@forgezero/agent 0.1.128 → 0.1.130

package/README.md

@@ -214,7 +214,7 @@ fz unlock --phrase-file /secure/offline-phrase.txt
 
 ## Use website operations from a project or an AI agent
 
-Every UI operation is an API operation. `fz ui routes --json` discovers the exact actions allowed by the signed-in account’s current realm, lifecycle stage and grants from the API’s enforced matrix, so the CLI and AI agents carry no copied route list. `fz api` (also `fz ui`) executes authenticated JSON GET, POST, PUT, PATCH and DELETE without requiring a browser visit for ordinary work. Paths are forced onto the signed-in origin, query values are repeatable, bodies can be inline, stdin or a file, and server grants plus fresh-proof rules remain authoritative. `fz project init|sync|check` separately gives AI tools one Git-persisted project memory.
+Every UI operation is an API operation. `fz ui routes --json` discovers the exact actions allowed by the signed-in account’s current workspace, lifecycle stage and permissions from the API’s enforced matrix, so the CLI and AI agents carry no copied route list. `fz api` (also `fz ui`) executes authenticated JSON GET, POST, PUT, PATCH and DELETE without requiring a browser visit for ordinary work. Paths are forced onto the signed-in origin, query values are repeatable, bodies can be inline, stdin or a file, and server permissions plus fresh-proof rules remain authoritative. `fz project init|sync|check` separately gives AI tools one Git-persisted project memory.
 
 ```text
 fz ui routes --json

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.128";
+var VERSION3 = "0.1.130";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.d.ts

@@ -210,6 +210,7 @@ export declare function interruptedPlatformReleaseIdentityDigests(config: Platfo
 export declare function bootstrapStatus(host?: BootstrapHost): Promise<BootstrapStatus>;
 export declare function applyBootstrap(input: BootstrapConfig, host?: BootstrapHost, secrets?: BootstrapSecrets, dependencies?: {
     fetcher?: typeof fetch;
+    reuseBoundPlatformCredentials?: boolean;
 }): Promise<BootstrapResult>;
 export declare function readBootstrapConfig(path: string): BootstrapConfig;
 interface BootstrapAgentInitialBundle {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.128";
+var VERSION = "0.1.130";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4664,6 +4664,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     installed = parseStoredState(host.read(STATE_PATH));
   let bootstrapManifest;
   let releaseEvidence;
+  let redundantBootstrapBundle = false;
   if (config.kind === "platform") {
     const staged = host.exists(config.bootstrapBundle.bundleFile) || host.exists(config.bootstrapBundle.manifestFile);
     if (staged && !(host.exists(config.bootstrapBundle.bundleFile) && host.exists(config.bootstrapBundle.manifestFile))) {
@@ -4684,8 +4685,11 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       if (typeof evidence.revision !== "string" || !/^[a-f0-9]{40}$/.test(evidence.revision) || typeof evidence.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(evidence.sha256) || typeof evidence.branch !== "string")
         throw new Error("bootstrap release evidence is malformed");
       releaseEvidence = { revision: evidence.revision, sha256: evidence.sha256, branch: evidence.branch };
-      if (evidence.revision !== reviewed.revision || evidence.sha256 !== reviewed.sha256 || evidence.branch !== reviewed.branch)
+      if (evidence.revision !== reviewed.revision || evidence.branch !== reviewed.branch) {
         bootstrapManifest = reviewed;
+      } else {
+        redundantBootstrapBundle = true;
+      }
     } else if (host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
       let evidence;
       try {
@@ -4757,7 +4761,11 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     }
     allowInterruptedReleaseRebind = !exactIdentity && (boundedReleaseResume || approvedIdentityMigration);
   }
-  const platformPrivate = config.kind === "platform" ? (() => {
+  const reuseBoundPlatformCredentials = config.kind === "platform" && dependencies.reuseBoundPlatformCredentials === true;
+  if (reuseBoundPlatformCredentials && (!installed || !host.exists("/var/lib/forgezero/enrolment.json"))) {
+    throw new Error("stored-credential promotion requires an installed enrolled platform compute");
+  }
+  const platformPrivate = config.kind === "platform" && !reuseBoundPlatformCredentials ? (() => {
     if (!secrets)
       throw new Error("platform apply requires attended credentials on stdin");
     const checked4 = validatePlatformBootstrapSecrets(config, secrets, {
@@ -4800,7 +4808,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (cloudflarePrivate && !host.exists(CF_API_CREDENTIAL)) {
     await seal(host, "CF_API_TOKEN", CF_API_CREDENTIAL, cloudflarePrivate.cloudflareApiToken);
   }
-  if (config.kind === "platform" && platformPrivate.cloudflareTunnelToken && !host.exists(CF_TUNNEL_API_CREDENTIAL)) {
+  if (config.kind === "platform" && platformPrivate?.cloudflareTunnelToken && !host.exists(CF_TUNNEL_API_CREDENTIAL)) {
     await seal(host, "CF_TUNNEL_TOKEN", CF_TUNNEL_API_CREDENTIAL, platformPrivate.cloudflareTunnelToken);
   }
   const realtimeSecrets = cloudflare?.realtime && cloudflarePrivate ? deriveCloudflareRealtimeSecrets(cloudflarePrivate.cloudflareApiToken) : undefined;
@@ -4858,24 +4866,38 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await verifyBootstrapBundleOnHost(host, config, true);
   }
   if (config.kind === "platform") {
-    const root = platformPrivate.root;
-    if (!host.exists(JWT_CREDENTIAL)) {
-      await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
-    }
-    if (!host.exists(ARANGO_ROOT_CREDENTIAL)) {
-      await seal(host, "arangodb-root-password", ARANGO_ROOT_CREDENTIAL, `fzr_${derive(root, "forgezero/cluster/arangodb-root-password/v1")}`);
-    }
-    await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
-    await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
-    for (const [name, source] of Object.entries({
-      ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "backup.s3.secretAccessKey": platformPrivate.backup
-    })) {
-      if (source) {
-        const destination2 = `${CREDS}/${name}.cred`;
-        if (!host.exists(destination2)) {
-          await seal(host, name, destination2, source);
+    if (reuseBoundPlatformCredentials) {
+      const required = [
+        ...config.database.role !== "none" ? [JWT_CREDENTIAL, ARANGO_ROOT_CREDENTIAL] : [],
+        SEED_CREDENTIAL,
+        BACKUP_RECOVERY_CREDENTIAL,
