@forgezero/agent 0.1.125 → 0.1.129

package/README.md

@@ -214,7 +214,7 @@ fz unlock --phrase-file /secure/offline-phrase.txt
 
 ## Use website operations from a project or an AI agent
 
-Every UI operation is an API operation. `fz ui routes --json` discovers the exact actions allowed by the signed-in account’s current realm, lifecycle stage and grants from the API’s enforced matrix, so the CLI and AI agents carry no copied route list. `fz api` (also `fz ui`) executes authenticated JSON GET, POST, PUT, PATCH and DELETE without requiring a browser visit for ordinary work. Paths are forced onto the signed-in origin, query values are repeatable, bodies can be inline, stdin or a file, and server grants plus fresh-proof rules remain authoritative. `fz project init|sync|check` separately gives AI tools one Git-persisted project memory.
+Every UI operation is an API operation. `fz ui routes --json` discovers the exact actions allowed by the signed-in account’s current workspace, lifecycle stage and permissions from the API’s enforced matrix, so the CLI and AI agents carry no copied route list. `fz api` (also `fz ui`) executes authenticated JSON GET, POST, PUT, PATCH and DELETE without requiring a browser visit for ordinary work. Paths are forced onto the signed-in origin, query values are repeatable, bodies can be inline, stdin or a file, and server permissions plus fresh-proof rules remain authoritative. `fz project init|sync|check` separately gives AI tools one Git-persisted project memory.
 
 ```text
 fz ui routes --json

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.125";
+var VERSION3 = "0.1.129";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.d.ts

@@ -123,7 +123,9 @@ export interface EnrolledComputeBootstrapSecrets {
 }
 export type BootstrapSecrets = PlatformBootstrapSecrets | EnrolledComputeBootstrapSecrets;
 export declare function validateEnrolledComputeBootstrapSecrets(config: EnrolledComputeActivationConfig, input: unknown): EnrolledComputeBootstrapSecrets;
-export declare function validatePlatformBootstrapSecrets(config: PlatformBootstrapConfig, input: unknown): PlatformBootstrapSecrets;
+export declare function validatePlatformBootstrapSecrets(config: PlatformBootstrapConfig, input: unknown, options?: {
+    allowStoredCloudflareCredentials?: boolean;
+}): PlatformBootstrapSecrets;
 export interface BootstrapStep {
     id: string;
     label: string;
@@ -208,6 +210,7 @@ export declare function interruptedPlatformReleaseIdentityDigests(config: Platfo
 export declare function bootstrapStatus(host?: BootstrapHost): Promise<BootstrapStatus>;
 export declare function applyBootstrap(input: BootstrapConfig, host?: BootstrapHost, secrets?: BootstrapSecrets, dependencies?: {
     fetcher?: typeof fetch;
+    reuseBoundPlatformCredentials?: boolean;
 }): Promise<BootstrapResult>;
 export declare function readBootstrapConfig(path: string): BootstrapConfig;
 interface BootstrapAgentInitialBundle {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.125";
+var VERSION = "0.1.129";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3805,7 +3805,7 @@ function validateEnrolledComputeBootstrapSecrets(config, input) {
     ...cloudflareConfigured ? validateCloudflareBootstrapSecretPair(source) : {}
   };
 }
-function validatePlatformBootstrapSecrets(config, input) {
+function validatePlatformBootstrapSecrets(config, input, options = {}) {
   if (!input || typeof input !== "object" || Array.isArray(input))
     throw new Error("bootstrap credential input must be an object");
   const source = input;
@@ -3833,7 +3833,8 @@ function validatePlatformBootstrapSecrets(config, input) {
     throw new Error("backup credential is malformed");
   }
   const cloudflareConfigured = Boolean(config.cloudflareHandoff || config.runtime.environment.cloudflare);
-  if (cloudflareConfigured !== Boolean(cloudflareTunnelToken && cloudflareApiToken)) {
+  const cloudflareCredentialsSupplied = Boolean(cloudflareTunnelToken || cloudflareApiToken);
