@forgezero/agent 0.1.21 → 0.1.23

package/dist/metal-provision.js

@@ -138,393 +138,6 @@ function shapeEgressUnitDirectives(tap, guaranteedMbps, burstMbps) {
 }
 var tapFor = (guestIndex) => `tap${guestIndex}`;
 
-// src/provision.ts
-function atLeast(version, floor) {
-  const parse = (value) => (value.trim().replace(/^v/, "").match(/\d+/g) ?? []).slice(0, 3).map(Number);
-  const got = parse(version);
-  const want = parse(floor);
-  if (got.length === 0)
-    return false;
-  for (let index = 0;index < want.length; index += 1) {
-    const a = got[index] ?? 0;
-    const b = want[index] ?? 0;
-    if (a > b)
-      return true;
-    if (a < b)
-      return false;
-  }
-  return true;
-}
-var CAPABILITY_CHECKS = {
-  snpGuest: {
-    command: "test -e /dev/sev-guest && echo yes || echo no",
-    satisfied: (stdout) => stdout.trim() === "yes",
-    remedy: "Not a confidential guest. The agent will run in `enrolled` mode, which is still stronger than an API key in the application."
-  },
-  systemd: {
-    command: "test -d /run/systemd/system && echo yes || echo no",
-    satisfied: (stdout) => stdout.trim() === "yes",
-    remedy: "systemd is what supervises the agent. On a non-systemd host, run `fz-agent` under whatever supervises services there."
-  },
-  bun: {
-    command: "bun --version 2>/dev/null || echo missing",
-    satisfied: (stdout) => atLeast(stdout, "1.1.0"),
-    remedy: "Install bun: curl -fsSL https://bun.sh/install | bash"
-  },
-  python: {
-    command: "python3 --version 2>/dev/null || echo missing",
-    satisfied: (stdout, exitCode) => exitCode === 0 && /^Python 3\./.test(stdout.trim()),
-    remedy: "Install Python 3. It supplies the standard-library ioctl boundary for SNP reports."
-  }
-};
-var modeFor = (capabilities) => capabilities.snpGuest ? "attested" : "enrolled";
-var reasonFor = (mode) => mode === "attested" ? "SEV-SNP guest device present, so the agent can prove what it is running and the platform can refuse it if the measurement is wrong." : "No SEV-SNP guest device. The agent authenticates with its enrolment token and hybrid Ed25519 + ML-DSA signature — weaker than attestation, stronger than an API key in the application.";
-var DEPLOYMENT_RUNNER_USER = "forgezero-runner";
-var DEPLOYMENT_GROUP = "forgezero-deploy";
-var VAULT_GROUP = "forgezero-vault";
-var DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
-var DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
-var ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
-function agentEnrolmentUnit(options) {
-  if (!options.apiUrl || !options.enrolTokenCredentialPath || !options.enrolStatePath) {
-    throw new Error("direct enrolment needs API, credential and state paths");
-  }
-  const bin = options.binPath ?? "fz-agent";
-  const user = options.user ?? "forgezero";
-  const seedCredentialPath = options.seedCredentialPath ?? "/etc/forgezero/creds/agent-seed.cred";
-  const label = options.nodeLabel ? `Environment=FZ_NODE_LABEL=${options.nodeLabel}
-` : "";
-  const gitPublicKey = options.gitPublicKeyPath ? `Environment=FZ_GIT_PUBLIC_KEY_FILE=${options.gitPublicKeyPath}
-` : "";
-  const stateDir = options.enrolStatePath.replace(/\/[^/]+$/, "");
-  return `[Unit]
-Description=Bind this machine to its ForgeZero compute
-After=network-online.target
-Wants=network-online.target
-Before=forgezero-agent.service
-ConditionPathExists=!${options.enrolStatePath}
-
-[Service]
-Type=oneshot
-User=${user}
-Group=${user}
-LoadCredentialEncrypted=agent-seed:${seedCredentialPath}
-LoadCredentialEncrypted=enrol-token:${options.enrolTokenCredentialPath}
-Environment=FZ_SEED_CREDENTIAL=agent-seed
-Environment=FZ_ENROL_TOKEN_CREDENTIAL=enrol-token
-Environment=FZ_ENROL_STATE_FILE=${options.enrolStatePath}
-Environment=FZ_API=${options.apiUrl}
-${label}${gitPublicKey}ExecStart=${bin} enrol
-# A '+' fixed command runs as root solely to remove the host-bound one-time
-# ciphertext. Tenant code and the agent never receive a privilege boundary.
