@forgezero/agent 0.1.11 → 0.1.12

package/dist/fz-agent.js

@@ -3,15 +3,258 @@
 
 // src/index.ts
 import { randomBytes } from "crypto";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync6, existsSync as existsSync9, mkdirSync as mkdirSync6, chmodSync as chmodSync8 } from "fs";
-import { dirname as dirname5, join as join4 } from "path";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync9, mkdirSync as mkdirSync5, chmodSync as chmodSync7 } from "fs";
+import { dirname as dirname4, join as join4 } from "path";
 import { deriveKeysFromSeed } from "@forgezero/runtime/identity";
 import { DEFAULT_SOCKET } from "@forgezero/vault";
 
 // src/socket.ts
 import { createServer } from "net";
 import { chmodSync, existsSync, unlinkSync } from "fs";
-import { signRequest } from "@forgezero/runtime/identity";
+import { signRequest as signRequest2 } from "@forgezero/runtime/identity";
+
+// src/cache.ts
+class CacheError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "CacheError";
+  }
+}
+var DEFAULT_TTL_MS = 60000;
+var DEFAULT_MAX_STALE_MS = 300000;
+function createSecretCache(options) {
+  const entries = new Map;
+  const now = options.now ?? (() => Date.now());
+  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+  const maxStaleMs = options.maxStaleMs ?? DEFAULT_MAX_STALE_MS;
+  let cursor = 0;
+  let replicated = false;
+  let lastSyncOkMs = now();
+  const loadScope = async () => {
+    if (!options.list)
+      return { loaded: 0, failed: [] };
+    const names = await options.list();
+    const failed = [];
+    let loaded = 0;
+    for (const name of names) {
+      try {
+        const result = await options.fetch(name);
+        entries.set(name, { value: result.value, version: result.version, fetchedAtMs: now() });
+        loaded += 1;
+      } catch {
+        failed.push(name);
+      }
+    }
+    replicated = true;
+    return { loaded, failed };
+  };
+  return {
+    names: () => [...entries.keys()],
+    get replica() {
+      return replicated;
+    },
+    load: loadScope,
+    get cursor() {
+      return cursor;
+    },
+    async get(name) {
+      const staleFor = now() - lastSyncOkMs;
+      if (staleFor > maxStaleMs) {
+        throw new CacheError("STALE", `Synchronisation has not succeeded for ${Math.round(staleFor / 1000)}s, so this ` + "cache can no longer vouch for what it holds. Refusing rather than serving a value " + "that may already be revoked.");
+      }
+      const cached = entries.get(name);
+      if (cached && now() - cached.fetchedAtMs < ttlMs)
+        return cached.value;
+      let fetched;
+      try {
+        fetched = await options.fetch(name);
+      } catch (cause) {
+        if (cached)
+          return cached.value;
+        throw new CacheError("FETCH_FAILED", cause instanceof Error ? cause.message : `Could not fetch ${name}.`);
+      }
+      entries.set(name, { ...fetched, fetchedAtMs: now() });
+      return fetched.value;
+    },
+    async sync() {
+      const result = await options.changes(cursor);
+      if (result.resync) {
+        const dropped = [...entries.keys()];
+        entries.clear();
+        cursor = 0;
+        lastSyncOkMs = now();
+        if (options.list)
+          await loadScope();
+        return { invalidated: dropped, cursor: 0, resync: true };
+      }
+      const invalidated = [];
+      for (const name of result.changed) {
+        if (entries.delete(name))
+          invalidated.push(name);
+      }
+      cursor = result.version;
+      lastSyncOkMs = now();
+      return { invalidated, cursor, resync: false };
+    },
+    clear() {
+      entries.clear();
+      cursor = 0;
+    },
+    staleForMs: () => now() - lastSyncOkMs
+  };
+}
+
+// src/signed-node-http.ts
+import {
+  encodeSignatureHeader,
+  generateResponseRecipient,
+  openResponse,
+  RESPONSE_KEY_HEADER,
+  signRequest
+} from "@forgezero/runtime/identity";
+
+class SignedNodeHttpError extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "SignedNodeHttpError";
+  }
+}
+async function postSignedNode(options, path, body, sealedResponse = false) {
+  const url = new URL(options.apiUrl);
+  url.pathname = `${url.pathname.replace(/\/$/, "")}/${path.replace(/^\//, "")}`.replace(/\/+/g, "/");
+  url.search = "";
+  url.hash = "";
+  const raw = JSON.stringify(body);
+  const recipient = sealedResponse ? generateResponseRecipient() : undefined;
+  const envelope = signRequest(options.keys, options.nodeKey, {
+    method: "POST",
+    path: url.pathname,
+    query: "",
+    body: raw,
+    responseKey: recipient?.publicKey
+  });
+  const signature = encodeSignatureHeader(envelope);
+  const response = await (options.fetch ?? globalThis.fetch)(url, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "x-fz-node": options.nodeKey,
+      "x-fz-signature": signature,
+      ...recipient ? { [RESPONSE_KEY_HEADER]: recipient.publicKey } : {}
+    },
+    body: raw,
+    signal: AbortSignal.timeout(options.requestTimeoutMs ?? 15000)
+  });
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) {
+    const failure = payload;
+    const reason = failure ? failure.error?.message ?? failure.message : undefined;
+    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`);
+  }
+  if (recipient) {
+    try {
+      return await openResponse(recipient.secretKey, signature, payload);
+    } catch {
+      throw new SignedNodeHttpError(502, "The node response was not sealed to this request.");
+    }
+  }
+  return payload;
+}
+
+// src/node-vault.ts
+var SCOPE_PART = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+function projectVaultCacheKey(coordinate) {
+  if (!SCOPE_PART.test(coordinate.environment) || !SCOPE_PART.test(coordinate.name)) {
+    throw new Error("node vault coordinate is malformed");
+  }
+  return JSON.stringify([coordinate.environment, coordinate.name]);
+}
+function projectVaultCoordinate(key) {
+  let value;
+  try {
+    value = JSON.parse(key);
+  } catch {
+    throw new Error("node vault cache key is malformed");
+  }
+  if (!Array.isArray(value) || value.length !== 2 || typeof value[0] !== "string" || typeof value[1] !== "string" || !SCOPE_PART.test(value[0]) || !SCOPE_PART.test(value[1]))
+    throw new Error("node vault cache key is malformed");
+  return { environment: value[0], name: value[1] };
+}
+function tenantNodeApiUrl(apiUrl, tenantSlug) {
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(tenantSlug))
+    throw new Error("tenant slug is malformed");
+  const url = new URL(apiUrl);
+  url.pathname = `/api/t/${encodeURIComponent(tenantSlug)}`;
+  url.search = "";
+  url.hash = "";
+  return url.toString().replace(/\/$/, "");
+}
+function createNodeVaultCache(options) {
+  const post = (operation, body) => postSignedNode(options, `v1/node/vault/${operation}`, body, true);
+  return createSecretCache({
+    ttlMs: options.ttlMs,
+    maxStaleMs: options.maxStaleMs,
+    list: async () => {
+      const payload = await post("list", {});
+      if (!Array.isArray(payload.entries) || payload.entries.some((entry) => !entry || typeof entry.environment !== "string" || typeof entry.name !== "string")) {
+        throw new Error("node vault list response is malformed");
+      }
+      return payload.entries.map(projectVaultCacheKey);
+    },
+    fetch: async (key) => {
+      const coordinate = projectVaultCoordinate(key);
+      const payload = await post("read", coordinate);
+      if (typeof payload.value !== "string" || !Number.isSafeInteger(payload.version)) {
+        throw new Error("node vault read response is malformed");
+      }
+      return { value: payload.value, version: payload.version };
+    },
+    changes: async (since) => {
+      const payload = await post("changes", { since });
+      if (!Number.isSafeInteger(payload.version) || !Array.isArray(payload.changed) || payload.changed.some((entry) => !entry || typeof entry.environment !== "string" || typeof entry.name !== "string"))
+        throw new Error("node vault changes response is malformed");
+      return {
+        version: payload.version,
+        changed: payload.changed.map(projectVaultCacheKey),
+        resync: payload.resync
+      };
+    }
+  });
+}
+function startNodeVaultSync(cache, options = {}) {
