@forgezero/agent 0.1.114 → 0.1.116

package/dist/fz-agent.js

@@ -5568,6 +5568,7 @@ function validateCapacityCalibrationOptions(options) {
   const endpoint = localCalibrationEndpoint(options.endpoint);
   const maxConcurrency = options.maxConcurrency ?? 256;
   const requestsPerWorker = options.requestsPerWorker ?? 8;
+  const maximumRequestsPerWorker = options.maximumRequestsPerWorker ?? 100;
   const maxP95Ms = options.maxP95Ms ?? 250;
   const maxErrorRate = options.maxErrorRate ?? 0.01;
   const safetyRatio = options.safetyRatio ?? 0.8;
@@ -5575,13 +5576,14 @@ function validateCapacityCalibrationOptions(options) {
   const minimumStageDurationMs = options.minimumStageDurationMs ?? 5000;
   const maxCpuUtilizationPercent = options.maxCpuUtilizationPercent ?? 90;
   const maxMemoryUtilizationPercent = options.maxMemoryUtilizationPercent ?? 90;
-  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
+  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isSafeInteger(maximumRequestsPerWorker) || maximumRequestsPerWorker < requestsPerWorker || maximumRequestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
     throw new Error("Capacity calibration bounds are invalid.");
   }
   return {
     endpoint,
     maxConcurrency,
     requestsPerWorker,
+    maximumRequestsPerWorker,
     maxP95Ms,
     maxErrorRate,
     safetyRatio,
@@ -5591,7 +5593,7 @@ function validateCapacityCalibrationOptions(options) {
     maxMemoryUtilizationPercent
   };
 }
-async function stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimumDurationMs, fetcher, sampler) {
+async function stage(endpoint, concurrency, requestsPerWorker, maximumRequestsPerWorker, timeoutMs, minimumDurationMs, fetcher, sampler) {
   const latencies = [];
   let succeeded = 0;
   let failed = 0;
@@ -5600,7 +5602,7 @@ async function stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimu
   const started = performance.now();
   await Promise.all(Array.from({ length: concurrency }, async () => {
     let request = 0;
-    while (request < requestsPerWorker || performance.now() - started < minimumDurationMs) {
+    while (request < maximumRequestsPerWorker && (request < requestsPerWorker || performance.now() - started < minimumDurationMs)) {
       request += 1;
       const requestStarted = performance.now();
       try {
@@ -5659,6 +5661,7 @@ async function calibrateHttpConcurrency(options, fetcher = fetch, sampler = host
     safetyRatio,
     requestTimeoutMs: timeoutMs,
     minimumStageDurationMs,
+    maximumRequestsPerWorker,
     maxCpuUtilizationPercent,
     maxMemoryUtilizationPercent
   } = validateCapacityCalibrationOptions(options);
@@ -5666,7 +5669,7 @@ async function calibrateHttpConcurrency(options, fetcher = fetch, sampler = host
   let lastSafe;
   let stopReason = "maximum-tested";
   for (let concurrency = 1;; concurrency = Math.min(maxConcurrency, concurrency * 2)) {
-    const measured = await stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimumStageDurationMs, fetcher, sampler);
+    const measured = await stage(endpoint, concurrency, requestsPerWorker, maximumRequestsPerWorker, timeoutMs, minimumStageDurationMs, fetcher, sampler);
     stages.push(measured);
     const previous = stages.at(-2);
     const throughputRegressed = Boolean(previous && concurrency > 1 && measured.successfulRequestsPerSecond < previous.successfulRequestsPerSecond * 0.9);
@@ -5767,6 +5770,7 @@ function capacityCalibration(value, where) {
     "endpoint",
     "maxConcurrency",
     "requestsPerWorker",
+    "maximumRequestsPerWorker",
     "maxP95Ms",
     "maxErrorRate",
     "safetyRatio",
@@ -5795,6 +5799,7 @@ function capacityCalibration(value, where) {
     ...Object.fromEntries([
       "maxConcurrency",
       "requestsPerWorker",
+      "maximumRequestsPerWorker",
       "maxP95Ms",
       "maxErrorRate",
       "safetyRatio",
@@ -6730,7 +6735,7 @@ function validateComponent(value, where, targets, requirements) {
   const row2 = object(value, where);
   const selectedTarget = targets.get(String(row2.target)) ?? fail(`${where}.target`, "must name an existing target.");
   if (row2.kind === "application") {
-    exact3(row2, ["kind", "target", "runtime", "service", "resources", "storage", "network", "rollout"], where);