+  if (!cloudflareConfigured && cloudflareCredentialsSupplied || cloudflareConfigured && !cloudflareCredentialsSupplied && !options.allowStoredCloudflareCredentials || Boolean(cloudflareTunnelToken) !== Boolean(cloudflareApiToken)) {
     throw new Error("Cloudflare configuration requires attended CF_TUNNEL_TOKEN and CF_API_TOKEN together");
   }
   if (cloudflareTunnelToken)
@@ -4756,10 +4757,16 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     }
     allowInterruptedReleaseRebind = !exactIdentity && (boundedReleaseResume || approvedIdentityMigration);
   }
-  const platformPrivate = config.kind === "platform" ? (() => {
+  const reuseBoundPlatformCredentials = config.kind === "platform" && dependencies.reuseBoundPlatformCredentials === true;
+  if (reuseBoundPlatformCredentials && (!installed || !host.exists("/var/lib/forgezero/enrolment.json"))) {
+    throw new Error("stored-credential promotion requires an installed enrolled platform compute");
+  }
+  const platformPrivate = config.kind === "platform" && !reuseBoundPlatformCredentials ? (() => {
     if (!secrets)
       throw new Error("platform apply requires attended credentials on stdin");
-    const checked4 = validatePlatformBootstrapSecrets(config, secrets);
+    const checked4 = validatePlatformBootstrapSecrets(config, secrets, {
+      allowStoredCloudflareCredentials: Boolean(installed?.cloudflare && config.cloudflareHandoff && !cloudflare)
+    });
     return {
       root: checked4.clusterBootstrapCode,
       email: checked4.emailSecret,
@@ -4797,7 +4804,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (cloudflarePrivate && !host.exists(CF_API_CREDENTIAL)) {
     await seal(host, "CF_API_TOKEN", CF_API_CREDENTIAL, cloudflarePrivate.cloudflareApiToken);
   }
-  if (config.kind === "platform" && platformPrivate.cloudflareTunnelToken && !host.exists(CF_TUNNEL_API_CREDENTIAL)) {
+  if (config.kind === "platform" && platformPrivate?.cloudflareTunnelToken && !host.exists(CF_TUNNEL_API_CREDENTIAL)) {
     await seal(host, "CF_TUNNEL_TOKEN", CF_TUNNEL_API_CREDENTIAL, platformPrivate.cloudflareTunnelToken);
   }
   const realtimeSecrets = cloudflare?.realtime && cloudflarePrivate ? deriveCloudflareRealtimeSecrets(cloudflarePrivate.cloudflareApiToken) : undefined;
@@ -4855,24 +4862,38 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await verifyBootstrapBundleOnHost(host, config, true);
   }
   if (config.kind === "platform") {
-    const root = platformPrivate.root;
-    if (!host.exists(JWT_CREDENTIAL)) {
-      await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
-    }
-    if (!host.exists(ARANGO_ROOT_CREDENTIAL)) {
-      await seal(host, "arangodb-root-password", ARANGO_ROOT_CREDENTIAL, `fzr_${derive(root, "forgezero/cluster/arangodb-root-password/v1")}`);
-    }
-    await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
-    await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
-    for (const [name, source] of Object.entries({
-      ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "backup.s3.secretAccessKey": platformPrivate.backup
-    })) {
-      if (source) {
-        const destination2 = `${CREDS}/${name}.cred`;
-        if (!host.exists(destination2)) {
-          await seal(host, name, destination2, source);
+    if (reuseBoundPlatformCredentials) {
+      const required = [
+        ...config.database.role !== "none" ? [JWT_CREDENTIAL, ARANGO_ROOT_CREDENTIAL] : [],
+        SEED_CREDENTIAL,
+        BACKUP_RECOVERY_CREDENTIAL,
+        ...emailCredentialName ? [`${CREDS}/${emailCredentialName}.cred`] : [],
+        ...config.runtime.environment.backup ? [`${CREDS}/backup.s3.secretAccessKey.cred`] : [],
+        ...installed?.cloudflare ? [CF_API_CREDENTIAL, CF_TUNNEL_API_CREDENTIAL, TUNNEL_CREDENTIAL] : [],
+        ...installed?.realtime ? [REALTIME_PUBLISH_CREDENTIAL, REALTIME_TICKET_CREDENTIAL] : []
+      ];
+      const missing = required.find((path) => !host.exists(path));