+        ...emailCredentialName ? [`${CREDS}/${emailCredentialName}.cred`] : [],
+        ...config.runtime.environment.backup ? [`${CREDS}/backup.s3.secretAccessKey.cred`] : [],
+        ...installed?.cloudflare ? [CF_API_CREDENTIAL, CF_TUNNEL_API_CREDENTIAL, TUNNEL_CREDENTIAL] : [],
+        ...installed?.realtime ? [REALTIME_PUBLISH_CREDENTIAL, REALTIME_TICKET_CREDENTIAL] : []
+      ];
+      const missing = required.find((path) => !host.exists(path));
+      if (missing)
+        throw new Error(`stored platform credential is missing: ${missing}`);
+    } else {
+      const root = platformPrivate.root;
+      if (!host.exists(JWT_CREDENTIAL)) {
+        await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
+      }
+      if (!host.exists(ARANGO_ROOT_CREDENTIAL)) {
+        await seal(host, "arangodb-root-password", ARANGO_ROOT_CREDENTIAL, `fzr_${derive(root, "forgezero/cluster/arangodb-root-password/v1")}`);
+      }
+      await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
+      await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
+      for (const [name, source] of Object.entries({
+        ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
+        "backup.s3.secretAccessKey": platformPrivate.backup
+      })) {
+        if (source) {
+          const destination2 = `${CREDS}/${name}.cred`;
+          if (!host.exists(destination2))
+            await seal(host, name, destination2, source);
         }
       }
     }
@@ -4944,6 +4966,46 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await checked3(host, ["nginx", "-t"], "nginx configuration");
     await checked3(host, ["systemctl", "daemon-reload"], "systemd reload");
     await checked3(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
+    if (alreadyEnrolled && !bootstrapManifest) {
+      const healthCommand = [
+        "curl",
+        "--fail",
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "10",
+        `http://127.0.0.1:${runtime.environment.publicApiPort}${runtime.healthPath}`
+      ];
+      const health = await host.exec(healthCommand);
+      if (health.exitCode !== 0) {
+        const activeSlotFile = `${runtime.slotsDirectory}/.active`;
+        if (!host.exists(activeSlotFile))
+          throw new Error("enrolled platform active API slot evidence is missing");
+        const activeSlot = host.read(activeSlotFile).trim();
+        if (activeSlot !== "blue" && activeSlot !== "green") {
+          throw new Error("enrolled platform active API slot evidence is malformed");
+        }
+        await checked3(host, ["systemctl", "start", `forgezero@${activeSlot}.service`], "active API slot repair");
+        let ready = false;
+        let lastHealthOutput = "";
+        for (let attempt = 0;attempt < 30; attempt += 1) {
+          const repairedHealth = await host.exec(healthCommand);
+          if (repairedHealth.exitCode === 0) {
+            ready = true;
+            break;
+          }
+          lastHealthOutput = repairedHealth.output.trim();
+          if (attempt < 29)
+            await (host.sleep?.(1000) ?? Bun.sleep(1000));
+        }
+        if (!ready)
+          throw new Error(`repaired API health failed: ${lastHealthOutput || "readiness deadline exceeded"}`);
+      }
+      if (redundantBootstrapBundle) {
+        host.remove(config.bootstrapBundle.bundleFile);
+        host.remove(config.bootstrapBundle.manifestFile);
+      }
+    }
     if (config.database.role === "master") {
       const invite = `${runtime.environment.sharedDirectory}/platform-invite.token`;
       if (!host.exists(invite)) {
@@ -5040,7 +5102,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     host.remove(config.cloudflareHandoff.handoffFile);
   }
   let launch;
-  if (config.kind === "platform" && config.database.role === "master") {
+  if (config.kind === "platform" && config.database.role === "master" && !reuseBoundPlatformCredentials) {
     const invitePath = `${config.runtime.environment.sharedDirectory}/platform-invite.token`;
     if (!host.exists(invitePath))
       throw new Error("platform invite is missing after deployment");

package/dist/fz-agent.js

@@ -9640,9 +9640,47 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.128";
+var VERSION2 = "0.1.130";
 
 // src/ssh-bootstrap.ts
+function deriveMetalAdmissionProvisioning(lscpu) {
+  const rows = lscpu.split(`
+`).map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).map((line) => {
+    const fields = line.split(",");
+    if (fields.length !== 4 || fields.some((field) => !/^\d+$/.test(field))) {
+      throw new SshBootstrapError("METAL_CPU_TOPOLOGY_INVALID");
+    }
+    return { cpu: Number(fields[0]), core: `${fields[2]}:${fields[1]}` };
+  });
+  if (rows.length < 2 || new Set(rows.map(({ cpu }) => cpu)).size !== rows.length) {
+    throw new SshBootstrapError("METAL_CPU_TOPOLOGY_INVALID");
+  }
+  const cores = new Map;
+  for (const row2 of rows)
+    cores.set(row2.core, [...cores.get(row2.core) ?? [], row2.cpu]);
+  if (cores.size < 2)
+    throw new SshBootstrapError("METAL_CPU_CAPACITY_INSUFFICIENT");
+  const ordered = [...cores.values()].map((cpus2) => cpus2.sort((a, b) => a - b)).sort((left, right) => left[0] - right[0]);
+  const threadsPerCore = ordered[0].length;
+  if (threadsPerCore < 1 || threadsPerCore > 8 || ordered.some((cpus2) => cpus2.length !== threadsPerCore)) {
+    throw new SshBootstrapError("METAL_CPU_TOPOLOGY_INVALID");
+  }
+  const linuxList = (values) => [...values].sort((a, b) => a - b).join(",");
+  const housekeeping = ordered.shift();
+  const guestCpus = Array.from({ length: threadsPerCore }, (_, thread) => ordered.map((cpus2) => cpus2[thread])).flat();
+  return {
+    volumeGroup: "fzvg",
+    bridge: "fzbr0",
+    subnetPrefix: "10.42.0",
+    addressStart: 20,
+    addressEnd: 200,
+    gateway: "10.42.0.1",
+    nameservers: ["1.1.1.1", "1.0.0.1"],
+    cpuPools: [{ key: "host-capacity", cpus: linuxList(guestCpus), physicalCores: ordered.length }],
+    housekeepingCpus: linuxList(housekeeping)
+  };
+}
+
 class SshBootstrapError extends Error {
   code;
   constructor(code, message = code) {
@@ -9677,7 +9715,7 @@ var validateClaim = (claim) => {
   if (!/^[A-Za-z0-9_-]{1,64}$/.test(claim.computeKey) || !/^[A-Za-z0-9_-]{16,128}$/.test(claim.claimToken) || !/^fze_[A-Za-z0-9_-]{32,128}$/.test(claim.enrolmentToken) || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(claim.realm) || !/^[A-Za-z0-9_-]{1,64}$/.test(claim.projectKey) || !/^[A-Za-z0-9_-]{1,64}$/.test(claim.environmentKey))
     throw new SshBootstrapError("CLAIM_INVALID");
