@forgezero/agent 0.1.64 → 0.1.67

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.64";
+var VERSION3 = "0.1.67";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/bootstrap-bundle.d.ts

@@ -26,6 +26,7 @@ export interface BootstrapBundleCommandResult {
 }
 export type BootstrapBundleCommand = (argv: readonly string[]) => Promise<BootstrapBundleCommandResult>;
 export declare function sha256File(path: string): Promise<string>;
+export declare const bootstrapBundleBranch: (value: unknown) => string;
 export declare function parseBootstrapBundleManifest(value: unknown): BootstrapBundleManifest;
 export declare function readBootstrapBundle(bundlePath: string, manifestPath?: string): Promise<BootstrapBundleBuildResult>;
 export declare function buildBootstrapBundle(input: BootstrapBundleBuildInput, exec?: BootstrapBundleCommand): Promise<BootstrapBundleBuildResult>;

package/dist/bootstrap-bundle.js

@@ -41,7 +41,7 @@ async function sha256File(path) {
   });
   return hash.digest("hex");
 }
-var branchName = (value) => {
+var bootstrapBundleBranch = (value) => {
   if (typeof value !== "string" || !/^[A-Za-z0-9](?:[A-Za-z0-9._/-]{0,126}[A-Za-z0-9])?$/.test(value) || value.includes("..") || value.includes("//") || value.startsWith("-")) {
     throw new Error("bootstrap bundle branch is malformed");
   }
@@ -58,7 +58,7 @@ function parseBootstrapBundleManifest(value) {
   if (source.format !== BOOTSTRAP_BUNDLE_FORMAT || source.kind !== BOOTSTRAP_BUNDLE_KIND) {
     throw new Error("bootstrap bundle manifest format is unsupported");
   }
-  branchName(source.branch);
+  bootstrapBundleBranch(source.branch);
   if (typeof source.revision !== "string" || !/^[a-f0-9]{40}$/.test(source.revision)) {
     throw new Error("bootstrap bundle revision must be an exact lowercase Git commit");
   }
@@ -103,7 +103,7 @@ async function buildBootstrapBundle(input, exec = run) {
   const repositoryRoot = resolve(input.repositoryRoot);
   const outputPath = resolve(input.outputPath);
   const manifestPath = `${outputPath}.json`;
-  const branch = branchName(input.branch);
+  const branch = bootstrapBundleBranch(input.branch);
   if (!isAbsolute(input.outputPath) || outputPath !== input.outputPath) {
     throw new Error("bootstrap bundle output must be a canonical absolute path");
   }
@@ -159,6 +159,7 @@ export {
   readBootstrapBundle,
   parseBootstrapBundleManifest,
   buildBootstrapBundle,
+  bootstrapBundleBranch,
   MAX_BOOTSTRAP_BUNDLE_BYTES,
   BOOTSTRAP_BUNDLE_KIND,
   BOOTSTRAP_BUNDLE_FORMAT

package/dist/bootstrap.d.ts

@@ -13,7 +13,7 @@ export interface PlatformBootstrapConfig {
     kind: 'platform';
     environment: BootstrapEnvironment;
     profile: PlatformBootstrapProfile;
-    /** API-owned compute reference. Initial seed references are fz-n1..3/dev-fz-n1..3. */
+    /** API-owned compute reference. Initial seed references come from the reviewed generic guest requests. */
     computeReference: string;
     nodeHostname: string;
     apiUrl: string;
@@ -21,6 +21,7 @@ export interface PlatformBootstrapConfig {
     bootstrapBundle: {
         bundleFile: string;
         manifestFile: string;
+        branch: string;
     };
     deployRoot?: string;
     telemetryEndpoint: string;
@@ -70,6 +71,11 @@ export interface PlatformBootstrapConfig {
 }
 export interface EnrolledComputeActivationConfig {
     kind: 'enrolled-compute';
+    operatingSystem: {
+        id: 'ubuntu';
+        version: '24.04' | '26.04';
+        architecture: 'x64';
+    };
     apiUrl: string;
     realm: string;
     nodeHostname: string;

