@forgezero/agent 0.1.62 → 0.1.63

package/dist/bootstrap.js

@@ -1209,19 +1209,175 @@ async function finalizeCloudflareBootstrapAcceptance(request, fetcher = fetch) {
   return evidence;
 }
 
+// src/bootstrap-bundle.ts
+import { createHash, randomBytes } from "crypto";
+import {
+  chmodSync,
+  createReadStream,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { dirname as dirname2, isAbsolute, resolve as resolve2 } from "path";
+var BOOTSTRAP_BUNDLE_FORMAT = 1;
+var BOOTSTRAP_BUNDLE_KIND = "forgezero-api-git-bundle";
+var MAX_BOOTSTRAP_BUNDLE_BYTES = 512 * 1024 * 1024;
+var run = async (argv) => {
+  const child = Bun.spawn([...argv], { stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, output: `${stdout}${stderr}`.slice(0, 65536) };
+};
+var checked = async (exec, argv, label) => {
+  const result = await exec(argv);
+  if (result.exitCode !== 0)
+    throw new Error(`${label} failed${result.output.trim() ? `: ${result.output.trim()}` : ""}`);
+  return result.output.trim();
+};
+async function sha256File(path) {
+  const hash = createHash("sha256");
+  await new Promise((resolveDone, reject) => {
+    const stream = createReadStream(path);
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("error", reject);
+    stream.on("end", resolveDone);
+  });
+  return hash.digest("hex");
+}
+var branchName = (value) => {
+  if (typeof value !== "string" || !/^[A-Za-z0-9](?:[A-Za-z0-9._/-]{0,126}[A-Za-z0-9])?$/.test(value) || value.includes("..") || value.includes("//") || value.startsWith("-")) {
+    throw new Error("bootstrap bundle branch is malformed");
+  }
+  return value;
+};
+function parseBootstrapBundleManifest(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("bootstrap bundle manifest must be an object");
+  const source = value;
+  const allowed = ["format", "kind", "branch", "revision", "sha256", "bytes", "createdAt"];
+  const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
+  if (unknown.length)
+    throw new Error(`bootstrap bundle manifest contains unknown field ${unknown[0]}`);
+  if (source.format !== BOOTSTRAP_BUNDLE_FORMAT || source.kind !== BOOTSTRAP_BUNDLE_KIND) {
+    throw new Error("bootstrap bundle manifest format is unsupported");
+  }
+  branchName(source.branch);
+  if (typeof source.revision !== "string" || !/^[a-f0-9]{40}$/.test(source.revision)) {
+    throw new Error("bootstrap bundle revision must be an exact lowercase Git commit");
+  }
+  if (typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256)) {
+    throw new Error("bootstrap bundle digest is malformed");
+  }
+  if (!Number.isSafeInteger(source.bytes) || Number(source.bytes) < 1 || Number(source.bytes) > MAX_BOOTSTRAP_BUNDLE_BYTES) {
+    throw new Error("bootstrap bundle size is outside the supported boundary");
+  }
+  if (typeof source.createdAt !== "string" || Number.isNaN(Date.parse(source.createdAt))) {
+    throw new Error("bootstrap bundle creation time is malformed");
+  }
+  return source;
+}
+function ownerRegularFile(path, maximum, label) {
+  if (!isAbsolute(path) || resolve2(path) !== path || /[\r\n\0]/.test(path)) {
+    throw new Error(`${label} path must be canonical and absolute`);
+  }
+  const value = lstatSync(path);
+  const uid = process.getuid?.() ?? value.uid;
+  if (!value.isFile() || value.isSymbolicLink() || value.uid !== uid || value.nlink !== 1 || (value.mode & 63) !== 0 || value.size < 1 || value.size > maximum) {
+    throw new Error(`${label} must be an owner-only regular file with one link and at most ${maximum} bytes`);
+  }
+}
+async function readBootstrapBundle(bundlePath, manifestPath = `${bundlePath}.json`) {
+  ownerRegularFile(bundlePath, MAX_BOOTSTRAP_BUNDLE_BYTES, "bootstrap bundle");
+  ownerRegularFile(manifestPath, 16 * 1024, "bootstrap bundle manifest");
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
+  } catch {
+    throw new Error("bootstrap bundle manifest is not valid JSON");
+  }
+  const manifest = parseBootstrapBundleManifest(parsed);
+  const size = lstatSync(bundlePath).size;
+  if (size !== manifest.bytes || await sha256File(bundlePath) !== manifest.sha256) {
+    throw new Error("bootstrap bundle bytes do not match their manifest");
+  }
+  return { bundlePath, manifestPath, manifest };
+}
+async function buildBootstrapBundle(input, exec = run) {
+  const repositoryRoot = resolve2(input.repositoryRoot);
+  const outputPath = resolve2(input.outputPath);
+  const manifestPath = `${outputPath}.json`;
+  const branch = branchName(input.branch);
+  if (!isAbsolute(input.outputPath) || outputPath !== input.outputPath) {
+    throw new Error("bootstrap bundle output must be a canonical absolute path");
+  }
+  if (existsSync(outputPath) || existsSync(manifestPath)) {
+    throw new Error("bootstrap bundle output already exists");
+  }
+  const root = lstatSync(repositoryRoot);
+  if (!root.isDirectory() || root.isSymbolicLink())
+    throw new Error("bootstrap bundle source must be a real directory");
+  mkdirSync(dirname2(outputPath), { recursive: true, mode: 448 });
+  const parent = lstatSync(dirname2(outputPath));
+  const uid = process.getuid?.() ?? parent.uid;
+  if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== uid || (parent.mode & 63) !== 0) {
+    throw new Error("bootstrap bundle output directory must be caller-owned and owner-only");
+  }
+  const dirty = await checked(exec, ["git", "-C", repositoryRoot, "status", "--porcelain=v1", "--untracked-files=no"], "Git worktree check");
+  if (dirty)
+    throw new Error("bootstrap bundle source has tracked changes; commit the reviewed API release first");
+  const revision = (await checked(exec, ["git", "-C", repositoryRoot, "rev-parse", "--verify", `refs/heads/${branch}^{commit}`], "Git branch resolution")).toLowerCase();
+  if (!/^[a-f0-9]{40}$/.test(revision))
+    throw new Error("bootstrap bundle branch did not resolve to one exact commit");
+  const temporary = `${outputPath}.next.${process.pid}.${randomBytes(6).toString("hex")}`;
+  try {
+    await checked(exec, ["git", "-C", repositoryRoot, "bundle", "create", temporary, `refs/heads/${branch}`], "Git bundle creation");
+    chmodSync(temporary, 384);
+    const file = lstatSync(temporary);
+    if (!file.isFile() || file.isSymbolicLink() || file.size < 1 || file.size > MAX_BOOTSTRAP_BUNDLE_BYTES) {
+      throw new Error("created bootstrap bundle is outside the supported boundary");
+    }
+    await checked(exec, ["git", "bundle", "verify", temporary], "Git bundle verification");
+    const manifest = {
+      format: BOOTSTRAP_BUNDLE_FORMAT,
+      kind: BOOTSTRAP_BUNDLE_KIND,
+      branch,
+      revision,
+      sha256: await sha256File(temporary),
+      bytes: file.size,
+      createdAt: new Date().toISOString()
+    };
+    const manifestTemporary = `${manifestPath}.next.${process.pid}.${randomBytes(6).toString("hex")}`;
+    writeFileSync(manifestTemporary, `${JSON.stringify(manifest, null, 2)}
+`, { mode: 384, flag: "wx" });
+    renameSync(temporary, outputPath);
+    renameSync(manifestTemporary, manifestPath);
+    return { bundlePath: outputPath, manifestPath, manifest };
+  } catch (cause) {
+    rmSync(temporary, { force: true });
+    throw cause;
+  }
+}
+
 // src/bootstrap.ts