-ExecStartPost=+/usr/bin/rm -f ${options.enrolTokenCredentialPath}
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=true
-ReadWritePaths=${stateDir}
-LimitCORE=0
-
-[Install]
-WantedBy=multi-user.target
-`;
-}
-function deploymentRunnerUnit(options) {
-  const bin = options.binPath ?? "fz-agent";
-  const root = options.deployRoot ?? "/opt/forgezero";
-  const agentUser = options.user ?? "forgezero-agent";
-  return `[Unit]
-Description=ForgeZero credential-free project command runner
-Documentation=https://www.forgezero.net/docs/agent
-
-[Service]
-Type=notify
-NotifyAccess=all
-User=${DEPLOYMENT_RUNNER_USER}
-Group=${DEPLOYMENT_GROUP}
-Environment=FZ_DEPLOY_RUNNER_SOCKET=${DEPLOYMENT_RUNNER_SOCKET}
-RuntimeDirectory=forgezero-deploy
-RuntimeDirectoryMode=0710
-ExecStartPre=+/usr/bin/install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0710 /run/forgezero-deploy
-ExecStartPre=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
-ExecStart=${bin} deploy-runner --root=${root} --home=${root}/runner-home
-ExecStartPost=+/usr/bin/chown ${agentUser}:${agentUser} ${DEPLOYMENT_RUNNER_SOCKET}
-ExecStartPost=+/usr/bin/chmod 0600 ${DEPLOYMENT_RUNNER_SOCKET}
-ExecStartPost=+/usr/bin/chown root:${VAULT_GROUP} /run/forgezero-deploy
-ExecStopPost=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
-Restart=always
-RestartSec=2
-UMask=0007
-LimitCORE=0
-NoNewPrivileges=false
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectControlGroups=true
-RestrictRealtime=true
-MemoryDenyWriteExecute=true
-LockPersonality=true
-ReadWritePaths=${root}/releases ${root}/runner-home
-
-[Install]
-WantedBy=multi-user.target
-`;
-}
-function agentUnit(options) {
-  const bin = options.binPath ?? "fz-agent";
-  const user = options.user ?? "forgezero";
-  const seedCredentialPath = options.seedCredentialPath ?? "/etc/forgezero/creds/agent-seed.cred";
-  const controlSocketPath = options.controlSocketPath ?? "/run/forgezero/control.sock";
-  const deployRoot = options.deployRoot ?? "/opt/forgezero";
-  const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
-  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath && options.enrolStatePath);
-  const deploymentEnvironment = options.deploymentEnvironment ?? {};
-  const deploymentCredentials = options.deploymentCredentials ?? {};
-  for (const [name, value] of Object.entries(deploymentEnvironment)) {
-    if (!/^[A-Z_][A-Z0-9_]*$/.test(name) || !/^[A-Za-z0-9._:\/@+-]+$/.test(value)) {
-      throw new Error(`invalid deployment environment entry: ${name}`);
-    }
-  }
-  for (const [name, path] of Object.entries(deploymentCredentials)) {
-    if (!/^[A-Z_][A-Z0-9_]*$/.test(name) || !path.startsWith("/") || /[\r\n:]/.test(path)) {
-      throw new Error(`invalid deployment credential entry: ${name}`);
-    }
-  }
-  const environment = [
-    `FZ_SOCKET_PATH=${options.socketPath}`,
-    `FZ_CONTROL_SOCKET=${controlSocketPath}`,
-    `FZ_SEED_CREDENTIAL=agent-seed`,
-    `FZ_AGENT_MODE=${options.mode}`,
-    options.apiUrl ? `FZ_API=${options.apiUrl}` : null,
-    options.project ? `FZ_PROJECT=${options.project}` : null,
-    options.environment ? `FZ_ENVIRONMENT=${options.environment}` : null,
-    options.enrolStatePath ? `FZ_ENROL_STATE_FILE=${options.enrolStatePath}` : null,
-    options.nodeLabel ? `FZ_NODE_LABEL=${options.nodeLabel}` : null,
-    options.gitPublicKeyPath ? `FZ_GIT_PUBLIC_KEY_FILE=${options.gitPublicKeyPath}` : null,
-    options.repository ? `FZ_DEPLOY_REPO=${options.repository}` : null,
-    options.branch ? `FZ_DEPLOY_BRANCH=${options.branch}` : null,
