@forgezero/agent 0.1.113 → 0.1.115

package/dist/fz-agent.js

@@ -5568,6 +5568,7 @@ function validateCapacityCalibrationOptions(options) {
   const endpoint = localCalibrationEndpoint(options.endpoint);
   const maxConcurrency = options.maxConcurrency ?? 256;
   const requestsPerWorker = options.requestsPerWorker ?? 8;
+  const maximumRequestsPerWorker = options.maximumRequestsPerWorker ?? 100;
   const maxP95Ms = options.maxP95Ms ?? 250;
   const maxErrorRate = options.maxErrorRate ?? 0.01;
   const safetyRatio = options.safetyRatio ?? 0.8;
@@ -5575,13 +5576,14 @@ function validateCapacityCalibrationOptions(options) {
   const minimumStageDurationMs = options.minimumStageDurationMs ?? 5000;
   const maxCpuUtilizationPercent = options.maxCpuUtilizationPercent ?? 90;
   const maxMemoryUtilizationPercent = options.maxMemoryUtilizationPercent ?? 90;
-  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
+  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isSafeInteger(maximumRequestsPerWorker) || maximumRequestsPerWorker < requestsPerWorker || maximumRequestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
     throw new Error("Capacity calibration bounds are invalid.");
   }
   return {
     endpoint,
     maxConcurrency,
     requestsPerWorker,
+    maximumRequestsPerWorker,
     maxP95Ms,
     maxErrorRate,
     safetyRatio,
@@ -5591,7 +5593,7 @@ function validateCapacityCalibrationOptions(options) {
     maxMemoryUtilizationPercent
   };
 }
-async function stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimumDurationMs, fetcher, sampler) {
+async function stage(endpoint, concurrency, requestsPerWorker, maximumRequestsPerWorker, timeoutMs, minimumDurationMs, fetcher, sampler) {
   const latencies = [];
   let succeeded = 0;
   let failed = 0;
@@ -5600,7 +5602,7 @@ async function stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimu
   const started = performance.now();
   await Promise.all(Array.from({ length: concurrency }, async () => {
     let request = 0;
-    while (request < requestsPerWorker || performance.now() - started < minimumDurationMs) {
+    while (request < maximumRequestsPerWorker && (request < requestsPerWorker || performance.now() - started < minimumDurationMs)) {
       request += 1;
       const requestStarted = performance.now();
       try {
@@ -5659,6 +5661,7 @@ async function calibrateHttpConcurrency(options, fetcher = fetch, sampler = host
     safetyRatio,
     requestTimeoutMs: timeoutMs,
     minimumStageDurationMs,
+    maximumRequestsPerWorker,
     maxCpuUtilizationPercent,
     maxMemoryUtilizationPercent
   } = validateCapacityCalibrationOptions(options);
@@ -5666,7 +5669,7 @@ async function calibrateHttpConcurrency(options, fetcher = fetch, sampler = host
   let lastSafe;
   let stopReason = "maximum-tested";
   for (let concurrency = 1;; concurrency = Math.min(maxConcurrency, concurrency * 2)) {
-    const measured = await stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimumStageDurationMs, fetcher, sampler);
+    const measured = await stage(endpoint, concurrency, requestsPerWorker, maximumRequestsPerWorker, timeoutMs, minimumStageDurationMs, fetcher, sampler);
     stages.push(measured);
     const previous = stages.at(-2);
     const throughputRegressed = Boolean(previous && concurrency > 1 && measured.successfulRequestsPerSecond < previous.successfulRequestsPerSecond * 0.9);
@@ -5767,6 +5770,7 @@ function capacityCalibration(value, where) {
     "endpoint",
     "maxConcurrency",
     "requestsPerWorker",
+    "maximumRequestsPerWorker",
     "maxP95Ms",
     "maxErrorRate",
     "safetyRatio",
@@ -5795,6 +5799,7 @@ function capacityCalibration(value, where) {
     ...Object.fromEntries([
       "maxConcurrency",
       "requestsPerWorker",
+      "maximumRequestsPerWorker",
       "maxP95Ms",
       "maxErrorRate",
       "safetyRatio",
@@ -6730,7 +6735,7 @@ function validateComponent(value, where, targets, requirements) {
   const row2 = object(value, where);
   const selectedTarget = targets.get(String(row2.target)) ?? fail(`${where}.target`, "must name an existing target.");
