@forgezero/agent 0.1.11 → 0.1.13

package/README.md

@@ -49,8 +49,9 @@ not exist on the box.
 
 ## A local copy, not a cache
 
-The agent holds the **whole assigned project + environment**, not just what has
-already been read. That is the difference between surviving an outage and not: a
+The agent holds the **whole assigned project across every environment**, not
+just what has already been read. Each application still selects one environment
+and cannot cross the enrolled project boundary. That is the difference between surviving an outage and not: a
 cache only has what you fetched, so a secret you have never read is exactly the
 one you cannot get when the platform is unreachable.
 
@@ -80,7 +81,24 @@ it is worse off than one that receives an error — the error is visible.
 
 Both are real. `enrolled` is still strictly better than an API key in the
 application: the key never leaves the agent, rotation reaches every process, and
-the socket is filesystem-scoped.
+the socket is filesystem-scoped. The socket is mode `0660` under the dedicated
+`forgezero-vault` group; add only the intended application service account to
+that group. The credential-free deployment runner is not a member.
+
+The attested posture is the intended production upgrade, not current live
+evidence: report acquisition and AMD-rooted measurement verification still have
+to cross the production fleet. Until then the node is honestly `enrolled`; the
+Agent never manufactures an attestation-shaped fallback.
+
+Every tenant Vault sync request uses the same hybrid signature codec as an
+external API key and signs its one-use hybrid ML-KEM-768 + X25519 response key.
+Vault values are AES-256-GCM sealed to that request before crossing the edge;
+there is no Ed25519-only or plaintext-response downgrade.
+
+The first guest enrolment uses the same contract before the identity exists in
+the database: the guest signs the exact token and public-key body with both keys
+it is asking the API to admit, and it accepts only an ML-KEM-sealed
+acknowledgement. The short-lived token is therefore not an unsigned Agent path.
 
 ## The socket interface
 
@@ -112,12 +130,21 @@ file before executing any command, prepares only the selected role, and gives a
 step only the vault values it explicitly names. `await` returns the complete
 pipeline result; no polling service or persistent queue is required.
 
-The daemon owns source checkout and command execution. On a platform node it
-watches the configured branch after bootstrap, resolves every change to an
-exact commit, and writes `pending` then `running` before submitting that commit
-to the keyed queue. A restart in either state resumes the exact commit; only an
-awaited successful pipeline writes `deployed`. Tenant nodes receive the same
-exact-commit request from the signed API claim path.
+The daemon owns source checkout and command execution. Bootstrap explicitly
+awaits release one because the API does not exist yet, then the Agent consumes a
+one-use platform enrolment capability. There is no branch watcher. Every normal
+platform or tenant release is a durable API row bound to one exact compute:
+`pending` is written before dispatch, `running` and a fenced lease before project
+code, and only an awaited successful pipeline writes `deployed`. An expired
+claim can be recovered; its stale token cannot renew or finish.
+
+The same package also runs the identity-only Metal Agent. It initiates outbound
+signed HTTPS to pull only claims assigned to its enrolled hostname, then passes
+the fixed claim over a local Unix socket to a narrowly privileged root helper.
+The helper can materialize the audited QEMU profile; it cannot clone a project,
+read Vault data, accept arbitrary commands, or retain tenant credentials. Root
+SSH is an operator-only platform-genesis/recovery path, not the normal tenant
+dispatch mechanism.
 
 Repository read authorization is explicit per pipeline: public HTTPS, the
 compute's systemd-sealed SSH deploy key, or a fine-grained HTTPS token selected

package/dist/deployment.d.ts

@@ -41,7 +41,7 @@ export type GitSourceAuth = {
     username?: string;
 };
 export interface DeploymentOptions {
-    /** Queue key. Same project/environment is serial; other managers may run in parallel. */
+    /** Queue key. The same deployment target is serial; different targets may run in parallel. */
     key: string;
     repository: string;
     branch: string;