@forgezero/agent 0.1.102 → 0.1.103

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.102";
+var VERSION3 = "0.1.103";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.d.ts

@@ -115,6 +115,10 @@ export interface PlatformBootstrapSecrets {
     backupS3Secret?: string;
     cloudflareTunnelToken?: string;
     cloudflareApiToken?: string;
+    githubClientSecret?: string;
+    /** One-line base64 form accepted by prompts/env; decoded before systemd sealing. */
+    githubPrivateKeyBase64?: string;
+    githubWebhookSecret?: string;
 }
 export interface EnrolledComputeBootstrapSecrets {
     enrolmentToken: string;

package/dist/bootstrap.js

@@ -1386,7 +1386,7 @@ async function buildBootstrapBundle(input, exec = run) {
 }
 
 // src/bootstrap.ts
-import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes3 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac2, createPrivateKey, randomBytes as randomBytes3 } from "crypto";
 import {
   chmodSync as chmodSync3,
   existsSync as existsSync5,
@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.102";
+var VERSION = "0.1.103";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3090,10 +3090,16 @@ var httpsOrigin = (name, raw) => {
 };
 var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "metalIdentity", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
+  if (value.metalIdentity !== undefined) {
+    const identity = value.metalIdentity;
+    if (!identity || typeof identity !== "object" || Array.isArray(identity) || Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !identity.publicKeys || identity.publicKeys.ed25519 !== identity.nodeKey || !/^[A-Za-z0-9_-]{1,8192}$/.test(identity.publicKeys.mlDsa) || Object.keys(identity.publicKeys).some((key) => !["ed25519", "mlDsa"].includes(key))) {
+      throw new Error("initial platform Metal identity is invalid");
+    }
+  }
   if (value.region.city !== undefined)
     safeAtom("initialInventory.region.city", value.region.city);
   if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
@@ -3128,6 +3134,7 @@ function validatePlatformInitialInventory(value) {
   }
   return {
     metalHostname: value.metalHostname,
+    ...value.metalIdentity ? { metalIdentity: structuredClone(value.metalIdentity) } : {},
     region: { ...value.region },
     computes: value.computes.map((compute, index) => ({
       ...computes[index],
@@ -3181,6 +3188,11 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
+  if (input.githubApp) {
+    if (!/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubApp.clientId) || !/^[1-9][0-9]{0,19}$/.test(input.githubApp.appId) || !/^[a-z0-9][a-z0-9-]{0,99}$/.test(input.githubApp.slug)) {
+      throw new Error("GitHub App client id, app id or slug is malformed.");
+    }
+  }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
     throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
@@ -3311,6 +3323,9 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
+    FZ_GITHUB_CLIENT_ID: value.githubApp?.clientId ?? "",
+    FZ_GITHUB_APP_ID: value.githubApp?.appId ?? "",
+    FZ_GITHUB_APP_SLUG: value.githubApp?.slug ?? "",
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -3322,6 +3337,9 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
+    ["fz_github.clientSecret", options.githubApp],
+    ["fz_github.privateKey", options.githubApp],
+    ["fz_github.webhookSecret", options.githubApp],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
@@ -3717,7 +3735,17 @@ function validatePlatformBootstrapSecrets(config, input) {
   if (!input || typeof input !== "object" || Array.isArray(input))
     throw new Error("bootstrap credential input must be an object");
   const source = input;
-  const allowed = ["clusterBootstrapCode", "emailSecret", "enrolmentToken", "backupS3Secret", "cloudflareTunnelToken", "cloudflareApiToken"];
+  const allowed = [
+    "clusterBootstrapCode",
+    "emailSecret",
+    "enrolmentToken",
+    "backupS3Secret",
+    "cloudflareTunnelToken",
+    "cloudflareApiToken",
+    "githubClientSecret",
+    "githubPrivateKeyBase64",
+    "githubWebhookSecret"
+  ];
   const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
   if (unknown.length)
     throw new Error(`bootstrap credential input contains unsupported field ${unknown[0]}`);
@@ -3727,6 +3755,9 @@ function validatePlatformBootstrapSecrets(config, input) {
   const backupS3Secret = typeof source.backupS3Secret === "string" ? source.backupS3Secret.trim() : undefined;
   const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : undefined;
   const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : undefined;
+  const githubClientSecret = typeof source.githubClientSecret === "string" ? source.githubClientSecret.trim() : undefined;
+  const githubPrivateKeyBase64 = typeof source.githubPrivateKeyBase64 === "string" ? source.githubPrivateKeyBase64.trim() : undefined;
+  const githubWebhookSecret = typeof source.githubWebhookSecret === "string" ? source.githubWebhookSecret.trim() : undefined;
   if (!/^[a-f0-9]{64}$/i.test(clusterBootstrapCode))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
   if (!emailSecret || emailSecret.length > 16384 || /[\r\n\0]/.test(emailSecret))
@@ -3746,12 +3777,29 @@ function validatePlatformBootstrapSecrets(config, input) {
   }
   if (cloudflareTunnelToken)
     validateCloudflareBootstrapSecretPair({ cloudflareTunnelToken, cloudflareApiToken });
+  const githubConfigured = Boolean(config.runtime.environment.githubApp);
+  if (githubConfigured !== Boolean(githubClientSecret && githubPrivateKeyBase64 && githubWebhookSecret)) {
+    throw new Error("GitHub App coordinates require client secret, private key and webhook secret together");
+  }
+  if (githubConfigured) {
+    if (githubClientSecret.length < 20 || githubClientSecret.length > 512 || /[\r\n\0]/.test(githubClientSecret) || githubWebhookSecret.length < 32 || githubWebhookSecret.length > 512 || /[\r\n\0]/.test(githubWebhookSecret)) {
+      throw new Error("GitHub App client or webhook secret is malformed");
+    }
+    try {
+      const pem = Buffer.from(githubPrivateKeyBase64, "base64").toString("utf8");
+      if (createPrivateKey(pem).asymmetricKeyType !== "rsa")
+        throw new Error("not RSA");
+    } catch {
+      throw new Error("GitHub App private key must be a base64-encoded RSA private key");
+    }
+  }
   return {
     clusterBootstrapCode,
     emailSecret,
     ...enrolmentToken ? { enrolmentToken } : {},
     ...backupS3Secret ? { backupS3Secret } : {},
-    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {}
+    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {},
+    ...githubConfigured ? { githubClientSecret, githubPrivateKeyBase64, githubWebhookSecret } : {}
   };
 }
 var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
@@ -4303,6 +4351,12 @@ function approvedPlatformRepairIdentityDigests(config) {
     delete beforeAttestation.runtime.environment.initialInventory.attestation;
     prior.push(beforeAttestation);
   }
+  const metalIdentity = config.runtime.environment.initialInventory?.metalIdentity;
+  if (metalIdentity && config.enrolment.source === "genesis-derived") {
+    const beforeMetalIdentity = structuredClone(config);
+    delete beforeMetalIdentity.runtime.environment.initialInventory.metalIdentity;
+    prior.push(beforeMetalIdentity);
+  }
   if (config.database.role === "joiner" && config.enrolment.source === "genesis-derived" && config.runtime.environment.custodianEmail) {
     const beforeReplicaCustodianEmail = structuredClone(config);
     delete beforeReplicaCustodianEmail.runtime.environment.custodianEmail;
@@ -4660,7 +4714,10 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       enrolmentToken: checked4.enrolmentToken,
       backup: checked4.backupS3Secret,
       cloudflareTunnelToken: checked4.cloudflareTunnelToken,
-      cloudflareApiToken: checked4.cloudflareApiToken
+      cloudflareApiToken: checked4.cloudflareApiToken,
+      githubClientSecret: checked4.githubClientSecret,
+      githubPrivateKey: checked4.githubPrivateKeyBase64 ? Buffer.from(checked4.githubPrivateKeyBase64, "base64").toString("utf8") : undefined,
+      githubWebhookSecret: checked4.githubWebhookSecret
     };
   })() : undefined;
   const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
@@ -4758,6 +4815,9 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
     for (const [name, source] of Object.entries({
       ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
+      "fz_github.clientSecret": platformPrivate.githubClientSecret,
+      "fz_github.privateKey": platformPrivate.githubPrivateKey,
+      "fz_github.webhookSecret": platformPrivate.githubWebhookSecret,
       "backup.s3.secretAccessKey": platformPrivate.backup
     })) {
       if (source) {
@@ -4774,6 +4834,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const credentials = platformApiCredentialSpecs({
       emailProvider: runtime.environment.email?.provider,
       cloudflareKv: cloudflareConfigured,
+      githubApp: Boolean(runtime.environment.githubApp),
       realtime: Boolean(runtime.environment.realtime)
     });
     const units = renderPlatformApiUnits({