   if (row2.kind === "application") {
-    exact3(row2, ["kind", "target", "runtime", "service", "resources", "storage", "network", "rollout"], where);
+    exact3(row2, ["kind", "target", "runtime", "service", "capacityCalibration", "resources", "storage", "network", "rollout"], where);
     const runtime = object(row2.runtime, `${where}.runtime`);
     const runtimeRequirement = requirements.get(String(runtime.requirement));
     if (!runtimeRequirement)
@@ -6812,6 +6817,33 @@ function validateComponent(value, where, targets, requirements) {
       fail(`${where}.service.websocket`, "must be a boolean.");
     if (service.maximumConnections !== undefined)
       integer(service.maximumConnections, `${where}.service.maximumConnections`, 1, 1e7);
+    if (row2.capacityCalibration !== undefined) {
+      const calibration = object(row2.capacityCalibration, `${where}.capacityCalibration`);
+      exact3(calibration, [
+        "path",
+        "maxConcurrency",
+        "requestsPerWorker",
+        "maximumRequestsPerWorker",
+        "maxP95Ms",
+        "maxErrorRate",
+        "safetyRatio",
+        "requestTimeoutMs",
+        "minimumStageDurationMs",
+        "maxCpuUtilizationPercent",
+        "maxMemoryUtilizationPercent"
+      ], `${where}.capacityCalibration`);
+      if (typeof calibration.path !== "string" || !HEALTH_PATH.test(calibration.path) || calibration.path.includes("..") || calibration.path.includes("//")) {
+        fail(`${where}.capacityCalibration.path`, "must be one bounded absolute loopback path.");
+      }
+      try {
+        validateCapacityCalibrationOptions({
+          ...calibration,
+          endpoint: `http://127.0.0.1:${String(service.port)}${calibration.path}`
+        });
+      } catch {
+        fail(`${where}.capacityCalibration`, "contains invalid bounds.");
+      }
+    }
     validateResources(row2.resources, `${where}.resources`);
     if (runtime.kind === "container") {
       const resources = object(row2.resources, `${where}.resources`);
@@ -7274,6 +7306,15 @@ function compileDeployment(sourceValue) {
     named(componentName, "deployment.spec.components key");
     validateComponent(value, `deployment.spec.components.${componentName}`, targetDefinitions, requirementDefinitions);
   }
+  for (const targetName of targetNames) {
+    const calibrated = componentEntries.filter(([, component2]) => {
+      const candidate = component2;
+      return candidate.kind === "application" && candidate.target === targetName && candidate.capacityCalibration !== undefined;
+    });
+    if (calibrated.length > 1) {
+      fail(`deployment.spec.components`, `may calibrate at most one application on target ${targetName}.`);
+    }
+  }
   for (const [targetName, target] of targetDefinitions) {
     if (target.connectivity?.public?.mode !== "cloudflare-tunnel")
       continue;
@@ -8340,14 +8381,14 @@ function createDeploymentManager(options) {
           } : {}
         });
       for (const targetName of targetNames) {
-        const capacity2 = resolvedTargets.find(({ name }) => name === targetName)?.allocation.resources;
-        if (!capacity2)
+        const capacity3 = resolvedTargets.find(({ name }) => name === targetName)?.allocation.resources;
+        if (!capacity3)
           throw new DeploymentError("PIPELINE_FAILED", `target ${targetName} has no resolved capacity`);
         const components = Object.values(plan.spec.components).filter(({ target }) => target === targetName);
         const cpu = components.reduce((sum, component2) => sum + (component2.resources?.cpu?.limit ?? 0), 0);
         const memoryMiB = components.reduce((sum, component2) => sum + (component2.resources?.memory?.limitMiB ?? 0), 0);
         const ephemeralMiB = components.reduce((sum, component2) => sum + (component2.kind === "application" ? (component2.storage ?? []).reduce((storage, mount) => storage + (mount.class === "ephemeral" ? mount.sizeMiB : 0), 0) : 0), 0);
-        if (cpu > capacity2.cpuCores || memoryMiB > capacity2.memoryMiB || ephemeralMiB > capacity2.storageGiB * 1024) {