-    options.role ? `FZ_DEPLOY_ROLE=${options.role}` : null,
-    options.repository && options.branch ? `FZ_DEPLOY_KEY=${options.project ?? "platform"}:${options.environment ?? "production"}` : null,
-    deploymentEnabled ? `FZ_DEPLOY_ROOT=${deployRoot}` : null,
-    deploymentEnabled ? `FZ_DEPLOY_RUNNER_SOCKET=${DEPLOYMENT_RUNNER_SOCKET}` : null,
-    Object.keys(deploymentCredentials).length > 0 ? `FZ_DEPLOY_SYSTEMD_SECRETS=${Object.keys(deploymentCredentials).join(",")}` : null,
-    Object.keys(deploymentEnvironment).length > 0 ? `FZ_DEPLOY_ENV_NAMES=${Object.keys(deploymentEnvironment).join(",")}` : null,
-    ...Object.entries(deploymentEnvironment).map(([name, value]) => `${name}=${value}`),
-    options.publicApiUrl ? `FZ_PUBLIC_API_URL=${options.publicApiUrl}` : null,
-    options.pullDeployments ? "FZ_DEPLOY_PULL=true" : null
-  ].filter((line) => line !== null);
-  if (deploymentEnabled) {
-    environment.push(`HOME=${deployRoot}/agent-home`, `XDG_CACHE_HOME=${deployRoot}/cache`);
-  }
-  const gitCredential = options.gitCredentialPath ? `LoadCredentialEncrypted=git-deploy-key:${options.gitCredentialPath}
-` : "";
-  const projectCredentials = Object.entries(deploymentCredentials).map(([name, path]) => `LoadCredentialEncrypted=${name}:${path}`).join(`
-`);
-  const deploymentWrites = deploymentEnabled ? `ReadWritePaths=${deployRoot}/releases ${deployRoot}/agent-home ${deployRoot}/cache` : "";
-  const deploymentGroup = deploymentEnabled ? `SupplementaryGroups=${DEPLOYMENT_GROUP}` : "";
-  const after = [
-    "network-online.target",
-    deploymentEnabled ? "forgezero-deploy-runner.service" : null,
-    enrolmentEnabled ? "forgezero-agent-enrol.service" : null
-  ].filter((value) => value !== null);
-  const requires = [
-    deploymentEnabled ? "forgezero-deploy-runner.service" : null,
-    enrolmentEnabled ? "forgezero-agent-enrol.service" : null
-  ].filter((value) => value !== null);
-  const deploymentDependency = [
-    `After=${after.join(" ")}`,
-    "Wants=network-online.target",
-    requires.length > 0 ? `Requires=${requires.join(" ")}` : null
-  ].filter((value) => value !== null).join(`
-`);
-  const snpDevice = options.mode === "attested" ? `DevicePolicy=closed
-DeviceAllow=/dev/sev-guest rw` : "";
-  const snpPrepare = options.mode === "attested" ? `ExecStartPre=+/bin/chgrp ${VAULT_GROUP} /dev/sev-guest
-ExecStartPre=+/bin/chmod 0640 /dev/sev-guest
-` : "";
-  return `[Unit]
-Description=ForgeZero node agent (${options.mode})
-Documentation=https://www.forgezero.net/docs/agent
-${deploymentDependency}
-
-[Service]
-Type=simple
-User=${user}
-Group=${VAULT_GROUP}
-${deploymentGroup}
-LoadCredentialEncrypted=agent-seed:${seedCredentialPath}
-${gitCredential}${projectCredentials}${projectCredentials ? `
-` : ""}${snpPrepare}ExecStart=${bin}
-Restart=always
-RestartSec=2
-
-${environment.map((line) => `Environment=${line}`).join(`
-`)}
-
-# The node seed and the vault replica live in this process's memory. A core dump
-# writes both to disk, which is the one artefact this design exists to remove.
-LimitCORE=0
-
-# The socket is the entire interface: anything that can read it can read the
-# scope. So it lives in a directory systemd creates with a known owner rather
-# than wherever the process happened to have write access.
-RuntimeDirectory=forgezero
-RuntimeDirectoryMode=0750
-UMask=0007
-
-# Tenant-controlled commands execute in forgezero-deploy-runner.service. This
-# credential-bearing process never needs to cross a privilege boundary.