   const { host, port, user, hostKeySha256, nodeHostname, operatingSystem } = claim.target;
-  if (!host || host.length > 253 || /[\s/@]/.test(host) || !Number.isSafeInteger(port) || port < 1 || port > 65535 || !/^[a-z_][a-z0-9_-]{0,31}$/.test(user) || !/^SHA256:[A-Za-z0-9+/]{43}$/.test(hostKeySha256) || !/^[a-z0-9](?:[a-z0-9.-]{1,251}[a-z0-9])$/.test(nodeHostname) || !nodeHostname.includes(".")) {
+  if (!host || host.length > 253 || /[\s/@]/.test(host) || !Number.isSafeInteger(port) || port < 1 || port > 65535 || !/^[a-z_][a-z0-9_-]{0,31}$/.test(user) || hostKeySha256 !== "" && !/^SHA256:[A-Za-z0-9+/]{43}$/.test(hostKeySha256) || !/^[a-z0-9](?:[a-z0-9.-]{1,251}[a-z0-9])$/.test(nodeHostname) || !nodeHostname.includes(".")) {
     throw new SshBootstrapError("CLAIM_INVALID");
   }
   if (operatingSystem?.id !== "ubuntu" || !["24.04", "26.04"].includes(operatingSystem.version) || operatingSystem.architecture !== "x64")
@@ -9738,11 +9776,14 @@ async function pinnedKnownHost(claim, pinned, directory, exec) {
   const candidates = scanned.split(`
 `).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
   let matched;
+  let observedFingerprint = "";
   for (const line of candidates) {
-    const fingerprint = await checked(exec, ["ssh-keygen", "-E", "sha256", "-lf", "-"], "HOST_KEY_INVALID", { stdin: `${line}
+    const result = await checked(exec, ["ssh-keygen", "-E", "sha256", "-lf", "-"], "HOST_KEY_INVALID", { stdin: `${line}
 ` });
-    if (fingerprint.split(/\s+/).includes(claim.target.hostKeySha256)) {
+    const fingerprint = result.split(/\s+/).find((part) => /^SHA256:[A-Za-z0-9+/]{43}$/.test(part)) ?? "";
+    if (fingerprint && (!claim.target.hostKeySha256 || fingerprint === claim.target.hostKeySha256)) {
       matched = line;
+      observedFingerprint = fingerprint;
       break;
     }
   }
@@ -9754,7 +9795,7 @@ async function pinnedKnownHost(claim, pinned, directory, exec) {
   const path2 = join3(directory, "known_hosts");
   writeFileSync5(path2, `${pinned.hostKeyAlias} ${key}
 `, { mode: 384, flag: "wx" });
-  return path2;
+  return { path: path2, fingerprint: observedFingerprint };
 }
 var BUN_RELEASE_URL = "https://github.com/oven-sh/bun/releases/download/bun-v1.3.14/bun-linux-x64.zip";
 var verifiedBunArchive = async (directory) => {
@@ -9809,7 +9850,9 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
     if (!resolved || resolved.protocol !== "ssh")
       throw new SshBootstrapError("TARGET_ADDRESS_REFUSED");
     pinned = resolved;
-    const knownHosts = await pinnedKnownHost(claim, pinned, directory, exec);
+    const observedHost = await pinnedKnownHost(claim, pinned, directory, exec);
+    claim.target.hostKeySha256 = observedHost.fingerprint;
+    const knownHosts = observedHost.path;
     const ssh = sshOptions(claim, pinned, knownHosts, sshKeyPath);
     remoteDirectory = await checked(exec, ["ssh", ...ssh, target(claim, pinned), "--", "mktemp", "-d", "/tmp/forgezero-bootstrap.XXXXXXXX"], "SSH_UNREACHABLE");
     if (!/^\/tmp\/forgezero-bootstrap\.[A-Za-z0-9]{8}$/.test(remoteDirectory))
@@ -10153,7 +10196,9 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
     if (!resolved || resolved.protocol !== "ssh")
       throw new SshBootstrapError("TARGET_ADDRESS_REFUSED");
     pinned = resolved;
-    const knownHosts = await pinnedKnownHost(claim, pinned, directory, exec);
+    const observedHost = await pinnedKnownHost(claim, pinned, directory, exec);
+    claim.target.hostKeySha256 = observedHost.fingerprint;
+    const knownHosts = observedHost.path;
     const ssh = sshOptions(claim, pinned, knownHosts, sshKeyPath);
     const destination = target(claim, pinned);
     remoteDirectory = await checked(exec, ["ssh", ...ssh, destination, "--", "mktemp", "-d", "/tmp/forgezero-metal-admission.XXXXXXXX"], "SSH_UNREACHABLE");
@@ -10173,6 +10218,13 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
     writeFileSync5(authorizedPath, authorized, { mode: 384, flag: "wx" });
     await checked(exec, ["scp", ...scpOptions(claim, pinned, knownHosts, sshKeyPath), authorizedPath, `${destination}:${remoteDirectory}/authorized_keys`], "SSH_IDENTITY_INSTALL_FAILED");
     await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/install", "-m", "0600", `${remoteDirectory}/authorized_keys`, `${home}/.ssh/authorized_keys`]);
+    await remote(exec, ssh, destination, "METAL_STORAGE_UNAVAILABLE", ["/usr/bin/sudo", "-n", "/usr/sbin/vgs", "fzvg"]);
+    await remote(exec, ssh, destination, "METAL_NETWORK_UNAVAILABLE", ["/usr/bin/sudo", "-n", "/usr/sbin/ip", "link", "show", "fzbr0"]);
+    const topology = await remote(exec, ssh, destination, "METAL_CPU_TOPOLOGY_INVALID", [
+      "/usr/bin/lscpu",
+      "--parse=CPU,CORE,SOCKET,NODE"
+    ]);
+    const provisioning = deriveMetalAdmissionProvisioning(topology);
     const fzCliPath = options.fzCliPath ?? fileURLToPath(new URL("./fz.js", import.meta.url));
     const fzAgentPath = options.fzAgentPath ?? fileURLToPath(new URL("./fz-agent.js", import.meta.url));
     for (const [source, name] of [[fzCliPath, "fz.js"], [fzAgentPath, "fz-agent.js"]]) {
@@ -10191,7 +10243,7 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
       hostTelemetryEndpoint: "http://127.0.0.1:4318",
       hostTelemetryUnit: "forgezero-otel-collector.service",
       profile: {
-        ...claim.provisioning,
+        ...provisioning,
         stateDir: "/etc/forgezero/metal-guests",
         seedDir: "/var/lib/forgezero/seed",
         unitDir: "/etc/systemd/system",

package/dist/fz.js

@@ -5788,7 +5788,7 @@ var VaultRuntimeClientError, json = (value) => ({ method: "POST", body: JSON.str
   } catch {
     return;
   }
-}, VERSION = "0.1.25";
+}, VERSION = "0.1.27";
 var init_dist = __esm(() => {
   init_vault_runtime();
   init_identity();
@@ -6007,7 +6007,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.128";
+var VERSION2 = "0.1.130";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -15284,6 +15284,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     installed = parseStoredState(host.read(STATE_PATH));
   let bootstrapManifest;
   let releaseEvidence;
+  let redundantBootstrapBundle = false;
   if (config.kind === "platform") {
     const staged = host.exists(config.bootstrapBundle.bundleFile) || host.exists(config.bootstrapBundle.manifestFile);
     if (staged && !(host.exists(config.bootstrapBundle.bundleFile) && host.exists(config.bootstrapBundle.manifestFile))) {