+        if (cpu > capacity3.cpuCores || memoryMiB > capacity3.memoryMiB || ephemeralMiB > capacity3.storageGiB * 1024) {
           throw new DeploymentError("PIPELINE_FAILED", `component limits exceed the reserved capacity of target ${targetName}`);
         }
       }
@@ -8592,6 +8633,37 @@ function createDeploymentManager(options) {
         const failed = run2.steps.find((step2) => step2.status === "failed" || step2.status === "manual-intervention");
         throw new DeploymentError("PIPELINE_FAILED", `deployment plan failed at ${failed?.id ?? "unknown step"}: ${failed?.error?.message ?? run2.status}`, deploymentExecution([phase]));
       }
+      const executionTarget = assigned?.targetName ?? matchingTargetNames[0];
+      const calibratedApplication = Object.values(plan.spec.components).find((component2) => component2.kind === "application" && component2.target === executionTarget && component2.capacityCalibration !== undefined);
+      let capacity2;
+      if (calibratedApplication?.kind === "application" && calibratedApplication.capacityCalibration) {
+        if (!options.capacityEvidenceDirectory) {
+          throw new DeploymentError("PIPELINE_FAILED", "capacity calibration was requested but the Agent has no evidence directory");
+        }
+        const { path: path2, ...bounds } = calibratedApplication.capacityCalibration;
+        const calibration = await (options.calibrateCapacity ?? calibrateHttpConcurrency)({
+          ...bounds,
+          endpoint: `http://127.0.0.1:${calibratedApplication.service.port}${path2}`
+        });
+        const measuredAtTs = now();
+        const evidencePath = persistCapacityCalibration({
+          directory: options.capacityEvidenceDirectory,
+          deploymentKey: options.key,
+          revision: head,
+          definitionDigest: plan.sourceDigest,
+          profile: options.profile,
+          measuredAtTs,
+          calibration
+        });
+        capacity2 = {
+          ...calibration,
+          evidencePath,
+          recommendedCoordinate: {
+            FZ_REQUESTS_PER_SECOND_LIMIT: String(calibration.allowedRequestsPerSecond),
+            FZ_CONCURRENCY_LIMIT: String(calibration.recommendedConcurrency)
+          }
+        };
+      }
       return {
         key: options.key,
         repository: options.repository,
@@ -8604,7 +8676,8 @@ function createDeploymentManager(options) {
         ok: true,
         phases: [phase],
         execution: deploymentExecution([phase]),
-        resolvedTargets
+        resolvedTargets,
+        ...capacity2 ? { capacity: capacity2 } : {}
       };
     }
     const definition = parseDeployDefinition(readDefinition(join2(release, ".fz", "deploy.json")));
@@ -9528,7 +9601,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.113";
+var VERSION2 = "0.1.115";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4841,7 +4841,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.113";
+var VERSION2 = "0.1.115";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4941,6 +4941,7 @@ function validateCapacityCalibrationOptions(options) {
   const endpoint = localCalibrationEndpoint(options.endpoint);
   const maxConcurrency = options.maxConcurrency ?? 256;
   const requestsPerWorker = options.requestsPerWorker ?? 8;
+  const maximumRequestsPerWorker = options.maximumRequestsPerWorker ?? 100;
   const maxP95Ms = options.maxP95Ms ?? 250;
   const maxErrorRate = options.maxErrorRate ?? 0.01;
   const safetyRatio = options.safetyRatio ?? 0.8;
@@ -4948,13 +4949,14 @@ function validateCapacityCalibrationOptions(options) {
   const minimumStageDurationMs = options.minimumStageDurationMs ?? 5000;
   const maxCpuUtilizationPercent = options.maxCpuUtilizationPercent ?? 90;
   const maxMemoryUtilizationPercent = options.maxMemoryUtilizationPercent ?? 90;
-  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
+  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isSafeInteger(maximumRequestsPerWorker) || maximumRequestsPerWorker < requestsPerWorker || maximumRequestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
     throw new Error("Capacity calibration bounds are invalid.");