+      if (missing)
+        throw new Error(`stored platform credential is missing: ${missing}`);
+    } else {
+      const root = platformPrivate.root;
+      if (!host.exists(JWT_CREDENTIAL)) {
+        await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
+      }
+      if (!host.exists(ARANGO_ROOT_CREDENTIAL)) {
+        await seal(host, "arangodb-root-password", ARANGO_ROOT_CREDENTIAL, `fzr_${derive(root, "forgezero/cluster/arangodb-root-password/v1")}`);
+      }
+      await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
+      await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
+      for (const [name, source] of Object.entries({
+        ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
+        "backup.s3.secretAccessKey": platformPrivate.backup
+      })) {
+        if (source) {
+          const destination2 = `${CREDS}/${name}.cred`;
+          if (!host.exists(destination2))
+            await seal(host, name, destination2, source);
         }
       }
     }
@@ -5037,7 +5058,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     host.remove(config.cloudflareHandoff.handoffFile);
   }
   let launch;
-  if (config.kind === "platform" && config.database.role === "master") {
+  if (config.kind === "platform" && config.database.role === "master" && !reuseBoundPlatformCredentials) {
     const invitePath = `${config.runtime.environment.sharedDirectory}/platform-invite.token`;
     if (!host.exists(invitePath))
       throw new Error("platform invite is missing after deployment");

package/dist/fz-agent.js

@@ -4049,7 +4049,7 @@ function combineKEMS(realSeedLen, realMsgLen, expandSeed, combiner, ...kems) {
 var x25519kem = /* @__PURE__ */ ecdhKem(x25519);
 var ml_kem768_x25519 = /* @__PURE__ */ (() => combineKEMS(32, 32, expandSeedXof(shake256), (pk, ct, ss) => sha3_256(concatBytes2(ss[0], ss[1], ct[1], pk[1], asciiToBytes("\\.//^\\"))), ml_kem768, x25519kem))();
 
-// ../../node_modules/.bun/@forgezero+runtime@0.1.17+cd212ec15d36da0a/node_modules/@forgezero/runtime/dist/identity.js
+// ../runtime/dist/identity.js
 var ENCODER = new TextEncoder;
 var b64 = toBase64Url;
 var un64 = fromBase64Url;
@@ -4196,7 +4196,7 @@ function signRequest(keys, nodeKey, args) {
   };
 }
 
-// ../../node_modules/.bun/@forgezero+vault@0.1.22+3f759277d50bc01a/node_modules/@forgezero/vault/dist/index.js
+// ../vault/dist/index.js
 var DEFAULT_SOCKET = "/run/forgezero/vault.sock";
 
 // src/socket.ts
@@ -4692,7 +4692,7 @@ import { chmodSync as chmodSync4, existsSync as existsSync4, lstatSync as lstatS
 import { createHash as createHash5, randomUUID } from "crypto";
 import { dirname as dirname3, isAbsolute as isAbsolute2, join as join2 } from "path";
 
-// ../../node_modules/.bun/@forgezero+runtime@0.1.17+cd212ec15d36da0a/node_modules/@forgezero/runtime/dist/queue.js
+// ../runtime/dist/queue.js
 class QueueStoppedError extends Error {
   constructor() {
     super("queue: stopped before this task could run");
@@ -9640,9 +9640,47 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.125";
+var VERSION2 = "0.1.129";
 
 // src/ssh-bootstrap.ts
+function deriveMetalAdmissionProvisioning(lscpu) {
+  const rows = lscpu.split(`
+`).map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).map((line) => {
+    const fields = line.split(",");
+    if (fields.length !== 4 || fields.some((field) => !/^\d+$/.test(field))) {
+      throw new SshBootstrapError("METAL_CPU_TOPOLOGY_INVALID");
+    }
+    return { cpu: Number(fields[0]), core: `${fields[2]}:${fields[1]}` };
+  });
+  if (rows.length < 2 || new Set(rows.map(({ cpu }) => cpu)).size !== rows.length) {
+    throw new SshBootstrapError("METAL_CPU_TOPOLOGY_INVALID");
+  }
+  const cores = new Map;
+  for (const row2 of rows)
+    cores.set(row2.core, [...cores.get(row2.core) ?? [], row2.cpu]);
+  if (cores.size < 2)
+    throw new SshBootstrapError("METAL_CPU_CAPACITY_INSUFFICIENT");