package/dist/bootstrap.js

@@ -1251,7 +1251,7 @@ async function sha256File(path) {
   });
   return hash.digest("hex");
 }
-var branchName = (value) => {
+var bootstrapBundleBranch = (value) => {
   if (typeof value !== "string" || !/^[A-Za-z0-9](?:[A-Za-z0-9._/-]{0,126}[A-Za-z0-9])?$/.test(value) || value.includes("..") || value.includes("//") || value.startsWith("-")) {
     throw new Error("bootstrap bundle branch is malformed");
   }
@@ -1268,7 +1268,7 @@ function parseBootstrapBundleManifest(value) {
   if (source.format !== BOOTSTRAP_BUNDLE_FORMAT || source.kind !== BOOTSTRAP_BUNDLE_KIND) {
     throw new Error("bootstrap bundle manifest format is unsupported");
   }
-  branchName(source.branch);
+  bootstrapBundleBranch(source.branch);
   if (typeof source.revision !== "string" || !/^[a-f0-9]{40}$/.test(source.revision)) {
     throw new Error("bootstrap bundle revision must be an exact lowercase Git commit");
   }
@@ -1313,7 +1313,7 @@ async function buildBootstrapBundle(input, exec = run) {
   const repositoryRoot = resolve2(input.repositoryRoot);
   const outputPath = resolve2(input.outputPath);
   const manifestPath = `${outputPath}.json`;
-  const branch = branchName(input.branch);
+  const branch = bootstrapBundleBranch(input.branch);
   if (!isAbsolute(input.outputPath) || outputPath !== input.outputPath) {
     throw new Error("bootstrap bundle output must be a canonical absolute path");
   }
@@ -1396,11 +1396,37 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.64";
+var VERSION = "0.1.67";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
 var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f";
+var OS_CATALOG = [
+  {
+    id: "ubuntu",
+    version: "26.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-resolute-20260731",
+    imageLabel: "Ubuntu 26.04 LTS Resolute",
+    imageVersion: "2026-07-31",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
+    imageSha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05",
+    confidentialModes: ["sev-snp"]
+  },
+  {
+    id: "ubuntu",
+    version: "24.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-noble-20260705",
+    imageLabel: "Ubuntu 24.04 LTS Noble",
+    imageVersion: "2026-07-05",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/noble/release-20260705/ubuntu-24.04-server-cloudimg-amd64.img",
+    imageSha256: "ffe6203da54deeb6db5d2a98a83f9ec8e55f149d3f7ba622e1abe5fa966ee3d6",
+    confidentialModes: []
+  }
+];
 var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
   "data-root": "/var/lib/docker",
   "storage-driver": "overlay2",
@@ -2786,6 +2812,143 @@ async function applyPlan(plan, run2) {
   return transcript;
 }
 