+    exact3(row2, ["kind", "target", "runtime", "service", "capacityCalibration", "resources", "storage", "network", "rollout"], where);
     const runtime = object(row2.runtime, `${where}.runtime`);
     const runtimeRequirement = requirements.get(String(runtime.requirement));
     if (!runtimeRequirement)
@@ -6812,6 +6817,33 @@ function validateComponent(value, where, targets, requirements) {
       fail(`${where}.service.websocket`, "must be a boolean.");
     if (service.maximumConnections !== undefined)
       integer(service.maximumConnections, `${where}.service.maximumConnections`, 1, 1e7);
+    if (row2.capacityCalibration !== undefined) {
+      const calibration = object(row2.capacityCalibration, `${where}.capacityCalibration`);
+      exact3(calibration, [
+        "path",
+        "maxConcurrency",
+        "requestsPerWorker",
+        "maximumRequestsPerWorker",
+        "maxP95Ms",
+        "maxErrorRate",
+        "safetyRatio",
+        "requestTimeoutMs",
+        "minimumStageDurationMs",
+        "maxCpuUtilizationPercent",
+        "maxMemoryUtilizationPercent"
+      ], `${where}.capacityCalibration`);
+      if (typeof calibration.path !== "string" || !HEALTH_PATH.test(calibration.path) || calibration.path.includes("..") || calibration.path.includes("//")) {
+        fail(`${where}.capacityCalibration.path`, "must be one bounded absolute loopback path.");
+      }
+      try {
+        validateCapacityCalibrationOptions({
+          ...calibration,
+          endpoint: `http://127.0.0.1:${String(service.port)}${calibration.path}`
+        });
+      } catch {
+        fail(`${where}.capacityCalibration`, "contains invalid bounds.");
+      }
+    }
     validateResources(row2.resources, `${where}.resources`);
     if (runtime.kind === "container") {
       const resources = object(row2.resources, `${where}.resources`);
@@ -7274,6 +7306,15 @@ function compileDeployment(sourceValue) {
     named(componentName, "deployment.spec.components key");
     validateComponent(value, `deployment.spec.components.${componentName}`, targetDefinitions, requirementDefinitions);
   }
+  for (const targetName of targetNames) {
+    const calibrated = componentEntries.filter(([, component2]) => {
+      const candidate = component2;
+      return candidate.kind === "application" && candidate.target === targetName && candidate.capacityCalibration !== undefined;
+    });
+    if (calibrated.length > 1) {
+      fail(`deployment.spec.components`, `may calibrate at most one application on target ${targetName}.`);
+    }
+  }
   for (const [targetName, target] of targetDefinitions) {
     if (target.connectivity?.public?.mode !== "cloudflare-tunnel")
       continue;
@@ -8340,14 +8381,14 @@ function createDeploymentManager(options) {
           } : {}
         });
       for (const targetName of targetNames) {
-        const capacity2 = resolvedTargets.find(({ name }) => name === targetName)?.allocation.resources;
-        if (!capacity2)
+        const capacity3 = resolvedTargets.find(({ name }) => name === targetName)?.allocation.resources;
+        if (!capacity3)
           throw new DeploymentError("PIPELINE_FAILED", `target ${targetName} has no resolved capacity`);
         const components = Object.values(plan.spec.components).filter(({ target }) => target === targetName);
         const cpu = components.reduce((sum, component2) => sum + (component2.resources?.cpu?.limit ?? 0), 0);
         const memoryMiB = components.reduce((sum, component2) => sum + (component2.resources?.memory?.limitMiB ?? 0), 0);
         const ephemeralMiB = components.reduce((sum, component2) => sum + (component2.kind === "application" ? (component2.storage ?? []).reduce((storage, mount) => storage + (mount.class === "ephemeral" ? mount.sizeMiB : 0), 0) : 0), 0);
-        if (cpu > capacity2.cpuCores || memoryMiB > capacity2.memoryMiB || ephemeralMiB > capacity2.storageGiB * 1024) {
+        if (cpu > capacity3.cpuCores || memoryMiB > capacity3.memoryMiB || ephemeralMiB > capacity3.storageGiB * 1024) {
           throw new DeploymentError("PIPELINE_FAILED", `component limits exceed the reserved capacity of target ${targetName}`);
         }
       }
@@ -8592,6 +8633,37 @@ function createDeploymentManager(options) {