+  const ordered = [...cores.values()].map((cpus2) => cpus2.sort((a, b) => a - b)).sort((left, right) => left[0] - right[0]);
+  const threadsPerCore = ordered[0].length;
+  if (threadsPerCore < 1 || threadsPerCore > 8 || ordered.some((cpus2) => cpus2.length !== threadsPerCore)) {
+    throw new SshBootstrapError("METAL_CPU_TOPOLOGY_INVALID");
+  }
+  const linuxList = (values) => [...values].sort((a, b) => a - b).join(",");
+  const housekeeping = ordered.shift();
+  const guestCpus = Array.from({ length: threadsPerCore }, (_, thread) => ordered.map((cpus2) => cpus2[thread])).flat();
+  return {
+    volumeGroup: "fzvg",
+    bridge: "fzbr0",
+    subnetPrefix: "10.42.0",
+    addressStart: 20,
+    addressEnd: 200,
+    gateway: "10.42.0.1",
+    nameservers: ["1.1.1.1", "1.0.0.1"],
+    cpuPools: [{ key: "host-capacity", cpus: linuxList(guestCpus), physicalCores: ordered.length }],
+    housekeepingCpus: linuxList(housekeeping)
+  };
+}
+
 class SshBootstrapError extends Error {
   code;
   constructor(code, message = code) {
@@ -9655,7 +9693,7 @@ var defaultExec = async (argv2, options = {}) => {
     stdin: options.stdin === undefined ? "ignore" : "pipe",
     stdout: "pipe",
     stderr: "pipe",
-    env: { PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin", LANG: "C", LC_ALL: "C" }
+    env: { PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin", LANG: "C", LC_ALL: "C", ...options.env }
   });
   if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
     await writeAndCloseProcessInput(child.stdin, options.stdin);
@@ -9677,12 +9715,12 @@ var validateClaim = (claim) => {
   if (!/^[A-Za-z0-9_-]{1,64}$/.test(claim.computeKey) || !/^[A-Za-z0-9_-]{16,128}$/.test(claim.claimToken) || !/^fze_[A-Za-z0-9_-]{32,128}$/.test(claim.enrolmentToken) || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(claim.realm) || !/^[A-Za-z0-9_-]{1,64}$/.test(claim.projectKey) || !/^[A-Za-z0-9_-]{1,64}$/.test(claim.environmentKey))
     throw new SshBootstrapError("CLAIM_INVALID");
   const { host, port, user, hostKeySha256, nodeHostname, operatingSystem } = claim.target;
-  if (!host || host.length > 253 || /[\s/@]/.test(host) || !Number.isSafeInteger(port) || port < 1 || port > 65535 || !/^[a-z_][a-z0-9_-]{0,31}$/.test(user) || !/^SHA256:[A-Za-z0-9+/]{43}$/.test(hostKeySha256) || !/^[a-z0-9](?:[a-z0-9.-]{1,251}[a-z0-9])$/.test(nodeHostname) || !nodeHostname.includes(".")) {
+  if (!host || host.length > 253 || /[\s/@]/.test(host) || !Number.isSafeInteger(port) || port < 1 || port > 65535 || !/^[a-z_][a-z0-9_-]{0,31}$/.test(user) || hostKeySha256 !== "" && !/^SHA256:[A-Za-z0-9+/]{43}$/.test(hostKeySha256) || !/^[a-z0-9](?:[a-z0-9.-]{1,251}[a-z0-9])$/.test(nodeHostname) || !nodeHostname.includes(".")) {
     throw new SshBootstrapError("CLAIM_INVALID");
   }
   if (operatingSystem?.id !== "ubuntu" || !["24.04", "26.04"].includes(operatingSystem.version) || operatingSystem.architecture !== "x64")
     throw new SshBootstrapError("CLAIM_INVALID");
-  if (!claim.target.credential || claim.target.credential.source !== "runner" && claim.target.credential.source !== "vault" || claim.target.credential.source === "vault" && (typeof claim.target.credential.privateKey !== "string" || claim.target.credential.privateKey.length > 32768 || !claim.target.credential.privateKey.startsWith("-----BEGIN OPENSSH PRIVATE KEY-----") || !claim.target.credential.privateKey.trimEnd().endsWith("-----END OPENSSH PRIVATE KEY-----"))) {
+  if (!/^ssh-(?:ed25519|rsa|ecdsa-[^\s]+) [A-Za-z0-9+/]+={0,3}(?:\s+.*)?$/.test(claim.runnerSshPublicKey) || !claim.target.credential || claim.target.credential.source !== "runner" && claim.target.credential.source !== "vault" || claim.target.credential.source === "vault" && (claim.target.credential.kind === "private-key" && (typeof claim.target.credential.privateKey !== "string" || claim.target.credential.privateKey.length > 32768 || !claim.target.credential.privateKey.startsWith("-----BEGIN OPENSSH PRIVATE KEY-----") || !claim.target.credential.privateKey.trimEnd().endsWith("-----END OPENSSH PRIVATE KEY-----")) || claim.target.credential.kind === "password" && (typeof claim.target.credential.password !== "string" || claim.target.credential.password.length < 1 || claim.target.credential.password.length > 4096))) {
