() {
+  local status=$?
+  if [[ "$status" -ne 0 && "$TRANSACTION_OPEN" -eq 1 ]]; then
+    node "$UPDATER" local-signer rollback >/dev/null 2>&1 || true
   fi
-  if command -v wget >/dev/null 2>&1; then
-    wget -O "$dst" "$src"
-    return
-  fi
-  echo "Need curl or wget to download fased-signerd" >&2
-  exit 1
+  return "$status"
 }
+trap rollback_failed_install EXIT
 
-sha256_file() {
-  local file="$1"
-  if command -v sha256sum >/dev/null 2>&1; then
-    sha256sum "$file" | awk '{print $1}'
-    return
-  fi
-  if command -v shasum >/dev/null 2>&1; then
-    shasum -a 256 "$file" | awk '{print $1}'
-    return
-  fi
-  echo "Need sha256sum or shasum for checksum verification" >&2
-  exit 1
-}
+node "$UPDATER" "${args[@]}"
 
-echo "Installing fased-signerd (${OS}/${ARCH}) from:"
-echo "  $URL"
-download
-echo "Verifying checksum from:"
-echo "  $SUMS_URL"
-download_to "$SUMS_URL" "${TMP}/checksums.txt"
-EXPECTED="$(awk -v asset="$ASSET" '$2==asset {print $1}' "${TMP}/checksums.txt" | head -n1)"
-if [[ -z "$EXPECTED" ]]; then
-  echo "Checksum entry not found for $ASSET in checksums file" >&2
-  exit 1
+if [[ "$ACTION" != "install" ]]; then
+  trap - EXIT
+  exit 0
 fi
-ACTUAL="$(sha256_file "${TMP}/fased-signerd")"
-if [[ "$ACTUAL" != "$EXPECTED" ]]; then
-  echo "Checksum mismatch for $ASSET" >&2
-  echo "expected: $EXPECTED" >&2
-  echo "actual:   $ACTUAL" >&2
-  exit 1
+TRANSACTION_OPEN=1
+
+POLICY_HELPER_PATH="${INSTALL_DIR}/fased-signer-owner-policy.mjs"
+POLICY_LAUNCHER_PATH="${INSTALL_DIR}/fased-signer-policy"
+POLICY_HELPER_SOURCE="${ROOT}/scripts/fased-signer-owner-policy.mjs"
+POLICY_LAUNCHER_SOURCE="${ROOT}/scripts/fased-signer-policy-local.sh"
+POLICY_TEMPLATE_SOURCE="${ROOT}/config/signer-policies"
+
+required_assets=(
+  "$POLICY_HELPER_SOURCE"
+  "$POLICY_LAUNCHER_SOURCE"
+  "$POLICY_TEMPLATE_SOURCE/README.md"
+  "$POLICY_TEMPLATE_SOURCE/agent.json.template"
+  "$POLICY_TEMPLATE_SOURCE/mining.json.template"
+  "$POLICY_TEMPLATE_SOURCE/vault.json.template"
+)
+if [[ -f "$POLICY_TEMPLATE_SOURCE/network.json.template" ]]; then
+  required_assets+=("$POLICY_TEMPLATE_SOURCE/network.json.template")
 fi
-echo "Checksum OK: $ACTUAL"
-install -m 0755 "${TMP}/fased-signerd" "$BIN_PATH"
+for required_path in "${required_assets[@]}"; do
+  [[ -f "$required_path" && ! -L "$required_path" ]] || {
+    echo "Packaged signer policy asset is missing or unsafe: $required_path" >&2
+    exit 1
+  }
+done
 
-echo "Installed: $BIN_PATH"
-echo "Export for Fased:"
-echo "  export FASED_WALLET_LOCAL_SIGNER_BIN=\"$BIN_PATH\""
+install -d -m 0700 "$INSTALL_DIR" "$POLICY_TEMPLATE_DIR"
+install -m 0700 "$POLICY_HELPER_SOURCE" "$POLICY_HELPER_PATH"
+install -m 0700 "$POLICY_LAUNCHER_SOURCE" "$POLICY_LAUNCHER_PATH"
+for template in README.md agent.json.template mining.json.template vault.json.template network.json.template; do
+  [[ -f "$POLICY_TEMPLATE_SOURCE/$template" ]] || continue
+  install -m 0600 "$POLICY_TEMPLATE_SOURCE/$template" "$POLICY_TEMPLATE_DIR/$template"
+done
+
+if [[ "$DEFER_COMMIT" -eq 0 ]]; then
+  node "$UPDATER" local-signer commit
+  TRANSACTION_OPEN=0
+fi
+trap - EXIT
+
+echo "Installed exact transactional signer: $INSTALL_DIR/fased-signerd"
+echo "Installed signer enrollment launcher: $INSTALL_DIR/fased-signer-enroll"
+echo "Installed signer policy launcher: $POLICY_LAUNCHER_PATH"
+echo "Installed fail-closed policy templates: $POLICY_TEMPLATE_DIR"
+cat <<EOF
+Fresh signer-owned wallets remain deny-all. After wallet setup creates a wallet,
+enroll the owner authenticator and apply an explicit reviewed policy as this user:
+  1. $INSTALL_DIR/fased-signer-enroll [authenticator-label]
+  2. Copy the matching owner-only template from $POLICY_TEMPLATE_DIR and replace
+     every REPLACE_WITH_ value.
+  3. $POLICY_LAUNCHER_PATH --initial-install --policy-file /absolute/path/to/policy.json
+
+Enrollment never enables signing, and copying a template never applies it.
+EOF