+  const interval = Math.max(1000, options.intervalMs ?? 30000);
+  const setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
+  const clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
+  let stopped = false;
+  let timer;
+  let active = null;
+  const schedule = () => {
+    if (!stopped)
+      timer = setTimer(tick, interval);
+  };
+  const tick = () => {
+    if (stopped || active)
+      return;
+    active = cache.sync().then((result) => options.onEvent?.("synced", result)).catch((cause) => options.onEvent?.("sync-failed", cause)).finally(() => {
+      active = null;
+      schedule();
+    });
+  };
+  schedule();
+  return {
+    async stop() {
+      stopped = true;
+      clearTimer(timer);
+      await active;
+    }
+  };
+}
+
+// src/socket.ts
 var MAX_LINE_BYTES = 64 * 1024;
 function handleRequest(options, request) {
   switch (request?.op) {
@@ -33,7 +276,7 @@ function handleRequest(options, request) {
       return Promise.resolve({
         ok: true,
         op: "sign",
-        envelope: signRequest(options.keys, options.nodeKey, {
+        envelope: signRequest2(options.keys, options.nodeKey, {
           method: request.method,
           path: request.path,
           query: request.query ?? "",
@@ -45,10 +288,16 @@ function handleRequest(options, request) {
       if (!options.cache) {
         return Promise.resolve(refuse("NO_CACHE", "This agent holds no secrets. It signs; it does not serve values."));
       }
-      if (typeof request.name !== "string" || !request.name) {
-        return Promise.resolve(refuse("BAD_REQUEST", "A read needs a name."));
+      if (typeof request.project !== "string" || request.project !== options.projectKey || typeof request.environment !== "string" || typeof request.name !== "string") {
+        return Promise.resolve(refuse("SCOPE_REFUSED", "This agent serves only its enrolled tenant project."));
       }
-      return options.cache.get(request.name).then((value) => ({ ok: true, op: "get", value })).catch((cause) => refuse(cause.code ?? "READ_FAILED", cause instanceof Error ? cause.message : "Could not read that value."));
+      let key;
+      try {
+        key = projectVaultCacheKey({ environment: request.environment, name: request.name });
+      } catch {
+        return Promise.resolve(refuse("BAD_REQUEST", "The vault coordinate is malformed."));
+      }
+      return options.cache.get(key).then((value) => ({ ok: true, op: "get", value })).catch((cause) => refuse(cause.code ?? "READ_FAILED", cause instanceof Error ? cause.message : "Could not read that value."));
     }
     case "sync": {
       if (!options.cache) {
@@ -65,10 +314,21 @@ function handleRequest(options, request) {
           staleForMs: 0
         });
       }
+      if (request.project !== options.projectKey) {
+        return Promise.resolve(refuse("SCOPE_REFUSED", "This agent serves only its enrolled tenant project."));
+      }
+      const names = options.cache.names().flatMap((key) => {
+        try {
+          const coordinate = projectVaultCoordinate(key);
+          return coordinate.environment === request.environment ? [coordinate.name] : [];
+        } catch {
+          return [];
+        }
+      });
       return Promise.resolve({
         ok: true,
         op: "held",
-        names: options.cache.names(),
+        names,
         staleForMs: options.cache.staleForMs()
       });
     }
@@ -121,7 +381,7 @@ function startAgent(options) {
     socket.on("error", () => socket.destroy());
   });
   server.listen(options.socketPath, () => {
-    chmodSync(options.socketPath, 384);
+    chmodSync(options.socketPath, 432);
   });
   return server;
 }
@@ -740,54 +1000,6 @@ function requestControl(request, socketPath = DEFAULT_CONTROL_SOCKET) {
   });
 }
 
-// src/signed-node-http.ts
-import { signRequest as signRequest2 } from "@forgezero/runtime/identity";
-
-class SignedNodeHttpError extends Error {
-  status;
-  constructor(status, message) {
-    super(message);
-    this.status = status;
-    this.name = "SignedNodeHttpError";
-  }
-}
-var signatureHeader = (envelope) => Buffer.from(JSON.stringify({
-  timestamp: envelope.timestamp,
-  nonce: envelope.nonce,
-  edSignature: envelope.edSignature,
-  mlDsaSignature: envelope.mlDsaSignature
-})).toString("base64url");
-async function postSignedNode(options, path, body) {
-  const url = new URL(options.apiUrl);
-  url.pathname = `${url.pathname.replace(/\/$/, "")}/${path.replace(/^\//, "")}`.replace(/\/+/g, "/");
-  url.search = "";
-  url.hash = "";
-  const raw = JSON.stringify(body);
-  const envelope = signRequest2(options.keys, options.nodeKey, {
-    method: "POST",
-    path: url.pathname,
-    query: "",
-    body: raw
-  });
-  const response = await (options.fetch ?? globalThis.fetch)(url, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      "x-fz-node": options.nodeKey,
-      "x-fz-signature": signatureHeader(envelope)
-    },
-    body: raw,
-    signal: AbortSignal.timeout(options.requestTimeoutMs ?? 15000)
-  });
-  const payload = await response.json().catch(() => null);
-  if (!response.ok) {
-    const failure = payload;
-    const reason = failure ? failure.error?.message ?? failure.message : undefined;
-    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`);
-  }
-  return payload;
-}
-
 // src/deployment-pull.ts
 class DeploymentClaimLostError extends Error {
   constructor(message) {
@@ -898,162 +1110,36 @@ async function pullDeploymentOnce(options) {
     detail: `Deployed ${result.revision}.`,
     release: result.release
   });
-  return { status: "deployed", claim, result };
-}
-function startDeploymentPull(options) {
-  const interval = Math.max(1000, options.intervalMs ?? 5000);
-  const setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
-  const clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
-  const emit = options.onEvent ?? (() => {});
-  const parallelism = Math.max(1, Math.min(options.parallelism ?? 4, 32));
-  let stopped = false;
-  const workers = Array.from({ length: parallelism }, () => ({ active: null }));
-  const schedule = (worker) => {
-    if (!stopped)
-      worker.timer = setTimer(() => tick(worker), interval);
-  };
-  const tick = (worker) => {
-    if (stopped || worker.active)
-      return;
-    worker.active = pullDeploymentOnce(options).then((result) => emit(result.status, result)).catch((cause) => emit("poll-failed", cause)).finally(() => {
-      worker.active = null;
-      schedule(worker);
-    });
-  };
-  for (const worker of workers)
-    tick(worker);
-  return {
-    async stop() {
-      stopped = true;
-      for (const worker of workers)
-        clearTimer(worker.timer);
-      await Promise.all(workers.map((worker) => worker.active));
-    },
-    get active() {
-      return !stopped;
-    }
-  };
-}
-
-// src/deployment-watch.ts
-import {
-  chmodSync as chmodSync4,
-  closeSync,
-  fsyncSync,
-  mkdirSync as mkdirSync2,
-  openSync,
-  readFileSync as readFileSync2,
-  renameSync as renameSync2,
-  unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { dirname as dirname2 } from "path";
-var validState = (value) => {
-  const state = value;
-  return Boolean(state && /^[a-f0-9]{40}$/i.test(state.revision ?? "") && ["pending", "running", "deployed", "failed"].includes(state.outcome ?? "") && Number.isFinite(state.updatedAtTs));
-};
-function readStaticDeploymentState(path) {
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return validState(parsed) ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-function writeStaticDeploymentState(path, state) {
-  const directory = dirname2(path);
-  mkdirSync2(directory, { recursive: true, mode: 448 });
-  const temporary = `${path}.new-${process.pid}`;
-  let file;
-  try {
-    file = openSync(temporary, "w", 384);
-    writeFileSync2(file, `${JSON.stringify(state)}
-`);
-    fsyncSync(file);
-    closeSync(file);
-    file = undefined;
-    chmodSync4(temporary, 384);
-    renameSync2(temporary, path);
-    const parent = openSync(directory, "r");
-    try {
-      fsyncSync(parent);
-    } finally {
-      closeSync(parent);
-    }
-  } catch (cause) {
-    if (file !== undefined)
-      closeSync(file);
-    try {
-      unlinkSync3(temporary);
-    } catch {}
-    throw cause;