     throw new SshBootstrapError("CLAIM_INVALID");
   }
 };
@@ -9693,14 +9731,7 @@ var target = (claim, pinned) => {
 var sshOptions = (claim, pinned, knownHosts, keyPath) => [
   "-F",
   "/dev/null",
-  "-o",
-  "BatchMode=yes",
-  "-o",
-  "IdentitiesOnly=yes",
-  "-o",
-  `IdentityFile=${keyPath}`,
-  "-o",
-  "IdentityAgent=none",
+  ...claim.target.credential.source === "vault" && claim.target.credential.kind === "password" ? ["-o", "BatchMode=no", "-o", "IdentitiesOnly=yes", "-o", "PubkeyAuthentication=no", "-o", "PreferredAuthentications=password,keyboard-interactive", "-o", "NumberOfPasswordPrompts=1"] : ["-o", "BatchMode=yes", "-o", "IdentitiesOnly=yes", "-o", `IdentityFile=${keyPath}`, "-o", "IdentityAgent=none"],
   "-o",
   `UserKnownHostsFile=${knownHosts}`,
   "-o",
@@ -9745,11 +9776,14 @@ async function pinnedKnownHost(claim, pinned, directory, exec) {
   const candidates = scanned.split(`
 `).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
   let matched;
+  let observedFingerprint = "";
   for (const line of candidates) {
-    const fingerprint = await checked(exec, ["ssh-keygen", "-E", "sha256", "-lf", "-"], "HOST_KEY_INVALID", { stdin: `${line}
+    const result = await checked(exec, ["ssh-keygen", "-E", "sha256", "-lf", "-"], "HOST_KEY_INVALID", { stdin: `${line}
 ` });
-    if (fingerprint.split(/\s+/).includes(claim.target.hostKeySha256)) {
+    const fingerprint = result.split(/\s+/).find((part) => /^SHA256:[A-Za-z0-9+/]{43}$/.test(part)) ?? "";
+    if (fingerprint && (!claim.target.hostKeySha256 || fingerprint === claim.target.hostKeySha256)) {
       matched = line;
+      observedFingerprint = fingerprint;
       break;
     }
   }
@@ -9761,7 +9795,7 @@ async function pinnedKnownHost(claim, pinned, directory, exec) {
   const path2 = join3(directory, "known_hosts");
   writeFileSync5(path2, `${pinned.hostKeyAlias} ${key}
 `, { mode: 384, flag: "wx" });
-  return path2;
+  return { path: path2, fingerprint: observedFingerprint };
 }
 var BUN_RELEASE_URL = "https://github.com/oven-sh/bun/releases/download/bun-v1.3.14/bun-linux-x64.zip";
 var verifiedBunArchive = async (directory) => {
@@ -9787,28 +9821,57 @@ async function executeSshBootstrap(claim, options) {
   const api = new URL(options.platformApiUrl);
   if (api.protocol !== "https:" || api.username || api.password || api.search || api.hash)
     throw new SshBootstrapError("TARGET_API_INVALID");
-  const exec = options.exec ?? defaultExec;
+  const baseExec = options.exec ?? defaultExec;
   const directory = mkdtempSync2(join3(tmpdir2(), "forgezero-ssh-bootstrap-"));
   chmodSync7(directory, 448);
+  let exec = baseExec;
   let sshKeyPath = options.sshKeyPath;
   let remoteDirectory = "";
   let pinned;
   try {
-    if (claim.target.credential.source === "vault") {
+    if (claim.target.credential.source === "vault" && claim.target.credential.kind === "private-key") {
       sshKeyPath = join3(directory, "identity");
       writeFileSync5(sshKeyPath, `${claim.target.credential.privateKey.trim()}
 `, { mode: 384, flag: "wx" });
     }
+    if (claim.target.credential.source === "vault" && claim.target.credential.kind === "password") {
+      const askpass = join3(directory, "askpass");
+      writeFileSync5(askpass, `#!/usr/bin/env bun
+process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
+`, { mode: 448, flag: "wx" });
+      const password = claim.target.credential.password;
+      exec = (argv2, command = {}) => baseExec(argv2, {
+        ...command,
+        env: { ...command.env, DISPLAY: "forgezero:0", SSH_ASKPASS: askpass, SSH_ASKPASS_REQUIRE: "force", FZ_SSH_PASSWORD: password }
+      });
+    }