-import { createHash, createHmac as createHmac2, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes3 } from "crypto";
 import {
-  chmodSync as chmodSync2,
-  existsSync as existsSync4,
-  lstatSync as lstatSync2,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync4,
-  renameSync as renameSync4,
-  rmSync as rmSync4,
-  writeFileSync as writeFileSync4
+  chmodSync as chmodSync3,
+  existsSync as existsSync5,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync5,
+  renameSync as renameSync5,
+  rmSync as rmSync5,
+  writeFileSync as writeFileSync5
 } from "fs";
-import { dirname as dirname5 } from "path";
+import { dirname as dirname6 } from "path";
 import { fileURLToPath } from "url";
 
 // src/agent-update-helper.ts
@@ -1240,7 +1396,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.62";
+var VERSION = "0.1.63";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -1255,8 +1411,8 @@ var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
 `;
 
 // src/service-supervisor.ts
-import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "fs";
-import { dirname as dirname2, join as join2, resolve as resolve2, sep } from "path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync, realpathSync, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, join as join2, resolve as resolve3, sep } from "path";
 
 // src/definition.ts
 var RESERVED_STEP_ENV = new Set([
@@ -1275,17 +1431,17 @@ var RESERVED_STEP_ENV = new Set([
 // src/service-supervisor.ts
 var defaultHost = {
   write(path, content, mode) {
-    mkdirSync(dirname2(path), { recursive: true, mode: 493 });
+    mkdirSync2(dirname3(path), { recursive: true, mode: 493 });
     const next = `${path}.next`;
-    writeFileSync(next, content, { mode });
-    renameSync(next, path);
+    writeFileSync2(next, content, { mode });
+    renameSync2(next, path);
   },
-  read: (path) => readFileSync(path, "utf8"),
-  exists: existsSync,
-  list: (path) => existsSync(path) ? readdirSync(path) : [],
+  read: (path) => readFileSync2(path, "utf8"),
+  exists: existsSync2,
+  list: (path) => existsSync2(path) ? readdirSync(path) : [],
   realpath: realpathSync,
-  mkdir: (path, mode) => mkdirSync(path, { recursive: true, mode }),
-  remove: (path) => rmSync(path, { force: true }),
+  mkdir: (path, mode) => mkdirSync2(path, { recursive: true, mode }),
+  remove: (path) => rmSync2(path, { force: true }),
   async exec(argv) {
     const child = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe", env: {
       PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
@@ -1315,21 +1471,21 @@ var defaultHost = {
 };
 
 // src/container-supervisor.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname3, resolve as resolve3, sep as sep2 } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname4, resolve as resolve4, sep as sep2 } from "path";
 var defaultHost2 = {
   realpath: realpathSync2,
-  exists: existsSync2,
-  read: (path) => readFileSync2(path, "utf8"),
+  exists: existsSync3,
+  read: (path) => readFileSync3(path, "utf8"),
   write(path, content, mode) {
-    mkdirSync2(dirname3(path), { recursive: true, mode: 493 });
+    mkdirSync3(dirname4(path), { recursive: true, mode: 493 });
     const next = `${path}.next`;
-    writeFileSync2(next, content, { mode });
-    renameSync2(next, path);
+    writeFileSync3(next, content, { mode });
+    renameSync3(next, path);
   },
-  remove: (path) => rmSync2(path, { force: true }),
-  list: (path) => existsSync2(path) ? readdirSync2(path) : [],
-  mkdir: (path, mode) => mkdirSync2(path, { recursive: true, mode }),
+  remove: (path) => rmSync3(path, { force: true }),
+  list: (path) => existsSync3(path) ? readdirSync2(path) : [],
+  mkdir: (path, mode) => mkdirSync3(path, { recursive: true, mode }),
   async exec(argv) {
     const child = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" } });
     const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
@@ -1479,7 +1635,11 @@ function agentEgressUnit(options) {
   const user = options.user ?? "forgezero";
   if (!/^[a-z_][a-z0-9_-]{0,30}$/.test(user))
     throw new Error("invalid Agent service user");
-  const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
+  const bootstrapBundleEnabled = Boolean(options.bootstrapBundlePath && options.bootstrapBundleManifestPath);
+  if (Boolean(options.bootstrapBundlePath) !== Boolean(options.bootstrapBundleManifestPath) || bootstrapBundleEnabled && ![options.bootstrapBundlePath, options.bootstrapBundleManifestPath].every((path) => path.startsWith("/") && !/[\r\n\0:]/.test(path))) {
+    throw new Error("bootstrap bundle and manifest must be supplied together as absolute paths");
+  }
+  const deploymentEnabled = Boolean(options.repository || bootstrapBundleEnabled || options.pullDeployments);
   const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
   const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
   if (deploymentEnabled && runnerPublicTcpPorts.length < 1) {
@@ -1949,6 +2109,8 @@ function agentUnit(options) {
     options.gitPublicKeyPath ? `FZ_GIT_PUBLIC_KEY_FILE=${options.gitPublicKeyPath}` : null,
     options.repository ? `FZ_DEPLOY_REPO=${options.repository}` : null,
     options.branch ? `FZ_DEPLOY_BRANCH=${options.branch}` : null,
+    options.bootstrapBundlePath ? `FZ_BOOTSTRAP_BUNDLE=${options.bootstrapBundlePath}` : null,
+    options.bootstrapBundleManifestPath ? `FZ_BOOTSTRAP_BUNDLE_MANIFEST=${options.bootstrapBundleManifestPath}` : null,
     options.profile ? `FZ_DEPLOY_PROFILE=${options.profile}` : null,
     options.repository && options.branch ? `FZ_DEPLOY_KEY=${options.project ?? "platform"}:${options.environment ?? "production"}` : null,
     deploymentEnabled ? `FZ_DEPLOY_ROOT=${deployRoot}` : null,
@@ -2331,27 +2493,27 @@ function planProvision(options) {
 }
 
 // src/cli/agent-install.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 import {
-  chmodSync,
+  chmodSync as chmodSync2,
   copyFileSync,
-  existsSync as existsSync3,
-  lstatSync,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync3,
+  existsSync as existsSync4,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync4,
   realpathSync as realpathSync3,
-  renameSync as renameSync3,
-  rmSync as rmSync3,
+  renameSync as renameSync4,
+  rmSync as rmSync4,
   symlinkSync,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "fs";
-import { dirname as dirname4 } from "path";
-async function readCapabilities(run) {
+import { dirname as dirname5 } from "path";
+async function readCapabilities(run2) {
   const answers = {};
   const checks = Object.entries(CAPABILITY_CHECKS);
   for (const [id, check] of checks) {
     try {
-      const result = await run(check.operation);
+      const result = await run2(check.operation);
       answers[id] = check.satisfied(result.stdout, result.exitCode);
     } catch {
       answers[id] = false;
@@ -2404,52 +2566,52 @@ var runProvisionOperation = async (operation) => {
   }
   if (operation.kind === "install-runtime") {
     const release = `/opt/forgezero/agent/versions/${operation.version}`;
-    mkdirSync3(`${release}/dist`, { recursive: true, mode: 493 });
-    mkdirSync3(dirname4(operation.binary), { recursive: true, mode: 493 });
+    mkdirSync4(`${release}/dist`, { recursive: true, mode: 493 });