@@ -15304,8 +15305,11 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       if (typeof evidence.revision !== "string" || !/^[a-f0-9]{40}$/.test(evidence.revision) || typeof evidence.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(evidence.sha256) || typeof evidence.branch !== "string")
         throw new Error("bootstrap release evidence is malformed");
       releaseEvidence = { revision: evidence.revision, sha256: evidence.sha256, branch: evidence.branch };
-      if (evidence.revision !== reviewed.revision || evidence.sha256 !== reviewed.sha256 || evidence.branch !== reviewed.branch)
+      if (evidence.revision !== reviewed.revision || evidence.branch !== reviewed.branch) {
         bootstrapManifest = reviewed;
+      } else {
+        redundantBootstrapBundle = true;
+      }
     } else if (host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
       let evidence;
       try {
@@ -15377,7 +15381,11 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     }
     allowInterruptedReleaseRebind = !exactIdentity && (boundedReleaseResume || approvedIdentityMigration);
   }
-  const platformPrivate = config.kind === "platform" ? (() => {
+  const reuseBoundPlatformCredentials = config.kind === "platform" && dependencies.reuseBoundPlatformCredentials === true;
+  if (reuseBoundPlatformCredentials && (!installed || !host.exists("/var/lib/forgezero/enrolment.json"))) {
+    throw new Error("stored-credential promotion requires an installed enrolled platform compute");
+  }
+  const platformPrivate = config.kind === "platform" && !reuseBoundPlatformCredentials ? (() => {
     if (!secrets)
       throw new Error("platform apply requires attended credentials on stdin");
     const checked4 = validatePlatformBootstrapSecrets(config, secrets, {
@@ -15420,7 +15428,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (cloudflarePrivate && !host.exists(CF_API_CREDENTIAL)) {
     await seal(host, "CF_API_TOKEN", CF_API_CREDENTIAL, cloudflarePrivate.cloudflareApiToken);
   }
-  if (config.kind === "platform" && platformPrivate.cloudflareTunnelToken && !host.exists(CF_TUNNEL_API_CREDENTIAL)) {
+  if (config.kind === "platform" && platformPrivate?.cloudflareTunnelToken && !host.exists(CF_TUNNEL_API_CREDENTIAL)) {
     await seal(host, "CF_TUNNEL_TOKEN", CF_TUNNEL_API_CREDENTIAL, platformPrivate.cloudflareTunnelToken);
   }
   const realtimeSecrets = cloudflare?.realtime && cloudflarePrivate ? deriveCloudflareRealtimeSecrets(cloudflarePrivate.cloudflareApiToken) : undefined;
@@ -15478,24 +15486,38 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await verifyBootstrapBundleOnHost(host, config, true);
   }
   if (config.kind === "platform") {
-    const root = platformPrivate.root;
-    if (!host.exists(JWT_CREDENTIAL)) {
-      await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
-    }
-    if (!host.exists(ARANGO_ROOT_CREDENTIAL)) {
-      await seal(host, "arangodb-root-password", ARANGO_ROOT_CREDENTIAL, `fzr_${derive(root, "forgezero/cluster/arangodb-root-password/v1")}`);
-    }
-    await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
-    await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
-    for (const [name, source] of Object.entries({
-      ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "backup.s3.secretAccessKey": platformPrivate.backup
-    })) {
-      if (source) {
-        const destination2 = `${CREDS}/${name}.cred`;
-        if (!host.exists(destination2)) {
-          await seal(host, name, destination2, source);
+    if (reuseBoundPlatformCredentials) {
+      const required = [
+        ...config.database.role !== "none" ? [JWT_CREDENTIAL, ARANGO_ROOT_CREDENTIAL] : [],
+        SEED_CREDENTIAL,
+        BACKUP_RECOVERY_CREDENTIAL,
+        ...emailCredentialName ? [`${CREDS}/${emailCredentialName}.cred`] : [],
+        ...config.runtime.environment.backup ? [`${CREDS}/backup.s3.secretAccessKey.cred`] : [],
+        ...installed?.cloudflare ? [CF_API_CREDENTIAL, CF_TUNNEL_API_CREDENTIAL, TUNNEL_CREDENTIAL] : [],
+        ...installed?.realtime ? [REALTIME_PUBLISH_CREDENTIAL, REALTIME_TICKET_CREDENTIAL] : []
+      ];
+      const missing = required.find((path) => !host.exists(path));
+      if (missing)
+        throw new Error(`stored platform credential is missing: ${missing}`);
+    } else {
+      const root = platformPrivate.root;
+      if (!host.exists(JWT_CREDENTIAL)) {
+        await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
+      }
+      if (!host.exists(ARANGO_ROOT_CREDENTIAL)) {
+        await seal(host, "arangodb-root-password", ARANGO_ROOT_CREDENTIAL, `fzr_${derive(root, "forgezero/cluster/arangodb-root-password/v1")}`);
+      }
+      await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
+      await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
+      for (const [name, source] of Object.entries({
+        ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
+        "backup.s3.secretAccessKey": platformPrivate.backup
+      })) {
+        if (source) {
+          const destination2 = `${CREDS}/${name}.cred`;
+          if (!host.exists(destination2))
+            await seal(host, name, destination2, source);
         }
       }
     }
@@ -15564,6 +15586,46 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await checked3(host, ["nginx", "-t"], "nginx configuration");
     await checked3(host, ["systemctl", "daemon-reload"], "systemd reload");
     await checked3(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
+    if (alreadyEnrolled && !bootstrapManifest) {
+      const healthCommand = [
+        "curl",
+        "--fail",
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "10",
+        `http://127.0.0.1:${runtime.environment.publicApiPort}${runtime.healthPath}`
+      ];
+      const health = await host.exec(healthCommand);
+      if (health.exitCode !== 0) {
+        const activeSlotFile = `${runtime.slotsDirectory}/.active`;
+        if (!host.exists(activeSlotFile))
+          throw new Error("enrolled platform active API slot evidence is missing");
+        const activeSlot = host.read(activeSlotFile).trim();
+        if (activeSlot !== "blue" && activeSlot !== "green") {
+          throw new Error("enrolled platform active API slot evidence is malformed");
+        }
+        await checked3(host, ["systemctl", "start", `forgezero@${activeSlot}.service`], "active API slot repair");
+        let ready = false;
+        let lastHealthOutput = "";
+        for (let attempt = 0;attempt < 30; attempt += 1) {
+          const repairedHealth = await host.exec(healthCommand);
+          if (repairedHealth.exitCode === 0) {
+            ready = true;
+            break;
+          }