     const sourceHost = claim.target.host.includes(":") ? `[${claim.target.host}]` : claim.target.host;
     const resolved = await resolvePinnedGitTarget(`ssh://${claim.target.user}@${sourceHost}:${claim.target.port}/`, options.resolveHost);
     if (!resolved || resolved.protocol !== "ssh")
       throw new SshBootstrapError("TARGET_ADDRESS_REFUSED");
     pinned = resolved;
-    const knownHosts = await pinnedKnownHost(claim, pinned, directory, exec);
+    const observedHost = await pinnedKnownHost(claim, pinned, directory, exec);
+    claim.target.hostKeySha256 = observedHost.fingerprint;
+    const knownHosts = observedHost.path;
     const ssh = sshOptions(claim, pinned, knownHosts, sshKeyPath);
     remoteDirectory = await checked(exec, ["ssh", ...ssh, target(claim, pinned), "--", "mktemp", "-d", "/tmp/forgezero-bootstrap.XXXXXXXX"], "SSH_UNREACHABLE");
     if (!/^\/tmp\/forgezero-bootstrap\.[A-Za-z0-9]{8}$/.test(remoteDirectory))
       throw new SshBootstrapError("REMOTE_PATH_INVALID");
+    const destination = target(claim, pinned);
+    const passwd = await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/getent", "passwd", claim.target.user]);
+    const home = passwd.split(":")[5] ?? "";
+    if (!home.startsWith("/") || /[\r\n]/.test(home))
+      throw new SshBootstrapError("SSH_IDENTITY_INSTALL_FAILED");
+    await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/install", "-d", "-m", "0700", `${home}/.ssh`]);
+    const existing = await remote(exec, ssh, destination, "SSH_IDENTITY_READ_FAILED", ["/usr/bin/cat", `${home}/.ssh/authorized_keys`]).catch(() => "");
+    const authorized = [...new Set([...existing.split(`
+`).map((line) => line.trim()).filter(Boolean), claim.runnerSshPublicKey])].join(`
+`) + `
+`;
+    const authorizedPath = join3(directory, "authorized_keys");
+    writeFileSync5(authorizedPath, authorized, { mode: 384, flag: "wx" });
+    await checked(exec, ["scp", ...scpOptions(claim, pinned, knownHosts, sshKeyPath), authorizedPath, `${destination}:${remoteDirectory}/authorized_keys`], "SSH_IDENTITY_INSTALL_FAILED");
+    await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/install", "-m", "0600", `${remoteDirectory}/authorized_keys`, `${home}/.ssh/authorized_keys`]);
     const config = {
       kind: "enrolled-compute",
       operatingSystem: claim.target.operatingSystem,
@@ -9844,7 +9907,6 @@ async function executeSshBootstrap(claim, options) {
         join3(directory, name),
         `${target(claim, pinned)}:${remoteDirectory}/${name}`
       ], "SCP_FAILED", { secret: name === "enrol.token" });
-    const destination = target(claim, pinned);
     const version = await remote(exec, ssh, destination, "REMOTE_BUN_CHECK_FAILED", ["/usr/local/bin/bun", "--version"]).catch(() => "");
     if (version !== PINNED_BUN_VERSION) {
       await remote(exec, ssh, destination, "REMOTE_PREREQUISITES_FAILED", [
@@ -10093,6 +10155,7 @@ var validateMetalClaim = (claim) => {
     realm: claim.tenantKey,
     projectKey: claim.projectKey,
     environmentKey: claim.environmentKey,
+    runnerSshPublicKey: claim.runnerSshPublicKey,
     target: claim.target,
     enrolmentToken: `fze_${"A".repeat(43)}`
   });
@@ -10104,29 +10167,64 @@ async function executeMetalAdmission(claim, options) {
   if (api.protocol !== "https:" || api.username || api.password || api.search || api.hash || telemetry.protocol !== "https:" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash) {
     throw new SshBootstrapError("TARGET_COORDINATE_INVALID");
   }
-  const exec = options.exec ?? defaultExec;
+  const baseExec = options.exec ?? defaultExec;
   const directory = mkdtempSync2(join3(tmpdir2(), "forgezero-metal-admission-"));
   chmodSync7(directory, 448);
+  let exec = baseExec;
   let sshKeyPath = options.sshKeyPath;
   let remoteDirectory = "";
   let pinned;
   try {
-    if (claim.target.credential.source === "vault") {
+    if (claim.target.credential.source === "vault" && claim.target.credential.kind === "private-key") {