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectControlGroups=true
-RestrictSUIDSGID=true
-RestrictRealtime=true
-MemoryDenyWriteExecute=true
-LockPersonality=true
-${snpDevice}
-${deploymentWrites}
-
-[Install]
-WantedBy=multi-user.target
-`;
-}
-var UNIT_PATH = "/etc/systemd/system/forgezero-agent.service";
-function planProvision(options) {
-  const mode = options.mode;
-  const user = options.user ?? "forgezero";
-  const seedCredentialPath = options.seedCredentialPath ?? "/etc/forgezero/creds/agent-seed.cred";
-  const credentialDir = seedCredentialPath.replace(/\/[^/]+$/, "");
-  const deployRoot = options.deployRoot ?? "/opt/forgezero";
-  const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
-  const enrolmentEnabled = Boolean(options.enrolTokenSourcePath && options.enrolTokenCredentialPath && options.enrolStatePath);
-  if (Boolean(options.enrolTokenSourcePath) !== Boolean(options.enrolTokenCredentialPath) || Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath))
-    throw new Error("direct enrolment paths must be supplied together");
-  const safePath = (value, label) => {
-    if (!value || !/^\/[A-Za-z0-9._@/-]+$/.test(value))
-      throw new Error(`invalid ${label} path`);
-    return value;
-  };
-  const enrolTokenSourcePath = enrolmentEnabled ? safePath(options.enrolTokenSourcePath, "enrolment source") : undefined;
-  const enrolTokenCredentialPath = enrolmentEnabled ? safePath(options.enrolTokenCredentialPath, "enrolment credential") : undefined;
-  const enrolStatePath = enrolmentEnabled ? safePath(options.enrolStatePath, "enrolment state") : undefined;
-  const enrolStateDir = enrolStatePath?.replace(/\/[^/]+$/, "");
-  const sourceBinPath = options.sourceBinPath ? safePath(options.sourceBinPath, "agent source binary") : undefined;
-  const binPath = options.binPath ? safePath(options.binPath, "agent binary") : undefined;
-  const gitCredentialPath = options.gitCredentialPath ? safePath(options.gitCredentialPath, "Git credential") : undefined;
-  const gitPublicKeyPath = options.gitPublicKeyPath ? safePath(options.gitPublicKeyPath, "Git public key") : undefined;
-  if (options.generateGitIdentity && (!gitCredentialPath || !gitPublicKeyPath)) {
-    throw new Error("generated Git identity needs credential and public-key paths");
-  }
-  const gitPublicKeyDir = gitPublicKeyPath?.replace(/\/[^/]+$/, "");
-  return {
-    mode,
-    reason: reasonFor(mode),
-    unitPath: UNIT_PATH,
-    unit: agentUnit({ ...options, mode }),
-    auxiliaryUnits: [
-      ...deploymentEnabled ? [
-        { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) }
-      ] : [],
-      ...enrolmentEnabled ? [
-        { path: ENROLMENT_UNIT_PATH, unit: agentEnrolmentUnit(options) }
-      ] : []
-    ],
-    socketPath: options.socketPath,
-    user,
-    steps: [
-      {
-        label: "vault socket access group",
-        command: `groupadd --system ${VAULT_GROUP} || true`
-      },
-      ...sourceBinPath && binPath ? [{
-        label: "root-owned agent runtime",
-        command: `install -d -o root -g root -m 0755 ${binPath.replace(/\/[^/]+$/, "")}; ` + `install -o root -g root -m 0755 ${sourceBinPath} ${binPath}`
-      }] : [],
-      ...deploymentEnabled ? [{
-        label: "deployment isolation group",
-        command: `groupadd --system ${DEPLOYMENT_GROUP} || true`
-      }] : [],
-      {
-        label: "service account",
-        command: `useradd --system --no-create-home --shell /usr/sbin/nologin ${user} || true`
-      },
-      {
-        label: "bind service account to vault group",
-        command: `usermod -g ${VAULT_GROUP} ${user}`
-      },
-      ...deploymentEnabled ? [{
-        label: "credential-free deployment account",
-        command: `useradd --system --no-create-home --shell /usr/sbin/nologin --gid ${DEPLOYMENT_GROUP} ${DEPLOYMENT_RUNNER_USER} || true; ` + `usermod -a -G ${DEPLOYMENT_GROUP} ${user}`
-      }] : [],
-      {
-        label: "credential directory",
-        command: `install -d -o root -g root -m 0700 ${credentialDir}`
-      },
-      {
-        label: "encrypted node identity",
-        command: `test -s ${seedCredentialPath} || { ` + `openssl rand -base64 32 | tr '+/' '-_' | tr -d '=\\n' | ` + `systemd-creds encrypt --name=agent-seed - ${seedCredentialPath}; ` + `chmod 0400 ${seedCredentialPath}; }`