+    mkdirSync4(dirname5(operation.binary), { recursive: true, mode: 493 });
     copyFileSync(operation.source, `${release}/dist/fz-agent.js`);
-    chmodSync(`${release}/dist/fz-agent.js`, 493);
-    const gitSshSource = `${dirname4(operation.source)}/fz-git-ssh.js`;
-    if (!existsSync3(gitSshSource))
+    chmodSync2(`${release}/dist/fz-agent.js`, 493);
+    const gitSshSource = `${dirname5(operation.source)}/fz-git-ssh.js`;
+    if (!existsSync4(gitSshSource))
       return { stdout: "packaged fz-git-ssh.js is missing", exitCode: 1 };
     copyFileSync(gitSshSource, `${release}/dist/fz-git-ssh.js`);
-    chmodSync(`${release}/dist/fz-git-ssh.js`, 493);
+    chmodSync2(`${release}/dist/fz-git-ssh.js`, 493);
     const pending = "/opt/forgezero/agent/current.next";
-    rmSync3(pending, { force: true });
+    rmSync4(pending, { force: true });
     symlinkSync(`versions/${operation.version}`, pending);
-    renameSync3(pending, "/opt/forgezero/agent/current");
-    rmSync3(operation.binary, { force: true });
+    renameSync4(pending, "/opt/forgezero/agent/current");
+    rmSync4(operation.binary, { force: true });
     symlinkSync("/opt/forgezero/agent/current/dist/fz-agent.js", operation.binary);
     const gitSshBinary = "/usr/local/lib/forgezero/agent/fz-git-ssh";
-    rmSync3(gitSshBinary, { force: true });
+    rmSync4(gitSshBinary, { force: true });
     symlinkSync("/opt/forgezero/agent/current/dist/fz-git-ssh.js", gitSshBinary);
     return { stdout: "", exitCode: 0 };
   }
   if (operation.kind === "ensure-seed") {
-    if (existsSync3(operation.credential) && lstatSync(operation.credential).size > 0)
+    if (existsSync4(operation.credential) && lstatSync2(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
-    const seed = randomBytes(32).toString("base64url");
+    const seed = randomBytes2(32).toString("base64url");
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=agent-seed", "-", operation.credential], seed);
     if (result.exitCode === 0)
-      chmodSync(operation.credential, 256);
+      chmodSync2(operation.credential, 256);
     return result;
   }
   if (operation.kind === "ensure-git-identity") {
     const key = "/run/forgezero-git-deploy-key";
     const publicKey = `${key}.pub`;
     try {
-      if (!existsSync3(operation.credential) || lstatSync(operation.credential).size < 1) {
-        rmSync3(key, { force: true });
-        rmSync3(publicKey, { force: true });
+      if (!existsSync4(operation.credential) || lstatSync2(operation.credential).size < 1) {
+        rmSync4(key, { force: true });
+        rmSync4(publicKey, { force: true });
         let result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-compute", "-f", key]);
         if (result.exitCode !== 0)
           return result;
         result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=git-deploy-key", key, operation.credential]);
         if (result.exitCode !== 0)
           return result;
-        chmodSync(operation.credential, 256);
+        chmodSync2(operation.credential, 256);
       }
-      if (!existsSync3(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
-        if (!existsSync3(key)) {
+      if (!existsSync4(operation.publicKey) || lstatSync2(operation.publicKey).size < 1) {
+        if (!existsSync4(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=git-deploy-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
@@ -2457,30 +2619,30 @@ var runProvisionOperation = async (operation) => {
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
         if (derived.exitCode !== 0)
           return derived;
-        writeFileSync3(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
+        writeFileSync4(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
 `, { mode: 292 });
       }
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync3(key, { force: true });
-      rmSync3(publicKey, { force: true });
+      rmSync4(key, { force: true });
+      rmSync4(publicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-bootstrap-ssh-identity") {
     const key = "/run/forgezero-bootstrap-ssh-key";
     const generatedPublicKey = `${key}.pub`;
     try {
-      if (!existsSync3(operation.credential) || lstatSync(operation.credential).size < 1) {
-        rmSync3(key, { force: true });
-        rmSync3(generatedPublicKey, { force: true });
+      if (!existsSync4(operation.credential) || lstatSync2(operation.credential).size < 1) {
+        rmSync4(key, { force: true });
+        rmSync4(generatedPublicKey, { force: true });
         let result;
         if (operation.source) {
-          const source = existsSync3(operation.source) ? lstatSync(operation.source) : undefined;
+          const source = existsSync4(operation.source) ? lstatSync2(operation.source) : undefined;
           if (!source?.isFile() || source.isSymbolicLink() || source.uid !== 0 || source.nlink !== 1 || (source.mode & 63) !== 0 || source.size < 32 || source.size > 16 * 1024) {
             return { stdout: "bootstrap SSH private-key source is missing or unsafe", exitCode: 1 };
           }
           copyFileSync(operation.source, key);
-          chmodSync(key, 384);
+          chmodSync2(key, 384);
         } else {
           result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-bootstrap-runner", "-f", key]);
           if (result.exitCode !== 0)
@@ -2493,48 +2655,48 @@ var runProvisionOperation = async (operation) => {
         result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=bootstrap-ssh-key", key, operation.credential]);
         if (result.exitCode !== 0)
           return result;
-        chmodSync(operation.credential, 256);
+        chmodSync2(operation.credential, 256);
       }
-      if (!existsSync3(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
-        if (!existsSync3(key)) {
+      if (!existsSync4(operation.publicKey) || lstatSync2(operation.publicKey).size < 1) {
+        if (!existsSync4(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=bootstrap-ssh-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
-          chmodSync(key, 384);
+          chmodSync2(key, 384);
         }
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
         if (derived.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(derived.stdout)) {
           return { stdout: "bootstrap SSH public key derivation failed", exitCode: 1 };
         }
-        mkdirSync3(dirname4(operation.publicKey), { recursive: true, mode: 493 });
-        writeFileSync3(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
+        mkdirSync4(dirname5(operation.publicKey), { recursive: true, mode: 493 });
+        writeFileSync4(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
 `, { mode: 292 });
-        chmodSync(operation.publicKey, 292);
+        chmodSync2(operation.publicKey, 292);
       }
       if (operation.source)
-        rmSync3(operation.source, { force: true });
+        rmSync4(operation.source, { force: true });
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync3(key, { force: true });
-      rmSync3(generatedPublicKey, { force: true });
+      rmSync4(key, { force: true });
+      rmSync4(generatedPublicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-enrolment") {