+          lastHealthOutput = repairedHealth.output.trim();
+          if (attempt < 29)
+            await (host.sleep?.(1000) ?? Bun.sleep(1000));
+        }
+        if (!ready)
+          throw new Error(`repaired API health failed: ${lastHealthOutput || "readiness deadline exceeded"}`);
+      }
+      if (redundantBootstrapBundle) {
+        host.remove(config.bootstrapBundle.bundleFile);
+        host.remove(config.bootstrapBundle.manifestFile);
+      }
+    }
     if (config.database.role === "master") {
       const invite = `${runtime.environment.sharedDirectory}/platform-invite.token`;
       if (!host.exists(invite)) {
@@ -15660,7 +15722,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     host.remove(config.cloudflareHandoff.handoffFile);
   }
   let launch;
-  if (config.kind === "platform" && config.database.role === "master") {
+  if (config.kind === "platform" && config.database.role === "master" && !reuseBoundPlatformCredentials) {
     const invitePath = `${config.runtime.environment.sharedDirectory}/platform-invite.token`;
     if (!host.exists(invitePath))
       throw new Error("platform invite is missing after deployment");
@@ -17621,7 +17683,14 @@ function planOperatorPlatformBootstrap(request, mode) {
       user: request.target.user,
       ...request.target.jump ? { via: request.target.jump.address } : {}
     },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "promote" ? [
+      "verify pinned SSH transport and caller-approved SSH agent",
+      "copy pinned Bun and packaged fz artifacts to a private staging directory",
+      "verify and copy the one immutable API Git bundle plus its manifest",
+      "stage the rewritten owner-only platform config without plaintext credentials",
+      "promote the exact release using the credentials already sealed on the enrolled compute",
+      "remove transient local and remote staging data"
+    ] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to a private staging directory",
       "verify and copy the one immutable API Git bundle plus its manifest",
@@ -18124,7 +18193,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
       allowStoredCloudflareCredentials: mode === "repair"
     }) : undefined;
     const staged = await stageConfig(config, directory, {
-      reuseBoundCloudflare: mode === "repair"
+      reuseBoundCloudflare: mode === "repair" || mode === "promote"
     });
     await installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options);
     await copy(exec, request, knownHosts, staged.path, `${remoteTemp}/platform-config.json`, true);
@@ -18141,15 +18210,15 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
       "-n",
       "/usr/local/bin/fz",
       "bootstrap",
-      mode === "repair" ? "repair" : "platform",
-      "credentials-stdin"
+      mode === "apply" ? "platform" : "repair",
+      mode === "promote" ? "stored-credentials" : "credentials-stdin"
     ];
     command.push("--bootstrap-config", `${REMOTE_STAGE}/platform-config.json`, "--apply");
     const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap", mode === "apply", secrets ? `${JSON.stringify(secrets)}
 ` : undefined, mode === "apply");
     return { plan, output };
   } finally {
-    if (knownHosts) {
+    if (knownHosts && mode !== "status") {
       await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/rm", "-rf", "--", REMOTE_STAGE, remoteTemp], "remote bootstrap cleanup", true).catch(() => {
         return;
       });
@@ -20067,6 +20136,31 @@ async function prepareForgeZeroPlatformLaunch(environment, outputDirectory, proj
     owner: owner ?? forgeZeroLaunchOwnerInput()
   });
 }
+var GENESIS_HOST_KEY_ATTEMPTS = 12;
+var GENESIS_HOST_KEY_RETRY_MS = 2000;
+async function reconcileForgeZeroGenesisGuests(outputDirectory) {
+  const base = dirname14(outputDirectory);
+  const metalRequestFile = join13(base, "metal", "metal-remote.json");
+  const guestHostKeysFile = join13(base, "genesis-guest-host-keys.json");
+  const metalRequest = readOperatorMetalBootstrapRequest(metalRequestFile, { validateMetalConfig: false });
+  await applyOperatorMetalBootstrap(metalRequest, "genesis");
+  let lastFailure;
+  for (let attempt = 1;attempt <= GENESIS_HOST_KEY_ATTEMPTS; attempt += 1) {
+    try {
+      const result = await applyOperatorMetalBootstrap(metalRequest, "host-keys");
+      const evidence = JSON.parse(result.output);
+      writeDerivedLaunchFile(guestHostKeysFile, (temporary) => writeOperatorGuestHostKeyEvidence(temporary, evidence, metalRequest));
+      readOperatorGuestHostKeyEvidence(guestHostKeysFile, metalRequest);
+      return;
+    } catch (cause) {
+      lastFailure = cause;
+      if (attempt < GENESIS_HOST_KEY_ATTEMPTS) {
+        await new Promise((resolve14) => setTimeout(resolve14, GENESIS_HOST_KEY_RETRY_MS));
+      }
+    }
+  }
+  throw new Error(`reviewed genesis guests did not become SSH-ready: ${lastFailure instanceof Error ? lastFailure.message : String(lastFailure)}`);
+}
 function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint) {
   if (!process.stdin.isTTY)
     throw new Error("non-interactive bootstrap requires --bootstrap-config <private-json-file>");
@@ -20266,6 +20360,8 @@ async function cmdBootstrap(options, args) {
       }
       const outputDirectory = options.outputPath ?? join13(homedir2(), ".forgezero-secure", environment, "genesis");
       const environmentInput = options.bootstrapSecretsEnvFile ? readPlatformLaunchEnvironment(options.bootstrapSecretsEnvFile) : undefined;
+      if (options.apply)
+        await reconcileForgeZeroGenesisGuests(outputDirectory);
       const fleet = readOperatorPlatformBootstrapFleetRequest((await prepareForgeZeroPlatformLaunch(environment, outputDirectory, options.projectRoot, environmentInput?.owner)).fleetRequest);
       if (planOperatorPlatformFleetBootstrap(fleet, "apply").environment !== environment) {
         throw new Error("existing platform fleet does not match the selected launch profile");
@@ -20277,8 +20373,8 @@ async function cmdBootstrap(options, args) {
     }
     if (operation === "platform" && args[1] === "fleet") {
       const mode = args[2];
-      if (!mode || !["apply", "status"].includes(mode) || args[3] !== undefined) {
-        throw new Error("Usage: fz bootstrap platform fleet <apply|status> --bootstrap-config <owner-only-platform-fleet-remote.json> [--apply]");
+      if (!mode || !["apply", "promote", "status"].includes(mode) || args[3] !== undefined) {
+        throw new Error("Usage: fz bootstrap platform fleet <apply|promote|status> --bootstrap-config <owner-only-platform-fleet-remote.json> [--apply]");