   }
   return {
     endpoint,
     maxConcurrency,
     requestsPerWorker,
+    maximumRequestsPerWorker,
     maxP95Ms,
     maxErrorRate,
     safetyRatio,
@@ -5034,6 +5036,7 @@ function capacityCalibration(value, where) {
     "endpoint",
     "maxConcurrency",
     "requestsPerWorker",
+    "maximumRequestsPerWorker",
     "maxP95Ms",
     "maxErrorRate",
     "safetyRatio",
@@ -5062,6 +5065,7 @@ function capacityCalibration(value, where) {
     ...Object.fromEntries([
       "maxConcurrency",
       "requestsPerWorker",
+      "maximumRequestsPerWorker",
       "maxP95Ms",
       "maxErrorRate",
       "safetyRatio",
@@ -10920,7 +10924,7 @@ function validateComponent(value, where, targets, requirements) {
   const row2 = object(value, where);
   const selectedTarget = targets.get(String(row2.target)) ?? fail2(`${where}.target`, "must name an existing target.");
   if (row2.kind === "application") {
-    exact3(row2, ["kind", "target", "runtime", "service", "resources", "storage", "network", "rollout"], where);
+    exact3(row2, ["kind", "target", "runtime", "service", "capacityCalibration", "resources", "storage", "network", "rollout"], where);
     const runtime = object(row2.runtime, `${where}.runtime`);
     const runtimeRequirement = requirements.get(String(runtime.requirement));
     if (!runtimeRequirement)
@@ -11002,6 +11006,33 @@ function validateComponent(value, where, targets, requirements) {
       fail2(`${where}.service.websocket`, "must be a boolean.");
     if (service.maximumConnections !== undefined)
       integer(service.maximumConnections, `${where}.service.maximumConnections`, 1, 1e7);
+    if (row2.capacityCalibration !== undefined) {
+      const calibration = object(row2.capacityCalibration, `${where}.capacityCalibration`);
+      exact3(calibration, [
+        "path",
+        "maxConcurrency",
+        "requestsPerWorker",
+        "maximumRequestsPerWorker",
+        "maxP95Ms",
+        "maxErrorRate",
+        "safetyRatio",
+        "requestTimeoutMs",
+        "minimumStageDurationMs",
+        "maxCpuUtilizationPercent",
+        "maxMemoryUtilizationPercent"
+      ], `${where}.capacityCalibration`);
+      if (typeof calibration.path !== "string" || !HEALTH_PATH.test(calibration.path) || calibration.path.includes("..") || calibration.path.includes("//")) {
+        fail2(`${where}.capacityCalibration.path`, "must be one bounded absolute loopback path.");
+      }
+      try {
+        validateCapacityCalibrationOptions({
+          ...calibration,
+          endpoint: `http://127.0.0.1:${String(service.port)}${calibration.path}`
+        });
+      } catch {
+        fail2(`${where}.capacityCalibration`, "contains invalid bounds.");
+      }
+    }
     validateResources(row2.resources, `${where}.resources`);
     if (runtime.kind === "container") {
       const resources = object(row2.resources, `${where}.resources`);
@@ -11464,6 +11495,15 @@ function compileDeployment(sourceValue) {
     named(componentName, "deployment.spec.components key");
     validateComponent(value, `deployment.spec.components.${componentName}`, targetDefinitions, requirementDefinitions);
   }
+  for (const targetName of targetNames) {
+    const calibrated = componentEntries.filter(([, component2]) => {
+      const candidate = component2;
+      return candidate.kind === "application" && candidate.target === targetName && candidate.capacityCalibration !== undefined;
+    });
+    if (calibrated.length > 1) {
+      fail2(`deployment.spec.components`, `may calibrate at most one application on target ${targetName}.`);
+    }
+  }
   for (const [targetName, target] of targetDefinitions) {
     if (target.connectivity?.public?.mode !== "cloudflare-tunnel")
       continue;
@@ -17971,13 +18011,21 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       if (typeof publicIdentity2 !== "string")
         throw new Error("remote Metal bootstrap omitted its public identity");
       const identity = parseMetalPublicIdentity(publicIdentity2);
-      writeOwnerJson2(request.metalIdentityEvidenceFile, {
+      const evidence = {