-    if (existsSync3(operation.state) && lstatSync(operation.state).size > 0 || existsSync3(operation.credential) && lstatSync(operation.credential).size > 0)
+    if (existsSync4(operation.state) && lstatSync2(operation.state).size > 0 || existsSync4(operation.credential) && lstatSync2(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
-    if (!existsSync3(operation.source))
+    if (!existsSync4(operation.source))
       return { stdout: "enrolment source is missing", exitCode: 1 };
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=enrol-token", operation.source, operation.credential]);
     if (result.exitCode === 0) {
-      chmodSync(operation.credential, 256);
-      rmSync3(operation.source, { force: true });
+      chmodSync2(operation.credential, 256);
+      rmSync4(operation.source, { force: true });
     }
     return result;
   }
   if (operation.kind === "wait-socket") {
     for (let attempt = 0;attempt < operation.attempts; attempt += 1) {
       try {
-        if (lstatSync(operation.path).isSocket())
+        if (lstatSync2(operation.path).isSocket())
           return { stdout: "", exitCode: 0 };
       } catch {}
       await Bun.sleep(operation.intervalMs);
@@ -2542,7 +2704,7 @@ var runProvisionOperation = async (operation) => {
     return { stdout: `socket did not become ready: ${operation.path}`, exitCode: 1 };
   }
   if (operation.kind === "verify-file")
-    return existsSync3(operation.path) && lstatSync(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
+    return existsSync4(operation.path) && lstatSync2(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
   if (operation.kind === "verify-egress") {
     const active = await fixed(["/usr/bin/systemctl", "is-active", "forgezero-agent-egress.service"]);
     if (active.exitCode !== 0)
@@ -2564,25 +2726,25 @@ var runProvisionOperation = async (operation) => {
     }
   }
   if (operation.kind === "install-warp") {
-    const os = readFileSync3("/etc/os-release", "utf8");
+    const os = readFileSync4("/etc/os-release", "utf8");
     if (!/^ID=ubuntu$/m.test(os) || !/^VERSION_ID="?26\.04"?$/m.test(os))
       return { stdout: "unsupported WARP host OS", exitCode: 1 };
     const response = await fetch("https://pkg.cloudflareclient.com/pubkey.gpg", { signal: AbortSignal.timeout(30000) });
     if (!response.ok)
       return { stdout: `WARP key HTTP ${response.status}`, exitCode: 1 };
-    mkdirSync3("/usr/share/keyrings", { recursive: true, mode: 493 });
-    mkdirSync3("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
-    mkdirSync3("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
+    mkdirSync4("/usr/share/keyrings", { recursive: true, mode: 493 });
+    mkdirSync4("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
+    mkdirSync4("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
     const key = "/run/cloudflare-warp-key.gpg";
-    writeFileSync3(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
+    writeFileSync4(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
     let result = await fixed(["/usr/bin/gpg", "--batch", "--yes", "--dearmor", "-o", "/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", key]);
-    rmSync3(key, { force: true });
+    rmSync4(key, { force: true });
     if (result.exitCode !== 0)
       return result;
     const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
     if (!codename)
       return { stdout: "Ubuntu codename missing", exitCode: 1 };
-    writeFileSync3("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
+    writeFileSync4("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
 `, { mode: 420 });
     result = await fixed(["/usr/bin/apt-get", "update", "-qq"]);
     return result.exitCode === 0 ? fixed(["/usr/bin/apt-get", "install", "-y", "cloudflare-warp"]) : result;
@@ -2597,7 +2759,7 @@ async function localRunner(operation) {
   if (capability.kind === "version")
     return fixed(capability.argv);
   try {
-    const metadata = lstatSync(capability.path);
+    const metadata = lstatSync2(capability.path);
     const present = capability.nodeType === "directory" ? metadata.isDirectory() : true;
     return { stdout: present ? `yes
 ` : `no
@@ -2611,10 +2773,10 @@ function planInstall(options) {
   const { capabilities, ...unit } = options;
   return planProvision({ ...unit, mode: modeFor(capabilities) });
 }
-async function applyPlan(plan, run) {
+async function applyPlan(plan, run2) {
   const transcript = [];
   for (const step2 of plan.steps) {
-    const result = await run(step2.operation);
+    const result = await run2(step2.operation);
     transcript.push({ label: step2.label, command: step2.command, exitCode: result.exitCode });
     if (result.exitCode !== 0 && !step2.optional) {
       throw new Error(`${step2.label} failed (exit ${result.exitCode}): ${step2.command}`);
@@ -2708,8 +2870,6 @@ function validatePlatformSharedEnvironment(input) {
     databaseUser: input.databaseUser,
     sharedDirectory: input.sharedDirectory,
     seedSyncEpoch: input.seedSyncEpoch,
-    repository: input.repository,
-    branch: input.branch,
     deployProfile: input.deployProfile
   }))
     safeAtom(name, value);
@@ -2792,8 +2952,6 @@ function renderPlatformSharedEnvironment(input) {
     FZ_AGENT_OTLP_ENDPOINT: value.agentOtlpEndpoint,
     FZ_CUSTODIAN_EMAIL: value.custodianEmail ?? "",
     FZ_PROFILE: value.deployProfile,
-    FZ_REPO: value.repository,
-    FZ_BRANCH: value.branch,
     FZ_EMAIL_PROVIDER: value.email?.provider ?? "",
     FZ_SMTP_HOST: value.email?.provider === "smtp" ? value.email.host : "",
     FZ_SMTP_PORT: value.email?.provider === "smtp" ? String(value.email.port) : "",
@@ -3004,7 +3162,7 @@ var EXTRACT = "/run/forgezero-otelcol-release";
 var BINARY = "/usr/local/lib/forgezero/otelcol/otelcol";
 var CONFIG = "/etc/forgezero/otelcol.yaml";
 var UNIT = `/etc/systemd/system/${FORGEZERO_OTEL_COLLECTOR_UNIT}`;
-var checked = async (host, argv) => {
+var checked2 = async (host, argv) => {
   const result = await host.exec(argv);
   const output = `${result.output ?? result.stdout ?? ""}${result.stderr ?? ""}`;
   if (result.exitCode !== 0)
@@ -3086,7 +3244,7 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
   });
   const versionOutput = `${observed.output ?? observed.stdout ?? ""}${observed.stderr ?? ""}`;
   if (observed.exitCode !== 0 || !versionOutput.includes(`otelcol version ${FORGEZERO_OTEL_COLLECTOR_VERSION}`)) {
-    await checked(host, [
+    await checked2(host, [
       "/usr/bin/curl",
       "--fail",
       "--silent",
@@ -3098,19 +3256,19 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
       ARCHIVE,
       `https://github.com/open-telemetry/opentelemetry-collector-releases/releases/download/v${FORGEZERO_OTEL_COLLECTOR_VERSION}/otelcol_${FORGEZERO_OTEL_COLLECTOR_VERSION}_linux_amd64.tar.gz`
     ]);
-    const digest = (await checked(host, ["/usr/bin/sha256sum", ARCHIVE])).split(/\s+/)[0];
+    const digest = (await checked2(host, ["/usr/bin/sha256sum", ARCHIVE])).split(/\s+/)[0];
     if (digest !== FORGEZERO_OTEL_COLLECTOR_SHA256)
       throw new Error("OTLP collector archive checksum mismatch");
-    await checked(host, ["/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/otelcol", EXTRACT]);