package/dist/fz-agent.js

@@ -9496,7 +9496,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.102";
+var VERSION2 = "0.1.103";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4841,7 +4841,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.102";
+var VERSION2 = "0.1.103";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -12058,7 +12058,7 @@ function removeSession(api, realm, path = defaultSessionPath()) {
 }
 
 // src/bootstrap.ts
-import { createHash as createHash4, createHmac as createHmac2, randomBytes as randomBytes7 } from "crypto";
+import { createHash as createHash4, createHmac as createHmac2, createPrivateKey, randomBytes as randomBytes7 } from "crypto";
 import {
   chmodSync as chmodSync4,
   existsSync as existsSync9,
@@ -12239,10 +12239,16 @@ var httpsOrigin = (name, raw) => {
 };
 var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "metalIdentity", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
+  if (value.metalIdentity !== undefined) {
+    const identity = value.metalIdentity;
+    if (!identity || typeof identity !== "object" || Array.isArray(identity) || Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !identity.publicKeys || identity.publicKeys.ed25519 !== identity.nodeKey || !/^[A-Za-z0-9_-]{1,8192}$/.test(identity.publicKeys.mlDsa) || Object.keys(identity.publicKeys).some((key) => !["ed25519", "mlDsa"].includes(key))) {
+      throw new Error("initial platform Metal identity is invalid");
+    }
+  }
   if (value.region.city !== undefined)
     safeAtom("initialInventory.region.city", value.region.city);
   if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
@@ -12277,6 +12283,7 @@ function validatePlatformInitialInventory(value) {
   }
   return {
     metalHostname: value.metalHostname,
+    ...value.metalIdentity ? { metalIdentity: structuredClone(value.metalIdentity) } : {},
     region: { ...value.region },
     computes: value.computes.map((compute, index) => ({
       ...computes[index],
@@ -12330,6 +12337,11 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
+  if (input.githubApp) {
+    if (!/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubApp.clientId) || !/^[1-9][0-9]{0,19}$/.test(input.githubApp.appId) || !/^[a-z0-9][a-z0-9-]{0,99}$/.test(input.githubApp.slug)) {
+      throw new Error("GitHub App client id, app id or slug is malformed.");
+    }
+  }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
     throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
@@ -12460,6 +12472,9 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
+    FZ_GITHUB_CLIENT_ID: value.githubApp?.clientId ?? "",
+    FZ_GITHUB_APP_ID: value.githubApp?.appId ?? "",
+    FZ_GITHUB_APP_SLUG: value.githubApp?.slug ?? "",
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -12471,6 +12486,9 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
+    ["fz_github.clientSecret", options.githubApp],
+    ["fz_github.privateKey", options.githubApp],
+    ["fz_github.webhookSecret", options.githubApp],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
@@ -14102,7 +14120,17 @@ function validatePlatformBootstrapSecrets(config, input) {
   if (!input || typeof input !== "object" || Array.isArray(input))
     throw new Error("bootstrap credential input must be an object");
   const source = input;
-  const allowed = ["clusterBootstrapCode", "emailSecret", "enrolmentToken", "backupS3Secret", "cloudflareTunnelToken", "cloudflareApiToken"];
+  const allowed = [
+    "clusterBootstrapCode",
+    "emailSecret",
+    "enrolmentToken",
+    "backupS3Secret",
+    "cloudflareTunnelToken",
+    "cloudflareApiToken",
+    "githubClientSecret",
+    "githubPrivateKeyBase64",
+    "githubWebhookSecret"
+  ];
   const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
   if (unknown.length)
     throw new Error(`bootstrap credential input contains unsupported field ${unknown[0]}`);
@@ -14112,6 +14140,9 @@ function validatePlatformBootstrapSecrets(config, input) {
   const backupS3Secret = typeof source.backupS3Secret === "string" ? source.backupS3Secret.trim() : undefined;
   const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : undefined;
   const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : undefined;
+  const githubClientSecret = typeof source.githubClientSecret === "string" ? source.githubClientSecret.trim() : undefined;
+  const githubPrivateKeyBase64 = typeof source.githubPrivateKeyBase64 === "string" ? source.githubPrivateKeyBase64.trim() : undefined;
+  const githubWebhookSecret = typeof source.githubWebhookSecret === "string" ? source.githubWebhookSecret.trim() : undefined;
   if (!/^[a-f0-9]{64}$/i.test(clusterBootstrapCode))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
   if (!emailSecret || emailSecret.length > 16384 || /[\r\n\0]/.test(emailSecret))
@@ -14131,12 +14162,29 @@ function validatePlatformBootstrapSecrets(config, input) {
   }
   if (cloudflareTunnelToken)
     validateCloudflareBootstrapSecretPair({ cloudflareTunnelToken, cloudflareApiToken });
+  const githubConfigured = Boolean(config.runtime.environment.githubApp);
+  if (githubConfigured !== Boolean(githubClientSecret && githubPrivateKeyBase64 && githubWebhookSecret)) {
+    throw new Error("GitHub App coordinates require client secret, private key and webhook secret together");
+  }
+  if (githubConfigured) {
+    if (githubClientSecret.length < 20 || githubClientSecret.length > 512 || /[\r\n\0]/.test(githubClientSecret) || githubWebhookSecret.length < 32 || githubWebhookSecret.length > 512 || /[\r\n\0]/.test(githubWebhookSecret)) {
+      throw new Error("GitHub App client or webhook secret is malformed");
+    }
+    try {
+      const pem = Buffer.from(githubPrivateKeyBase64, "base64").toString("utf8");
+      if (createPrivateKey(pem).asymmetricKeyType !== "rsa")
+        throw new Error("not RSA");
+    } catch {
+      throw new Error("GitHub App private key must be a base64-encoded RSA private key");
+    }
+  }
   return {
     clusterBootstrapCode,
     emailSecret,
     ...enrolmentToken ? { enrolmentToken } : {},
     ...backupS3Secret ? { backupS3Secret } : {},
-    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {}
+    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {},
+    ...githubConfigured ? { githubClientSecret, githubPrivateKeyBase64, githubWebhookSecret } : {}
   };
 }
 var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
@@ -14688,6 +14736,12 @@ function approvedPlatformRepairIdentityDigests(config) {
     delete beforeAttestation.runtime.environment.initialInventory.attestation;
     prior.push(beforeAttestation);
   }
+  const metalIdentity = config.runtime.environment.initialInventory?.metalIdentity;
+  if (metalIdentity && config.enrolment.source === "genesis-derived") {
+    const beforeMetalIdentity = structuredClone(config);
+    delete beforeMetalIdentity.runtime.environment.initialInventory.metalIdentity;
+    prior.push(beforeMetalIdentity);
+  }
   if (config.database.role === "joiner" && config.enrolment.source === "genesis-derived" && config.runtime.environment.custodianEmail) {
     const beforeReplicaCustodianEmail = structuredClone(config);
     delete beforeReplicaCustodianEmail.runtime.environment.custodianEmail;
@@ -15045,7 +15099,10 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       enrolmentToken: checked4.enrolmentToken,
       backup: checked4.backupS3Secret,
       cloudflareTunnelToken: checked4.cloudflareTunnelToken,
-      cloudflareApiToken: checked4.cloudflareApiToken
+      cloudflareApiToken: checked4.cloudflareApiToken,
+      githubClientSecret: checked4.githubClientSecret,
+      githubPrivateKey: checked4.githubPrivateKeyBase64 ? Buffer.from(checked4.githubPrivateKeyBase64, "base64").toString("utf8") : undefined,
+      githubWebhookSecret: checked4.githubWebhookSecret
     };
   })() : undefined;
   const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
@@ -15143,6 +15200,9 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
     for (const [name, source] of Object.entries({
       ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
+      "fz_github.clientSecret": platformPrivate.githubClientSecret,
+      "fz_github.privateKey": platformPrivate.githubPrivateKey,
+      "fz_github.webhookSecret": platformPrivate.githubWebhookSecret,
       "backup.s3.secretAccessKey": platformPrivate.backup
     })) {
       if (source) {
@@ -15159,6 +15219,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const credentials = platformApiCredentialSpecs({
       emailProvider: runtime.environment.email?.provider,
       cloudflareKv: cloudflareConfigured,
+      githubApp: Boolean(runtime.environment.githubApp),
       realtime: Boolean(runtime.environment.realtime)
     });
     const units = renderPlatformApiUnits({
@@ -16156,7 +16217,7 @@ var SUPPORTED_BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dc
 