         const failed = run2.steps.find((step2) => step2.status === "failed" || step2.status === "manual-intervention");
         throw new DeploymentError("PIPELINE_FAILED", `deployment plan failed at ${failed?.id ?? "unknown step"}: ${failed?.error?.message ?? run2.status}`, deploymentExecution([phase]));
       }
+      const executionTarget = assigned?.targetName ?? matchingTargetNames[0];
+      const calibratedApplication = Object.values(plan.spec.components).find((component2) => component2.kind === "application" && component2.target === executionTarget && component2.capacityCalibration !== undefined);
+      let capacity2;
+      if (calibratedApplication?.kind === "application" && calibratedApplication.capacityCalibration) {
+        if (!options.capacityEvidenceDirectory) {
+          throw new DeploymentError("PIPELINE_FAILED", "capacity calibration was requested but the Agent has no evidence directory");
+        }
+        const { path: path2, ...bounds } = calibratedApplication.capacityCalibration;
+        const calibration = await (options.calibrateCapacity ?? calibrateHttpConcurrency)({
+          ...bounds,
+          endpoint: `http://127.0.0.1:${calibratedApplication.service.port}${path2}`
+        });
+        const measuredAtTs = now();
+        const evidencePath = persistCapacityCalibration({
+          directory: options.capacityEvidenceDirectory,
+          deploymentKey: options.key,
+          revision: head,
+          definitionDigest: plan.sourceDigest,
+          profile: options.profile,
+          measuredAtTs,
+          calibration
+        });
+        capacity2 = {
+          ...calibration,
+          evidencePath,
+          recommendedCoordinate: {
+            FZ_REQUESTS_PER_SECOND_LIMIT: String(calibration.allowedRequestsPerSecond),
+            FZ_CONCURRENCY_LIMIT: String(calibration.recommendedConcurrency)
+          }
+        };
+      }
       return {
         key: options.key,
         repository: options.repository,
@@ -8604,7 +8676,8 @@ function createDeploymentManager(options) {
         ok: true,
         phases: [phase],
         execution: deploymentExecution([phase]),
-        resolvedTargets
+        resolvedTargets,
+        ...capacity2 ? { capacity: capacity2 } : {}
       };
     }
     const definition = parseDeployDefinition(readDefinition(join2(release, ".fz", "deploy.json")));
@@ -9528,7 +9601,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.114";
+var VERSION2 = "0.1.116";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4841,7 +4841,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.114";
+var VERSION2 = "0.1.116";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4941,6 +4941,7 @@ function validateCapacityCalibrationOptions(options) {
   const endpoint = localCalibrationEndpoint(options.endpoint);
   const maxConcurrency = options.maxConcurrency ?? 256;
   const requestsPerWorker = options.requestsPerWorker ?? 8;
+  const maximumRequestsPerWorker = options.maximumRequestsPerWorker ?? 100;
   const maxP95Ms = options.maxP95Ms ?? 250;
   const maxErrorRate = options.maxErrorRate ?? 0.01;
   const safetyRatio = options.safetyRatio ?? 0.8;
@@ -4948,13 +4949,14 @@ function validateCapacityCalibrationOptions(options) {
   const minimumStageDurationMs = options.minimumStageDurationMs ?? 5000;
   const maxCpuUtilizationPercent = options.maxCpuUtilizationPercent ?? 90;
   const maxMemoryUtilizationPercent = options.maxMemoryUtilizationPercent ?? 90;
-  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
+  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isSafeInteger(maximumRequestsPerWorker) || maximumRequestsPerWorker < requestsPerWorker || maximumRequestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
     throw new Error("Capacity calibration bounds are invalid.");
   }
   return {
     endpoint,
     maxConcurrency,
     requestsPerWorker,
+    maximumRequestsPerWorker,
     maxP95Ms,
     maxErrorRate,
     safetyRatio,
@@ -5034,6 +5036,7 @@ function capacityCalibration(value, where) {
     "endpoint",
     "maxConcurrency",
     "requestsPerWorker",
+    "maximumRequestsPerWorker",
     "maxP95Ms",
     "maxErrorRate",
     "safetyRatio",
@@ -5062,6 +5065,7 @@ function capacityCalibration(value, where) {