-    await checked(host, ["/usr/bin/tar", "-xzf", ARCHIVE, "-C", EXTRACT, "otelcol"]);
-    await checked(host, ["/usr/bin/install", "-m", "0755", `${EXTRACT}/otelcol`, BINARY]);
-    await checked(host, ["/usr/bin/rm", "-f", ARCHIVE, `${EXTRACT}/otelcol`]);
+    await checked2(host, ["/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/otelcol", EXTRACT]);
+    await checked2(host, ["/usr/bin/tar", "-xzf", ARCHIVE, "-C", EXTRACT, "otelcol"]);
+    await checked2(host, ["/usr/bin/install", "-m", "0755", `${EXTRACT}/otelcol`, BINARY]);
+    await checked2(host, ["/usr/bin/rm", "-f", ARCHIVE, `${EXTRACT}/otelcol`]);
   }
   if ((await host.exec(["/usr/bin/getent", "group", "forgezero-otel"])).exitCode !== 0) {
-    await checked(host, ["/usr/sbin/groupadd", "--system", "forgezero-otel"]);
+    await checked2(host, ["/usr/sbin/groupadd", "--system", "forgezero-otel"]);
   }
   if ((await host.exec(["/usr/bin/id", "forgezero-otel"])).exitCode !== 0) {
-    await checked(host, [
+    await checked2(host, [
       "/usr/sbin/useradd",
       "--system",
       "--no-create-home",
@@ -3123,8 +3281,8 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
   }
   host.write(CONFIG, rendered.config, 420);
   host.write(UNIT, rendered.unit, 420);
-  await checked(host, ["/usr/bin/systemctl", "daemon-reload"]);
-  await checked(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "daemon-reload"]);
+  await checked2(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
   let ready = false;
   for (let attempt = 0;attempt < 100; attempt += 1) {
     const probe = await host.exec([
@@ -3253,7 +3411,7 @@ var SEED_CREDENTIAL = `${CREDS}/seed-sync-root.cred`;
 var BACKUP_RECOVERY_CREDENTIAL = `${CREDS}/backup-recovery-root.cred`;
 var BOOTSTRAP_SSH_CREDENTIAL = `${CREDS}/bootstrap-ssh-key.cred`;
 var BOOTSTRAP_SSH_PUBLIC_KEY = "/etc/forgezero/bootstrap/runner.pub";
-var GIT_PUBLIC_KEY = "/etc/forgezero/git/deploy.pub";
+var BOOTSTRAP_RELEASE_EVIDENCE = "/var/lib/forgezero/bootstrap-release.json";
 var DB_MODE_EVIDENCE = "/var/lib/forgezero-cluster/server-mode.json";
 var LIFECYCLE_PROFILE = "/etc/forgezero/lifecycle.json";
 var CONTROL_SOCKET = "/run/forgezero/control.sock";
@@ -3326,6 +3484,9 @@ function validateBootstrapConfig(value) {
     throw new Error("Cloudflare Mesh/WARP requires a node-specific Cloudflare handoff");
   }
   if (value.kind === "enrolled-compute") {
+    if (value.gitDeployKey !== undefined && typeof value.gitDeployKey !== "boolean") {
+      throw new Error("gitDeployKey must be boolean");
+    }
     if (!/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(value.realm))
       throw new Error("tenant realm is malformed");
     if (!/^https:\/\//.test(value.apiUrl) && !/^http:\/\/(?:127\.0\.0\.1|localhost)(?::\d+)?$/.test(value.apiUrl)) {
@@ -3351,6 +3512,9 @@ function validateBootstrapConfig(value) {
     throw new Error("unsupported platform software profile");
   if (!["production", "development"].includes(value.environment))
     throw new Error("platform environment must be production or development");
+  if (!value.bootstrapBundle || ![value.bootstrapBundle.bundleFile, value.bootstrapBundle.manifestFile].every((path) => typeof path === "string" && path.startsWith("/") && !/[\r\n\0:]/.test(path))) {
+    throw new Error("platform bootstrap requires absolute bundle and manifest paths");
+  }
   let api;
   try {
     api = new URL(value.apiUrl);
@@ -3383,7 +3547,7 @@ function validateBootstrapConfig(value) {
   if (runtime.otlpCollectorUnit !== FORGEZERO_OTEL_COLLECTOR_UNIT) {
     throw new Error(`platform bootstrap requires ${FORGEZERO_OTEL_COLLECTOR_UNIT}`);
   }
-  if (runtime.softwareProfile !== value.profile || runtime.databaseRole !== value.database.role || runtime.nodeHostname !== value.nodeHostname || runtime.apiOrigin !== api.origin || runtime.repository !== value.repository || runtime.branch !== value.branch || runtime.databaseCoordinators.join(",") !== write.join(",")) {
+  if (runtime.softwareProfile !== value.profile || runtime.databaseRole !== value.database.role || runtime.nodeHostname !== value.nodeHostname || runtime.apiOrigin !== api.origin || runtime.databaseCoordinators.join(",") !== write.join(",")) {
     throw new Error("platform runtime coordinates disagree with immutable bootstrap coordinates");
   }
   if (runtime.deployProfile !== value.environment)
@@ -3413,6 +3577,7 @@ function planBootstrap(input, initialized = false) {
   ] : [
     ...config.firewall.enabled ? [{ id: "ufw", version: "ubuntu-26.04" }] : [],
     { id: "bun", version: "1.3.14" },
+    { id: "git", version: "ubuntu-26.04" },
     { id: "nginx", version: "ubuntu-26.04" },
     ...platformBootstrapRunner(config) ? [{ id: "openssh-client", version: "ubuntu-26.04" }] : [],
     ...config.profile === "platform-api" ? [] : [{ id: "arangodb", version: "3.11.14" }],
@@ -3441,7 +3606,7 @@ function planBootstrap(input, initialized = false) {
     ]
   };
 }
-var checked2 = async (host, argv, label, options) => {
+var checked3 = async (host, argv, label, options) => {
   const result = await host.exec(argv, options);
   if (result.exitCode !== 0)
     throw new Error(`${label} failed: ${result.output.trim()}`);
@@ -3622,6 +3787,37 @@ async function seal(host, name, destination2, value) {
   if (result.exitCode !== 0)
     throw new Error(`could not seal ${name}: ${result.output.trim()}`);
 }
+async function verifyBootstrapBundleOnHost(host, config, verifyGit = false) {
+  const manifestMetadata = host.inspect?.(config.bootstrapBundle.manifestFile);
+  const bundleMetadata = host.inspect?.(config.bootstrapBundle.bundleFile);
+  if (manifestMetadata && (!manifestMetadata.regular || manifestMetadata.symbolic || manifestMetadata.uid !== 0 || manifestMetadata.links !== 1 || (manifestMetadata.mode & 63) !== 0 || manifestMetadata.size > 16 * 1024)) {
+    throw new Error("bootstrap bundle manifest must be a root-owned owner-only regular file");
+  }
+  if (bundleMetadata && (!bundleMetadata.regular || bundleMetadata.symbolic || bundleMetadata.uid !== 0 || bundleMetadata.links !== 1 || (bundleMetadata.mode & 63) !== 0 || bundleMetadata.size < 1 || bundleMetadata.size > 512 * 1024 * 1024)) {
+    throw new Error("bootstrap bundle must be a root-owned owner-only regular file within 512 MiB");
+  }
+  if (!host.exists(config.bootstrapBundle.bundleFile) || !host.exists(config.bootstrapBundle.manifestFile)) {
+    throw new Error("attended bootstrap bundle and manifest are required for release generation one");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(host.read(config.bootstrapBundle.manifestFile));
+  } catch {
+    throw new Error("bootstrap bundle manifest is not valid JSON");
+  }
+  const manifest = parseBootstrapBundleManifest(parsed);
+  const expectedBranch = config.environment === "production" ? "main" : "dev";
+  if (manifest.branch !== expectedBranch || bundleMetadata && bundleMetadata.size !== manifest.bytes) {
+    throw new Error("bootstrap bundle manifest disagrees with the selected platform environment");
+  }
+  const digest = (await checked3(host, ["/usr/bin/sha256sum", config.bootstrapBundle.bundleFile], "bootstrap bundle digest")).trim().split(/\s+/)[0];
+  if (digest !== manifest.sha256)
+    throw new Error("bootstrap bundle digest does not match its manifest");