+// src/ubuntu.ts
+var current = OS_CATALOG[0];
+var SUPPORTED_GUEST_IMAGE = Object.freeze({
+  key: current.imageKey,
+  family: `${current.id}-${current.version}`,
+  version: current.imageVersion,
+  label: current.imageLabel,
+  url: current.imageUrl,
+  sha256: current.imageSha256
+});
+var SUPPORTED_GUEST_IMAGES = Object.freeze(OS_CATALOG.filter(({ status }) => status === "active").map(({ id, imageKey, imageLabel, imageVersion, version, confidentialModes }) => ({
+  key: imageKey,
+  label: imageLabel,
+  family: `${id}-${version}`,
+  version: imageVersion,
+  confidential: confidentialModes.some((mode) => mode === "sev-snp")
+})));
+function assertSupportedGuestImage(imageKey, confidential = false) {
+  const selected = OS_CATALOG.find((entry) => entry.status === "active" && entry.imageKey === imageKey);
+  if (!selected) {
+    throw new Error(`unsupported guest image ${imageKey}; supported images: ${SUPPORTED_GUEST_IMAGES.map(({ key }) => key).join(", ")}`);
+  }
+  if (confidential && !selected.confidentialModes.some((mode) => mode === "sev-snp")) {
+    throw new Error(`guest image ${imageKey} is not approved for SEV-SNP`);
+  }
+}
+
+// src/platform-genesis.ts
+var SAFE_NAME = /^[a-z][a-z0-9-]{0,62}$/;
+var SAFE_POOL = /^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/;
+var PRIVATE_V4 = /^(?:10\.(?:\d{1,3}\.){2}\d{1,3}|192\.168\.(?:\d{1,3})\.(?:\d{1,3})|172\.(?:1[6-9]|2\d|3[01])\.(?:\d{1,3})\.(?:\d{1,3}))$/;
+var integer = (value, minimum, maximum, label) => {
+  if (!Number.isInteger(value) || value < minimum || value > maximum) {
+    throw new Error(`platform genesis ${label} is outside the supported range`);
+  }
+  return value;
+};
+function validatePlatformGenesisGuests(guests, expectedCount = 3) {
+  if (!Array.isArray(guests) || guests.length !== expectedCount) {
+    throw new Error(`platform genesis requires exactly ${expectedCount} reviewed guest requests`);
+  }
+  const names = new Set;
+  const addresses = new Set;
+  const pools = new Set;
+  return guests.map((input) => {
+    if (!input || typeof input !== "object" || !SAFE_NAME.test(input.name)) {
+      throw new Error("platform genesis guest name is malformed");
+    }
+    if (!PRIVATE_V4.test(input.address))
+      throw new Error("platform genesis guest address must be private IPv4");
+    if (typeof input.confidential !== "boolean")
+      throw new Error("platform genesis confidential requirement is missing");
+    assertSupportedGuestImage(input.imageKey, input.confidential);
+    if (input.cpuPoolKey !== undefined && !SAFE_POOL.test(input.cpuPoolKey)) {
+      throw new Error("platform genesis CPU pool key is malformed");
+    }
+    if (names.has(input.name) || addresses.has(input.address) || input.cpuPoolKey !== undefined && pools.has(input.cpuPoolKey)) {
+      throw new Error("platform genesis guest names, addresses and explicit CPU pools must be unique");
+    }
+    names.add(input.name);
+    addresses.add(input.address);
+    if (input.cpuPoolKey !== undefined)
+      pools.add(input.cpuPoolKey);
+    const physicalCores = integer(input.physicalCores, 1, 256, "physical core count");
+    const vcpu = integer(input.vcpu, 1, 512, "vCPU count");
+    if (vcpu < physicalCores)
+      throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
+    const memoryGib = integer(input.memoryGib, 1, 8192, "memory");
+    const diskGib = integer(input.diskGib, 8, 65536, "disk");
+    const egressGuaranteedMbps = integer(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
+    const egressBurstMbps = integer(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
+    return {
+      name: input.name,
+      address: input.address,
+      imageKey: input.imageKey,
+      ...input.cpuPoolKey ? { cpuPoolKey: input.cpuPoolKey } : {},
+      physicalCores,
+      vcpu,
+      memoryGib,
+      diskGib,
+      egressGuaranteedMbps,
+      egressBurstMbps,
+      confidential: input.confidential
+    };
+  });
+}
+var publicKey = (value) => {
+  const normalized = value.trim();
+  if (!/^ssh-(?:ed25519|rsa) [A-Za-z0-9+/]+={0,3}(?: [^\r\n]+)?$/.test(normalized)) {
+    throw new Error("platform genesis SSH public key is malformed");
+  }
+  return normalized;
+};
+var claimFor = (guest, keys, action) => {
+  const common = {
+    computeKey: `platform:${guest.name}`,
+    claimToken: "offline-platform-genesis",
+    claimExpiresAtTs: Number.MAX_SAFE_INTEGER,
+    attempt: 1,
+    bootstrap: { kind: "platform-genesis" },
+    spec: {
+      reference: `platform:${guest.name}`,
+      imageKey: guest.imageKey,
+      guestName: guest.name,
+      guestAddress: guest.address,
+      ...guest.cpuPoolKey ? { cpuPoolKey: guest.cpuPoolKey } : {},
+      physicalCores: guest.physicalCores,
+      vcpu: guest.vcpu,
+      memoryGib: guest.memoryGib,
+      diskGib: guest.diskGib,
+      egressGuaranteedMbps: guest.egressGuaranteedMbps,
+      egressBurstMbps: guest.egressBurstMbps,
+      confidential: guest.confidential
+    }
+  };
+  if (action === "delete")
+    return { ...common, action: "delete" };
+  return { ...common, action: "create", access: { sshUser: "forgezero", sshPublicKeys: [...keys] } };
+};
+function platformGenesisClaims(guests, sshPublicKeys) {