       }
       if (!options.bootstrapConfigPath)
         throw new Error("remote platform fleet bootstrap requires --bootstrap-config");
@@ -20288,12 +20384,23 @@ async function cmdBootstrap(options, args) {
         out.line(JSON.stringify(result2, null, 2));
         return result2.ok ? 0 : 1;
       }
+      if (mode === "promote") {
+        const plan2 = planOperatorPlatformFleetBootstrap(fleet, mode);
+        out.line(JSON.stringify(plan2, null, 2));
+        if (!options.apply) {
+          out.step("Review the pinned secret-free promotion, then repeat with --apply.");
+          return 0;
+        }
+        const result2 = await applyOperatorPlatformFleetBootstrap(fleet, mode);
+        out.line(JSON.stringify(result2, null, 2));
+        return result2.ok ? 0 : 1;
+      }
       return await runAttendedPlatformFleet(fleet, options.apply);
     }
     if (operation === "platform" && args[1] === "remote") {
       const mode = args[2];
-      if (!mode || !["apply", "repair", "status"].includes(mode) || args[3] !== undefined) {
-        throw new Error("Usage: fz bootstrap platform remote <apply|repair|status> --bootstrap-config <owner-only-request.json> [--apply]");
+      if (!mode || !["apply", "repair", "promote", "status"].includes(mode) || args[3] !== undefined) {
+        throw new Error("Usage: fz bootstrap platform remote <apply|repair|promote|status> --bootstrap-config <owner-only-request.json> [--apply]");
       }
       if (!options.bootstrapConfigPath)
         throw new Error("remote platform bootstrap requires --bootstrap-config");
@@ -20406,8 +20513,9 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     const credentialStdin = (operation === "platform" || operation === "repair") && args[1] === "credentials-stdin";
-    if (credentialStdin && args[2] !== undefined)
-      throw new Error("platform credential stdin accepts no additional positional arguments");
+    const storedCredentials = operation === "repair" && args[1] === "stored-credentials";
+    if ((credentialStdin || storedCredentials) && args[2] !== undefined)
+      throw new Error("platform credential mode accepts no additional positional arguments");
     const installedBootstrapKind = () => resolveInstalledBootstrapKind({
       metal: existsSync13(METAL_BOOTSTRAP_STATE_PATH),
       compute: existsSync13(BOOTSTRAP_STATE_PATH)
@@ -20451,7 +20559,7 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (!["platform", "repair"].includes(operation)) {
-      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [launch|bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|genesis-cleanup|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>]|status|repair [--bootstrap-config <path>] [--apply]");
+      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [launch|bundle|fleet <apply|promote|status>|remote <apply|repair|promote|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|genesis-cleanup|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>]|status|repair [--bootstrap-config <path>] [--apply]");
     }
     const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
       throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
@@ -20468,7 +20576,7 @@ async function cmdBootstrap(options, args) {
       out.step("Review the plan, then repeat with --apply as root.");
       return 0;
     }
-    const secrets = config.kind === "platform" && !credentialStdin ? await promptPlatformBootstrapSecrets(config, undefined, {
+    const secrets = config.kind === "platform" && !credentialStdin && !storedCredentials ? await promptPlatformBootstrapSecrets(config, undefined, {
       reuseBoundCloudflare: operation === "repair"
     }) : undefined;
     let stdinSecrets = secrets;
@@ -20486,7 +20594,9 @@ async function cmdBootstrap(options, args) {
         allowStoredCloudflareCredentials: operation === "repair"
       });
     }
-    const result = await applyBootstrap(config, undefined, stdinSecrets);
+    const result = await applyBootstrap(config, undefined, stdinSecrets, {
+      reuseBoundPlatformCredentials: storedCredentials
+    });
     out.line(JSON.stringify(result, null, 2));
     return 0;
   } catch (cause) {
@@ -21114,10 +21224,10 @@ function usage() {
 	                         One profile-driven attended launch. Public topology,
 	                         bundle and edge names are derived; the owner supplies
 	                         only email settings, hidden provider tokens and APPLY
-	 fz bootstrap platform remote <apply|repair|status>
+	 fz bootstrap platform remote <apply|repair|promote|status>
 	                         Run typed bootstrap from the operator laptop through
-	                         a pinned host; apply copies and verifies that bundle
-	 fz bootstrap platform fleet <apply|status>
+	                         a pinned host; promote reuses sealed host credentials
+	 fz bootstrap platform fleet <apply|promote|status>
 	                         One attended genesis operation: reconcile public
 	                         hostnames/Tunnels, seal credentials, deploy the bundle,
 	                         run all three nodes, verify ingress and print the invite

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.128";
+var VERSION = "0.1.130";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.d.ts

@@ -89,7 +89,7 @@ export interface OperatorPlatformFleetCoordinates {
         databaseRole: 'master' | 'joiner';
     }[];
 }
-export type OperatorPlatformBootstrapMode = 'apply' | 'repair' | 'status';
+export type OperatorPlatformBootstrapMode = 'apply' | 'repair' | 'promote' | 'status';
 export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'genesis-cleanup' | 'rehearsal' | 'rehearsal-cleanup' | 'host-keys' | 'rehearsal-host-keys' | 'status';
 export interface OperatorPlatformBootstrapPlan {
     kind: 'platform-remote';

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.128";
+var VERSION = "0.1.130";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4664,6 +4664,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     installed = parseStoredState(host.read(STATE_PATH));
   let bootstrapManifest;
   let releaseEvidence;
+  let redundantBootstrapBundle = false;
   if (config.kind === "platform") {
     const staged = host.exists(config.bootstrapBundle.bundleFile) || host.exists(config.bootstrapBundle.manifestFile);
     if (staged && !(host.exists(config.bootstrapBundle.bundleFile) && host.exists(config.bootstrapBundle.manifestFile))) {