         format: 1,
         kind: "forgezero-operator-metal-identity",
         metalHostname: config.metalHostname,
         metalHostKeySha256: request.target.hostKeySha256,
         ...identity
-      }, "operator metal identity evidence");
+      };
+      if (existsSync11(request.metalIdentityEvidenceFile)) {
+        const current2 = readOperatorMetalIdentityEvidence(request.metalIdentityEvidenceFile, request);
+        if (current2.nodeKey !== evidence.nodeKey || current2.publicKeys.ed25519 !== evidence.publicKeys.ed25519 || current2.publicKeys.mlDsa !== evidence.publicKeys.mlDsa) {
+          throw new Error("remote Metal repair returned a different public identity");
+        }
+      } else {
+        writeOwnerJson2(request.metalIdentityEvidenceFile, evidence, "operator metal identity evidence");
+      }
     }
     return { plan, output };
   } finally {

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.113";
+var VERSION = "0.1.115";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.113";
+var VERSION = "0.1.115";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -1504,6 +1504,44 @@ var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync, realpathSync, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname3, join as join2, resolve as resolve3, sep } from "path";
 
+// src/capacity-calibration.ts
+function localCalibrationEndpoint(value) {
+  const endpoint2 = new URL(value);
+  if (endpoint2.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(endpoint2.hostname) || !endpoint2.port || endpoint2.username || endpoint2.password || endpoint2.hash) {
+    throw new Error("Capacity calibration requires an explicit loopback HTTP endpoint and port.");
+  }
+  return endpoint2;
+}
+function validateCapacityCalibrationOptions(options) {
+  const endpoint2 = localCalibrationEndpoint(options.endpoint);
+  const maxConcurrency = options.maxConcurrency ?? 256;
+  const requestsPerWorker = options.requestsPerWorker ?? 8;
+  const maximumRequestsPerWorker = options.maximumRequestsPerWorker ?? 100;
+  const maxP95Ms = options.maxP95Ms ?? 250;
+  const maxErrorRate = options.maxErrorRate ?? 0.01;
+  const safetyRatio = options.safetyRatio ?? 0.8;
+  const requestTimeoutMs = options.requestTimeoutMs ?? 5000;
+  const minimumStageDurationMs = options.minimumStageDurationMs ?? 5000;
+  const maxCpuUtilizationPercent = options.maxCpuUtilizationPercent ?? 90;
+  const maxMemoryUtilizationPercent = options.maxMemoryUtilizationPercent ?? 90;
+  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isSafeInteger(maximumRequestsPerWorker) || maximumRequestsPerWorker < requestsPerWorker || maximumRequestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
+    throw new Error("Capacity calibration bounds are invalid.");
+  }
+  return {
+    endpoint: endpoint2,
+    maxConcurrency,
+    requestsPerWorker,
+    maximumRequestsPerWorker,
+    maxP95Ms,
+    maxErrorRate,
+    safetyRatio,
+    requestTimeoutMs,
+    minimumStageDurationMs,
+    maxCpuUtilizationPercent,
+    maxMemoryUtilizationPercent
+  };
+}
+
 // src/definition.ts
 var RESERVED_STEP_ENV = new Set([
   "PATH",
@@ -7417,13 +7455,21 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       if (typeof publicIdentity2 !== "string")
         throw new Error("remote Metal bootstrap omitted its public identity");
       const identity = parseMetalPublicIdentity(publicIdentity2);
-      writeOwnerJson2(request.metalIdentityEvidenceFile, {
+      const evidence = {
         format: 1,
         kind: "forgezero-operator-metal-identity",
         metalHostname: config.metalHostname,
         metalHostKeySha256: request.target.hostKeySha256,
         ...identity
-      }, "operator metal identity evidence");
+      };
+      if (existsSync7(request.metalIdentityEvidenceFile)) {
+        const current2 = readOperatorMetalIdentityEvidence(request.metalIdentityEvidenceFile, request);
+        if (current2.nodeKey !== evidence.nodeKey || current2.publicKeys.ed25519 !== evidence.publicKeys.ed25519 || current2.publicKeys.mlDsa !== evidence.publicKeys.mlDsa) {