 class MetalBootstrapError extends Error {
 }
-function normalizeMetalPublicIdentity(value) {
+function parseMetalPublicIdentity(value) {
   let parsed;
   try {
     parsed = JSON.parse(value);
@@ -16171,7 +16232,13 @@ function normalizeMetalPublicIdentity(value) {
   if (Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || typeof identity.nodeKey !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !keys || Object.keys(keys).some((key) => !["ed25519", "mlDsa"].includes(key)) || keys.ed25519 !== identity.nodeKey || typeof keys.mlDsa !== "string" || !/^[A-Za-z0-9_-]{1,8192}$/.test(keys.mlDsa)) {
     throw new MetalBootstrapError("metal public identity proof was invalid");
   }
-  return JSON.stringify(parsed);
+  return {
+    nodeKey: identity.nodeKey,
+    publicKeys: { ed25519: keys.ed25519, mlDsa: keys.mlDsa }
+  };
+}
+function normalizeMetalPublicIdentity(value) {
+  return JSON.stringify(parseMetalPublicIdentity(value));
 }
 var defaultExec2 = async (argv2, stdin) => {
   const child = Bun.spawn([...argv2], {
@@ -17061,7 +17128,7 @@ function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles, cloudfla
   return writeOwnerJson2(path, request, "operator fleet request");
 }
 var validateMetalRequestValue = (value, options = {}) => {
-  const root = exactKeys5(value, ["kind", "target", "metalConfigFile", "genesis"], "operator metal request");
+  const root = exactKeys5(value, ["kind", "target", "metalConfigFile", "metalIdentityEvidenceFile", "genesis"], "operator metal request");
   if (root.kind !== "metal-remote")
     throw new Error("operator metal bootstrap kind must be metal-remote");
   const targetValue = exactKeys5(root.target, ["address", "port", "user", "hostKey", "hostKeySha256", "identityPublicKeyFile", "agentSocket"], "operator metal target");
@@ -17080,6 +17147,12 @@ var validateMetalRequestValue = (value, options = {}) => {
   if (typeof root.metalConfigFile !== "string")
     throw new Error("metalConfigFile must be an absolute path");
   canonicalOutputPath(root.metalConfigFile, "metalConfigFile");
+  if (root.metalIdentityEvidenceFile !== undefined && typeof root.metalIdentityEvidenceFile !== "string") {
+    throw new Error("metalIdentityEvidenceFile must be an absolute path");
+  }
+  if (typeof root.metalIdentityEvidenceFile === "string") {
+    canonicalOutputPath(root.metalIdentityEvidenceFile, "metalIdentityEvidenceFile");
+  }
   if (options.validateMetalConfig !== false)
     readMetalBootstrapConfig(root.metalConfigFile);
   const genesis = exactKeys5(root.genesis, ["nodes", "rehearsalNode", "sshPublicKeyFiles"], "operator metal genesis");
@@ -17128,6 +17201,7 @@ var validateMetalRequestValue = (value, options = {}) => {
   return {
     kind: "metal-remote",
     metalConfigFile: root.metalConfigFile,
+    ...typeof root.metalIdentityEvidenceFile === "string" ? { metalIdentityEvidenceFile: root.metalIdentityEvidenceFile } : {},
     target: {
       ...target,
       identityPublicKeyFile: targetValue.identityPublicKeyFile,
@@ -17148,6 +17222,25 @@ function writeOperatorMetalBootstrapRequest(path, request) {
   validateMetalRequestValue(request);
   return writeOwnerJson2(path, request, "operator metal request");
 }
+function readOperatorMetalIdentityEvidence(path, request) {
+  const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator metal identity evidence")));
+  const root = exactKeys5(value, ["format", "kind", "metalHostname", "metalHostKeySha256", "nodeKey", "publicKeys"], "operator metal identity evidence");
+  if (root.format !== 1 || root.kind !== "forgezero-operator-metal-identity" || typeof root.metalHostname !== "string" || typeof root.metalHostKeySha256 !== "string" || typeof root.nodeKey !== "string" || !root.publicKeys || typeof root.publicKeys !== "object") {
+    throw new Error("operator metal identity evidence is malformed");
+  }
+  const identity = parseMetalPublicIdentity(JSON.stringify({ nodeKey: root.nodeKey, publicKeys: root.publicKeys }));
+  const config = readMetalBootstrapConfig(request.metalConfigFile, { allowHistoricalRelease: true });
+  if (root.metalHostname !== config.metalHostname || root.metalHostKeySha256 !== request.target.hostKeySha256) {
+    throw new Error("operator metal identity evidence does not match the reviewed Metal target");
+  }
+  return {
+    format: 1,
+    kind: "forgezero-operator-metal-identity",
+    metalHostname: root.metalHostname,
+    metalHostKeySha256: root.metalHostKeySha256,
+    ...identity
+  };
+}
 var validateGuestHostKeyEvidenceValue = (value, request) => {
   const root = exactKeys5(value, ["format", "kind", "metalHostKeySha256", "nodes"], "operator guest host-key evidence");
   if (root.format !== 1 || root.kind !== "forgezero-operator-guest-host-keys" || typeof root.metalHostKeySha256 !== "string" || !Array.isArray(root.nodes)) {
@@ -17833,6 +17926,25 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       `${REMOTE_STAGE}/metal-config.json`,
       "--apply"
     ], "remote typed metal bootstrap");
+    if (request.metalIdentityEvidenceFile) {
+      let applied;
+      try {
+        applied = JSON.parse(output);
+      } catch {
+        throw new Error("remote Metal bootstrap did not return identity evidence");
+      }
+      const publicIdentity2 = applied?.publicIdentity;
+      if (typeof publicIdentity2 !== "string")
+        throw new Error("remote Metal bootstrap omitted its public identity");
+      const identity = parseMetalPublicIdentity(publicIdentity2);
+      writeOwnerJson2(request.metalIdentityEvidenceFile, {
+        format: 1,
+        kind: "forgezero-operator-metal-identity",
+        metalHostname: config.metalHostname,
+        metalHostKeySha256: request.target.hostKeySha256,
+        ...identity
+      }, "operator metal identity evidence");
+    }
     return { plan, output };
   } finally {
     if (knownHosts) {
@@ -17886,7 +17998,7 @@ async function applyAttendedPlatformBootstrap(fleetRequest, cloudflareRequest, a
 }
 