+  if (verifyGit) {
+    await checked3(host, ["/usr/bin/git", "bundle", "verify", config.bootstrapBundle.bundleFile], "bootstrap Git bundle verification");
+  }
+  return manifest;
+}
 function bootstrapIdentity(config) {
   if (config.kind === "enrolled-compute")
     return {
@@ -3648,8 +3844,7 @@ function bootstrapIdentity(config) {
     computeReference: config.computeReference,
     nodeHostname: config.nodeHostname,
     apiUrl: config.apiUrl,
-    repository: config.repository,
-    branch: config.branch,
+    bootstrapBundle: config.bootstrapBundle,
     deployRoot: config.deployRoot ?? "/opt/forgezero",
     telemetryEndpoint: config.telemetryEndpoint,
     database: {
@@ -3679,7 +3874,7 @@ function bootstrapIdentity(config) {
   };
 }
 function bootstrapIdentityDigest(config) {
-  return createHash("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
+  return createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
 }
 function parseStoredState(raw) {
   let value;
@@ -3729,34 +3924,6 @@ function bindBootstrapIntent(host, config) {
   }
   return identityDigest;
 }
-async function preparePlatformBootstrap(input, host = localBootstrapHost()) {
-  const config = validateBootstrapConfig(structuredClone(input));
-  if (config.kind !== "platform")
-    throw new Error("platform preparation requires a platform bootstrap config");
-  if (host.uid() !== 0)
-    throw new Error("fz bootstrap platform prepare --apply must run as root");
-  if (host.exists(STATE_PATH)) {
-    const installed = parseStoredState(host.read(STATE_PATH));
-    if (installed.kind !== "platform" || installed.identityDigest !== bootstrapIdentityDigest(config)) {
-      throw new Error("platform preparation coordinates do not match the installed host identity");
-    }
-  }
-  const identityDigest = bindBootstrapIntent(host, config);
-  await host.installAgent(config);
-  if (!host.exists(GIT_PUBLIC_KEY))
-    throw new Error("Agent installation did not produce its public Git deploy key");
-  const gitPublicKey = host.read(GIT_PUBLIC_KEY).trim();
-  if (!/^ssh-(?:ed25519|rsa) [A-Za-z0-9+/]+={0,3}(?: [^\r\n]+)?$/.test(gitPublicKey)) {
-    throw new Error("Agent public Git deploy key is malformed");
-  }
-  return {
-    kind: "platform",
-    prepared: true,
-    identityDigest,
-    gitPublicKey,
-    next: "register this read-only deploy key, then run --apply concurrently on all three genesis Agency members"
-  };
-}
 function stateFor(config, cloudflare, previousCloudflareTunnelId) {
   return `${JSON.stringify({
     format: 2,
@@ -3910,6 +4077,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   let installed;
   if (host.exists(STATE_PATH))
     installed = parseStoredState(host.read(STATE_PATH));
+  const bootstrapManifest = config.kind === "platform" && !host.exists(BOOTSTRAP_RELEASE_EVIDENCE) ? await verifyBootstrapBundleOnHost(host, config) : undefined;
   let cloudflare;
   if (config.cloudflareHandoff) {
     if (host.exists(config.cloudflareHandoff.handoffFile)) {
@@ -3967,14 +4135,14 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   const platformPrivate = config.kind === "platform" ? (() => {
     if (!secrets)
       throw new Error("platform apply requires attended credentials on stdin");
-    const checked3 = validatePlatformBootstrapSecrets(config, secrets);
+    const checked4 = validatePlatformBootstrapSecrets(config, secrets);
     return {
-      root: checked3.clusterBootstrapCode,
-      email: checked3.emailSecret,
-      enrolmentToken: checked3.enrolmentToken,
-      backup: checked3.backupS3Secret,
-      cloudflareTunnelToken: checked3.cloudflareTunnelToken,
-      cloudflareApiToken: checked3.cloudflareApiToken
+      root: checked4.clusterBootstrapCode,
+      email: checked4.emailSecret,
+      enrolmentToken: checked4.enrolmentToken,
+      backup: checked4.backupS3Secret,
+      cloudflareTunnelToken: checked4.cloudflareTunnelToken,
+      cloudflareApiToken: checked4.cloudflareApiToken
     };
   })() : undefined;
   const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
@@ -4019,18 +4187,21 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   } else
     await host.ensureSoftware(plan.software);
   if (config.kind === "platform" && config.firewall.enabled) {
-    await checked2(host, ["ufw", "--force", "default", "deny", "incoming"], "firewall inbound policy");
-    await checked2(host, ["ufw", "--force", "default", "allow", "outgoing"], "firewall outbound policy");
-    await checked2(host, ["ufw", "allow", `${config.firewall.sshPort}/tcp`], "firewall SSH rule");
+    await checked3(host, ["ufw", "--force", "default", "deny", "incoming"], "firewall inbound policy");
+    await checked3(host, ["ufw", "--force", "default", "allow", "outgoing"], "firewall outbound policy");
+    await checked3(host, ["ufw", "allow", `${config.firewall.sshPort}/tcp`], "firewall SSH rule");
     for (const cidr of config.firewall.privateCidrs) {
       if (config.database.role !== "none")
-        await checked2(host, ["ufw", "allow", "from", cidr, "to", "any", "port", "8528:8539", "proto", "tcp"], "database firewall rule");
+        await checked3(host, ["ufw", "allow", "from", cidr, "to", "any", "port", "8528:8539", "proto", "tcp"], "database firewall rule");
       for (const port of [config.runtime.bluePort, config.runtime.greenPort])
-        await checked2(host, ["ufw", "allow", "from", cidr, "to", "any", "port", String(port), "proto", "tcp"], "seed-mesh firewall rule");
+        await checked3(host, ["ufw", "allow", "from", cidr, "to", "any", "port", String(port), "proto", "tcp"], "seed-mesh firewall rule");
     }
-    await checked2(host, ["ufw", "--force", "enable"], "firewall activation");
+    await checked3(host, ["ufw", "--force", "enable"], "firewall activation");
     await host.ensureSoftware(plan.software.filter(({ id }) => id !== "ufw"));
   }
+  if (config.kind === "platform" && bootstrapManifest) {
+    await verifyBootstrapBundleOnHost(host, config, true);
+  }
   if (config.kind === "platform") {
     const root = platformPrivate.root;
     if (!host.exists(JWT_CREDENTIAL)) {
@@ -4085,8 +4256,8 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       keepReleases: runtime.keepReleases,
       drainDeadlineMs: runtime.environment.drainDeadlineMs
     });
-    await checked2(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
-      await checked2(host, ["id", runtime.serviceUser], "existing API service account");
+    await checked3(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
+      await checked3(host, ["id", runtime.serviceUser], "existing API service account");
     });
     host.mkdir(runtime.environment.sharedDirectory, 488);
     host.mkdir(runtime.slotsDirectory, 493);
@@ -4095,7 +4266,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       host.write("/etc/forgezero/capacity.env", `FZ_CONCURRENCY_LIMIT=${runtime.environment.concurrencyLimit}
 `, 420);
     }
-    await checked2(host, ["chown", `root:${runtime.serviceUser}`, runtime.environment.sharedDirectory, envPath], "runtime ownership");
+    await checked3(host, ["chown", `root:${runtime.serviceUser}`, runtime.environment.sharedDirectory, envPath], "runtime ownership");