+  const reviewed = validatePlatformGenesisGuests(guests);
+  const keys = [...new Set(sshPublicKeys.map(publicKey))];
+  if (keys.length === 0)
+    throw new Error("platform genesis requires at least one operator SSH public key");
+  return reviewed.map((guest) => claimFor(guest, keys, "create"));
+}
+function platformCommunityRehearsalClaims(seedGuests, rehearsalGuest, sshPublicKeys) {
+  const reviewed = validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4);
+  const keys = [...new Set(sshPublicKeys.map(publicKey))];
+  if (keys.length === 0)
+    throw new Error("platform genesis requires at least one operator SSH public key");
+  return reviewed.map((guest) => claimFor(guest, keys, "create"));
+}
+function platformCommunityRehearsalDeletionClaims(seedGuests, rehearsalGuest) {
+  return validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4).map((guest) => claimFor(guest, [], "delete"));
+}
+
 // src/platform-bootstrap-runtime.ts
 var safeAtom = (name, value) => {
   if (!value || /[\0\r\n]/.test(value))
@@ -2817,6 +2980,50 @@ var httpsOrigin = (name, raw) => {
   }
   return value.origin;
 };
+function validatePlatformInitialInventory(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+    throw new Error("initial platform inventory coordinates are invalid");
+  }
+  safeAtom("initialInventory.region.label", value.region.label);
+  if (value.region.city !== undefined)
+    safeAtom("initialInventory.region.city", value.region.city);
+  const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
+    if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
+      "name",
+      "address",
+      "imageKey",
+      "cpuPoolKey",
+      "physicalCores",
+      "vcpu",
+      "memoryGib",
+      "diskGib",
+      "egressGuaranteedMbps",
+      "egressBurstMbps",
+      "confidential",
+      "databaseRole",
+      "databaseAgency"
+    ].includes(key)))
+      throw new Error("initial platform compute contains unknown fields");
+    return compute;
+  }));
+  for (let index = 0;index < computes.length; index += 1) {
+    const declared = value.computes[index];
+    const expectedRole = index === 0 ? "master" : "joiner";
+    if (declared.databaseRole !== expectedRole || declared.databaseAgency !== "member" || declared.confidential !== true) {
+      throw new Error("initial platform inventory requires one master, two joiners, three Agency members and confidential compute");
+    }
+  }
+  return {
+    metalHostname: value.metalHostname,
+    region: { ...value.region },
+    computes: value.computes.map((compute, index) => ({
+      ...computes[index],
+      databaseRole: compute.databaseRole,
+      databaseAgency: compute.databaseAgency,
+      confidential: true
+    }))
+  };
+}
 var systemdValue = (name, raw) => {
   if (/[\0\r\n]/.test(raw))
     throw new Error(`${name} must be single-line.`);
@@ -2902,12 +3109,14 @@ function validatePlatformSharedEnvironment(input) {
       throw new Error("realtime.producer is invalid.");
     }
   }
+  const initialInventory = input.initialInventory ? validatePlatformInitialInventory(input.initialInventory) : undefined;
   return {
     ...input,
     databaseCoordinators: coordinators,
     appOrigin: httpsOrigin("appOrigin", input.appOrigin),
     apiOrigin: httpsOrigin("apiOrigin", input.apiOrigin),
-    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint)
+    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint),
+    ...initialInventory ? { initialInventory } : {}
   };
 }
 function renderPlatformSharedEnvironment(input) {
@@ -2970,7 +3179,8 @@ function renderPlatformSharedEnvironment(input) {
     FZ_CF_TUNNEL_SERVICE: value.cloudflare?.tunnelService ?? "",
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
-    FZ_REALTIME_PRODUCER: value.realtime?.producer ?? ""
+    FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
+    FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
 ` + Object.entries(entries).map(([key, entry]) => `${key}=${systemdValue(key, entry)}`).join(`
@@ -3485,6 +3695,12 @@ function validateBootstrapConfig(value) {
     throw new Error("Cloudflare Mesh/WARP requires a node-specific Cloudflare handoff");
   }
   if (value.kind === "enrolled-compute") {
+    const os = OS_CATALOG.find((entry) => entry.status === "active" && entry.id === value.operatingSystem?.id && entry.version === value.operatingSystem?.version && entry.architecture === value.operatingSystem?.architecture);
+    if (!os)
+      throw new Error("enrolled compute operating system is not in the active typed OS catalog");
+    if (value.operatingSystem.version === "24.04" && (value.installCloudflared || value.installWarp)) {
+      throw new Error("Cloudflare Tunnel and WARP require the reviewed Ubuntu 26.04 strategy");
+    }
     if (value.gitDeployKey !== undefined && typeof value.gitDeployKey !== "boolean") {
       throw new Error("gitDeployKey must be boolean");
     }
@@ -3516,6 +3732,7 @@ function validateBootstrapConfig(value) {
   if (!value.bootstrapBundle || ![value.bootstrapBundle.bundleFile, value.bootstrapBundle.manifestFile].every((path) => typeof path === "string" && path.startsWith("/") && !/[\r\n\0:]/.test(path))) {