       sshKeyPath = join3(directory, "identity");
       writeFileSync5(sshKeyPath, `${claim.target.credential.privateKey.trim()}
 `, { mode: 384, flag: "wx" });
     }
+    if (claim.target.credential.source === "vault" && claim.target.credential.kind === "password") {
+      const askpass = join3(directory, "askpass");
+      writeFileSync5(askpass, `#!/usr/bin/env bun
+process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
+`, { mode: 448, flag: "wx" });
+      const password = claim.target.credential.password;
+      exec = (argv2, command = {}) => baseExec(argv2, {
+        ...command,
+        env: { ...command.env, DISPLAY: "forgezero:0", SSH_ASKPASS: askpass, SSH_ASKPASS_REQUIRE: "force", FZ_SSH_PASSWORD: password }
+      });
+    }
     const sourceHost = claim.target.host.includes(":") ? `[${claim.target.host}]` : claim.target.host;
     const resolved = await resolvePinnedGitTarget(`ssh://${claim.target.user}@${sourceHost}:${claim.target.port}/`, options.resolveHost);
     if (!resolved || resolved.protocol !== "ssh")
       throw new SshBootstrapError("TARGET_ADDRESS_REFUSED");
     pinned = resolved;
-    const knownHosts = await pinnedKnownHost(claim, pinned, directory, exec);
+    const observedHost = await pinnedKnownHost(claim, pinned, directory, exec);
+    claim.target.hostKeySha256 = observedHost.fingerprint;
+    const knownHosts = observedHost.path;
     const ssh = sshOptions(claim, pinned, knownHosts, sshKeyPath);
     const destination = target(claim, pinned);
     remoteDirectory = await checked(exec, ["ssh", ...ssh, destination, "--", "mktemp", "-d", "/tmp/forgezero-metal-admission.XXXXXXXX"], "SSH_UNREACHABLE");
     if (!/^\/tmp\/forgezero-metal-admission\.[A-Za-z0-9]{8}$/.test(remoteDirectory))
       throw new SshBootstrapError("REMOTE_PATH_INVALID");
+    const passwd = await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/getent", "passwd", claim.target.user]);
+    const home = passwd.split(":")[5] ?? "";
+    if (!home.startsWith("/") || /[\r\n]/.test(home))
+      throw new SshBootstrapError("SSH_IDENTITY_INSTALL_FAILED");
+    await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/install", "-d", "-m", "0700", `${home}/.ssh`]);
+    const existing = await remote(exec, ssh, destination, "SSH_IDENTITY_READ_FAILED", ["/usr/bin/cat", `${home}/.ssh/authorized_keys`]).catch(() => "");
+    const authorized = [...new Set([...existing.split(`
+`).map((line) => line.trim()).filter(Boolean), claim.runnerSshPublicKey])].join(`
+`) + `
+`;
+    const authorizedPath = join3(directory, "authorized_keys");
+    writeFileSync5(authorizedPath, authorized, { mode: 384, flag: "wx" });
+    await checked(exec, ["scp", ...scpOptions(claim, pinned, knownHosts, sshKeyPath), authorizedPath, `${destination}:${remoteDirectory}/authorized_keys`], "SSH_IDENTITY_INSTALL_FAILED");
+    await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/install", "-m", "0600", `${remoteDirectory}/authorized_keys`, `${home}/.ssh/authorized_keys`]);
+    await remote(exec, ssh, destination, "METAL_STORAGE_UNAVAILABLE", ["/usr/bin/sudo", "-n", "/usr/sbin/vgs", "fzvg"]);
+    await remote(exec, ssh, destination, "METAL_NETWORK_UNAVAILABLE", ["/usr/bin/sudo", "-n", "/usr/sbin/ip", "link", "show", "fzbr0"]);
+    const topology = await remote(exec, ssh, destination, "METAL_CPU_TOPOLOGY_INVALID", [
+      "/usr/bin/lscpu",
+      "--parse=CPU,CORE,SOCKET,NODE"
+    ]);
+    const provisioning = deriveMetalAdmissionProvisioning(topology);
     const fzCliPath = options.fzCliPath ?? fileURLToPath(new URL("./fz.js", import.meta.url));
     const fzAgentPath = options.fzAgentPath ?? fileURLToPath(new URL("./fz-agent.js", import.meta.url));
     for (const [source, name] of [[fzCliPath, "fz.js"], [fzAgentPath, "fz-agent.js"]]) {
@@ -10145,7 +10243,7 @@ async function executeMetalAdmission(claim, options) {
       hostTelemetryEndpoint: "http://127.0.0.1:4318",