     host.write("/etc/systemd/system/forgezero@.service", units.template, 420);
     host.write("/etc/systemd/system/forgezero@blue.service.d/port.conf", units.dropIns.blue, 420);
     host.write("/etc/systemd/system/forgezero@green.service.d/port.conf", units.dropIns.green, 420);
@@ -4104,30 +4275,30 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     host.write("/etc/forgezero/deploy.env", activation.environment, 420);
     host.write("/etc/forgezero/deploy-activation.json", activation.helper, 384);
     host.write("/etc/sudoers.d/forgezero-runner", activation.sudoers, 288);
-    await checked2(host, ["visudo", "-cf", "/etc/sudoers.d/forgezero-runner"], "activation sudo policy");
+    await checked3(host, ["visudo", "-cf", "/etc/sudoers.d/forgezero-runner"], "activation sudo policy");
     const telemetry = planLocalOtlpProof(runtime.environment.otlpEndpoint, runtime.environment.otlpCollectorUnit);
-    await checked2(host, telemetry.unitCheck.argv, "OTLP collector supervision");
-    const otlpStatus = (await checked2(host, [telemetry.receiverCheck.command, ...telemetry.receiverCheck.argv], "OTLP receiver")).trim();
+    await checked3(host, telemetry.unitCheck.argv, "OTLP collector supervision");
+    const otlpStatus = (await checked3(host, [telemetry.receiverCheck.command, ...telemetry.receiverCheck.argv], "OTLP receiver")).trim();
     if (!/^2\d\d$/.test(otlpStatus))
       throw new Error(`OTLP receiver returned HTTP ${otlpStatus || "unknown"}`);
-    await checked2(host, ["nginx", "-t"], "nginx configuration");
-    await checked2(host, ["systemctl", "daemon-reload"], "systemd reload");
-    await checked2(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
+    await checked3(host, ["nginx", "-t"], "nginx configuration");
+    await checked3(host, ["systemctl", "daemon-reload"], "systemd reload");
+    await checked3(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
     if (config.database.role === "master") {
       const invite = `${runtime.environment.sharedDirectory}/platform-invite.token`;
       if (!host.exists(invite)) {
-        host.write(invite, `plt_${randomBytes2(24).toString("hex")}
+        host.write(invite, `plt_${randomBytes3(24).toString("hex")}
 `, 384);
-        await checked2(host, ["chown", `${runtime.serviceUser}:${runtime.serviceUser}`, invite], "platform invite ownership");
+        await checked3(host, ["chown", `${runtime.serviceUser}:${runtime.serviceUser}`, invite], "platform invite ownership");
       }
     }
     if (config.database.role !== "none") {
       host.mkdir("/var/lib/forgezero-cluster", 448);
-      await checked2(host, ["chown", "arangodb:arangodb", "/var/lib/forgezero-cluster"], "database state ownership");
+      await checked3(host, ["chown", "arangodb:arangodb", "/var/lib/forgezero-cluster"], "database state ownership");
       host.write("/etc/systemd/system/forgezero-db.service", databaseUnit(config), 420);
       host.write("/etc/systemd/system/forgezero-db-verify.service", databaseVerifyUnit(config), 420);
-      await checked2(host, ["systemctl", "daemon-reload"], "database unit reload");
-      await checked2(host, ["systemctl", "enable", "--now", "forgezero-db.service", "forgezero-db-verify.service"], "database supervision");
+      await checked3(host, ["systemctl", "daemon-reload"], "database unit reload");
+      await checked3(host, ["systemctl", "enable", "--now", "forgezero-db.service", "forgezero-db-verify.service"], "database supervision");
       const evidence = {
         expectedMode: "default",
         role: "COORDINATOR",
@@ -4138,15 +4309,30 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       host.write(DB_MODE_EVIDENCE, `${JSON.stringify(evidence, null, 2)}
 `, 384);
     }
-    await checked2(host, [
-      "runuser",
-      "-u",
-      "forgezero-agent",
-      "--",
-      "/usr/local/bin/fz-agent",
-      "deploy",
-      ...config.database.role === "master" ? ["--release-executor"] : []
-    ], "initial Agent deployment");
+    if (bootstrapManifest) {
+      await checked3(host, [
+        "runuser",
+        "-u",
+        "forgezero-agent",
+        "--",
+        "/usr/local/bin/fz-agent",
+        "deploy",
+        `--revision=${bootstrapManifest.revision}`,
+        ...config.database.role === "master" ? ["--release-executor"] : []
+      ], "initial Agent deployment");
+      host.write(BOOTSTRAP_RELEASE_EVIDENCE, `${JSON.stringify({
+        format: 1,
+        kind: "forgezero-bootstrap-release",
+        revision: bootstrapManifest.revision,
+        sha256: bootstrapManifest.sha256,
+        branch: bootstrapManifest.branch,
+        deployedAt: new Date().toISOString()
+      }, null, 2)}
+`, 384);
+      host.remove(config.bootstrapBundle.bundleFile);
+      host.remove(config.bootstrapBundle.manifestFile);
+      await host.installAgent(config);
+    }
   }
   if (config.cloudflareHandoff) {
     if (!host.exists(TUNNEL_CREDENTIAL) && connectorCapabilities) {
@@ -4155,8 +4341,8 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     if (!host.exists(TUNNEL_CREDENTIAL))
       throw new Error("sealed cloudflared connector credential is missing");
     host.write("/etc/systemd/system/cloudflared.service", tunnelUnit(), 420);
-    await checked2(host, ["systemctl", "daemon-reload"], "cloudflared unit reload");
-    await checked2(host, ["systemctl", "enable", "--now", "cloudflared.service"], "cloudflared connector supervision");
+    await checked3(host, ["systemctl", "daemon-reload"], "cloudflared unit reload");
+    await checked3(host, ["systemctl", "enable", "--now", "cloudflared.service"], "cloudflared connector supervision");
     const tunnelId = cloudflare?.tunnelId ?? installed?.cloudflareTunnelId ?? (config.kind === "platform" ? config.runtime.environment.cloudflare?.tunnelId : undefined);
     if (!tunnelId)
       throw new Error("Cloudflare tunnel identity is missing after handoff validation");
@@ -4166,8 +4352,8 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     if (!host.exists(WARP_CONNECTOR_CREDENTIAL))
       throw new Error("sealed Cloudflare Mesh connector credential is missing");
     host.write("/etc/systemd/system/forgezero-mesh-config.service", meshConnectorUnit(), 420);
-    await checked2(host, ["systemctl", "daemon-reload"], "Cloudflare Mesh unit reload");
-    await checked2(host, ["systemctl", "enable", "--now", "warp-svc.service", "forgezero-mesh-config.service"], "Cloudflare Mesh connector supervision");
+    await checked3(host, ["systemctl", "daemon-reload"], "Cloudflare Mesh unit reload");
+    await checked3(host, ["systemctl", "enable", "--now", "warp-svc.service", "forgezero-mesh-config.service"], "Cloudflare Mesh connector supervision");
   }
   host.write(STATE_PATH, stateFor(config, cloudflare, installed?.cloudflareTunnelId), 384);
   const status = await bootstrapStatus(host);
@@ -4212,8 +4398,7 @@ function strictBootstrapDocument(value) {
     "computeReference",
     "nodeHostname",
     "apiUrl",
-    "repository",
-    "branch",
+    "bootstrapBundle",
     "deployRoot",
     "telemetryEndpoint",
     "database",
@@ -4226,9 +4411,11 @@ function strictBootstrapDocument(value) {
     "realm",
     "software",
     "deploymentCredentials",
+    "gitDeployKey",
     "bootstrapRunner"