     ...Object.fromEntries([
       "maxConcurrency",
       "requestsPerWorker",
+      "maximumRequestsPerWorker",
       "maxP95Ms",
       "maxErrorRate",
       "safetyRatio",
@@ -10920,7 +10924,7 @@ function validateComponent(value, where, targets, requirements) {
   const row2 = object(value, where);
   const selectedTarget = targets.get(String(row2.target)) ?? fail2(`${where}.target`, "must name an existing target.");
   if (row2.kind === "application") {
-    exact3(row2, ["kind", "target", "runtime", "service", "resources", "storage", "network", "rollout"], where);
+    exact3(row2, ["kind", "target", "runtime", "service", "capacityCalibration", "resources", "storage", "network", "rollout"], where);
     const runtime = object(row2.runtime, `${where}.runtime`);
     const runtimeRequirement = requirements.get(String(runtime.requirement));
     if (!runtimeRequirement)
@@ -11002,6 +11006,33 @@ function validateComponent(value, where, targets, requirements) {
       fail2(`${where}.service.websocket`, "must be a boolean.");
     if (service.maximumConnections !== undefined)
       integer(service.maximumConnections, `${where}.service.maximumConnections`, 1, 1e7);
+    if (row2.capacityCalibration !== undefined) {
+      const calibration = object(row2.capacityCalibration, `${where}.capacityCalibration`);
+      exact3(calibration, [
+        "path",
+        "maxConcurrency",
+        "requestsPerWorker",
+        "maximumRequestsPerWorker",
+        "maxP95Ms",
+        "maxErrorRate",
+        "safetyRatio",
+        "requestTimeoutMs",
+        "minimumStageDurationMs",
+        "maxCpuUtilizationPercent",
+        "maxMemoryUtilizationPercent"
+      ], `${where}.capacityCalibration`);
+      if (typeof calibration.path !== "string" || !HEALTH_PATH.test(calibration.path) || calibration.path.includes("..") || calibration.path.includes("//")) {
+        fail2(`${where}.capacityCalibration.path`, "must be one bounded absolute loopback path.");
+      }
+      try {
+        validateCapacityCalibrationOptions({
+          ...calibration,
+          endpoint: `http://127.0.0.1:${String(service.port)}${calibration.path}`
+        });
+      } catch {
+        fail2(`${where}.capacityCalibration`, "contains invalid bounds.");
+      }
+    }
     validateResources(row2.resources, `${where}.resources`);
     if (runtime.kind === "container") {
       const resources = object(row2.resources, `${where}.resources`);
@@ -11464,6 +11495,15 @@ function compileDeployment(sourceValue) {
     named(componentName, "deployment.spec.components key");
     validateComponent(value, `deployment.spec.components.${componentName}`, targetDefinitions, requirementDefinitions);
   }
+  for (const targetName of targetNames) {
+    const calibrated = componentEntries.filter(([, component2]) => {
+      const candidate = component2;
+      return candidate.kind === "application" && candidate.target === targetName && candidate.capacityCalibration !== undefined;
+    });
+    if (calibrated.length > 1) {
+      fail2(`deployment.spec.components`, `may calibrate at most one application on target ${targetName}.`);
+    }
+  }
   for (const [targetName, target] of targetDefinitions) {
     if (target.connectivity?.public?.mode !== "cloudflare-tunnel")
       continue;
@@ -12198,6 +12238,9 @@ function platformGenesisClaims(guests, sshPublicKeys) {
     throw new Error("platform genesis requires at least one operator SSH public key");
   return reviewed.map((guest) => claimFor(guest, keys, "create"));
 }
+function platformGenesisDeletionClaims(guests) {
+  return validatePlatformGenesisGuests(guests).map((guest) => claimFor(guest, [], "delete"));
+}
 function platformCommunityRehearsalClaims(seedGuests, rehearsalGuest, sshPublicKeys) {
   const reviewed = validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4);
   const keys = [...new Set(sshPublicKeys.map(publicKey))];
@@ -17323,14 +17366,14 @@ function planOperatorMetalBootstrap(request, mode) {
   if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
     throw new Error("the reviewed metal request has no rehearsal node");
   }
-  const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
+  const claims = mode === "genesis-cleanup" ? platformGenesisDeletionClaims(request.genesis.nodes) : mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