-      },
-      ...options.generateGitIdentity && gitCredentialPath && gitPublicKeyPath ? [
-        {
-          label: "Git deploy identity directory",
-          command: `install -d -o root -g root -m 0755 ${gitPublicKeyDir}`
-        },
-        {
-          label: "unique encrypted Git deploy identity",
-          command: `test -s ${gitCredentialPath} || { ` + `rm -f /run/forgezero-git-deploy-key /run/forgezero-git-deploy-key.pub; ` + `ssh-keygen -q -t ed25519 -N '' -C forgezero-compute -f /run/forgezero-git-deploy-key; ` + `systemd-creds encrypt --name=git-deploy-key /run/forgezero-git-deploy-key ${gitCredentialPath}; ` + `install -o root -g root -m 0444 /run/forgezero-git-deploy-key.pub ${gitPublicKeyPath}; ` + `rm -f /run/forgezero-git-deploy-key /run/forgezero-git-deploy-key.pub; ` + `chmod 0400 ${gitCredentialPath}; }; ` + `test -s ${gitPublicKeyPath} || { ` + `systemd-creds decrypt --name=git-deploy-key ${gitCredentialPath} /run/forgezero-git-deploy-key; ` + `ssh-keygen -y -f /run/forgezero-git-deploy-key | ` + `sed 's/$/ forgezero-compute/' > /run/forgezero-git-deploy-key.pub; ` + `install -o root -g root -m 0444 /run/forgezero-git-deploy-key.pub ${gitPublicKeyPath}; ` + `rm -f /run/forgezero-git-deploy-key /run/forgezero-git-deploy-key.pub; }; ` + `test -s ${gitCredentialPath} && test -s ${gitPublicKeyPath}`
-        }
-      ] : [],
-      ...enrolmentEnabled ? [
-        {
-          label: "enrolment state directory",
-          command: `install -d -o ${user} -g ${user} -m 0700 ${enrolStateDir}`
-        },
-        {
-          label: "encrypted one-time enrolment capability",
-          command: `test -s ${enrolTokenCredentialPath} || { test -r ${enrolTokenSourcePath}; ` + `systemd-creds encrypt --name=enrol-token ${enrolTokenSourcePath} ${enrolTokenCredentialPath}; ` + `chmod 0400 ${enrolTokenCredentialPath}; rm -f ${enrolTokenSourcePath}; }`
-        }
-      ] : [],
-      ...deploymentEnabled ? [{
-        label: "deployment directories",
-        command: `install -d -o root -g root -m 0755 ${deployRoot} && ` + `install -d -o root -g ${DEPLOYMENT_GROUP} -m 3770 ${deployRoot}/releases && ` + `install -d -o ${user} -g ${user} -m 0750 ${deployRoot}/cache && ` + `install -d -o ${user} -g ${user} -m 0700 ${deployRoot}/agent-home && ` + `install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0700 ${deployRoot}/runner-home ${deployRoot}/runner-home/cache`
-      }] : [],
-      { label: "reload units", command: "systemctl daemon-reload" },
-      ...deploymentEnabled ? [{
-        label: "remove unsupported deployment socket activation",
-        command: "systemctl disable --now forgezero-deploy-runner.socket 2>/dev/null || true; rm -f /etc/systemd/system/forgezero-deploy-runner.socket; systemctl daemon-reload"
-      }] : [],
-      {
-        label: "enable and start",
-        command: `systemctl enable --now ${[
-          ...deploymentEnabled ? ["forgezero-deploy-runner.service"] : [],
-          ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : [],
-          "forgezero-agent.service"
-        ].join(" ")}`
-      },
-      ...enrolmentEnabled ? [{
-        label: "prove the compute binding is durable",
-        command: `test -s ${enrolStatePath}`
-      }] : [],
-      { label: "prove it is running", command: "systemctl is-active forgezero-agent.service" },
-      { label: "prove the vault socket exists", command: `test -S ${options.socketPath}` },
-      ...deploymentEnabled ? [{
-        label: "prove the deployment runner socket exists",
-        command: `test -S ${DEPLOYMENT_RUNNER_SOCKET}`
-      }] : [],
-      ...options.repository ? [{
-        label: "prove the deployment control socket exists",
-        command: `test -S ${options.controlSocketPath ?? "/run/forgezero/control.sock"}`
-      }] : []
-    ]
-  };
-}
-
 // src/ubuntu.ts
 var SUPPORTED_GUEST_IMAGE = Object.freeze({
   key: "ubuntu-resolute-20260731",
@@ -717,7 +330,7 @@ var yamlFile = (path, content, permissions) => `  - path: ${JSON.stringify(path)
     encoding: b64
     content: ${base64(content)}
 `;
-function guestBootstrapScript(profile, attested = Boolean(profile.confidential), hasEnrolment = true) {
+function guestBootstrapScript(profile, attested = Boolean(profile.confidential), hasEnrolment = true, nodeLabel = "compute") {