     throw new Error("platform bootstrap requires absolute bundle and manifest paths");
   }
+  bootstrapBundleBranch(value.bootstrapBundle.branch);
   let api;
   try {
     api = new URL(value.apiUrl);
@@ -3570,9 +3787,19 @@ function validateBootstrapConfig(value) {
 }
 function planBootstrap(input, initialized = false) {
   const config = validateBootstrapConfig(structuredClone(input));
+  const enrolledOsVersion = config.kind === "enrolled-compute" ? `ubuntu-${config.operatingSystem.version}` : undefined;
+  const enrolledSoftware = config.kind === "enrolled-compute" ? [...config.software ?? []] : [];
+  if (config.kind === "enrolled-compute") {
+    if (!enrolledSoftware.some(({ id }) => id === "bun"))
+      enrolledSoftware.push({ id: "bun", version: "1.3.14" });
+    if (!enrolledSoftware.some(({ id }) => id === "git"))
+      enrolledSoftware.push({ id: "git", version: enrolledOsVersion });
+    if (!enrolledSoftware.some(({ id }) => id === "ufw"))
+      enrolledSoftware.push({ id: "ufw", version: enrolledOsVersion });
+  }
   const software = config.kind === "enrolled-compute" ? [
-    ...config.software ?? [],
-    ...config.bootstrapRunner && !config.software?.some(({ id }) => id === "openssh-client") ? [{ id: "openssh-client", version: "ubuntu-26.04" }] : [],
+    ...enrolledSoftware,
+    ...config.bootstrapRunner && !enrolledSoftware.some(({ id }) => id === "openssh-client") ? [{ id: "openssh-client", version: enrolledOsVersion }] : [],
     ...config.installCloudflared ? [{ id: "cloudflared", version: "2026.7.3" }] : [],
     ...config.installWarp ? [{ id: "cloudflare-warp", version: "2026.6.822.0-min" }] : []
   ] : [
@@ -3807,9 +4034,8 @@ async function verifyBootstrapBundleOnHost(host, config, verifyGit = false) {
     throw new Error("bootstrap bundle manifest is not valid JSON");
   }
   const manifest = parseBootstrapBundleManifest(parsed);
-  const expectedBranch = config.environment === "production" ? "main" : "dev";
-  if (manifest.branch !== expectedBranch || bundleMetadata && bundleMetadata.size !== manifest.bytes) {
-    throw new Error("bootstrap bundle manifest disagrees with the selected platform environment");
+  if (manifest.branch !== config.bootstrapBundle.branch || bundleMetadata && bundleMetadata.size !== manifest.bytes) {
+    throw new Error("bootstrap bundle manifest disagrees with the reviewed bootstrap bundle coordinates");
   }
   const digest = (await checked3(host, ["/usr/bin/sha256sum", config.bootstrapBundle.bundleFile], "bootstrap bundle digest")).trim().split(/\s+/)[0];
   if (digest !== manifest.sha256)
@@ -3823,6 +4049,7 @@ function bootstrapIdentity(config) {
   if (config.kind === "enrolled-compute")
     return {
       kind: config.kind,
+      operatingSystem: config.operatingSystem,
       apiUrl: config.apiUrl,
       realm: config.realm,
       nodeHostname: config.nodeHostname,
@@ -4436,7 +4663,7 @@ function strictBootstrapDocument(value) {
     "bootstrapRunner"
   ], "bootstrap config");
   if (root.kind === "platform") {
-    exactKeys(root.bootstrapBundle, ["bundleFile", "manifestFile"], "bootstrap bundle config");
+    exactKeys(root.bootstrapBundle, ["bundleFile", "manifestFile", "branch"], "bootstrap bundle config");
     exactKeys(root.firewall, ["enabled", "sshPort", "privateCidrs"], "firewall config");
     if (root.cloudflareHandoff !== undefined)
       exactKeys(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
@@ -4483,9 +4710,32 @@ function strictBootstrapDocument(value) {
       "otlpTraceSampleRatio",
       "backup",
       "cloudflare",
-      "realtime"
+      "realtime",
+      "initialInventory"
     ], "runtime environment");
     const environment = runtime.environment;
+    if (environment.initialInventory !== undefined) {
+      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes"], "initial inventory");
+      exactKeys(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
+      if (!Array.isArray(inventory.computes))
+        throw new Error("initial inventory computes must be an array");
+      for (const compute of inventory.computes)
+        exactKeys(compute, [
+          "name",
+          "address",
+          "imageKey",
+          "cpuPoolKey",
+          "physicalCores",
+          "vcpu",
+          "memoryGib",
+          "diskGib",
+          "egressGuaranteedMbps",
+          "egressBurstMbps",
+          "confidential",
+          "databaseRole",
+          "databaseAgency"
+        ], "initial inventory compute");
+    }
     if (environment.email !== undefined) {
       const email = exactKeys(environment.email, ["provider", "host", "port", "user", "from", "eu"], "email config");
       if (email.provider === "smtp")
@@ -4502,6 +4752,7 @@ function strictBootstrapDocument(value) {
     if (environment.realtime !== undefined)
       exactKeys(environment.realtime, ["workerScriptName", "endpoint", "producer"], "realtime runtime config");
   } else if (root.kind === "enrolled-compute") {
+    exactKeys(root.operatingSystem, ["id", "version", "architecture"], "enrolled compute operating system");
     if (root.cloudflareHandoff !== undefined)
       exactKeys(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
     if (root.bootstrapRunner !== undefined)