 // src/platform-genesis-config.ts
-function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname, region, deployment, attestation) {
+function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname, region, deployment, attestation, metalIdentity) {
   const fleet = validatePlatformGenesisGuests(guests);
   if (!/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(metalHostname)) {
     throw new Error("platform genesis requires the reviewed metal hostname");
@@ -17902,6 +18014,7 @@ function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname,
   const coordinators = fleet.map((guest) => `http://${guest.address}:8529`);
   const initialInventory = {
     metalHostname,
+    ...metalIdentity ? { metalIdentity: structuredClone(metalIdentity) } : {},
     region: {
       key: template.runtime.environment.nodeRegion,
       label: region.label,
@@ -18065,6 +18178,7 @@ function forgeZeroLaunchTemplate(profile, guests, bundle, owner) {
         otlpTraceSampleRatio: 0.1,
         custodianEmail: owner.custodianEmail,
         email: owner.email,
+        ...owner.githubApp ? { githubApp: owner.githubApp } : {},
         deployProfile: profile.environment
       },
       serviceUser: "forgezero-api",
@@ -19267,13 +19381,20 @@ function readPlatformLaunchEnvironment(path) {
   if (smtpPort !== undefined && (!Number.isInteger(smtpPort) || smtpPort < 1 || smtpPort > 65535)) {
     throw new Error("FZ_SMTP_PORT must be an integer from 1 through 65535");
   }
+  const githubEnabled = (values.get("FZ_GITHUB_ENABLED") ?? "false").trim().toLowerCase() === "true";
+  const githubApp = githubEnabled ? {
+    clientId: requiredValue("FZ_GITHUB_CLIENT_ID"),
+    appId: requiredValue("FZ_GITHUB_APP_ID"),
+    slug: requiredValue("FZ_GITHUB_APP_SLUG")
+  } : undefined;
   const owner = provider === "jetemail" ? {
     custodianEmail: requiredValue("FZ_BOOTSTRAP_CUSTODIAN_EMAIL"),
     email: {
       provider,
       from: requiredValue("FZ_EMAIL_FROM"),
       eu: (values.get("FZ_JETEMAIL_EU") ?? "false").trim().toLowerCase() === "true"
-    }
+    },
+    ...githubApp ? { githubApp } : {}
   } : {
     custodianEmail: requiredValue("FZ_BOOTSTRAP_CUSTODIAN_EMAIL"),
     email: {
@@ -19282,13 +19403,19 @@ function readPlatformLaunchEnvironment(path) {
       host: requiredValue("FZ_SMTP_HOST"),
       port: smtpPort,
       user: requiredValue("FZ_SMTP_USER")
-    }
+    },
+    ...githubApp ? { githubApp } : {}
   };
   return {
     owner,
     emailSecret: requiredValue(provider === "jetemail" ? "FZ_JETEMAIL_API_KEY" : "FZ_SMTP_PASSWORD"),
     cloudflareTunnelToken: requiredValue("CF_TUNNEL_TOKEN"),
-    cloudflareApiToken: requiredValue("CF_API_TOKEN")
+    cloudflareApiToken: requiredValue("CF_API_TOKEN"),
+    ...githubEnabled ? {
+      githubClientSecret: requiredValue("FZ_GITHUB_CLIENT_SECRET"),
+      githubPrivateKeyBase64: requiredValue("FZ_GITHUB_PRIVATE_KEY_BASE64"),
+      githubWebhookSecret: requiredValue("FZ_GITHUB_WEBHOOK_SECRET")
+    } : {}
   };
 }
 async function promptPlatformBootstrapSecrets(config, generatedClusterBootstrapCode) {
@@ -19300,6 +19427,11 @@ async function promptPlatformBootstrapSecrets(config, generatedClusterBootstrapC
     ...config.cloudflareHandoff || config.runtime.environment.cloudflare ? {
       cloudflareTunnelToken: await bootstrapSecret("CF_TUNNEL_TOKEN"),
       cloudflareApiToken: await bootstrapSecret("CF_API_TOKEN")
+    } : {},
+    ...config.runtime.environment.githubApp ? {
+      githubClientSecret: await bootstrapSecret("GitHub App client secret"),
+      githubPrivateKeyBase64: await bootstrapSecret("GitHub App RSA private key (base64)"),
+      githubWebhookSecret: await bootstrapSecret("GitHub App webhook secret")
     } : {}
   });
 }
@@ -19481,6 +19613,7 @@ function writeMetalOperatorFiles(directory) {
   const remoteRequest = writeOperatorMetalBootstrapRequest(join13(output, "metal-remote.json"), {
     kind: "metal-remote",
     metalConfigFile: metalConfig,
+    metalIdentityEvidenceFile: join13(output, "metal-identity.json"),
     target: { ...target, ...identity },
     genesis: { ...interactiveGenesisGuests(), sshPublicKeyFiles: [identity.identityPublicKeyFile] }
   });
@@ -19501,6 +19634,10 @@ function writePlatformGenesisFleet(directory, preset) {
   const output = genesisOutputDirectory(directory);
   const metalRequestFile = preset?.metalRequestFile ?? bootstrapAnswer("Owner-only metal remote request containing the reviewed genesis guests");
   const metalRequest = readOperatorMetalBootstrapRequest(metalRequestFile, { validateMetalConfig: false });
+  if (!metalRequest.metalIdentityEvidenceFile) {
+    throw new Error("the reviewed Metal request predates automatic identity seeding; rerun Metal apply with a generated request");
+  }
+  const metalIdentity = readOperatorMetalIdentityEvidence(metalRequest.metalIdentityEvidenceFile, metalRequest);
   const guestHostKeysFile = preset?.guestHostKeysFile ?? bootstrapAnswer("Owner-only guest host-key evidence file");
   const guestHostKeys = readOperatorGuestHostKeyEvidence(guestHostKeysFile, metalRequest);
   const fleet = metalRequest.genesis.nodes;
@@ -19545,7 +19682,7 @@ function writePlatformGenesisFleet(directory, preset) {
     branch: preset.profile.branch,
     revision: preset.bundle.manifest.revision,
     bundleSha256: preset.bundle.manifest.sha256
-  } : undefined, preset?.profile.attestation).map((config) => {
+  } : undefined, preset?.profile.attestation, { nodeKey: metalIdentity.nodeKey, publicKeys: { ...metalIdentity.publicKeys } }).map((config) => {
     const path = `${output}/${config.computeReference}-platform.json`;
     if (preset)
       writeDerivedLaunchFile(path, (temporary) => writeBootstrapConfig(temporary, config));
@@ -19599,10 +19736,16 @@ function forgeZeroLaunchOwnerInput() {
     throw new Error("Bootstrap email provider must be smtp or jetemail");
   }
   const from = bootstrapAnswer("Bootstrap email From address");
+  const githubApp = bootstrapBoolean("Configure the platform GitHub App now?", "no") ? {
+    clientId: bootstrapAnswer("GitHub App client ID"),
+    appId: bootstrapAnswer("GitHub App ID"),
+    slug: bootstrapAnswer("GitHub App slug")
+  } : undefined;
   if (provider === "jetemail") {
     return {
       custodianEmail,
-      email: { provider, from, eu: bootstrapBoolean("Use JetEmail EU processing?", "no") }
+      email: { provider, from, eu: bootstrapBoolean("Use JetEmail EU processing?", "no") },
+      ...githubApp ? { githubApp } : {}
     };
   }
   return {
@@ -19613,7 +19756,8 @@ function forgeZeroLaunchOwnerInput() {
       host: bootstrapAnswer("SMTP host"),
       port: bootstrapNumber("SMTP port", "587"),
       user: bootstrapAnswer("SMTP user")
-    }
+    },
+    ...githubApp ? { githubApp } : {}
   };
 }
 async function prepareForgeZeroPlatformLaunch(environment, outputDirectory, projectRoot, owner) {
@@ -19798,7 +19942,12 @@ async function runAttendedPlatformFleet(fleet, apply, generatedClusterBootstrapC
     clusterBootstrapCode: generatedClusterBootstrapCode,
     emailSecret: environmentInput.emailSecret,
     cloudflareTunnelToken: environmentInput.cloudflareTunnelToken,
-    cloudflareApiToken: environmentInput.cloudflareApiToken
+    cloudflareApiToken: environmentInput.cloudflareApiToken,
+    ...environmentInput.githubClientSecret ? {
+      githubClientSecret: environmentInput.githubClientSecret,
+      githubPrivateKeyBase64: environmentInput.githubPrivateKeyBase64,
+      githubWebhookSecret: environmentInput.githubWebhookSecret
+    } : {}
   }) : await promptPlatformBootstrapSecrets(firstConfig, generatedClusterBootstrapCode);
   const cloudflare = await resolveCloudflareBootstrapCommandConfig(fleet.cloudflareConfigFile, {
     tunnelToken: secrets.cloudflareTunnelToken,