   const agentBun = "/usr/local/lib/forgezero/bun";
   const attestationSetup = attested ? `# The report device is not part of the encryption path, so a guest can appear
 # healthy and encrypted while attestation is silently impossible. Install and
@@ -731,26 +344,7 @@ printf 'sev-guest
 ` : "";
   return `#!/usr/bin/env bash
 set -Eeuo pipefail
-${attestationSetup}groupadd --system ${VAULT_GROUP} 2>/dev/null || true
-useradd --system --no-create-home --shell /usr/sbin/nologin forgezero-agent 2>/dev/null || true
-usermod -g ${VAULT_GROUP} forgezero-agent
-groupadd --system ${DEPLOYMENT_GROUP} 2>/dev/null || true
-useradd --system --no-create-home --shell /usr/sbin/nologin --gid ${DEPLOYMENT_GROUP} ${DEPLOYMENT_RUNNER_USER} 2>/dev/null || true
-usermod -a -G ${DEPLOYMENT_GROUP} forgezero-agent
-install -d -o root -g root -m 0700 /etc/forgezero/creds
-install -d -o root -g root -m 0755 /etc/forgezero/git
-install -d -o forgezero-agent -g forgezero-agent -m 0700 /var/lib/forgezero
-install -d -o root -g root -m 0755 /opt/forgezero
-install -d -o root -g ${DEPLOYMENT_GROUP} -m 3770 /opt/forgezero/releases
-install -d -o forgezero-agent -g forgezero-agent -m 0700 /opt/forgezero/cache /opt/forgezero/home
-install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0700 /opt/forgezero/runner-home /opt/forgezero/runner-home/cache
-${hasEnrolment ? `if [[ -s /run/forgezero-enrol-token ]]; then
-  systemd-creds encrypt --name=enrol-token /run/forgezero-enrol-token /var/lib/forgezero/enrol-token.cred
-  rm -f /run/forgezero-enrol-token
-fi
-chown root:root /var/lib/forgezero/enrol-token.cred
-chmod 0400 /var/lib/forgezero/enrol-token.cred
-` : ""}if [[ ! -x /usr/local/bin/bun ]]; then
+${attestationSetup}if [[ ! -x /usr/local/bin/bun ]]; then
   curl -fsSL https://bun.sh/install -o /run/fz-bun-install
   printf '%s  %s
 ' '${profile.bunInstallerSha256}' /run/fz-bun-install | sha256sum -c -
@@ -758,132 +352,16 @@ chmod 0400 /var/lib/forgezero/enrol-token.cred
   install -m 0755 ${agentBun}/bin/bun /usr/local/bin/bun
   rm -f /run/fz-bun-install
 fi
-if [[ ! -x /usr/local/bin/fz-agent ]]; then
+if [[ ! -x /usr/local/bin/fz-agent ]] || [[ "$(/usr/local/bin/fz-agent --version 2>/dev/null || true)" != "${profile.agentVersion}" ]]; then
   env BUN_INSTALL=${agentBun} /usr/local/bin/bun add -g --no-cache --force @forgezero/agent@${profile.agentVersion}
   ln -sfn ${agentBun}/bin/fz-agent /usr/local/bin/fz-agent
 fi
-if [[ ! -s /etc/forgezero/creds/agent-seed.cred ]]; then
-  umask 077
-  openssl rand -base64 32 | tr '+/' '-_' | tr -d '=
-' >/run/fz-agent-seed
-  systemd-creds encrypt --name=agent-seed /run/fz-agent-seed /etc/forgezero/creds/agent-seed.cred
-  rm -f /run/fz-agent-seed
-fi
-chmod 0400 /etc/forgezero/creds/agent-seed.cred
-if [[ ! -s /etc/forgezero/creds/git-deploy-key.cred ]]; then
-  umask 077
-  rm -f /run/fz-git-deploy-key /run/fz-git-deploy-key.pub
-  ssh-keygen -q -t ed25519 -N '' -C forgezero-compute -f /run/fz-git-deploy-key
-  systemd-creds encrypt --name=git-deploy-key /run/fz-git-deploy-key /etc/forgezero/creds/git-deploy-key.cred
-  install -o root -g root -m 0444 /run/fz-git-deploy-key.pub /etc/forgezero/git/deploy.pub
-  rm -f /run/fz-git-deploy-key /run/fz-git-deploy-key.pub
-fi
-if [[ ! -s /etc/forgezero/git/deploy.pub ]]; then
-  systemd-creds decrypt --name=git-deploy-key /etc/forgezero/creds/git-deploy-key.cred /run/fz-git-deploy-key
-  ssh-keygen -y -f /run/fz-git-deploy-key | sed 's/$/ forgezero-compute/' >/run/fz-git-deploy-key.pub
-  install -o root -g root -m 0444 /run/fz-git-deploy-key.pub /etc/forgezero/git/deploy.pub
-  rm -f /run/fz-git-deploy-key /run/fz-git-deploy-key.pub
-fi
-chmod 0400 /etc/forgezero/creds/git-deploy-key.cred
-systemctl daemon-reload
-systemctl disable --now forgezero-deploy-runner.socket 2>/dev/null || true
-rm -f /etc/systemd/system/forgezero-deploy-runner.socket
-systemctl daemon-reload
-systemctl enable --now forgezero-deploy-runner.service forgezero-agent.service
-`;
-}
-function guestAgentUnit(profile, name, attested = Boolean(profile.confidential), pull = true) {
-  const attestationPrepare = attested ? `ExecStartPre=+/bin/chgrp ${VAULT_GROUP} /dev/sev-guest
-ExecStartPre=+/bin/chmod 0640 /dev/sev-guest
-` : "";
-  const attestationDevice = attested ? `DevicePolicy=closed
-DeviceAllow=/dev/sev-guest rw
-` : "";
-  return `[Unit]