package/dist/cli/agent-install.d.ts

@@ -84,6 +84,15 @@ export interface InstallOptions {
     nodeHostname?: string;
     telemetryEndpoint?: string;
 }
+export type GitIdentityInstallOptions = Pick<InstallOptions, 'gitCredentialPath' | 'gitPublicKeyPath' | 'generateGitIdentity'>;
+/**
+ * Resolve the optional compatibility Git identity from the explicit install
+ * environment. An ordinary Agent install must not load a credential merely
+ * because the CLI knows its conventional pathname: systemd treats every
+ * LoadCredentialEncrypted entry as required and refuses to start when that
+ * file does not exist.
+ */
+export declare function resolveGitIdentityInstallOptions(environment: Readonly<Record<string, string | undefined>>): GitIdentityInstallOptions;
 export declare function planInstall(options: InstallOptions): ProvisionPlan;
 /** Execute the same ordered plan the control plane executes over SSH. */
 export declare function applyPlan(plan: ProvisionPlan, run: (operation: CapabilityOperation | ProvisionOperation) => Promise<{

package/dist/community-rehearsal-host.d.ts

@@ -4,12 +4,20 @@ export declare const COMMUNITY_REHEARSAL_ROOT = "/opt/forgezero-rehearsals/commu
 export declare const COMMUNITY_DATABASE_ROOT = "/var/lib/forgezero-rehearsal-cluster";
 export declare const COMMUNITY_CREDENTIAL_PARENT = "/etc/forgezero-rehearsal";
 export declare const COMMUNITY_CREDENTIAL_ROOT = "/etc/forgezero-rehearsal/creds";
+export interface CommunityRehearsalNode {
+    name: string;
+    address: string;
+    agency: boolean;
+    starter: boolean;
+    readPreferred: boolean;
+}
 export type CommunityRehearsalApiOperation = 'health' | 'init' | 'write' | 'read' | 'query' | 'cluster';
 export type CommunityRehearsalHostRequest = {
     action: 'prepare';
     node: string;
     address: string;
     agency: boolean;
+    topology: readonly CommunityRehearsalNode[];
     release: string;
     archivePath: string;
     archiveSha256: string;
@@ -17,12 +25,15 @@ export type CommunityRehearsalHostRequest = {
 } | {
     action: 'cleanup';
     node: string;
+    topology: readonly CommunityRehearsalNode[];
 } | {
     action: 'database-enable' | 'api-enable' | 'database-ready' | 'starter-ready' | 'api-ready' | 'database-status' | 'api-status';
     node: string;
+    topology: readonly CommunityRehearsalNode[];
 } | {
     action: 'api';
     node: string;
+    topology: readonly CommunityRehearsalNode[];
     operation: CommunityRehearsalApiOperation;
     key?: string;
     value?: string;
@@ -49,6 +60,7 @@ export type CommunityHostOperation = {
     accepted?: readonly number[];
 };
 export declare function ensureCommunityRehearsalArango(execute?: SoftwareExec): Promise<void>;
+export declare const validateCommunityRehearsalTopology: (value: unknown) => readonly CommunityRehearsalNode[];
 export declare function parseCommunityRehearsalHostRequest(value: unknown): CommunityRehearsalHostRequest;
 export declare function planCommunityRehearsalPrepare(request: Extract<CommunityRehearsalHostRequest, {
     action: 'prepare';