package/dist/metal-bootstrap.d.ts

@@ -43,6 +43,14 @@ export interface MetalBootstrapApplyOptions {
 }
 export declare class MetalBootstrapError extends Error {
 }
+export interface MetalPublicIdentity {
+    nodeKey: string;
+    publicKeys: {
+        ed25519: string;
+        mlDsa: string;
+    };
+}
+export declare function parseMetalPublicIdentity(value: string): MetalPublicIdentity;
 export declare function normalizeMetalPublicIdentity(value: string): string;
 export interface MetalBootstrapValidationOptions {
     /**

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.102";
+var VERSION = "0.1.103";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
@@ -543,7 +543,7 @@ var SUPPORTED_BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dc
 
 class MetalBootstrapError extends Error {
 }
-function normalizeMetalPublicIdentity(value) {
+function parseMetalPublicIdentity(value) {
   let parsed;
   try {
     parsed = JSON.parse(value);
@@ -558,7 +558,13 @@ function normalizeMetalPublicIdentity(value) {
   if (Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || typeof identity.nodeKey !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !keys || Object.keys(keys).some((key) => !["ed25519", "mlDsa"].includes(key)) || keys.ed25519 !== identity.nodeKey || typeof keys.mlDsa !== "string" || !/^[A-Za-z0-9_-]{1,8192}$/.test(keys.mlDsa)) {
     throw new MetalBootstrapError("metal public identity proof was invalid");
   }
-  return JSON.stringify(parsed);
+  return {
+    nodeKey: identity.nodeKey,
+    publicKeys: { ed25519: keys.ed25519, mlDsa: keys.mlDsa }
+  };
+}
+function normalizeMetalPublicIdentity(value) {
+  return JSON.stringify(parseMetalPublicIdentity(value));
 }
 var defaultExec2 = async (argv, stdin) => {
   const child = Bun.spawn([...argv], {
@@ -1258,6 +1264,7 @@ export {
   renderMetalUnits,
   readMetalBootstrapConfig,
   planMetalBootstrap,
+  parseMetalPublicIdentity,
   normalizeMetalPublicIdentity,
   metalBootstrapStatus,
   applyMetalBootstrap,

package/dist/operator-bootstrap.d.ts

@@ -1,4 +1,5 @@
 import { type PlatformBootstrapConfig, type PlatformBootstrapSecrets } from './bootstrap';
+import { type MetalPublicIdentity } from './metal-bootstrap';
 import { type PlatformGenesisGuest } from './platform-genesis';
 export interface OperatorSshHop {
     address: string;
@@ -20,12 +21,20 @@ export interface OperatorMetalBootstrapRequest {
     kind: 'metal-remote';
     target: OperatorPlatformBootstrapRequest['target'];
     metalConfigFile: string;
+    /** Secret-free, pinned-host identity evidence written automatically after apply. */
+    metalIdentityEvidenceFile?: string;
     genesis: {
         nodes: readonly [PlatformGenesisGuest, PlatformGenesisGuest, PlatformGenesisGuest];
         rehearsalNode?: PlatformGenesisGuest;
         sshPublicKeyFiles: string[];
     };
 }
+export interface OperatorMetalIdentityEvidence extends MetalPublicIdentity {
+    format: 1;
+    kind: 'forgezero-operator-metal-identity';
+    metalHostname: string;
+    metalHostKeySha256: string;
+}
 export interface OperatorGuestHostKeyEvidence {
     format: 1;
     kind: 'forgezero-operator-guest-host-keys';
@@ -139,6 +148,7 @@ export declare function readOperatorMetalBootstrapRequest(path: string, options?
     validateMetalConfig?: boolean;
 }): OperatorMetalBootstrapRequest;
 export declare function writeOperatorMetalBootstrapRequest(path: string, request: OperatorMetalBootstrapRequest): string;
+export declare function readOperatorMetalIdentityEvidence(path: string, request: OperatorMetalBootstrapRequest): OperatorMetalIdentityEvidence;
 export declare function readOperatorGuestHostKeyEvidence(path: string, request?: OperatorMetalBootstrapRequest): OperatorGuestHostKeyEvidence;
 export declare function writeOperatorGuestHostKeyEvidence(path: string, evidence: OperatorGuestHostKeyEvidence, request?: OperatorMetalBootstrapRequest): string;
 export declare function planOperatorMetalBootstrap(request: OperatorMetalBootstrapRequest, mode: OperatorMetalBootstrapMode): OperatorMetalBootstrapPlan;

package/dist/operator-bootstrap.js

@@ -1386,7 +1386,7 @@ async function buildBootstrapBundle(input, exec = run) {
 }
 