-  }
+  return { status: "deployed", claim, result };
 }
-function startStaticDeploymentWatch(options) {
-  const interval = Math.max(1000, options.intervalMs ?? 15000);
+function startDeploymentPull(options) {
+  const interval = Math.max(1000, options.intervalMs ?? 5000);
   const setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
   const clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
-  const now = options.now ?? Date.now;
-  const readState = options.readState ?? (() => readStaticDeploymentState(options.statePath));
-  const writeState = options.writeState ?? ((state) => writeStaticDeploymentState(options.statePath, state));
-  const emit = options.onEvent ?? (() => {
-    return;
-  });
+  const emit = options.onEvent ?? (() => {});
+  const parallelism = Math.max(1, Math.min(options.parallelism ?? 4, 32));
   let stopped = false;
-  let timer;
-  let inFlight = null;
-  const persist = (revision, outcome, detail) => {
-    writeState({ revision, outcome, updatedAtTs: now(), ...detail ? { detail: detail.slice(0, 2000) } : {} });
-  };
-  const schedule = () => {
+  const workers = Array.from({ length: parallelism }, () => ({ active: null }));
+  const schedule = (worker) => {
     if (!stopped)
-      timer = setTimer(tick, interval);
-  };
-  const run = async () => {
-    const prior = readState();
-    const revision = prior && (prior.outcome === "pending" || prior.outcome === "running") ? prior.revision : await options.manager.latestRevision();
-    const current = options.currentRevision?.();
-    if (prior?.outcome === "deployed" && prior.revision === revision) {
-      emit("unchanged", { revision });
-      return;
-    }
-    if (prior?.outcome === "failed" && prior.revision === revision) {
-      emit("failed-unchanged", { revision, detail: prior.detail });
-      return;
-    }
-    if (!prior && current === revision) {
-      persist(revision, "deployed", "Adopted the already active bootstrap release.");
-      emit("adopted", { revision });
-      return;
-    }
-    persist(revision, "pending", "Observed at the configured branch head.");
-    persist(revision, "running", "Submitted to the keyed deployment queue.");
-    let result;
-    try {
-      result = await options.manager.deploy({ revision, coordinator: options.coordinator }).result;
-    } catch (cause) {
-      const detail = cause instanceof Error ? cause.message : String(cause);
-      persist(revision, "failed", detail);
-      emit("failed", { revision, detail });
-      return;
-    }
-    persist(revision, "deployed", `Activated ${result.release}.`);
-    emit("deployed", { revision, release: result.release });
+      worker.timer = setTimer(() => tick(worker), interval);
   };
-  function tick() {
-    if (stopped || inFlight)
+  const tick = (worker) => {
+    if (stopped || worker.active)
       return;
-    inFlight = run().catch((cause) => emit("poll-failed", cause)).finally(() => {
-      inFlight = null;
-      schedule();
+    worker.active = pullDeploymentOnce(options).then((result) => emit(result.status, result)).catch((cause) => emit("poll-failed", cause)).finally(() => {
+      worker.active = null;
+      schedule(worker);
     });
-  }
-  tick();
+  };
+  for (const worker of workers)
+    tick(worker);
   return {
     async stop() {
       stopped = true;
-      clearTimer(timer);
-      await inFlight;
+      for (const worker of workers)
+        clearTimer(worker.timer);
+      await Promise.all(workers.map((worker) => worker.active));
     },
     get active() {
       return !stopped;
@@ -1063,21 +1149,21 @@ function startStaticDeploymentWatch(options) {
 
 // src/guest-enrolment.ts
 import {
-  chmodSync as chmodSync5,
+  chmodSync as chmodSync4,
   existsSync as existsSync4,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync3,
-  renameSync as renameSync3,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
   statSync,
-  unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync3
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync2
 } from "fs";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname2 } from "path";
 var validBinding = (value, expectedNodeKey) => {
   if (!value || typeof value !== "object")
     return false;
   const row = value;
-  return ["nodeKey", "computeReference", "projectKey", "environmentKey", "tenantSlug"].every((key) => typeof row[key] === "string" && row[key].length > 0) && (!expectedNodeKey || row.nodeKey === expectedNodeKey);
+  return ["nodeKey", "computeReference", "projectKey", "environmentKey"].every((key) => typeof row[key] === "string" && row[key].length > 0) && (row.realm === "platform" || row.realm === "tenant" && typeof row.tenantSlug === "string" && row.tenantSlug.length > 0) && (!expectedNodeKey || row.nodeKey === expectedNodeKey);
 };
 function loadGuestBinding(path, expectedNodeKey) {
   if (!existsSync4(path))
@@ -1088,7 +1174,7 @@ function loadGuestBinding(path, expectedNodeKey) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync3(path, "utf8"));
+    parsed = JSON.parse(readFileSync2(path, "utf8"));
   } catch {
     throw new Error(`guest enrolment state at ${path} is malformed`);
   }
@@ -1098,213 +1184,51 @@ function loadGuestBinding(path, expectedNodeKey) {
   return parsed;
 }
 function persistGuestBinding(path, binding) {
-  mkdirSync3(dirname3(path), { recursive: true, mode: 448 });
+  mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
   const temporary = `${path}.next`;
-  writeFileSync3(temporary, `${JSON.stringify(binding)}
+  writeFileSync2(temporary, `${JSON.stringify(binding)}
 `, { mode: 384 });
-  chmodSync5(temporary, 384);
-  renameSync3(temporary, path);
+  chmodSync4(temporary, 384);
+  renameSync2(temporary, path);
 }
 async function enrolGuestIdentity(options) {
-  const token = options.token?.trim() ?? (options.tokenPath ? readFileSync3(options.tokenPath, "utf8").trim() : "");
+  const token = options.token?.trim() ?? (options.tokenPath ? readFileSync2(options.tokenPath, "utf8").trim() : "");
   if (!token.startsWith("fze_"))
     throw new Error("guest enrolment credential is malformed");
-  const url = new URL(options.apiUrl);
-  url.pathname = `${url.pathname.replace(/\/$/, "")}/v1/compute/enrol`.replace(/\/+/g, "/");
-  url.search = "";
-  url.hash = "";
-  const response = await (options.fetch ?? globalThis.fetch)(url, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      token,
-      label: options.label,
-      gitDeployPublicKey: options.gitDeployPublicKey,
-      publicKeys: {
-        ed25519: options.keys.ed25519.publicKey,
-        mlDsa: options.keys.mlDsa.publicKey
-      }
-    }),
-    signal: AbortSignal.timeout(options.requestTimeoutMs ?? 15000)
-  });
-  const payload = await response.json().catch(() => null);
-  if (!response.ok || !payload?.ok || payload.nodeKey !== options.nodeKey || !payload.computeReference || !payload.projectKey || !payload.environmentKey || !payload.tenantSlug) {
-    throw new Error(payload?.error?.message || `guest enrolment returned HTTP ${response.status}`);
+  const payload = await postSignedNode({
+    apiUrl: options.apiUrl,
+    nodeKey: options.nodeKey,
+    keys: options.keys,
+    fetch: options.fetch,
+    requestTimeoutMs: options.requestTimeoutMs
+  }, "v1/compute/enrol", {
+    token,
+    label: options.label,
+    gitDeployPublicKey: options.gitDeployPublicKey,
+    publicKeys: {
+      ed25519: options.keys.ed25519.publicKey,
+      mlDsa: options.keys.mlDsa.publicKey
+    }
+  }, true);
+  if (!payload?.ok || payload.nodeKey !== options.nodeKey || !payload.computeReference || !payload.projectKey || !payload.environmentKey || payload.realm !== "platform" && (payload.realm !== "tenant" || !payload.tenantSlug)) {
+    throw new Error(payload?.error?.message || "guest enrolment response was not accepted");
   }
   const binding = {
     nodeKey: payload.nodeKey,
     computeReference: payload.computeReference,
     projectKey: payload.projectKey,
     environmentKey: payload.environmentKey,
-    tenantSlug: payload.tenantSlug
+    realm: payload.realm,
+    ...payload.tenantSlug ? { tenantSlug: payload.tenantSlug } : {}
   };
   persistGuestBinding(options.statePath, binding);
   if (options.consume)
     await options.consume();