   const genesisNodes = mode === "host-keys" ? request.genesis.nodes.map(({ name }) => name) : mode === "rehearsal-host-keys" ? guestRows(request).map(({ name }) => name) : claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name));
   return {
     kind: "metal-remote",
     mode,
     mutation: !["status", "host-keys", "rehearsal-host-keys"].includes(mode),
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "host-keys" || mode === "rehearsal-host-keys" ? ["verify pinned SSH transport", "collect exact Ed25519 host keys for the reviewed guest addresses"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "host-keys" || mode === "rehearsal-host-keys" ? ["verify pinned SSH transport", "collect exact Ed25519 host keys for the reviewed guest addresses"] : mode === "genesis" || mode === "genesis-cleanup" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "genesis-cleanup" ? "delete the exact three reviewed platform guests and their owned disks, units, seed data and inventory" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
@@ -17928,13 +17971,13 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
         output: JSON.stringify(await collectOperatorGuestHostKeys(request, { ...options, exec }, mode === "rehearsal-host-keys"))
       };
     }
-    if (mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
+    if (mode === "genesis" || mode === "genesis-cleanup" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
       if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
         throw new Error("the reviewed metal request has no rehearsal node");
       }
       const outputs = [];
-      const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
+      const claims = mode === "genesis-cleanup" ? platformGenesisDeletionClaims(request.genesis.nodes) : mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
       for (const claim of claims) {
         outputs.push(await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz-agent", "metal-apply", "--claim=-"], `provision ${claim.spec.guestName}`, false, `${JSON.stringify(claim)}
 `));
@@ -18838,7 +18881,9 @@ function parseOptions(argv2) {
       options.bootstrapConfigPath = argv2[++index];
     else if (token === "--secrets-env-file")
       options.bootstrapSecretsEnvFile = argv2[++index];
-    else if (token === "--output")
+    else if (token.startsWith("--confirm-disposable-fleet=")) {
+      options.disposableFleetConfirmation = token.slice("--confirm-disposable-fleet=".length);
+    } else if (token === "--output")
       options.outputPath = argv2[++index];
     else if (token === "--query")
       options.queries.push(argv2[++index] ?? "");
@@ -20035,8 +20080,8 @@ async function cmdBootstrap(options, args) {
     }
     if (operation === "metal" && args[1] === "remote") {
       const mode = args[2];
-      if (!mode || !["apply", "genesis", "rehearsal", "rehearsal-cleanup", "host-keys", "rehearsal-host-keys", "status"].includes(mode) || args[3] !== undefined) {
-        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status> --bootstrap-config <owner-only-request.json> [--output <owner-only-evidence.json>] [--apply]");
+      if (!mode || !["apply", "genesis", "genesis-cleanup", "rehearsal", "rehearsal-cleanup", "host-keys", "rehearsal-host-keys", "status"].includes(mode) || args[3] !== undefined) {
+        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|genesis-cleanup|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status> --bootstrap-config <owner-only-request.json> [--output <owner-only-evidence.json>] [--confirm-disposable-fleet=<exact-names>] [--apply]");
       }
       if (!options.bootstrapConfigPath)
         throw new Error("remote metal bootstrap requires --bootstrap-config");
@@ -20047,6 +20092,17 @@ async function cmdBootstrap(options, args) {
         validateMetalConfig: mode === "apply"
       });
       const plan2 = planOperatorMetalBootstrap(request, mode);
+      if (mode === "genesis-cleanup") {
+        const expected = plan2.genesisNodes.join(",");
+        if (!options.apply) {
+          out.line(JSON.stringify({ ...plan2, requiredConfirmation: expected }, null, 2));