 // src/bootstrap.ts
-import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes3 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac2, createPrivateKey, randomBytes as randomBytes3 } from "crypto";
 import {
   chmodSync as chmodSync3,
   existsSync as existsSync5,
@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.102";
+var VERSION = "0.1.103";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3090,10 +3090,16 @@ var httpsOrigin = (name, raw) => {
 };
 var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "metalIdentity", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
+  if (value.metalIdentity !== undefined) {
+    const identity = value.metalIdentity;
+    if (!identity || typeof identity !== "object" || Array.isArray(identity) || Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !identity.publicKeys || identity.publicKeys.ed25519 !== identity.nodeKey || !/^[A-Za-z0-9_-]{1,8192}$/.test(identity.publicKeys.mlDsa) || Object.keys(identity.publicKeys).some((key) => !["ed25519", "mlDsa"].includes(key))) {
+      throw new Error("initial platform Metal identity is invalid");
+    }
+  }
   if (value.region.city !== undefined)
     safeAtom("initialInventory.region.city", value.region.city);
   if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
@@ -3128,6 +3134,7 @@ function validatePlatformInitialInventory(value) {
   }
   return {
     metalHostname: value.metalHostname,
+    ...value.metalIdentity ? { metalIdentity: structuredClone(value.metalIdentity) } : {},
     region: { ...value.region },
     computes: value.computes.map((compute, index) => ({
       ...computes[index],
@@ -3181,6 +3188,11 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
+  if (input.githubApp) {
+    if (!/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubApp.clientId) || !/^[1-9][0-9]{0,19}$/.test(input.githubApp.appId) || !/^[a-z0-9][a-z0-9-]{0,99}$/.test(input.githubApp.slug)) {
+      throw new Error("GitHub App client id, app id or slug is malformed.");
+    }
+  }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
     throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
@@ -3311,6 +3323,9 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
+    FZ_GITHUB_CLIENT_ID: value.githubApp?.clientId ?? "",
+    FZ_GITHUB_APP_ID: value.githubApp?.appId ?? "",
+    FZ_GITHUB_APP_SLUG: value.githubApp?.slug ?? "",
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -3322,6 +3337,9 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
+    ["fz_github.clientSecret", options.githubApp],
+    ["fz_github.privateKey", options.githubApp],
+    ["fz_github.webhookSecret", options.githubApp],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
@@ -3717,7 +3735,17 @@ function validatePlatformBootstrapSecrets(config, input) {
   if (!input || typeof input !== "object" || Array.isArray(input))
     throw new Error("bootstrap credential input must be an object");
   const source = input;
-  const allowed = ["clusterBootstrapCode", "emailSecret", "enrolmentToken", "backupS3Secret", "cloudflareTunnelToken", "cloudflareApiToken"];
+  const allowed = [
+    "clusterBootstrapCode",
+    "emailSecret",
+    "enrolmentToken",
+    "backupS3Secret",
+    "cloudflareTunnelToken",
+    "cloudflareApiToken",
+    "githubClientSecret",
+    "githubPrivateKeyBase64",
+    "githubWebhookSecret"
+  ];
   const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
   if (unknown.length)
     throw new Error(`bootstrap credential input contains unsupported field ${unknown[0]}`);
@@ -3727,6 +3755,9 @@ function validatePlatformBootstrapSecrets(config, input) {
   const backupS3Secret = typeof source.backupS3Secret === "string" ? source.backupS3Secret.trim() : undefined;
   const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : undefined;
   const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : undefined;
+  const githubClientSecret = typeof source.githubClientSecret === "string" ? source.githubClientSecret.trim() : undefined;
+  const githubPrivateKeyBase64 = typeof source.githubPrivateKeyBase64 === "string" ? source.githubPrivateKeyBase64.trim() : undefined;
+  const githubWebhookSecret = typeof source.githubWebhookSecret === "string" ? source.githubWebhookSecret.trim() : undefined;
   if (!/^[a-f0-9]{64}$/i.test(clusterBootstrapCode))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
   if (!emailSecret || emailSecret.length > 16384 || /[\r\n\0]/.test(emailSecret))
@@ -3746,12 +3777,29 @@ function validatePlatformBootstrapSecrets(config, input) {
   }
   if (cloudflareTunnelToken)
     validateCloudflareBootstrapSecretPair({ cloudflareTunnelToken, cloudflareApiToken });
+  const githubConfigured = Boolean(config.runtime.environment.githubApp);
+  if (githubConfigured !== Boolean(githubClientSecret && githubPrivateKeyBase64 && githubWebhookSecret)) {
+    throw new Error("GitHub App coordinates require client secret, private key and webhook secret together");
+  }
+  if (githubConfigured) {
+    if (githubClientSecret.length < 20 || githubClientSecret.length > 512 || /[\r\n\0]/.test(githubClientSecret) || githubWebhookSecret.length < 32 || githubWebhookSecret.length > 512 || /[\r\n\0]/.test(githubWebhookSecret)) {
+      throw new Error("GitHub App client or webhook secret is malformed");
+    }
+    try {
+      const pem = Buffer.from(githubPrivateKeyBase64, "base64").toString("utf8");
+      if (createPrivateKey(pem).asymmetricKeyType !== "rsa")
+        throw new Error("not RSA");
+    } catch {
+      throw new Error("GitHub App private key must be a base64-encoded RSA private key");
+    }
+  }
   return {
     clusterBootstrapCode,
     emailSecret,
     ...enrolmentToken ? { enrolmentToken } : {},
     ...backupS3Secret ? { backupS3Secret } : {},
-    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {}
+    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {},
+    ...githubConfigured ? { githubClientSecret, githubPrivateKeyBase64, githubWebhookSecret } : {}
   };
 }
 var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
@@ -4303,6 +4351,12 @@ function approvedPlatformRepairIdentityDigests(config) {
     delete beforeAttestation.runtime.environment.initialInventory.attestation;
     prior.push(beforeAttestation);
   }
+  const metalIdentity = config.runtime.environment.initialInventory?.metalIdentity;
+  if (metalIdentity && config.enrolment.source === "genesis-derived") {
+    const beforeMetalIdentity = structuredClone(config);
+    delete beforeMetalIdentity.runtime.environment.initialInventory.metalIdentity;
+    prior.push(beforeMetalIdentity);
+  }
   if (config.database.role === "joiner" && config.enrolment.source === "genesis-derived" && config.runtime.environment.custodianEmail) {
     const beforeReplicaCustodianEmail = structuredClone(config);
     delete beforeReplicaCustodianEmail.runtime.environment.custodianEmail;
@@ -4660,7 +4714,10 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       enrolmentToken: checked4.enrolmentToken,
       backup: checked4.backupS3Secret,
       cloudflareTunnelToken: checked4.cloudflareTunnelToken,
-      cloudflareApiToken: checked4.cloudflareApiToken
+      cloudflareApiToken: checked4.cloudflareApiToken,
+      githubClientSecret: checked4.githubClientSecret,
+      githubPrivateKey: checked4.githubPrivateKeyBase64 ? Buffer.from(checked4.githubPrivateKeyBase64, "base64").toString("utf8") : undefined,
+      githubWebhookSecret: checked4.githubWebhookSecret
     };
   })() : undefined;
   const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
@@ -4758,6 +4815,9 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
     for (const [name, source] of Object.entries({
       ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
+      "fz_github.clientSecret": platformPrivate.githubClientSecret,
+      "fz_github.privateKey": platformPrivate.githubPrivateKey,
+      "fz_github.webhookSecret": platformPrivate.githubWebhookSecret,
       "backup.s3.secretAccessKey": platformPrivate.backup
     })) {
       if (source) {
@@ -4774,6 +4834,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const credentials = platformApiCredentialSpecs({
       emailProvider: runtime.environment.email?.provider,
       cloudflareKv: cloudflareConfigured,
+      githubApp: Boolean(runtime.environment.githubApp),
       realtime: Boolean(runtime.environment.realtime)
     });
     const units = renderPlatformApiUnits({
@@ -5501,7 +5562,7 @@ var SUPPORTED_BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dc
 