-Description=ForgeZero compute agent (${name})
-After=network-online.target forgezero-deploy-runner.service
-Wants=network-online.target
-Requires=forgezero-deploy-runner.service
-
-[Service]
-Type=simple
-User=forgezero-agent
-Group=${VAULT_GROUP}
-SupplementaryGroups=${DEPLOYMENT_GROUP}
-LoadCredentialEncrypted=agent-seed:/etc/forgezero/creds/agent-seed.cred
-LoadCredentialEncrypted=git-deploy-key:/etc/forgezero/creds/git-deploy-key.cred
-Environment=FZ_SEED_CREDENTIAL=agent-seed
-Environment=FZ_GIT_PUBLIC_KEY_FILE=/etc/forgezero/git/deploy.pub
-Environment=FZ_API=${profile.apiUrl}
-Environment=FZ_ENROL_STATE_FILE=/var/lib/forgezero/enrolment.json
-Environment=FZ_NODE_LABEL=${name}
-Environment=FZ_SOCKET_PATH=/run/forgezero/vault.sock
-Environment=FZ_DEPLOY_ROOT=/opt/forgezero
-Environment=FZ_DEPLOY_PULL=${pull ? "true" : "false"}
-Environment=FZ_DEPLOY_RUNNER_SOCKET=${DEPLOYMENT_RUNNER_SOCKET}
-Environment=HOME=/opt/forgezero/home
-${attestationPrepare}ExecStart=/usr/local/bin/fz-agent
-Restart=on-failure
-RestartSec=5
-RuntimeDirectory=forgezero
-RuntimeDirectoryMode=0750
-UMask=0007
-LimitCORE=0
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=true
-ReadWritePaths=/var/lib/forgezero /opt/forgezero
-${attestationDevice}
-
-[Install]
-WantedBy=multi-user.target
-`;
-}
-function guestEnrolmentDropIn() {
-  return `[Service]
-LoadCredentialEncrypted=enrol-token:/var/lib/forgezero/enrol-token.cred
-Environment=FZ_ENROL_TOKEN_CREDENTIAL=enrol-token
-`;
-}
-function guestEnrolmentCleanupScript() {
-  return `#!/usr/bin/env bash
-set -Eeuo pipefail
-for _ in $(seq 1 180); do
-  [[ -s /var/lib/forgezero/enrolment.json ]] && break
-  sleep 1
-done
-[[ -s /var/lib/forgezero/enrolment.json ]] || { echo 'guest enrolment did not become durable' >&2; exit 1; }
-rm -f /var/lib/forgezero/enrol-token.cred
-rm -f /etc/systemd/system/forgezero-agent.service.d/enrolment.conf
-systemctl daemon-reload
-systemctl disable forgezero-enrolment-cleanup.service
-`;
-}
-function guestEnrolmentCleanupUnit() {
-  return `[Unit]
-Description=Remove the consumed ForgeZero guest enrolment credential
-After=forgezero-agent.service
-Requires=forgezero-agent.service
-ConditionPathExists=/var/lib/forgezero/enrol-token.cred
-
-[Service]
-Type=oneshot
-ExecStart=/usr/local/sbin/forgezero-enrolment-cleanup
-TimeoutStartSec=4min
-
-[Install]
-WantedBy=multi-user.target
+env   FZ_API=${profile.apiUrl}   FZ_AGENT_BIN=/usr/local/bin/fz-agent   FZ_AGENT_USER=forgezero-agent   FZ_SOCKET_PATH=/run/forgezero/vault.sock   FZ_SEED_CREDENTIAL_PATH=/etc/forgezero/creds/agent-seed.cred   FZ_GIT_CREDENTIAL_PATH=/etc/forgezero/creds/git-deploy-key.cred   FZ_GIT_PUBLIC_KEY_PATH=/etc/forgezero/git/deploy.pub   FZ_DEPLOY_ROOT=/opt/forgezero   FZ_DEPLOY_PULL=${hasEnrolment ? "true" : "false"}   FZ_NODE_LABEL=${nodeLabel}   ${agentBun}/bin/fz agent install --apply${hasEnrolment ? " --enrol" : ""}
 `;
 }
 function cloudInit(profile, claim, manifest) {
   const enrolled = Boolean(claim.enrolment);
-  const bootstrap = guestBootstrapScript(profile, claim.spec.confidential, enrolled);
-  const agentUnit2 = guestAgentUnit(profile, manifest.name, claim.spec.confidential, enrolled);
-  const enrolmentDropIn = guestEnrolmentDropIn();
-  const cleanupScript = guestEnrolmentCleanupScript();
-  const cleanupUnit = guestEnrolmentCleanupUnit();
-  const runnerUnit = deploymentRunnerUnit({ binPath: "/usr/local/bin/fz-agent", deployRoot: "/opt/forgezero", user: "forgezero-agent" });
+  const bootstrap = guestBootstrapScript(profile, claim.spec.confidential, enrolled, manifest.name);
   const access = claim.access;
   const users = access ? `users:
   - default
@@ -895,8 +373,8 @@ function cloudInit(profile, claim, manifest) {
 ${access.sshPublicKeys.map((key) => `      - ${JSON.stringify(key)}`).join(`
 `)}
 ` : "";
-  const enrolmentFiles = enrolled ? `${yamlFile("/run/forgezero-enrol-token", `${claim.enrolment.token}
-`, "0600")}${yamlFile("/usr/local/sbin/forgezero-enrolment-cleanup", cleanupScript, "0700")}${yamlFile("/etc/systemd/system/forgezero-agent.service.d/enrolment.conf", enrolmentDropIn, "0644")}${yamlFile("/etc/systemd/system/forgezero-enrolment-cleanup.service", cleanupUnit, "0644")}` : "";
+  const enrolmentFiles = enrolled ? yamlFile("/run/forgezero-enrol-token", `${claim.enrolment.token}
+`, "0600") : "";