   else if (options.tokenPath)
-    unlinkSync4(options.tokenPath);
+    unlinkSync3(options.tokenPath);
   return binding;
 }
 
-// src/cache.ts
-class CacheError extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "CacheError";
-  }
-}
-var DEFAULT_TTL_MS = 60000;
-var DEFAULT_MAX_STALE_MS = 300000;
-function createSecretCache(options) {
-  const entries = new Map;
-  const now = options.now ?? (() => Date.now());
-  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
-  const maxStaleMs = options.maxStaleMs ?? DEFAULT_MAX_STALE_MS;
-  let cursor = 0;
-  let replicated = false;
-  let lastSyncOkMs = now();
-  const loadScope = async () => {
-    if (!options.list)
-      return { loaded: 0, failed: [] };
-    const names = await options.list();
-    const failed = [];
-    let loaded = 0;
-    for (const name of names) {
-      try {
-        const result = await options.fetch(name);
-        entries.set(name, { value: result.value, version: result.version, fetchedAtMs: now() });
-        loaded += 1;
-      } catch {
-        failed.push(name);
-      }
-    }
-    replicated = true;
-    return { loaded, failed };
-  };
-  return {
-    names: () => [...entries.keys()],
-    get replica() {
-      return replicated;
-    },
-    load: loadScope,
-    get cursor() {
-      return cursor;
-    },
-    async get(name) {
-      const staleFor = now() - lastSyncOkMs;
-      if (staleFor > maxStaleMs) {
-        throw new CacheError("STALE", `Synchronisation has not succeeded for ${Math.round(staleFor / 1000)}s, so this ` + "cache can no longer vouch for what it holds. Refusing rather than serving a value " + "that may already be revoked.");
-      }
-      const cached = entries.get(name);
-      if (cached && now() - cached.fetchedAtMs < ttlMs)
-        return cached.value;
-      let fetched;
-      try {
-        fetched = await options.fetch(name);
-      } catch (cause) {
-        if (cached)
-          return cached.value;
-        throw new CacheError("FETCH_FAILED", cause instanceof Error ? cause.message : `Could not fetch ${name}.`);
-      }
-      entries.set(name, { ...fetched, fetchedAtMs: now() });
-      return fetched.value;
-    },
-    async sync() {
-      const result = await options.changes(cursor);
-      if (result.resync) {
-        const dropped = [...entries.keys()];
-        entries.clear();
-        cursor = 0;
-        lastSyncOkMs = now();
-        if (options.list)
-          await loadScope();
-        return { invalidated: dropped, cursor: 0, resync: true };
-      }
-      const invalidated = [];
-      for (const name of result.changed) {
-        if (entries.delete(name))
-          invalidated.push(name);
-      }
-      cursor = result.version;
-      lastSyncOkMs = now();
-      return { invalidated, cursor, resync: false };
-    },
-    clear() {
-      entries.clear();
-      cursor = 0;
-    },
-    staleForMs: () => now() - lastSyncOkMs
-  };
-}
-
-// src/node-vault.ts
-function tenantNodeApiUrl(apiUrl, tenantSlug) {
-  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(tenantSlug))
-    throw new Error("tenant slug is malformed");
-  const url = new URL(apiUrl);
-  url.pathname = `/api/t/${encodeURIComponent(tenantSlug)}`;
-  url.search = "";
-  url.hash = "";
-  return url.toString().replace(/\/$/, "");
-}
-function createNodeVaultCache(options) {
-  const post = (operation, body) => postSignedNode(options, `v1/node/vault/${operation}`, body);
-  return createSecretCache({
-    ttlMs: options.ttlMs,
-    maxStaleMs: options.maxStaleMs,
-    list: async () => {
-      const payload = await post("list", {});
-      if (!Array.isArray(payload.names) || payload.names.some((name) => typeof name !== "string")) {
-        throw new Error("node vault list response is malformed");
-      }
-      return payload.names;
-    },
-    fetch: async (name) => {
-      const payload = await post("read", { name });
-      if (typeof payload.value !== "string" || !Number.isSafeInteger(payload.version)) {
-        throw new Error("node vault read response is malformed");
-      }
-      return { value: payload.value, version: payload.version };
-    },
-    changes: async (since) => {
-      const payload = await post("changes", { since });
-      if (!Number.isSafeInteger(payload.version) || !Array.isArray(payload.changed) || payload.changed.some((name) => typeof name !== "string"))
-        throw new Error("node vault changes response is malformed");
-      return { version: payload.version, changed: payload.changed, resync: payload.resync };
-    }
-  });
-}
-function startNodeVaultSync(cache, options = {}) {
-  const interval = Math.max(1000, options.intervalMs ?? 30000);
-  const setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
-  const clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
-  let stopped = false;
-  let timer;
-  let active = null;
-  const schedule = () => {
-    if (!stopped)
-      timer = setTimer(tick, interval);
-  };
-  const tick = () => {
-    if (stopped || active)
-      return;
-    active = cache.sync().then((result) => options.onEvent?.("synced", result)).catch((cause) => options.onEvent?.("sync-failed", cause)).finally(() => {
-      active = null;
-      schedule();
-    });
-  };
-  schedule();
-  return {
-    async stop() {
-      stopped = true;
-      clearTimer(timer);
-      await active;
-    }
-  };
-}
-
 // src/provisioning-pull.ts
 class ProvisionClaimLostError extends Error {
 }
@@ -1451,21 +1375,22 @@ function startProvisioningPull(options) {
 }
 
 // src/metal-helper-socket.ts
-import { chmodSync as chmodSync6, existsSync as existsSync6, unlinkSync as unlinkSync6 } from "fs";
+import { chmodSync as chmodSync5, existsSync as existsSync6, unlinkSync as unlinkSync5 } from "fs";
 import { connect as connect2, createServer as createServer3 } from "net";
 
 // src/metal-provision.ts
 import { createHash } from "crypto";
 import {
   existsSync as existsSync5,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync4,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
   readdirSync,
+  rmSync,
   statSync as statSync2,
-  unlinkSync as unlinkSync5,
-  writeFileSync as writeFileSync4
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname4, isAbsolute, join as join2 } from "path";
+import { dirname as dirname3, isAbsolute, join as join2 } from "path";
 
 // src/compute.ts
 class ComputeError extends Error {
@@ -1568,6 +1493,7 @@ function shapeEgressUnitDirectives(tap, guaranteedMbps, burstMbps) {
 // src/provision.ts
 var DEPLOYMENT_RUNNER_USER = "forgezero-runner";
 var DEPLOYMENT_GROUP = "forgezero-deploy";
+var VAULT_GROUP = "forgezero-vault";
 var DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
 function deploymentRunnerSocketUnit(agentUser) {
   return `[Unit]
@@ -1622,6 +1548,21 @@ WantedBy=multi-user.target
 `;
 }
 
+// src/ubuntu.ts
+var SUPPORTED_GUEST_IMAGE = Object.freeze({
+  key: "ubuntu-resolute-20260731",
+  family: "ubuntu-26.04",
+  version: "2026-07-31",
+  label: "Ubuntu 26.04 LTS Resolute",
+  url: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
+  sha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05"
+});
+function assertSupportedGuestImage(imageKey) {
+  if (imageKey !== SUPPORTED_GUEST_IMAGE.key) {
+    throw new Error(`unsupported guest image ${imageKey}; ForgeZero currently supports only ${SUPPORTED_GUEST_IMAGE.key}`);
+  }
+}
+
 // src/metal-provision.ts
 var SAFE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/;
 var DEVICE = /^[a-zA-Z][a-zA-Z0-9_.-]{0,14}$/;
@@ -1672,6 +1613,10 @@ function validateMetalProfile(profile) {
       throw new MetalProvisionError("metal paths must be absolute");
   }
   new URL(profile.apiUrl);
+  const imageKeys = Object.keys(profile.images);
+  if (imageKeys.length !== 1 || imageKeys[0] !== SUPPORTED_GUEST_IMAGE.key || profile.images[SUPPORTED_GUEST_IMAGE.key]?.sha256 !== SUPPORTED_GUEST_IMAGE.sha256) {
+    throw new MetalProvisionError(`metal profile must contain only the pinned ${SUPPORTED_GUEST_IMAGE.key} image contract`);
+  }
   if (!Array.isArray(profile.cpuPools) || profile.cpuPools.length === 0) {
     throw new MetalProvisionError("at least one exclusive CPU pool is required");
   }
@@ -1720,7 +1665,7 @@ function validateMetalProfile(profile) {