@@ -4684,8 +4685,11 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       if (typeof evidence.revision !== "string" || !/^[a-f0-9]{40}$/.test(evidence.revision) || typeof evidence.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(evidence.sha256) || typeof evidence.branch !== "string")
         throw new Error("bootstrap release evidence is malformed");
       releaseEvidence = { revision: evidence.revision, sha256: evidence.sha256, branch: evidence.branch };
-      if (evidence.revision !== reviewed.revision || evidence.sha256 !== reviewed.sha256 || evidence.branch !== reviewed.branch)
+      if (evidence.revision !== reviewed.revision || evidence.branch !== reviewed.branch) {
         bootstrapManifest = reviewed;
+      } else {
+        redundantBootstrapBundle = true;
+      }
     } else if (host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
       let evidence;
       try {
@@ -4757,7 +4761,11 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     }
     allowInterruptedReleaseRebind = !exactIdentity && (boundedReleaseResume || approvedIdentityMigration);
   }
-  const platformPrivate = config.kind === "platform" ? (() => {
+  const reuseBoundPlatformCredentials = config.kind === "platform" && dependencies.reuseBoundPlatformCredentials === true;
+  if (reuseBoundPlatformCredentials && (!installed || !host.exists("/var/lib/forgezero/enrolment.json"))) {
+    throw new Error("stored-credential promotion requires an installed enrolled platform compute");
+  }
+  const platformPrivate = config.kind === "platform" && !reuseBoundPlatformCredentials ? (() => {
     if (!secrets)
       throw new Error("platform apply requires attended credentials on stdin");
     const checked4 = validatePlatformBootstrapSecrets(config, secrets, {
@@ -4800,7 +4808,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (cloudflarePrivate && !host.exists(CF_API_CREDENTIAL)) {
     await seal(host, "CF_API_TOKEN", CF_API_CREDENTIAL, cloudflarePrivate.cloudflareApiToken);
   }
-  if (config.kind === "platform" && platformPrivate.cloudflareTunnelToken && !host.exists(CF_TUNNEL_API_CREDENTIAL)) {
+  if (config.kind === "platform" && platformPrivate?.cloudflareTunnelToken && !host.exists(CF_TUNNEL_API_CREDENTIAL)) {
     await seal(host, "CF_TUNNEL_TOKEN", CF_TUNNEL_API_CREDENTIAL, platformPrivate.cloudflareTunnelToken);
   }
   const realtimeSecrets = cloudflare?.realtime && cloudflarePrivate ? deriveCloudflareRealtimeSecrets(cloudflarePrivate.cloudflareApiToken) : undefined;
@@ -4858,24 +4866,38 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await verifyBootstrapBundleOnHost(host, config, true);
   }
   if (config.kind === "platform") {
-    const root = platformPrivate.root;
-    if (!host.exists(JWT_CREDENTIAL)) {
-      await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
-    }
-    if (!host.exists(ARANGO_ROOT_CREDENTIAL)) {
-      await seal(host, "arangodb-root-password", ARANGO_ROOT_CREDENTIAL, `fzr_${derive(root, "forgezero/cluster/arangodb-root-password/v1")}`);
-    }
-    await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
-    await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
-    for (const [name, source] of Object.entries({
-      ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "backup.s3.secretAccessKey": platformPrivate.backup
-    })) {
-      if (source) {
-        const destination2 = `${CREDS}/${name}.cred`;
-        if (!host.exists(destination2)) {
-          await seal(host, name, destination2, source);
+    if (reuseBoundPlatformCredentials) {
+      const required = [
+        ...config.database.role !== "none" ? [JWT_CREDENTIAL, ARANGO_ROOT_CREDENTIAL] : [],
+        SEED_CREDENTIAL,
+        BACKUP_RECOVERY_CREDENTIAL,
+        ...emailCredentialName ? [`${CREDS}/${emailCredentialName}.cred`] : [],
+        ...config.runtime.environment.backup ? [`${CREDS}/backup.s3.secretAccessKey.cred`] : [],
+        ...installed?.cloudflare ? [CF_API_CREDENTIAL, CF_TUNNEL_API_CREDENTIAL, TUNNEL_CREDENTIAL] : [],
+        ...installed?.realtime ? [REALTIME_PUBLISH_CREDENTIAL, REALTIME_TICKET_CREDENTIAL] : []
+      ];
+      const missing = required.find((path) => !host.exists(path));
+      if (missing)
+        throw new Error(`stored platform credential is missing: ${missing}`);
+    } else {
+      const root = platformPrivate.root;
+      if (!host.exists(JWT_CREDENTIAL)) {
+        await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
+      }
+      if (!host.exists(ARANGO_ROOT_CREDENTIAL)) {
+        await seal(host, "arangodb-root-password", ARANGO_ROOT_CREDENTIAL, `fzr_${derive(root, "forgezero/cluster/arangodb-root-password/v1")}`);
+      }
+      await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
+      await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
+      for (const [name, source] of Object.entries({
+        ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
+        "backup.s3.secretAccessKey": platformPrivate.backup
+      })) {
+        if (source) {
+          const destination2 = `${CREDS}/${name}.cred`;
+          if (!host.exists(destination2))
+            await seal(host, name, destination2, source);
         }
       }
     }
@@ -4944,6 +4966,46 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await checked3(host, ["nginx", "-t"], "nginx configuration");
     await checked3(host, ["systemctl", "daemon-reload"], "systemd reload");
     await checked3(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
+    if (alreadyEnrolled && !bootstrapManifest) {
+      const healthCommand = [
+        "curl",
+        "--fail",
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "10",
+        `http://127.0.0.1:${runtime.environment.publicApiPort}${runtime.healthPath}`
+      ];
+      const health = await host.exec(healthCommand);
+      if (health.exitCode !== 0) {
+        const activeSlotFile = `${runtime.slotsDirectory}/.active`;
+        if (!host.exists(activeSlotFile))
+          throw new Error("enrolled platform active API slot evidence is missing");
+        const activeSlot = host.read(activeSlotFile).trim();
+        if (activeSlot !== "blue" && activeSlot !== "green") {
+          throw new Error("enrolled platform active API slot evidence is malformed");
+        }
+        await checked3(host, ["systemctl", "start", `forgezero@${activeSlot}.service`], "active API slot repair");
+        let ready = false;
+        let lastHealthOutput = "";
+        for (let attempt = 0;attempt < 30; attempt += 1) {
+          const repairedHealth = await host.exec(healthCommand);
+          if (repairedHealth.exitCode === 0) {
+            ready = true;