+          throw new Error("remote Metal repair returned a different public identity");
+        }
+      } else {
+        writeOwnerJson2(request.metalIdentityEvidenceFile, evidence, "operator metal identity evidence");
+      }
     }
     return { plan, output };
   } finally {

package/dist/platform-fleet-verification.js

@@ -1415,6 +1415,7 @@ function validateCapacityCalibrationOptions(options) {
   const endpoint = localCalibrationEndpoint(options.endpoint);
   const maxConcurrency = options.maxConcurrency ?? 256;
   const requestsPerWorker = options.requestsPerWorker ?? 8;
+  const maximumRequestsPerWorker = options.maximumRequestsPerWorker ?? 100;
   const maxP95Ms = options.maxP95Ms ?? 250;
   const maxErrorRate = options.maxErrorRate ?? 0.01;
   const safetyRatio = options.safetyRatio ?? 0.8;
@@ -1422,13 +1423,14 @@ function validateCapacityCalibrationOptions(options) {
   const minimumStageDurationMs = options.minimumStageDurationMs ?? 5000;
   const maxCpuUtilizationPercent = options.maxCpuUtilizationPercent ?? 90;
   const maxMemoryUtilizationPercent = options.maxMemoryUtilizationPercent ?? 90;
-  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
+  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isSafeInteger(maximumRequestsPerWorker) || maximumRequestsPerWorker < requestsPerWorker || maximumRequestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
     throw new Error("Capacity calibration bounds are invalid.");
   }
   return {
     endpoint,
     maxConcurrency,
     requestsPerWorker,
+    maximumRequestsPerWorker,
     maxP95Ms,
     maxErrorRate,
     safetyRatio,
@@ -1438,7 +1440,7 @@ function validateCapacityCalibrationOptions(options) {
     maxMemoryUtilizationPercent
   };
 }
-async function stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimumDurationMs, fetcher, sampler) {
+async function stage(endpoint, concurrency, requestsPerWorker, maximumRequestsPerWorker, timeoutMs, minimumDurationMs, fetcher, sampler) {
   const latencies = [];
   let succeeded = 0;
   let failed = 0;
@@ -1447,7 +1449,7 @@ async function stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimu
   const started = performance.now();
   await Promise.all(Array.from({ length: concurrency }, async () => {
     let request = 0;
-    while (request < requestsPerWorker || performance.now() - started < minimumDurationMs) {
+    while (request < maximumRequestsPerWorker && (request < requestsPerWorker || performance.now() - started < minimumDurationMs)) {
       request += 1;
       const requestStarted = performance.now();
       try {
@@ -1506,6 +1508,7 @@ async function calibrateHttpConcurrency(options, fetcher = fetch, sampler = host
     safetyRatio,
     requestTimeoutMs: timeoutMs,
     minimumStageDurationMs,
+    maximumRequestsPerWorker,
     maxCpuUtilizationPercent,
     maxMemoryUtilizationPercent
   } = validateCapacityCalibrationOptions(options);
@@ -1513,7 +1516,7 @@ async function calibrateHttpConcurrency(options, fetcher = fetch, sampler = host
   let lastSafe;
   let stopReason = "maximum-tested";
   for (let concurrency = 1;; concurrency = Math.min(maxConcurrency, concurrency * 2)) {
-    const measured = await stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimumStageDurationMs, fetcher, sampler);
+    const measured = await stage(endpoint, concurrency, requestsPerWorker, maximumRequestsPerWorker, timeoutMs, minimumStageDurationMs, fetcher, sampler);
     stages.push(measured);
     const previous = stages.at(-2);
     const throughputRegressed = Boolean(previous && concurrency > 1 && measured.successfulRequestsPerSecond < previous.successfulRequestsPerSecond * 0.9);
@@ -1614,6 +1617,7 @@ function capacityCalibration(value, where) {
     "endpoint",
     "maxConcurrency",
     "requestsPerWorker",
+    "maximumRequestsPerWorker",
     "maxP95Ms",
     "maxErrorRate",
     "safetyRatio",
@@ -1642,6 +1646,7 @@ function capacityCalibration(value, where) {
     ...Object.fromEntries([
       "maxConcurrency",
       "requestsPerWorker",
+      "maximumRequestsPerWorker",
       "maxP95Ms",
       "maxErrorRate",
       "safetyRatio",