+          out.step(`Repeat with --confirm-disposable-fleet=${expected} --apply to delete only this reviewed fleet.`);
+          return 0;
+        }
+        if (options.disposableFleetConfirmation !== expected) {
+          throw new Error(`genesis cleanup requires --confirm-disposable-fleet=${expected}`);
+        }
+      }
       if (!options.apply) {
         out.line(JSON.stringify(plan2, null, 2));
         out.step("Review the pinned metal target and exact genesis nodes, then repeat with --apply to contact the host.");
@@ -20148,7 +20204,7 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (!["platform", "repair"].includes(operation)) {
-      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [launch|bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>]|status|repair [--bootstrap-config <path>] [--apply]");
+      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [launch|bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|genesis-cleanup|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>]|status|repair [--bootstrap-config <path>] [--apply]");
     }
     const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
       throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
@@ -20818,7 +20874,7 @@ function usage() {
 	                         Persist secret-free public-node acceptance, then remove
 	                         the completed non-secret checkpoint and node handoffs
 	 fz bootstrap metal      Plan/install an identity-only physical provisioner
-	 fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>
+	 fz bootstrap metal remote <apply|genesis|genesis-cleanup|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>
 	                         Install/bootstrap one pinned blank metal target, then
 	                         provision the exact selected three-node genesis seed
 	 fz bootstrap status     Verify persisted profile and supervised units

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.114";
+var VERSION = "0.1.116";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.d.ts

@@ -90,7 +90,7 @@ export interface OperatorPlatformFleetCoordinates {
     }[];
 }
 export type OperatorPlatformBootstrapMode = 'apply' | 'status';
-export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'rehearsal' | 'rehearsal-cleanup' | 'host-keys' | 'rehearsal-host-keys' | 'status';
+export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'genesis-cleanup' | 'rehearsal' | 'rehearsal-cleanup' | 'host-keys' | 'rehearsal-host-keys' | 'status';
 export interface OperatorPlatformBootstrapPlan {
     kind: 'platform-remote';
     mode: OperatorPlatformBootstrapMode;

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.114";
+var VERSION = "0.1.116";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -1504,6 +1504,44 @@ var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync, realpathSync, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname3, join as join2, resolve as resolve3, sep } from "path";
 
+// src/capacity-calibration.ts
+function localCalibrationEndpoint(value) {
+  const endpoint2 = new URL(value);
+  if (endpoint2.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(endpoint2.hostname) || !endpoint2.port || endpoint2.username || endpoint2.password || endpoint2.hash) {
+    throw new Error("Capacity calibration requires an explicit loopback HTTP endpoint and port.");
+  }
+  return endpoint2;
+}
+function validateCapacityCalibrationOptions(options) {
+  const endpoint2 = localCalibrationEndpoint(options.endpoint);
+  const maxConcurrency = options.maxConcurrency ?? 256;
+  const requestsPerWorker = options.requestsPerWorker ?? 8;
+  const maximumRequestsPerWorker = options.maximumRequestsPerWorker ?? 100;
+  const maxP95Ms = options.maxP95Ms ?? 250;
+  const maxErrorRate = options.maxErrorRate ?? 0.01;
+  const safetyRatio = options.safetyRatio ?? 0.8;
+  const requestTimeoutMs = options.requestTimeoutMs ?? 5000;
+  const minimumStageDurationMs = options.minimumStageDurationMs ?? 5000;
+  const maxCpuUtilizationPercent = options.maxCpuUtilizationPercent ?? 90;
+  const maxMemoryUtilizationPercent = options.maxMemoryUtilizationPercent ?? 90;
+  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isSafeInteger(maximumRequestsPerWorker) || maximumRequestsPerWorker < requestsPerWorker || maximumRequestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