   return {
     userData: `#cloud-config
 package_update: true
@@ -905,10 +383,8 @@ ${users}disable_root: true
 # every dynamically claimed repository must be cloneable on a clean image.
 packages: [curl, ca-certificates, openssl, openssh-client, git, unzip${claim.spec.confidential ? ", python3" : ""}]
 write_files:
-${enrolmentFiles}${yamlFile("/usr/local/sbin/forgezero-guest-bootstrap", bootstrap, "0700")}${yamlFile("/etc/systemd/system/forgezero-deploy-runner.service", runnerUnit, "0644")}${yamlFile("/etc/systemd/system/forgezero-agent.service", agentUnit2, "0644")}runcmd:
+${enrolmentFiles}${yamlFile("/usr/local/sbin/forgezero-guest-bootstrap", bootstrap, "0700")}runcmd:
   - [ bash, /usr/local/sbin/forgezero-guest-bootstrap ]
-${enrolled ? `  - [ systemctl, enable, --now, forgezero-enrolment-cleanup.service ]
-` : ""}
 `,
     metaData: `instance-id: ${manifest.name}-${claim.attempt}
 local-hostname: ${manifest.name}
@@ -1124,11 +600,7 @@ export {
   provisionMetalGuest,
   macForAddress,
   guestNameFor,
-  guestEnrolmentDropIn,
-  guestEnrolmentCleanupUnit,
-  guestEnrolmentCleanupScript,
   guestBootstrapScript,
-  guestAgentUnit,
   cloudInit,
   allocateCpuPool,
   allocateAddress,

package/dist/migration-pull.d.ts

@@ -0,0 +1,55 @@
+import type { NodeKeyPair } from '@forgezero/runtime/identity';
+export type MigrationNetwork = 'private-lan' | 'cloudflare-warp';
+export type MigrationAction = 'network-ready' | 'database-member-ready' | 'api-ready' | 'source-drained' | 'source-stopped';
+export interface MigrationEvidence {
+    targetAgentReady?: boolean;
+    privateNetworkReady?: boolean;
+    warpConnected?: boolean;
+    databaseMemberHealthy?: boolean;
+    apiHealthy?: boolean;
+    sourceDrained?: boolean;
+    sourceStopped?: boolean;
+}
+export interface RemoteMigrationClaim {
+    migrationKey: string;
+    action: MigrationAction;
+    network: MigrationNetwork;
+    claimToken: string;
+    claimExpiresAtTs: number;
+    attempt: number;
+    /** Signed controller-selected private peers used only for reachability probes. */
+    peerPrivateAddresses: readonly string[];
+}
+export interface MigrationPullOptions {
+    apiUrl: string;
+    nodeKey: string;
+    keys: NodeKeyPair;
+    run(claim: RemoteMigrationClaim): Promise<MigrationEvidence>;
+    fetch?: (input: URL, init: RequestInit) => Promise<Response>;
+    intervalMs?: number;
+    requestTimeoutMs?: number;
+    completionAttempts?: number;
+    renewRetryMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    setTimer?: (callback: () => void, ms: number) => unknown;
+    clearTimer?: (handle: unknown) => void;
+    onEvent?: (event: string, detail?: unknown) => void;
+}
+export type MigrationPullResult = {
+    status: 'idle';
+} | {
+    status: 'completed';
+    claim: RemoteMigrationClaim;
+    evidence: MigrationEvidence;
+} | {
+    status: 'failed';
+    claim: RemoteMigrationClaim;
+    reason: string;
+};
+/** Claim one lifecycle action, await it, and acknowledge only its fenced claim. */
+export declare function pullMigrationOnce(options: MigrationPullOptions): Promise<MigrationPullResult>;
+export declare function startMigrationPull(options: MigrationPullOptions): {
+    stop(): Promise<void>;
+    readonly active: boolean;
+};