 var readManifests = (stateDir) => {
   if (!existsSync5(stateDir))
     return [];
-  return readdirSync(stateDir).filter((name) => name.endsWith(".json")).map((name) => JSON.parse(readFileSync4(join2(stateDir, name), "utf8")));
+  return readdirSync(stateDir).filter((name) => name.endsWith(".json")).map((name) => JSON.parse(readFileSync3(join2(stateDir, name), "utf8")));
 };
 function allocateAddress(profile, computeKey, rows) {
   const existing = rows.find((row) => row.computeKey === computeKey);
@@ -1737,6 +1682,21 @@ function allocateAddress(profile, computeKey, rows) {
   }
   throw new MetalProvisionError("guest address range is full");
 }
+function requestedAddress(profile, claim, rows) {
+  if (!claim.spec.guestAddress)
+    return allocateAddress(profile, claim.computeKey, rows);
+  if (!claim.spec.guestAddress.startsWith(`${profile.subnetPrefix}.`)) {
+    throw new MetalProvisionError("requested guest address is outside the metal profile");
+  }
+  const last = Number(claim.spec.guestAddress.slice(profile.subnetPrefix.length + 1));
+  if (!Number.isInteger(last) || last < profile.addressStart || last > profile.addressEnd) {
+    throw new MetalProvisionError("requested guest address is outside the allocatable range");
+  }
+  const occupied = rows.find((row) => row.address === claim.spec.guestAddress && row.computeKey !== claim.computeKey);
+  if (occupied)
+    throw new MetalProvisionError("requested guest address is already allocated");
+  return claim.spec.guestAddress;
+}
 function allocateCpuPool(profile, claim, rows) {
   const prior = rows.find((row) => row.computeKey === claim.computeKey);
   if (prior) {
@@ -1747,6 +1707,15 @@ function allocateCpuPool(profile, claim, rows) {
     return retained;
   }
   const used = new Set(rows.map((row) => row.cpuPoolKey));
+  if (claim.spec.cpuPoolKey) {
+    const requested = profile.cpuPools.find((pool) => pool.key === claim.spec.cpuPoolKey);
+    if (!requested || used.has(requested.key)) {
+      throw new MetalProvisionError("requested CPU pool is unavailable");
+    }
+    if (requested.physicalCores < claim.spec.physicalCores || membersOfLinuxList(requested.cpus, "CPU").length < claim.spec.vcpu)
+      throw new MetalProvisionError("requested CPU pool cannot satisfy this guest");
+    return requested;
+  }
   const candidates = profile.cpuPools.filter((pool) => !used.has(pool.key) && pool.physicalCores >= claim.spec.physicalCores && membersOfLinuxList(pool.cpus, "CPU").length >= claim.spec.vcpu).sort((left, right) => left.physicalCores - right.physicalCores || membersOfLinuxList(left.cpus, "CPU").length - membersOfLinuxList(right.cpus, "CPU").length || left.key.localeCompare(right.key));
   const selected = candidates[0];
   if (!selected)
@@ -1759,7 +1728,7 @@ var yamlFile = (path, content, permissions) => `  - path: ${JSON.stringify(path)
     encoding: b64
     content: ${base64(content)}
 `;
-function guestBootstrapScript(profile, attested = Boolean(profile.confidential)) {
+function guestBootstrapScript(profile, attested = Boolean(profile.confidential), hasEnrolment = true) {
   const agentBun = "/usr/local/lib/forgezero/bun";
   const attestationSetup = attested ? `# The report device is not part of the encryption path, so a guest can appear
 # healthy and encrypted while attestation is silently impossible. Install and
@@ -1772,7 +1741,9 @@ test -c /dev/sev-guest
 ` : "";
   return `#!/usr/bin/env bash
 set -Eeuo pipefail
-${attestationSetup}useradd --system --no-create-home --shell /usr/sbin/nologin forgezero-agent 2>/dev/null || true
+${attestationSetup}groupadd --system ${VAULT_GROUP} 2>/dev/null || true
+useradd --system --no-create-home --shell /usr/sbin/nologin forgezero-agent 2>/dev/null || true
+usermod -g ${VAULT_GROUP} forgezero-agent
 groupadd --system ${DEPLOYMENT_GROUP} 2>/dev/null || true
 useradd --system --no-create-home --shell /usr/sbin/nologin --gid ${DEPLOYMENT_GROUP} ${DEPLOYMENT_RUNNER_USER} 2>/dev/null || true
 usermod -a -G ${DEPLOYMENT_GROUP} forgezero-agent
@@ -1783,13 +1754,13 @@ install -d -o root -g root -m 0755 /opt/forgezero
 install -d -o root -g ${DEPLOYMENT_GROUP} -m 3770 /opt/forgezero/releases
 install -d -o forgezero-agent -g forgezero-agent -m 0700 /opt/forgezero/cache /opt/forgezero/home
 install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0700 /opt/forgezero/runner-home /opt/forgezero/runner-home/cache
-if [[ -s /run/forgezero-enrol-token ]]; then
+${hasEnrolment ? `if [[ -s /run/forgezero-enrol-token ]]; then
   systemd-creds encrypt --name=enrol-token /run/forgezero-enrol-token /var/lib/forgezero/enrol-token.cred
   rm -f /run/forgezero-enrol-token
 fi
 chown root:root /var/lib/forgezero/enrol-token.cred
 chmod 0400 /var/lib/forgezero/enrol-token.cred
-if [[ ! -x /usr/local/bin/bun ]]; then
+` : ""}if [[ ! -x /usr/local/bin/bun ]]; then
   curl -fsSL https://bun.sh/install -o /run/fz-bun-install
   printf '%s  %s
 ' '${profile.bunInstallerSha256}' /run/fz-bun-install | sha256sum -c -
@@ -1828,8 +1799,8 @@ systemctl daemon-reload
 systemctl enable --now forgezero-deploy-runner.socket forgezero-deploy-runner.service forgezero-agent.service
 `;
 }
-function guestAgentUnit(profile, name, attested = Boolean(profile.confidential)) {
-  const attestationPrepare = attested ? `ExecStartPre=+/bin/chgrp forgezero-agent /dev/sev-guest
+function guestAgentUnit(profile, name, attested = Boolean(profile.confidential), pull = true) {
+  const attestationPrepare = attested ? `ExecStartPre=+/bin/chgrp ${VAULT_GROUP} /dev/sev-guest
 ExecStartPre=+/bin/chmod 0640 /dev/sev-guest
 ` : "";
   const attestationDevice = attested ? `DevicePolicy=closed
@@ -1844,7 +1815,7 @@ Requires=forgezero-deploy-runner.service
 [Service]
 Type=simple
 User=forgezero-agent
-Group=forgezero-agent
+Group=${VAULT_GROUP}
 SupplementaryGroups=${DEPLOYMENT_GROUP}
 LoadCredentialEncrypted=agent-seed:/etc/forgezero/creds/agent-seed.cred
 LoadCredentialEncrypted=git-deploy-key:/etc/forgezero/creds/git-deploy-key.cred
@@ -1855,15 +1826,15 @@ Environment=FZ_ENROL_STATE_FILE=/var/lib/forgezero/enrolment.json
 Environment=FZ_NODE_LABEL=${name}
 Environment=FZ_SOCKET_PATH=/run/forgezero/vault.sock
 Environment=FZ_DEPLOY_ROOT=/opt/forgezero
-Environment=FZ_DEPLOY_PULL=true
+Environment=FZ_DEPLOY_PULL=${pull ? "true" : "false"}
 Environment=FZ_DEPLOY_RUNNER_SOCKET=${DEPLOYMENT_RUNNER_SOCKET}
 Environment=HOME=/opt/forgezero/home
 ${attestationPrepare}ExecStart=/usr/local/bin/fz-agent
 Restart=on-failure
 RestartSec=5
 RuntimeDirectory=forgezero
-RuntimeDirectoryMode=0710
-UMask=0077
+RuntimeDirectoryMode=0750
+UMask=0007
 LimitCORE=0
 NoNewPrivileges=true
 PrivateTmp=true
@@ -1913,24 +1884,39 @@ WantedBy=multi-user.target
 `;
 }
 function cloudInit(profile, claim, manifest) {
-  const bootstrap = guestBootstrapScript(profile, claim.spec.confidential);
-  const agentUnit = guestAgentUnit(profile, manifest.name, claim.spec.confidential);
+  const enrolled = Boolean(claim.enrolment);
+  const bootstrap = guestBootstrapScript(profile, claim.spec.confidential, enrolled);
+  const agentUnit = guestAgentUnit(profile, manifest.name, claim.spec.confidential, enrolled);
   const enrolmentDropIn = guestEnrolmentDropIn();
   const cleanupScript = guestEnrolmentCleanupScript();
   const cleanupUnit = guestEnrolmentCleanupUnit();
   const runnerSocketUnit = deploymentRunnerSocketUnit("forgezero-agent");
   const runnerUnit = deploymentRunnerUnit({ binPath: "/usr/local/bin/fz-agent", deployRoot: "/opt/forgezero" });
+  const access = claim.access;
+  const users = access ? `users:
+  - default
+  - name: ${access.sshUser}
+    groups: [sudo]
+    shell: /bin/bash
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    ssh_authorized_keys:
+${access.sshPublicKeys.map((key) => `      - ${JSON.stringify(key)}`).join(`
+`)}
+` : "";
+  const enrolmentFiles = enrolled ? `${yamlFile("/run/forgezero-enrol-token", `${claim.enrolment.token}
+`, "0600")}${yamlFile("/usr/local/sbin/forgezero-enrolment-cleanup", cleanupScript, "0700")}${yamlFile("/etc/systemd/system/forgezero-agent.service.d/enrolment.conf", enrolmentDropIn, "0644")}${yamlFile("/etc/systemd/system/forgezero-enrolment-cleanup.service", cleanupUnit, "0644")}` : "";