+    throw new Error("Capacity calibration bounds are invalid.");
+  }
+  return {
+    endpoint: endpoint2,
+    maxConcurrency,
+    requestsPerWorker,
+    maximumRequestsPerWorker,
+    maxP95Ms,
+    maxErrorRate,
+    safetyRatio,
+    requestTimeoutMs,
+    minimumStageDurationMs,
+    maxCpuUtilizationPercent,
+    maxMemoryUtilizationPercent
+  };
+}
+
 // src/definition.ts
 var RESERVED_STEP_ENV = new Set([
   "PATH",
@@ -3089,6 +3127,9 @@ function platformGenesisClaims(guests, sshPublicKeys) {
     throw new Error("platform genesis requires at least one operator SSH public key");
   return reviewed.map((guest) => claimFor(guest, keys, "create"));
 }
+function platformGenesisDeletionClaims(guests) {
+  return validatePlatformGenesisGuests(guests).map((guest) => claimFor(guest, [], "delete"));
+}
 function platformCommunityRehearsalClaims(seedGuests, rehearsalGuest, sshPublicKeys) {
   const reviewed = validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4);
   const keys = [...new Set(sshPublicKeys.map(publicKey))];
@@ -6674,14 +6715,14 @@ function planOperatorMetalBootstrap(request, mode) {
   if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
     throw new Error("the reviewed metal request has no rehearsal node");
   }
-  const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
+  const claims = mode === "genesis-cleanup" ? platformGenesisDeletionClaims(request.genesis.nodes) : mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
   const genesisNodes = mode === "host-keys" ? request.genesis.nodes.map(({ name }) => name) : mode === "rehearsal-host-keys" ? guestRows(request).map(({ name }) => name) : claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name));
   return {
     kind: "metal-remote",
     mode,
     mutation: !["status", "host-keys", "rehearsal-host-keys"].includes(mode),
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "host-keys" || mode === "rehearsal-host-keys" ? ["verify pinned SSH transport", "collect exact Ed25519 host keys for the reviewed guest addresses"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "host-keys" || mode === "rehearsal-host-keys" ? ["verify pinned SSH transport", "collect exact Ed25519 host keys for the reviewed guest addresses"] : mode === "genesis" || mode === "genesis-cleanup" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "genesis-cleanup" ? "delete the exact three reviewed platform guests and their owned disks, units, seed data and inventory" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
@@ -7374,13 +7415,13 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
         output: JSON.stringify(await collectOperatorGuestHostKeys(request, { ...options, exec }, mode === "rehearsal-host-keys"))
       };
     }
-    if (mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
+    if (mode === "genesis" || mode === "genesis-cleanup" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
       if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
         throw new Error("the reviewed metal request has no rehearsal node");
       }
       const outputs = [];
-      const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
+      const claims = mode === "genesis-cleanup" ? platformGenesisDeletionClaims(request.genesis.nodes) : mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
       for (const claim of claims) {
         outputs.push(await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz-agent", "metal-apply", "--claim=-"], `provision ${claim.spec.guestName}`, false, `${JSON.stringify(claim)}
 `));

package/dist/platform-bootstrap-runtime.js

@@ -669,6 +669,9 @@ function platformGenesisClaims(guests, sshPublicKeys) {
     throw new Error("platform genesis requires at least one operator SSH public key");
   return reviewed.map((guest) => claimFor(guest, keys, "create"));
 }
+function platformGenesisDeletionClaims(guests) {
+  return validatePlatformGenesisGuests(guests).map((guest) => claimFor(guest, [], "delete"));
+}
 function platformCommunityRehearsalClaims(seedGuests, rehearsalGuest, sshPublicKeys) {
   const reviewed = validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4);
   const keys = [...new Set(sshPublicKeys.map(publicKey))];