   ], "bootstrap config");
   if (root.kind === "platform") {
+    exactKeys(root.bootstrapBundle, ["bundleFile", "manifestFile"], "bootstrap bundle config");
     exactKeys(root.firewall, ["enabled", "sshPort", "privateCidrs"], "firewall config");
     if (root.cloudflareHandoff !== undefined)
       exactKeys(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
@@ -4270,8 +4457,6 @@ function strictBootstrapDocument(value) {
       "agentOtlpEndpoint",
       "custodianEmail",
       "email",
-      "repository",
-      "branch",
       "deployProfile",
       "otlpFlushIntervalMs",
       "otlpTraceSampleRatio",
@@ -4309,11 +4494,11 @@ function strictBootstrapDocument(value) {
   return value;
 }
 function readBootstrapConfig(path) {
-  const metadata = lstatSync2(path);
+  const metadata = lstatSync3(path);
   if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== (process.getuid?.() ?? metadata.uid) || metadata.nlink !== 1 || (metadata.mode & 63) !== 0 || metadata.size > 64 * 1024) {
     throw new Error("bootstrap config must be an owner-only regular file with one link and at most 64 KiB");
   }
-  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync4(path, "utf8"))));
+  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync5(path, "utf8"))));
 }
 function localBootstrapHost() {
   const execute = async (argv, options = {}) => {
@@ -4331,19 +4516,19 @@ function localBootstrapHost() {
   };
   return {
     uid: () => process.getuid?.() ?? -1,
-    exists: existsSync4,
-    read: (path) => readFileSync4(path, "utf8"),
+    exists: existsSync5,
+    read: (path) => readFileSync5(path, "utf8"),
     write(path, content, mode) {
-      mkdirSync4(dirname5(path), { recursive: true, mode: 493 });
+      mkdirSync5(dirname6(path), { recursive: true, mode: 493 });
       const temporary = `${path}.next.${process.pid}`;
-      writeFileSync4(temporary, content, { mode });
-      chmodSync2(temporary, mode);
-      renameSync4(temporary, path);
+      writeFileSync5(temporary, content, { mode });
+      chmodSync3(temporary, mode);
+      renameSync5(temporary, path);
     },
-    mkdir: (path, mode) => mkdirSync4(path, { recursive: true, mode }),
-    remove: (path) => rmSync4(path, { force: true }),
+    mkdir: (path, mode) => mkdirSync5(path, { recursive: true, mode }),
+    remove: (path) => rmSync5(path, { force: true }),
     inspect(path) {
-      const value = lstatSync2(path);
+      const value = lstatSync3(path);
       return { regular: value.isFile(), symbolic: value.isSymbolicLink(), uid: value.uid, mode: value.mode, links: value.nlink, size: value.size };
     },
     exec: execute,
@@ -4365,7 +4550,12 @@ function localBootstrapHost() {
     async installAgent(config) {
       const capabilities = await readCapabilities(localRunner);
       const deployRoot = config.deployRoot ?? "/opt/forgezero";
-      const hasBinding = config.kind === "enrolled-compute" || existsSync4(ENROL_CREDENTIAL) || existsSync4("/var/lib/forgezero/enrolment.json");
+      const hasBinding = existsSync5("/var/lib/forgezero/enrolment.json");
+      const initialBundle = config.kind === "platform" && !existsSync5(BOOTSTRAP_RELEASE_EVIDENCE) ? {
+        path: config.bootstrapBundle.bundleFile,
+        manifestPath: config.bootstrapBundle.manifestFile,
+        manifest: parseBootstrapBundleManifest(JSON.parse(readFileSync5(config.bootstrapBundle.manifestFile, "utf8")))
+      } : undefined;
       if (config.kind === "platform") {
         const lifecycle = config.database.role === "none" ? {
           apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
@@ -4377,8 +4567,8 @@ function localBootstrapHost() {
           databaseHealthUrl: `http://${config.database.address}:8529/_api/version`,
           databasePorts: [8529]
         };
-        mkdirSync4(dirname5(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
-        writeFileSync4(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
+        mkdirSync5(dirname6(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
+        writeFileSync5(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
 `, { mode: 256 });
       }
       const plan = planInstall({
@@ -4386,15 +4576,17 @@ function localBootstrapHost() {
         socketPath: DEFAULT_SOCKET2,
         seedPath: "/var/lib/forgezero/node.seed",
         controlSocketPath: "/run/forgezero/control.sock",
-        repository: config.repository,
-        branch: config.branch,
+        repository: initialBundle?.path ?? (config.kind === "enrolled-compute" ? config.repository : undefined),
+        branch: initialBundle?.manifest.branch ?? (config.kind === "enrolled-compute" ? config.branch : undefined),
+        bootstrapBundlePath: initialBundle?.path,
+        bootstrapBundleManifestPath: initialBundle?.manifestPath,
         profile: config.kind === "platform" ? config.profile : config.profile,
         deployRoot,
         deploymentCredentials: config.deploymentCredentials,
         publicApiUrl: config.apiUrl,
-        gitCredentialPath: "/etc/forgezero/creds/git-deploy-key.cred",
-        gitPublicKeyPath: "/etc/forgezero/git/deploy.pub",
-        generateGitIdentity: true,
+        gitCredentialPath: config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/creds/git-deploy-key.cred" : undefined,
+        gitPublicKeyPath: config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/git/deploy.pub" : undefined,
+        generateGitIdentity: config.kind === "enrolled-compute" && config.gitDeployKey === true,
         pullDeployments: hasBinding,
         pullMigrations: config.kind === "platform" && hasBinding,
         pullBootstrap: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && Boolean(config.bootstrapRunner),
@@ -4408,9 +4600,11 @@ function localBootstrapHost() {
         telemetryEndpoint: config.telemetryEndpoint,
         binPath: "/usr/local/lib/forgezero/agent/fz-agent",
         sourceBinPath: PACKAGED_AGENT_BIN,
+        ...existsSync5(ENROL_CREDENTIAL) || hasBinding ? {
+          enrolTokenCredentialPath: existsSync5(ENROL_CREDENTIAL) ? ENROL_CREDENTIAL : undefined,
+          enrolStatePath: "/var/lib/forgezero/enrolment.json"
+        } : {},
         ...hasBinding ? {
-          enrolTokenCredentialPath: ENROL_CREDENTIAL,
-          enrolStatePath: "/var/lib/forgezero/enrolment.json",
           apiUrl: config.apiUrl,
           project: config.kind === "enrolled-compute" ? config.realm : "platform",
           environment: config.kind === "enrolled-compute" ? undefined : config.environment,
@@ -4418,8 +4612,8 @@ function localBootstrapHost() {
         } : {}
       });
       for (const unit of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
-        mkdirSync4(dirname5(unit.path), { recursive: true, mode: 493 });
-        writeFileSync4(unit.path, unit.unit, { mode: 420 });
+        mkdirSync5(dirname6(unit.path), { recursive: true, mode: 493 });
+        writeFileSync5(unit.path, unit.unit, { mode: 420 });
       }
       await applyPlan(plan, localRunner);
       return plan;
@@ -4432,7 +4626,6 @@ export {
   validateBootstrapConfig,
   resolveInstalledBootstrapKind,
   readBootstrapConfig,
-  preparePlatformBootstrap,
   planBootstrap,
   localBootstrapHost,
   bootstrapStatus,