   return {
     userData: `#cloud-config
 package_update: true
+${users}disable_root: true
 # Git is part of the deployment transport, not a tenant-selected prerequisite:
 # every dynamically claimed repository must be cloneable on a clean image.
 packages: [curl, ca-certificates, openssl, openssh-client, git${claim.spec.confidential ? ", python3" : ""}]
 write_files:
-${yamlFile("/run/forgezero-enrol-token", `${claim.enrolment.token}
-`, "0600")}${yamlFile("/usr/local/sbin/forgezero-guest-bootstrap", bootstrap, "0700")}${yamlFile("/usr/local/sbin/forgezero-enrolment-cleanup", cleanupScript, "0700")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.socket", runnerSocketUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.service", runnerUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-agent.service", agentUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-agent.service.d/enrolment.conf", enrolmentDropIn, "0644")}${yamlFile("/etc/systemd/system/forgezero-enrolment-cleanup.service", cleanupUnit, "0644")}runcmd:
+${enrolmentFiles}${yamlFile("/usr/local/sbin/forgezero-guest-bootstrap", bootstrap, "0700")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.socket", runnerSocketUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.service", runnerUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-agent.service", agentUnit, "0644")}runcmd:
   - [ bash, /usr/local/sbin/forgezero-guest-bootstrap ]
-  - [ systemctl, enable, --now, forgezero-enrolment-cleanup.service ]
+${enrolled ? `  - [ systemctl, enable, --now, forgezero-enrolment-cleanup.service ]
+` : ""}
 `,
     metaData: `instance-id: ${manifest.name}-${claim.attempt}
 local-hostname: ${manifest.name}
@@ -1954,7 +1940,8 @@ var checked = async (exec, argv) => {
 };
 async function provisionMetalGuest(profile, claim, exec) {
   validateMetalProfile(profile);
-  if (!claim.computeKey || !claim.spec.reference || !SAFE_NAME.test(claim.spec.imageKey) || !Number.isInteger(claim.spec.physicalCores) || claim.spec.physicalCores < 1 || claim.spec.physicalCores > 256 || !Number.isInteger(claim.spec.vcpu) || claim.spec.vcpu < 1 || claim.spec.vcpu > 512 || !Number.isInteger(claim.spec.memoryGib) || claim.spec.memoryGib < 1 || claim.spec.memoryGib > 8192 || !Number.isInteger(claim.spec.diskGib) || claim.spec.diskGib < 8 || claim.spec.diskGib > 65536 || !Number.isInteger(claim.spec.egressGuaranteedMbps) || claim.spec.egressGuaranteedMbps < 0 || !Number.isInteger(claim.spec.egressBurstMbps) || claim.spec.egressBurstMbps < claim.spec.egressGuaranteedMbps)
+  assertSupportedGuestImage(claim.spec.imageKey);
+  if (!claim.computeKey || !claim.spec.reference || !SAFE_NAME.test(claim.spec.imageKey) || claim.spec.guestName !== undefined && !SAFE_NAME.test(claim.spec.guestName) || claim.spec.cpuPoolKey !== undefined && !SAFE_NAME.test(claim.spec.cpuPoolKey) || !Number.isInteger(claim.spec.physicalCores) || claim.spec.physicalCores < 1 || claim.spec.physicalCores > 256 || !Number.isInteger(claim.spec.vcpu) || claim.spec.vcpu < 1 || claim.spec.vcpu > 512 || !Number.isInteger(claim.spec.memoryGib) || claim.spec.memoryGib < 1 || claim.spec.memoryGib > 8192 || !Number.isInteger(claim.spec.diskGib) || claim.spec.diskGib < 8 || claim.spec.diskGib > 65536 || !Number.isInteger(claim.spec.egressGuaranteedMbps) || claim.spec.egressGuaranteedMbps < 0 || !Number.isInteger(claim.spec.egressBurstMbps) || claim.spec.egressBurstMbps < claim.spec.egressGuaranteedMbps)
     throw new MetalProvisionError("invalid compute claim");
   const image = profile.images[claim.spec.imageKey];
   if (!image || !isAbsolute(image.path) || !SHA256.test(image.sha256)) {
@@ -1966,14 +1953,24 @@ async function provisionMetalGuest(profile, claim, exec) {
   if (digest !== image.sha256)
     throw new MetalProvisionError("configured image checksum mismatch");
   for (const path of [profile.stateDir, profile.seedDir, profile.unitDir])
-    mkdirSync4(path, { recursive: true, mode: 448 });
+    mkdirSync3(path, { recursive: true, mode: 448 });
   const manifests = readManifests(profile.stateDir);
-  const name = guestNameFor(claim.computeKey);
+  if (claim.access) {
+    if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(claim.access.sshUser)) {
+      throw new MetalProvisionError("invalid SSH user");
+    }
+    if (claim.access.sshPublicKeys.length < 1 || claim.access.sshPublicKeys.length > 16 || claim.access.sshPublicKeys.some((key) => typeof key !== "string" || key.length > 16384 || !/^ssh-(?:ed25519|rsa)\s+[A-Za-z0-9+/]+={0,3}(?:\s+.*)?$/.test(key.trim())))
+      throw new MetalProvisionError("invalid SSH public key list");
+  }
+  const name = claim.spec.guestName ?? guestNameFor(claim.computeKey);
+  const conflictingName = manifests.find((row) => row.name === name && row.computeKey !== claim.computeKey);
+  if (conflictingName)
+    throw new MetalProvisionError("requested guest name is already allocated");
   const manifestPath = join2(profile.stateDir, `${name}.json`);
   const prior = manifests.find((row) => row.computeKey === claim.computeKey);
   if (prior && prior.reference !== claim.spec.reference)
     throw new MetalProvisionError("compute identity conflicts with host inventory");
-  const address = allocateAddress(profile, claim.computeKey, manifests);
+  const address = requestedAddress(profile, claim, manifests);
   const cpuPool = allocateCpuPool(profile, claim, manifests);
   const manifest = prior ?? {
     computeKey: claim.computeKey,
@@ -1986,7 +1983,7 @@ async function provisionMetalGuest(profile, claim, exec) {
     allowedMemoryNodes: cpuPool.memoryNodes,
     phase: "allocating"
   };
-  const save = () => writeFileSync4(manifestPath, `${JSON.stringify(manifest, null, 2)}
+  const save = () => writeFileSync3(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `, { mode: 384 });
   save();
   const lv = `/dev/${profile.volumeGroup}/${name}`;
@@ -2000,9 +1997,9 @@ async function provisionMetalGuest(profile, claim, exec) {
   }
   const seedBase = join2(profile.seedDir, name);
   const init = cloudInit(profile, claim, manifest);
-  writeFileSync4(`${seedBase}-user-data`, init.userData, { mode: 384 });
-  writeFileSync4(`${seedBase}-meta-data`, init.metaData, { mode: 384 });
-  writeFileSync4(`${seedBase}-network-config`, init.networkConfig, { mode: 384 });
+  writeFileSync3(`${seedBase}-user-data`, init.userData, { mode: 384 });
+  writeFileSync3(`${seedBase}-meta-data`, init.metaData, { mode: 384 });
+  writeFileSync3(`${seedBase}-network-config`, init.networkConfig, { mode: 384 });
   const seed = `${seedBase}-seed.iso`;
   await checked(exec, [
     "cloud-localds",
@@ -2035,8 +2032,8 @@ async function provisionMetalGuest(profile, claim, exec) {
   }
   const service = `forgezero-guest@${name}.service`;
   const unitPath = join2(profile.unitDir, service);
-  mkdirSync4(dirname4(unitPath), { recursive: true });
-  writeFileSync4(unitPath, guestUnit(spec), { mode: 420 });
+  mkdirSync3(dirname3(unitPath), { recursive: true });
+  writeFileSync3(unitPath, guestUnit(spec), { mode: 420 });
   await checked(exec, ["systemctl", "daemon-reload"]);
   if (prior?.phase === "running") {
     await checked(exec, ["systemctl", "restart", service]);
@@ -2052,18 +2049,22 @@ async function removeMetalGuest(profile, claim, exec) {
   validateMetalProfile(profile);
   if (claim.action !== "delete")
     throw new MetalProvisionError("create claim cannot remove a guest");
-  const name = guestNameFor(claim.computeKey);
+  const name = claim.spec.guestName ?? guestNameFor(claim.computeKey);
   const manifestPath = join2(profile.stateDir, `${name}.json`);
   if (!existsSync5(manifestPath))
     return {};
-  const manifest = JSON.parse(readFileSync4(manifestPath, "utf8"));
-  if (manifest.computeKey !== claim.computeKey || manifest.reference !== claim.spec.reference || manifest.name !== name) {
+  const manifest = JSON.parse(readFileSync3(manifestPath, "utf8"));
+  const currentIdentity = manifest.computeKey === claim.computeKey && manifest.reference === claim.spec.reference && manifest.name === name;