 class MetalBootstrapError extends Error {
 }
-function normalizeMetalPublicIdentity(value) {
+function parseMetalPublicIdentity(value) {
   let parsed;
   try {
     parsed = JSON.parse(value);
@@ -5516,7 +5577,13 @@ function normalizeMetalPublicIdentity(value) {
   if (Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || typeof identity.nodeKey !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !keys || Object.keys(keys).some((key) => !["ed25519", "mlDsa"].includes(key)) || keys.ed25519 !== identity.nodeKey || typeof keys.mlDsa !== "string" || !/^[A-Za-z0-9_-]{1,8192}$/.test(keys.mlDsa)) {
     throw new MetalBootstrapError("metal public identity proof was invalid");
   }
-  return JSON.stringify(parsed);
+  return {
+    nodeKey: identity.nodeKey,
+    publicKeys: { ed25519: keys.ed25519, mlDsa: keys.mlDsa }
+  };
+}
+function normalizeMetalPublicIdentity(value) {
+  return JSON.stringify(parseMetalPublicIdentity(value));
 }
 var defaultExec2 = async (argv, stdin) => {
   const child = Bun.spawn([...argv], {
@@ -6412,7 +6479,7 @@ function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles, cloudfla
   return writeOwnerJson2(path, request, "operator fleet request");
 }
 var validateMetalRequestValue = (value, options = {}) => {
-  const root = exactKeys3(value, ["kind", "target", "metalConfigFile", "genesis"], "operator metal request");
+  const root = exactKeys3(value, ["kind", "target", "metalConfigFile", "metalIdentityEvidenceFile", "genesis"], "operator metal request");
   if (root.kind !== "metal-remote")
     throw new Error("operator metal bootstrap kind must be metal-remote");
   const targetValue = exactKeys3(root.target, ["address", "port", "user", "hostKey", "hostKeySha256", "identityPublicKeyFile", "agentSocket"], "operator metal target");
@@ -6431,6 +6498,12 @@ var validateMetalRequestValue = (value, options = {}) => {
   if (typeof root.metalConfigFile !== "string")
     throw new Error("metalConfigFile must be an absolute path");
   canonicalOutputPath(root.metalConfigFile, "metalConfigFile");
+  if (root.metalIdentityEvidenceFile !== undefined && typeof root.metalIdentityEvidenceFile !== "string") {
+    throw new Error("metalIdentityEvidenceFile must be an absolute path");
+  }
+  if (typeof root.metalIdentityEvidenceFile === "string") {
+    canonicalOutputPath(root.metalIdentityEvidenceFile, "metalIdentityEvidenceFile");
+  }
   if (options.validateMetalConfig !== false)
     readMetalBootstrapConfig(root.metalConfigFile);
   const genesis = exactKeys3(root.genesis, ["nodes", "rehearsalNode", "sshPublicKeyFiles"], "operator metal genesis");
@@ -6479,6 +6552,7 @@ var validateMetalRequestValue = (value, options = {}) => {
   return {
     kind: "metal-remote",
     metalConfigFile: root.metalConfigFile,
+    ...typeof root.metalIdentityEvidenceFile === "string" ? { metalIdentityEvidenceFile: root.metalIdentityEvidenceFile } : {},
     target: {
       ...target,
       identityPublicKeyFile: targetValue.identityPublicKeyFile,
@@ -6499,6 +6573,25 @@ function writeOperatorMetalBootstrapRequest(path, request) {
   validateMetalRequestValue(request);
   return writeOwnerJson2(path, request, "operator metal request");
 }
+function readOperatorMetalIdentityEvidence(path, request) {
+  const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator metal identity evidence")));
+  const root = exactKeys3(value, ["format", "kind", "metalHostname", "metalHostKeySha256", "nodeKey", "publicKeys"], "operator metal identity evidence");
+  if (root.format !== 1 || root.kind !== "forgezero-operator-metal-identity" || typeof root.metalHostname !== "string" || typeof root.metalHostKeySha256 !== "string" || typeof root.nodeKey !== "string" || !root.publicKeys || typeof root.publicKeys !== "object") {
+    throw new Error("operator metal identity evidence is malformed");
+  }
+  const identity = parseMetalPublicIdentity(JSON.stringify({ nodeKey: root.nodeKey, publicKeys: root.publicKeys }));
+  const config = readMetalBootstrapConfig(request.metalConfigFile, { allowHistoricalRelease: true });
+  if (root.metalHostname !== config.metalHostname || root.metalHostKeySha256 !== request.target.hostKeySha256) {
+    throw new Error("operator metal identity evidence does not match the reviewed Metal target");
+  }
+  return {
+    format: 1,
+    kind: "forgezero-operator-metal-identity",
+    metalHostname: root.metalHostname,
+    metalHostKeySha256: root.metalHostKeySha256,
+    ...identity
+  };
+}
 var validateGuestHostKeyEvidenceValue = (value, request) => {
   const root = exactKeys3(value, ["format", "kind", "metalHostKeySha256", "nodes"], "operator guest host-key evidence");
   if (root.format !== 1 || root.kind !== "forgezero-operator-guest-host-keys" || typeof root.metalHostKeySha256 !== "string" || !Array.isArray(root.nodes)) {
@@ -7279,6 +7372,25 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       `${REMOTE_STAGE}/metal-config.json`,
       "--apply"
     ], "remote typed metal bootstrap");
+    if (request.metalIdentityEvidenceFile) {
+      let applied;
+      try {
+        applied = JSON.parse(output);
+      } catch {
+        throw new Error("remote Metal bootstrap did not return identity evidence");
+      }
+      const publicIdentity2 = applied?.publicIdentity;
+      if (typeof publicIdentity2 !== "string")
+        throw new Error("remote Metal bootstrap omitted its public identity");
+      const identity = parseMetalPublicIdentity(publicIdentity2);
+      writeOwnerJson2(request.metalIdentityEvidenceFile, {
+        format: 1,
+        kind: "forgezero-operator-metal-identity",
+        metalHostname: config.metalHostname,
+        metalHostKeySha256: request.target.hostKeySha256,
+        ...identity
+      }, "operator metal identity evidence");
+    }
     return { plan, output };
   } finally {
     if (knownHosts) {
@@ -7299,6 +7411,7 @@ export {
   redactOperatorSecretDiagnostic,
   readOperatorPlatformBootstrapRequest,
   readOperatorPlatformBootstrapFleetRequest,
+  readOperatorMetalIdentityEvidence,
   readOperatorMetalBootstrapRequest,
   readOperatorGuestHostKeyEvidence,
   planOperatorPlatformFleetBootstrap,