       hostTelemetryUnit: "forgezero-otel-collector.service",
       profile: {
-        ...claim.provisioning,
+        ...provisioning,
         stateDir: "/etc/forgezero/metal-guests",
         seedDir: "/var/lib/forgezero/seed",
         unitDir: "/etc/systemd/system",
@@ -11363,7 +11461,7 @@ function requestDeploymentCommand(input, socketPath = DEFAULT_DEPLOYMENT_RUNNER_
 // src/snp-attestation.ts
 import { existsSync as existsSync10 } from "fs";
 
-// ../../node_modules/.bun/@forgezero+runtime@0.1.17+cd212ec15d36da0a/node_modules/@forgezero/runtime/dist/snp.js
+// ../runtime/dist/snp.js
 var REPORT_BYTES = 1184;
 
 // src/snp-attestation.ts
@@ -15302,6 +15400,26 @@ var nonEmpty = (path2) => {
   if (!existsSync20(path2) || !statSync5(path2).isFile() || statSync5(path2).size < 1)
     throw new Error(`required file missing: ${path2}`);
 };
+function validateRecoveryBootstrapState(value, expected) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("bootstrap state is malformed");
+  const state = value;
+  if (state.format !== 2 || state.kind !== "platform" || state.environment !== expected.profile || state.databaseRole !== expected.role || state.profile !== expected.software || state.apiUrl !== expected.apiOrigin || state.nodeHostname !== expected.edgeHostname || expected.databaseAddress !== undefined && state.databaseAddress !== expected.databaseAddress)
+    throw new Error("bootstrap state does not match reviewed recovery coordinates");
+}
+var exactBootstrapState = (expected) => {
+  const path2 = "/var/lib/forgezero/bootstrap.json";
+  nonEmpty(path2);
+  if (statSync5(path2).size > 64 * 1024)
+    throw new Error("bootstrap state is oversized");
+  let value;
+  try {
+    value = JSON.parse(readFileSync15(path2, "utf8"));
+  } catch {
+    throw new Error("bootstrap state is malformed");
+  }
+  validateRecoveryBootstrapState(value, expected);
+};
 var option = (args, name) => {
   const value = args.find((arg) => arg.startsWith(`--${name}=`))?.slice(name.length + 3);
   if (!value || /[\0\r\n]/.test(value))
@@ -15325,15 +15443,11 @@ async function runRecoveryHost(args, run2 = execute2) {
     const apiOrigin = option(args, "api-origin");
     const edgeHostname = option(args, "edge-hostname");
     const databaseAddress = args.find((arg) => arg.startsWith("--db-address="))?.slice(13);
-    exactState("/opt/forgezero/.forge-state", `profile=${profile}`);
-    exactState("/opt/forgezero/.forge-state", `db_role=${role}`);
-    exactState("/opt/forgezero/.forge-state", `software_profile=${software}`);
-    if (databaseAddress)
-      exactState("/opt/forgezero/.forge-state", `db_address=${databaseAddress}`);
-    exactState("/opt/forgezero/shared/.env", "ARANGO_DB=fz");
-    exactState("/opt/forgezero/shared/.env", "FZ_DATABASE_MODE=platform");
-    exactState("/opt/forgezero/shared/.env", `API_ORIGIN=${apiOrigin}`);
-    exactState("/opt/forgezero/shared/.env", `FZ_NODE_HOSTNAME=${edgeHostname}`);
+    exactBootstrapState({ profile, role, software, apiOrigin, edgeHostname, ...databaseAddress ? { databaseAddress } : {} });
+    exactState("/opt/forgezero/shared/.env", 'ARANGO_DB="fz"');
+    exactState("/opt/forgezero/shared/.env", 'FZ_DATABASE_MODE="platform"');
+    exactState("/opt/forgezero/shared/.env", `API_ORIGIN="${apiOrigin}"`);
+    exactState("/opt/forgezero/shared/.env", `FZ_NODE_HOSTNAME="${edgeHostname}"`);
     nonEmpty("/etc/forgezero/creds/arangodb-jwt.cred");
     const hasDatabase = role !== "none";
     if (hasDatabase) {
@@ -15377,7 +15491,7 @@ async function runRecoveryHost(args, run2 = execute2) {
       throw new Error("maintenance accepts only fz db argv");
     const slot = activeSlot();
     const properties = [
-      "--property=User=forgezero",
+      "--property=User=forgezero-api",
       `--property=WorkingDirectory=/opt/forgezero/slots/${slot}`,
       "--property=Environment=NODE_ENV=production",
       "--property=EnvironmentFile=/opt/forgezero/shared/.env",