+  const legacyPlatformIdentity = claim.bootstrap?.kind === "platform-genesis" && claim.computeKey === `platform:${name}` && claim.spec.reference === `platform:${name}` && manifest.name === name && manifest.disk === `/dev/${profile.volumeGroup}/${name}` && manifest.address === claim.spec.guestAddress && (manifest.unit === `fz-guest@${name}.service` || manifest.unit === `forgezero-guest@${name}.service`);
+  if (!currentIdentity && !legacyPlatformIdentity) {
     throw new MetalProvisionError("compute identity conflicts with host inventory");
   }
   const service = `forgezero-guest@${name}.service`;
   const unitPath = join2(profile.unitDir, service);
   if (existsSync5(unitPath))
     await checked(exec, ["systemctl", "disable", "--now", service]);
+  else if (legacyPlatformIdentity)
+    await checked(exec, ["systemctl", "disable", "--now", service]);
   else if ((await exec(["systemctl", "is-active", service])).exitCode === 0) {
     throw new MetalProvisionError("guest unit is active but its owned unit file is missing");
   }
@@ -2079,7 +2080,15 @@ async function removeMetalGuest(profile, claim, exec) {
     manifestPath
   ])
     if (existsSync5(path))
-      unlinkSync5(path);
+      unlinkSync4(path);
+  if (legacyPlatformIdentity) {
+    const legacyConfig = `/etc/forgezero/guests/${name}.conf`;
+    const legacyDropIn = join2(profile.unitDir, `${service}.d`);
+    if (existsSync5(legacyConfig))
+      unlinkSync4(legacyConfig);
+    if (existsSync5(legacyDropIn))
+      rmSync(legacyDropIn, { recursive: true });
+  }
   await checked(exec, ["systemctl", "daemon-reload"]);
   return {};
 }
@@ -2117,7 +2126,7 @@ function startMetalHelper(options) {
   validateMetalProfile(options.profile);
   const socketPath = options.socketPath ?? DEFAULT_METAL_HELPER_SOCKET;
   if (existsSync6(socketPath))
-    unlinkSync6(socketPath);
+    unlinkSync5(socketPath);
   let tail = Promise.resolve();
   const server = createServer3((socket) => {
     let buffer = "";
@@ -2163,7 +2172,7 @@ function startMetalHelper(options) {
     });
     socket.on("error", () => socket.destroy());
   });
-  server.listen(socketPath, () => chmodSync6(socketPath, 432));
+  server.listen(socketPath, () => chmodSync5(socketPath, 432));
   return {
     server,
     async stop() {
@@ -2203,7 +2212,7 @@ function requestMetalProvision(claim, socketPath = DEFAULT_METAL_HELPER_SOCKET)
 }
 
 // src/deployment-runner.ts
-import { chmodSync as chmodSync7, existsSync as existsSync7, realpathSync, unlinkSync as unlinkSync7 } from "fs";
+import { chmodSync as chmodSync6, existsSync as existsSync7, realpathSync, unlinkSync as unlinkSync6 } from "fs";
 import { isAbsolute as isAbsolute2, resolve, sep } from "path";
 import { connect as connect3, createServer as createServer4 } from "net";
 var DEFAULT_DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
@@ -2308,7 +2317,7 @@ function startDeploymentRunner(options) {
   const home = resolve(options.home);
   const socketPath = options.socketPath ?? DEFAULT_DEPLOYMENT_RUNNER_SOCKET;
   if (options.listenFd === undefined && existsSync7(socketPath))
-    unlinkSync7(socketPath);
+    unlinkSync6(socketPath);
   const active = new Set;
   const server = createServer4((socket) => {
     let buffer = "";
@@ -2352,7 +2361,7 @@ function startDeploymentRunner(options) {
   if (options.listenFd !== undefined)
     server.listen({ fd: options.listenFd });
   else
-    server.listen(socketPath, () => chmodSync7(socketPath, 432));
+    server.listen(socketPath, () => chmodSync6(socketPath, 432));
   return {
     server,
     async stop() {
@@ -2571,7 +2580,7 @@ function startNodeAttestation(options) {
 }
 
 // src/metal-isolation.ts
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
 import { join as join3 } from "path";
 var members = (list) => list.split(",").flatMap((part) => {
   const [first, last = first] = part.split("-").map(Number);
@@ -2649,16 +2658,16 @@ async function applyMetalIsolation(profile, exec = defaultExec) {
   validateMetalProfile(profile);
   await requireGuestsInSlice(exec);
   const unitDir = profile.unitDir;
-  mkdirSync5(unitDir, { recursive: true });
-  writeFileSync5(join3(unitDir, "forgezero-guests.slice"), metalGuestSliceUnit(profile), { mode: 420 });
+  mkdirSync4(unitDir, { recursive: true });
+  writeFileSync4(join3(unitDir, "forgezero-guests.slice"), metalGuestSliceUnit(profile), { mode: 420 });
   for (const unit of ["system.slice", "user.slice"]) {
     const directory = join3(unitDir, `${unit}.d`);
-    mkdirSync5(directory, { recursive: true });
-    writeFileSync5(join3(directory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "slice"), { mode: 420 });
+    mkdirSync4(directory, { recursive: true });
+    writeFileSync4(join3(directory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "slice"), { mode: 420 });
   }
   const initDirectory = join3(unitDir, "init.scope.d");
-  mkdirSync5(initDirectory, { recursive: true });
-  writeFileSync5(join3(initDirectory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "scope"), { mode: 420 });
+  mkdirSync4(initDirectory, { recursive: true });
+  writeFileSync4(join3(initDirectory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "scope"), { mode: 420 });
   await checked2(exec, ["systemctl", "daemon-reload"]);
   await requireGuestsInSlice(exec);
   const properties = [`AllowedCPUs=${profile.housekeepingCpus}`];
@@ -2669,20 +2678,22 @@ async function applyMetalIsolation(profile, exec = defaultExec) {
   }
 }
 
+// src/version.ts
+var VERSION = "0.1.12";
+
 // src/index.ts
-var VERSION = "0.1.11";
 function loadOrCreateSeed(path) {
   if (existsSync9(path)) {
-    const seed2 = new Uint8Array(Buffer.from(readFileSync5(path, "utf8").trim(), "base64url"));
+    const seed2 = new Uint8Array(Buffer.from(readFileSync4(path, "utf8").trim(), "base64url"));
     if (seed2.length < 32) {
       throw new Error(`agent: the seed at ${path} is too short to derive a key from.`);
     }
     return seed2;
   }
-  mkdirSync6(dirname5(path), { recursive: true });
+  mkdirSync5(dirname4(path), { recursive: true });
   const seed = new Uint8Array(randomBytes(32));
-  writeFileSync6(path, Buffer.from(seed).toString("base64url"), { mode: 384 });
-  chmodSync8(path, 384);
+  writeFileSync5(path, Buffer.from(seed).toString("base64url"), { mode: 384 });
+  chmodSync7(path, 384);
   return seed;
 }
 var DEFAULT_SOCKET_PATH = DEFAULT_SOCKET;
@@ -2695,7 +2706,7 @@ function loadSeedCredential(name = DEFAULT_SEED_CREDENTIAL, directory = process.
   const path = `${directory}/${name}`;
   if (!existsSync9(path))
     throw new Error(`agent: the systemd credential ${name} is missing at ${path}.`);
-  const seed = new Uint8Array(Buffer.from(readFileSync5(path, "utf8").trim(), "base64url"));
+  const seed = new Uint8Array(Buffer.from(readFileSync4(path, "utf8").trim(), "base64url"));
   if (seed.length < 32)
     throw new Error(`agent: the systemd credential ${name} is too short to derive a key from.`);
   return seed;
@@ -2705,7 +2716,7 @@ function loadTextCredential(name, directory = process.env.CREDENTIALS_DIRECTORY)
     throw new Error("agent: CREDENTIALS_DIRECTORY is missing; systemd did not load the credential.");
   if (!/^[A-Za-z0-9_.-]+$/.test(name))
     throw new Error("agent: invalid systemd credential name.");
-  const value = readFileSync5(`${directory}/${name}`, "utf8").trim();
+  const value = readFileSync4(`${directory}/${name}`, "utf8").trim();
   if (!value)
     throw new Error(`agent: systemd credential ${name} is empty.`);
   return value;
@@ -2740,9 +2751,15 @@ function runAgent(config = {}) {
     record: config.record
   };
   const server = startAgent(options);
-  return { server, keys, nodeKey, setCache: (cache) => {
-    options.cache = cache;
-  } };
+  return {
+    server,
+    keys,
+    nodeKey,
+    setVault: (cache, projectKey) => {
+      options.cache = cache;
+      options.projectKey = projectKey;
+    }
+  };
 }
 if (import.meta.main) {
   const args = process.argv.slice(2);
@@ -2805,7 +2822,7 @@ if (import.meta.main) {
       nodeKey: nodeKey2,
       keys: keys2,
       label: process.env.FZ_NODE_LABEL,
-      gitDeployPublicKey: process.env.FZ_GIT_PUBLIC_KEY_FILE ? readFileSync5(process.env.FZ_GIT_PUBLIC_KEY_FILE, "utf8").trim() : undefined