package/dist/platform-bootstrap-runtime.d.ts

@@ -19,6 +19,14 @@ export interface PlatformInitialInventoryCompute {
 }
 export interface PlatformInitialInventory {
     metalHostname: string;
+    /** Hybrid public identity proved by the pinned Metal bootstrap transport. */
+    metalIdentity?: {
+        nodeKey: string;
+        publicKeys: {
+            ed25519: string;
+            mlDsa: string;
+        };
+    };
     region: {
         key: string;
         label: string;
@@ -60,6 +68,16 @@ export type PlatformBootstrapEmail = {
     from: string;
     eu: boolean;
 };
+/**
+ * Public coordinates for one GitHub App. Its client secret, RSA private key and
+ * webhook secret are attended inputs sealed as systemd credentials and later
+ * imported into the unlocked platform Vault.
+ */
+export interface PlatformBootstrapGitHubApp {
+    clientId: string;
+    appId: string;
+    slug: string;
+}
 export interface PlatformSharedEnvironment {
     softwareProfile: PlatformSoftwareProfile;
     databaseRole: PlatformDatabaseRole;
@@ -91,6 +109,7 @@ export interface PlatformSharedEnvironment {
     otlpTraceSampleRatio: number;
     custodianEmail?: string;
     email?: PlatformBootstrapEmail;
+    githubApp?: PlatformBootstrapGitHubApp;
     backup?: {
         endpoint: string;
         region: string;
@@ -118,12 +137,13 @@ export declare function validatePlatformSharedEnvironment(input: PlatformSharedE
 /** Render only non-secret runtime coordinates. Passwords/tokens have no field in this contract. */
 export declare function renderPlatformSharedEnvironment(input: PlatformSharedEnvironment): string;
 export interface SystemdCredentialSpec {
-    name: 'arangodb-jwt' | 'seed-sync-root' | 'fz_smtp.password' | 'fz_jetemail.apiKey' | 'CF_API_TOKEN' | 'CF_TUNNEL_TOKEN' | 'REALTIME_PUBLISH_SECRET' | 'REALTIME_TICKET_SECRET';
+    name: 'arangodb-jwt' | 'seed-sync-root' | 'fz_smtp.password' | 'fz_jetemail.apiKey' | 'fz_github.clientSecret' | 'fz_github.privateKey' | 'fz_github.webhookSecret' | 'CF_API_TOKEN' | 'CF_TUNNEL_TOKEN' | 'REALTIME_PUBLISH_SECRET' | 'REALTIME_TICKET_SECRET';
     encryptedPath: string;
     required: boolean;
 }
 export declare function platformApiCredentialSpecs(options: {
     emailProvider?: PlatformBootstrapEmail['provider'];
+    githubApp: boolean;
     cloudflareKv: boolean;
     realtime: boolean;
 }): SystemdCredentialSpec[];

package/dist/platform-bootstrap-runtime.js

@@ -730,10 +730,16 @@ var httpsOrigin = (name, raw) => {
 };
 var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "metalIdentity", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
+  if (value.metalIdentity !== undefined) {
+    const identity = value.metalIdentity;
+    if (!identity || typeof identity !== "object" || Array.isArray(identity) || Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !identity.publicKeys || identity.publicKeys.ed25519 !== identity.nodeKey || !/^[A-Za-z0-9_-]{1,8192}$/.test(identity.publicKeys.mlDsa) || Object.keys(identity.publicKeys).some((key) => !["ed25519", "mlDsa"].includes(key))) {
+      throw new Error("initial platform Metal identity is invalid");
+    }
+  }
   if (value.region.city !== undefined)
     safeAtom("initialInventory.region.city", value.region.city);
   if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
@@ -768,6 +774,7 @@ function validatePlatformInitialInventory(value) {
   }
   return {
     metalHostname: value.metalHostname,
+    ...value.metalIdentity ? { metalIdentity: structuredClone(value.metalIdentity) } : {},
     region: { ...value.region },
     computes: value.computes.map((compute, index) => ({
       ...computes[index],
@@ -821,6 +828,11 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
+  if (input.githubApp) {
+    if (!/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubApp.clientId) || !/^[1-9][0-9]{0,19}$/.test(input.githubApp.appId) || !/^[a-z0-9][a-z0-9-]{0,99}$/.test(input.githubApp.slug)) {
+      throw new Error("GitHub App client id, app id or slug is malformed.");
+    }
+  }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
     throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
@@ -951,6 +963,9 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
+    FZ_GITHUB_CLIENT_ID: value.githubApp?.clientId ?? "",
+    FZ_GITHUB_APP_ID: value.githubApp?.appId ?? "",
+    FZ_GITHUB_APP_SLUG: value.githubApp?.slug ?? "",
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -962,6 +977,9 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
+    ["fz_github.clientSecret", options.githubApp],
+    ["fz_github.privateKey", options.githubApp],
+    ["fz_github.webhookSecret", options.githubApp],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],

package/dist/platform-fleet-verification.js

@@ -2908,7 +2908,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.102";
+var VERSION3 = "0.1.103";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -4142,10 +4142,16 @@ var httpsOrigin = (name, raw) => {
 };
 var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "metalIdentity", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
+  if (value.metalIdentity !== undefined) {
+    const identity = value.metalIdentity;
+    if (!identity || typeof identity !== "object" || Array.isArray(identity) || Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !identity.publicKeys || identity.publicKeys.ed25519 !== identity.nodeKey || !/^[A-Za-z0-9_-]{1,8192}$/.test(identity.publicKeys.mlDsa) || Object.keys(identity.publicKeys).some((key) => !["ed25519", "mlDsa"].includes(key))) {
+      throw new Error("initial platform Metal identity is invalid");
+    }
+  }
   if (value.region.city !== undefined)
     safeAtom("initialInventory.region.city", value.region.city);
   if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
@@ -4180,6 +4186,7 @@ function validatePlatformInitialInventory(value) {
   }
   return {
     metalHostname: value.metalHostname,
+    ...value.metalIdentity ? { metalIdentity: structuredClone(value.metalIdentity) } : {},
     region: { ...value.region },
     computes: value.computes.map((compute, index) => ({
       ...computes[index],
@@ -4233,6 +4240,11 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
+  if (input.githubApp) {
+    if (!/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubApp.clientId) || !/^[1-9][0-9]{0,19}$/.test(input.githubApp.appId) || !/^[a-z0-9][a-z0-9-]{0,99}$/.test(input.githubApp.slug)) {
+      throw new Error("GitHub App client id, app id or slug is malformed.");
+    }
+  }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
     throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
@@ -4363,6 +4375,9 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
+    FZ_GITHUB_CLIENT_ID: value.githubApp?.clientId ?? "",
+    FZ_GITHUB_APP_ID: value.githubApp?.appId ?? "",
+    FZ_GITHUB_APP_SLUG: value.githubApp?.slug ?? "",
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -4374,6 +4389,9 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
+    ["fz_github.clientSecret", options.githubApp],
+    ["fz_github.privateKey", options.githubApp],
+    ["fz_github.webhookSecret", options.githubApp],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
@@ -4727,7 +4745,7 @@ function planLocalOtlpProof(endpoint, collectorUnit) {
 import { lstatSync as lstatSync5 } from "node:fs";
 
 // src/bootstrap.ts
-import { createHash as createHash7, createHmac as createHmac2, randomBytes as randomBytes3 } from "node:crypto";
+import { createHash as createHash7, createHmac as createHmac2, createPrivateKey, randomBytes as randomBytes3 } from "node:crypto";
 import {
   chmodSync as chmodSync9,
   existsSync as existsSync11,

package/dist/platform-genesis-config.d.ts

@@ -15,4 +15,4 @@ export declare function platformGenesisBootstrapConfigs(template: PlatformBootst
     branch: 'dev' | 'main';
     revision: string;
     bundleSha256: string;
-}, attestation?: import('./platform-bootstrap-runtime').PlatformInitialInventory['attestation']): readonly PlatformBootstrapConfig[];
+}, attestation?: import('./platform-bootstrap-runtime').PlatformInitialInventory['attestation'], metalIdentity?: NonNullable<import('./platform-bootstrap-runtime').PlatformInitialInventory['metalIdentity']>): readonly PlatformBootstrapConfig[];

package/dist/platform-launch-profile.d.ts

@@ -45,6 +45,11 @@ export interface ForgeZeroLaunchOwnerInput {
         from: string;
         eu: boolean;
     };
+    githubApp?: {
+        clientId: string;
+        appId: string;
+        slug: string;
+    };
 }
 /**
  * ForgeZero's own genesis public coordinates. They are reviewed source data,

package/dist/provision.js

@@ -2908,7 +2908,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.102";
+var VERSION3 = "0.1.103";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.102";
+export declare const VERSION = "0.1.103";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.102",
+  "version": "0.1.103",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",