+            break;
+          }
+          lastHealthOutput = repairedHealth.output.trim();
+          if (attempt < 29)
+            await (host.sleep?.(1000) ?? Bun.sleep(1000));
+        }
+        if (!ready)
+          throw new Error(`repaired API health failed: ${lastHealthOutput || "readiness deadline exceeded"}`);
+      }
+      if (redundantBootstrapBundle) {
+        host.remove(config.bootstrapBundle.bundleFile);
+        host.remove(config.bootstrapBundle.manifestFile);
+      }
+    }
     if (config.database.role === "master") {
       const invite = `${runtime.environment.sharedDirectory}/platform-invite.token`;
       if (!host.exists(invite)) {
@@ -5040,7 +5102,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     host.remove(config.cloudflareHandoff.handoffFile);
   }
   let launch;
-  if (config.kind === "platform" && config.database.role === "master") {
+  if (config.kind === "platform" && config.database.role === "master" && !reuseBoundPlatformCredentials) {
     const invitePath = `${config.runtime.environment.sharedDirectory}/platform-invite.token`;
     if (!host.exists(invitePath))
       throw new Error("platform invite is missing after deployment");
@@ -6737,7 +6799,14 @@ function planOperatorPlatformBootstrap(request, mode) {
       user: request.target.user,
       ...request.target.jump ? { via: request.target.jump.address } : {}
     },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "promote" ? [
+      "verify pinned SSH transport and caller-approved SSH agent",
+      "copy pinned Bun and packaged fz artifacts to a private staging directory",
+      "verify and copy the one immutable API Git bundle plus its manifest",
+      "stage the rewritten owner-only platform config without plaintext credentials",
+      "promote the exact release using the credentials already sealed on the enrolled compute",
+      "remove transient local and remote staging data"
+    ] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to a private staging directory",
       "verify and copy the one immutable API Git bundle plus its manifest",
@@ -7303,7 +7372,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
       allowStoredCloudflareCredentials: mode === "repair"
     }) : undefined;
     const staged = await stageConfig(config, directory, {
-      reuseBoundCloudflare: mode === "repair"
+      reuseBoundCloudflare: mode === "repair" || mode === "promote"
     });
     await installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options);
     await copy(exec, request, knownHosts, staged.path, `${remoteTemp}/platform-config.json`, true);
@@ -7320,15 +7389,15 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
       "-n",
       "/usr/local/bin/fz",
       "bootstrap",
-      mode === "repair" ? "repair" : "platform",
-      "credentials-stdin"
+      mode === "apply" ? "platform" : "repair",
+      mode === "promote" ? "stored-credentials" : "credentials-stdin"
     ];
     command.push("--bootstrap-config", `${REMOTE_STAGE}/platform-config.json`, "--apply");
     const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap", mode === "apply", secrets ? `${JSON.stringify(secrets)}
 ` : undefined, mode === "apply");
     return { plan, output };
   } finally {
-    if (knownHosts) {
+    if (knownHosts && mode !== "status") {
       await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/rm", "-rf", "--", REMOTE_STAGE, remoteTemp], "remote bootstrap cleanup", true).catch(() => {
         return;
       });

package/dist/platform-fleet-verification.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.128";
+var VERSION3 = "0.1.130";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.128";
+var VERSION3 = "0.1.130";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/ssh-bootstrap.d.ts

@@ -1,6 +1,7 @@
 import type { NodeKeyPair } from '@forgezero/runtime/identity';
 import type { AgentOperationTelemetry } from './telemetry-runtime';
 import { type GitHostResolver } from './git-egress';
+import type { MetalBootstrapConfig } from './metal-bootstrap';
 export interface RemoteSshBootstrapClaim {
     computeKey: string;
     computeReference: string;
@@ -50,30 +51,16 @@ export interface RemoteMetalAdmissionClaim {
     runnerNodeKey: string;
     runnerSshPublicKey: string;
     challenge: string;
-    provisioning: {
-        volumeGroup: string;
-        bridge: string;
-        subnetPrefix: string;
-        addressStart: number;
-        addressEnd: number;
-        gateway: string;
-        nameservers: string[];
-        cpuPools: Array<{
-            key: string;
-            cpus: string;
-            physicalCores: number;
-            memoryNodes?: string;
-        }>;
-        housekeepingCpus: string;
-        housekeepingMemoryNodes?: string;
-        confidential?: {
-            cbitpos: number;
-            reducedPhysBits: number;
-            policy: string;
-        };
-    };
     target: RemoteSshBootstrapClaim['target'];
 }
+type MetalAdmissionProvisioning = Pick<MetalBootstrapConfig['profile'], 'volumeGroup' | 'bridge' | 'subnetPrefix' | 'addressStart' | 'addressEnd' | 'gateway' | 'nameservers' | 'cpuPools' | 'housekeepingCpus'>;
+/**
+ * Convert runner-observed Linux CPU topology into the fixed ForgeZero host
+ * boundary. The browser never authors this capacity. One physical core and all
+ * of its SMT siblings remain reserved for the host; every other complete core
+ * becomes the initial allocatable pool.
+ */
+export declare function deriveMetalAdmissionProvisioning(lscpu: string): MetalAdmissionProvisioning;
 export interface MetalAdmissionProof {
     jobKey: string;
     tenantKey: string;
@@ -181,3 +168,4 @@ export declare function startMetalAdmissionPull(options: SshBootstrapPullOptions
     stop(): Promise<void>;
     readonly active: boolean;
 };
+export {};

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.128";
+export declare const VERSION = "0.1.130";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.128",
+  "version": "0.1.130",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",
@@ -11,13 +11,13 @@
     "typescript": "^5.6.0",
     "@types/bun": "latest",
     "@types/node": "^22.0.0",
-    "@forgezero/access": "0.1.13",
+    "@forgezero/access": "0.1.14",
     "@noble/curves": "^2.2.0",
     "@noble/post-quantum": "^0.6.1"
   },
   "dependencies": {
-    "@forgezero/runtime": "0.1.19",
-    "@forgezero/vault": "0.1.25",
+    "@forgezero/runtime": "0.1.21",
+    "@forgezero/vault": "0.1.27",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
     "@noble/post-quantum": "0.6.1",