+      gitDeployPublicKey: process.env.FZ_GIT_PUBLIC_KEY_FILE ? readFileSync4(process.env.FZ_GIT_PUBLIC_KEY_FILE, "utf8").trim() : undefined
     });
     console.log(`[agent] enrolled ${binding2.computeReference} in project ${binding2.projectKey}/${binding2.environmentKey}`);
     process.exit(0);
@@ -2814,7 +2831,7 @@ if (import.meta.main) {
     const profilePath = args.find((arg) => arg.startsWith("--profile="))?.slice("--profile=".length);
     if (!profilePath)
       throw new Error("metal-helper requires --profile=/absolute/path.json");
-    const profile = JSON.parse(readFileSync5(profilePath, "utf8"));
+    const profile = JSON.parse(readFileSync4(profilePath, "utf8"));
     const helper = startMetalHelper({
       profile,
       socketPath: process.env.FZ_METAL_HELPER_SOCKET ?? DEFAULT_METAL_HELPER_SOCKET
@@ -2836,7 +2853,7 @@ if (import.meta.main) {
     const profilePath = args.find((arg) => arg.startsWith("--profile="))?.slice("--profile=".length);
     if (!profilePath)
       throw new Error("metal-isolation requires --profile=/absolute/path.json");
-    const profile = JSON.parse(readFileSync5(profilePath, "utf8"));
+    const profile = JSON.parse(readFileSync4(profilePath, "utf8"));
     await applyMetalIsolation(profile);
     console.log("[metal-isolation] host and guest cgroup boundaries active");
     process.exit(0);
@@ -2865,6 +2882,27 @@ if (import.meta.main) {
     process.on("SIGINT", () => void stop());
     await new Promise(() => {});
   }
+  if (command === "metal-apply") {
+    const claimArg = args.find((arg) => arg.startsWith("--claim="))?.slice("--claim=".length);
+    if (!claimArg)
+      throw new Error("metal-apply requires --claim=- or --claim=/absolute/path.json");
+    if (typeof process.getuid !== "function" || process.getuid() !== 0) {
+      throw new Error("metal-apply must be invoked by the authenticated root bootstrap session");
+    }
+    if (claimArg !== "-" && !claimArg.startsWith("/")) {
+      throw new Error("metal-apply claim path must be absolute");
+    }
+    const raw = readFileSync4(claimArg === "-" ? "/dev/stdin" : claimArg, "utf8");
+    if (Buffer.byteLength(raw) > 32 * 1024)
+      throw new Error("metal-apply claim exceeds 32 KiB");
+    const claim = JSON.parse(raw);
+    if (claim.bootstrap?.kind !== "platform-genesis" || "enrolment" in claim) {
+      throw new Error("metal-apply accepts only an offline platform-genesis claim");
+    }
+    const result = await requestMetalProvision(claim, process.env.FZ_METAL_HELPER_SOCKET ?? DEFAULT_METAL_HELPER_SOCKET);
+    console.log(JSON.stringify({ ok: true, computeKey: claim.computeKey, ...result }));
+    process.exit(0);
+  }
   if (process.env.FZ_AGENT_ROLE === "metal") {
     if (!process.env.FZ_API)
       throw new Error("metal agent requires FZ_API");
@@ -2954,28 +2992,33 @@ if (import.meta.main) {
       nodeKey,
       keys,
       label: process.env.FZ_NODE_LABEL,
-      gitDeployPublicKey: process.env.FZ_GIT_PUBLIC_KEY_FILE ? readFileSync5(process.env.FZ_GIT_PUBLIC_KEY_FILE, "utf8").trim() : undefined
+      gitDeployPublicKey: process.env.FZ_GIT_PUBLIC_KEY_FILE ? readFileSync4(process.env.FZ_GIT_PUBLIC_KEY_FILE, "utf8").trim() : undefined
     });
     console.log(`[agent] enrolled ${binding.computeReference} in project ${binding.projectKey}/${binding.environmentKey}`);
   }
-  let nodeApiUrl = binding && process.env.FZ_API ? tenantNodeApiUrl(process.env.FZ_API, binding.tenantSlug) : process.env.FZ_API;
+  let nodeApiUrl = binding && process.env.FZ_API ? binding.realm === "platform" ? process.env.FZ_API : tenantNodeApiUrl(process.env.FZ_API, binding.tenantSlug) : process.env.FZ_API;
   let secretCache;
   let vaultSync;
   if (binding && attestationSource && nodeApiUrl) {
     const result = await attestNodeOnce({ apiUrl: nodeApiUrl, nodeKey, keys, source: attestationSource });
     console.log(`[agent] initial SEV-SNP attestation verified ${result.measurement.slice(0, 16)}\u2026`);
   }
-  if (binding && nodeApiUrl) {
-    secretCache = createNodeVaultCache({ apiUrl: nodeApiUrl, nodeKey, keys });
+  if (binding?.realm === "tenant" && nodeApiUrl) {
+    secretCache = createNodeVaultCache({
+      apiUrl: nodeApiUrl,
+      nodeKey,
+      keys,
+      projectKey: binding.projectKey
+    });
     const loaded = await secretCache.load();
     if (loaded.failed.length > 0) {
       throw new Error(`agent: failed to load ${loaded.failed.length} assigned vault entries`);
     }
-    running.setCache(secretCache);
+    running.setVault(secretCache, binding.projectKey);
     vaultSync = startNodeVaultSync(secretCache, {
       onEvent: (event, detail) => console.log(`[agent] vault ${event}${detail ? ` ${JSON.stringify(detail)}` : ""}`)
     });
-    console.log(`[agent] in-memory vault loaded for ${binding.projectKey}/${binding.environmentKey}`);
+    console.log(`[agent] in-memory vault loaded for every environment in project ${binding.projectKey}`);
   }
   const attestationLoop = attestationSource && nodeApiUrl ? startNodeAttestation({
     apiUrl: nodeApiUrl,
@@ -3035,23 +3078,6 @@ if (import.meta.main) {
     const control = staticManager ? startControlServer(staticManager, process.env.FZ_CONTROL_SOCKET ?? DEFAULT_CONTROL_SOCKET) : undefined;
     if (control)
       console.log(`[agent] deployment control listening for ${repository}@${branch}`);
-    const staticWatch = staticManager && process.env.FZ_DEPLOY_WATCH === "true" ? startStaticDeploymentWatch({
-      manager: staticManager,
-      statePath: process.env.FZ_DEPLOY_STATE ?? join4(root, "cache", "static-deployment.json"),
-      coordinator: process.env.FZ_DEPLOY_COORDINATOR === "true",
-      currentRevision: () => {
-        try {
-          const slot = readFileSync5(join4(root, ".forge-slot"), "utf8").trim();
-          const revision = readFileSync5(join4(root, "slots", slot, ".git", "HEAD"), "utf8").trim();
-          return /^[a-f0-9]{40}$/i.test(revision) ? revision.toLowerCase() : undefined;
-        } catch {
-          return;
-        }
-      },
-      onEvent: (event, detail) => console.log(`[agent] static deployment ${event}${detail ? ` ${JSON.stringify(detail)}` : ""}`)
-    }) : undefined;
-    if (staticWatch)
-      console.log(`[agent] watching ${repository}@${branch} for exact revisions`);
     const pull = pullEnabled ? startDeploymentPull({
       apiUrl: nodeApiUrl,
       nodeKey,
@@ -3086,13 +3112,10 @@ if (import.meta.main) {
         await new Promise((resolve2) => control.close(() => resolve2()));
       const deadlineMs = Math.max(1, Number(process.env.FZ_DRAIN_DEADLINE_MS ?? 30000));
       const deadline = Date.now() + deadlineMs;
-      const pullDrain = Promise.all([
-        pull?.stop() ?? Promise.resolve(),
-        staticWatch?.stop() ?? Promise.resolve()
-      ]);
+      const pullDrain = pull?.stop() ?? Promise.resolve();
       const vaultDrain = vaultSync?.stop() ?? Promise.resolve();
       const attestationDrain = attestationLoop?.stop() ?? Promise.resolve();
-      const pullWithinDeadline = pull || staticWatch ? Promise.race([
+      const pullWithinDeadline = pull ? Promise.race([
         pullDrain.then(() => true),
         new Promise((resolve2) => setTimeout(() => resolve2(false), deadlineMs))
       ]) : Promise.resolve(true);
@@ -3127,10 +3150,8 @@ if (import.meta.main) {
   }
 }
 export {
-  writeStaticDeploymentState,
   validateMetalProfile,
   tenantNodeApiUrl,
-  startStaticDeploymentWatch,
   startProvisioningPull,
   startNodeVaultSync,
   startNodeAttestation,
@@ -3144,10 +3165,11 @@ export {
   requestDeploymentCommand,
   requestControl,
   removeMetalGuest,
-  readStaticDeploymentState,
   pullProvisioningOnce,
   pullDeploymentOnce,
   provisionMetalGuest,
+  projectVaultCoordinate,
+  projectVaultCacheKey,
   metalHousekeepingDropIn,
   metalGuestSliceUnit,
   loadTextCredential,
@@ -3164,10 +3186,12 @@ export {
   createDeploymentManager,
   cloudInit,
   attestNodeOnce,
+  assertSupportedGuestImage,
   applyMetalIsolation,
   allocateCpuPool,
   allocateAddress,
   VERSION,
+  SUPPORTED_GUEST_IMAGE,
   DeploymentError,
   DEFAULT_SOCKET_PATH,
   DEFAULT_SEED_PATH,