@@ -3004,7 +3009,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.113";
+var VERSION3 = "0.1.115";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -1415,6 +1415,7 @@ function validateCapacityCalibrationOptions(options) {
   const endpoint = localCalibrationEndpoint(options.endpoint);
   const maxConcurrency = options.maxConcurrency ?? 256;
   const requestsPerWorker = options.requestsPerWorker ?? 8;
+  const maximumRequestsPerWorker = options.maximumRequestsPerWorker ?? 100;
   const maxP95Ms = options.maxP95Ms ?? 250;
   const maxErrorRate = options.maxErrorRate ?? 0.01;
   const safetyRatio = options.safetyRatio ?? 0.8;
@@ -1422,13 +1423,14 @@ function validateCapacityCalibrationOptions(options) {
   const minimumStageDurationMs = options.minimumStageDurationMs ?? 5000;
   const maxCpuUtilizationPercent = options.maxCpuUtilizationPercent ?? 90;
   const maxMemoryUtilizationPercent = options.maxMemoryUtilizationPercent ?? 90;
-  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
+  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isSafeInteger(maximumRequestsPerWorker) || maximumRequestsPerWorker < requestsPerWorker || maximumRequestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
     throw new Error("Capacity calibration bounds are invalid.");
   }
   return {
     endpoint,
     maxConcurrency,
     requestsPerWorker,
+    maximumRequestsPerWorker,
     maxP95Ms,
     maxErrorRate,
     safetyRatio,
@@ -1438,7 +1440,7 @@ function validateCapacityCalibrationOptions(options) {
     maxMemoryUtilizationPercent
   };
 }
-async function stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimumDurationMs, fetcher, sampler) {
+async function stage(endpoint, concurrency, requestsPerWorker, maximumRequestsPerWorker, timeoutMs, minimumDurationMs, fetcher, sampler) {
   const latencies = [];
   let succeeded = 0;
   let failed = 0;
@@ -1447,7 +1449,7 @@ async function stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimu
   const started = performance.now();
   await Promise.all(Array.from({ length: concurrency }, async () => {
     let request = 0;
-    while (request < requestsPerWorker || performance.now() - started < minimumDurationMs) {
+    while (request < maximumRequestsPerWorker && (request < requestsPerWorker || performance.now() - started < minimumDurationMs)) {
       request += 1;
       const requestStarted = performance.now();
       try {
@@ -1506,6 +1508,7 @@ async function calibrateHttpConcurrency(options, fetcher = fetch, sampler = host
     safetyRatio,
     requestTimeoutMs: timeoutMs,
     minimumStageDurationMs,
+    maximumRequestsPerWorker,
     maxCpuUtilizationPercent,
     maxMemoryUtilizationPercent
   } = validateCapacityCalibrationOptions(options);
@@ -1513,7 +1516,7 @@ async function calibrateHttpConcurrency(options, fetcher = fetch, sampler = host
   let lastSafe;
   let stopReason = "maximum-tested";
   for (let concurrency = 1;; concurrency = Math.min(maxConcurrency, concurrency * 2)) {
-    const measured = await stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimumStageDurationMs, fetcher, sampler);
+    const measured = await stage(endpoint, concurrency, requestsPerWorker, maximumRequestsPerWorker, timeoutMs, minimumStageDurationMs, fetcher, sampler);
     stages.push(measured);
     const previous = stages.at(-2);
     const throughputRegressed = Boolean(previous && concurrency > 1 && measured.successfulRequestsPerSecond < previous.successfulRequestsPerSecond * 0.9);
@@ -1614,6 +1617,7 @@ function capacityCalibration(value, where) {
     "endpoint",
     "maxConcurrency",
     "requestsPerWorker",
+    "maximumRequestsPerWorker",
     "maxP95Ms",
     "maxErrorRate",
     "safetyRatio",
@@ -1642,6 +1646,7 @@ function capacityCalibration(value, where) {
     ...Object.fromEntries([
       "maxConcurrency",
       "requestsPerWorker",
+      "maximumRequestsPerWorker",
       "maxP95Ms",
       "maxErrorRate",
       "safetyRatio",
@@ -3004,7 +3009,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.113";
+var VERSION3 = "0.1.115";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";