@forgezero/agent 0.1.64 → 0.1.67

package/dist/community-rehearsal-host.js

@@ -21,7 +21,30 @@ var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cb
 var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
 var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
 var OS_CATALOG = [
-  { id: "ubuntu", version: "26.04", architecture: "x64", status: "active" }
+  {
+    id: "ubuntu",
+    version: "26.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-resolute-20260731",
+    imageLabel: "Ubuntu 26.04 LTS Resolute",
+    imageVersion: "2026-07-31",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
+    imageSha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05",
+    confidentialModes: ["sev-snp"]
+  },
+  {
+    id: "ubuntu",
+    version: "24.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-noble-20260705",
+    imageLabel: "Ubuntu 24.04 LTS Noble",
+    imageVersion: "2026-07-05",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/noble/release-20260705/ubuntu-24.04-server-cloudimg-amd64.img",
+    imageSha256: "ffe6203da54deeb6db5d2a98a83f9ec8e55f149d3f7ba622e1abe5fa966ee3d6",
+    confidentialModes: []
+  }
 ];
 var SOFTWARE_CATALOG = [
   { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -32,7 +55,12 @@ var SOFTWARE_CATALOG = [
   { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
@@ -45,6 +73,15 @@ var UBUNTU_2604_X64 = [
   { requirement: { id: "openssh-client", version: "ubuntu-26.04" } },
   { requirement: { id: "git", version: "ubuntu-26.04" } }
 ];
+var UBUNTU_2404_X64 = [
+  { requirement: { id: "bun", version: "1.3.14" } },
+  { requirement: { id: "docker", version: "ubuntu-24.04" } },
+  { requirement: { id: "nginx", version: "ubuntu-24.04" } },
+  { requirement: { id: "ufw", version: "ubuntu-24.04" } },
+  { requirement: { id: "openssh-client", version: "ubuntu-24.04" } },
+  { requirement: { id: "git", version: "ubuntu-24.04" } }
+];
+var strategiesFor = (observation) => observation.os.id === "ubuntu" && observation.architecture === "x64" ? observation.os.versionId === "26.04" ? UBUNTU_2604_X64 : observation.os.versionId === "24.04" ? UBUNTU_2404_X64 : undefined : undefined;
 var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var DOCKER_DAEMON_PATH = "/etc/docker/daemon.json";
 var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
@@ -91,7 +128,7 @@ var aptInstall = async (name) => {
 };
 async function executeSoftwareOperation(operation) {
   const { software, version } = operation;
-  if (!UBUNTU_2604_X64.some(({ requirement }) => requirement.id === software && requirement.version === version)) {
+  if (![...UBUNTU_2604_X64, ...UBUNTU_2404_X64].some(({ requirement }) => requirement.id === software && requirement.version === version)) {
     return { exitCode: 2, output: "unsupported software operation" };
   }
   if (operation.kind === "check") {
@@ -261,7 +298,7 @@ async function ensureSoftwareRequirements(requirementsInput, options) {
   }
   const results = [];
   for (const requirement of requirements) {
-    const strategy = UBUNTU_2604_X64.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
+    const strategy = strategiesFor(observation)?.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
     if (!strategy)
       throw new Error(`unsupported software requirement: ${requirement.id}@${requirement.version}`);
     const before = await options.exec({ kind: "check", software: requirement.id, version: requirement.version });
@@ -283,19 +320,15 @@ async function ensureSoftwareRequirements(requirementsInput, options) {
 // src/community-rehearsal-host.ts
 import { createHash as createHash2 } from "node:crypto";
 import { lstatSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, symlinkSync as symlinkSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { isIP } from "node:net";
 import { dirname } from "node:path";
 var COMMUNITY_REHEARSAL_VERSION = "3.11.14";
 var COMMUNITY_REHEARSAL_ROOT = "/opt/forgezero-rehearsals/community-cluster-api";
 var COMMUNITY_DATABASE_ROOT = "/var/lib/forgezero-rehearsal-cluster";
 var COMMUNITY_CREDENTIAL_PARENT = "/etc/forgezero-rehearsal";
 var COMMUNITY_CREDENTIAL_ROOT = "/etc/forgezero-rehearsal/creds";
-var NODES = new Map([
-  ["dev-fz-n1", { address: "10.42.0.21", agency: true }],
-  ["dev-fz-n2", { address: "10.42.0.22", agency: true }],
-  ["dev-fz-n3", { address: "10.42.0.23", agency: true }],
-  ["dev-fz-n4", { address: "10.42.0.24", agency: false }]
-]);
 var RELEASE = /^[a-f0-9]{64}$/;
+var SAFE_NAME = /^[a-z][a-z0-9-]{0,62}$/;
 async function ensureCommunityRehearsalArango(execute = executeSoftwareOperation) {
   const requirement = { software: "arangodb", version: COMMUNITY_REHEARSAL_VERSION };
   if ((await execute({ kind: "check", ...requirement })).exitCode === 0)
@@ -310,50 +343,70 @@ var exactObject = (value) => {
     throw new Error("community rehearsal request must be an object");
   return value;
 };
-var exactNode = (node) => {
-  if (typeof node !== "string")
+var nodeName = (node) => {
+  if (typeof node !== "string" || !SAFE_NAME.test(node))
     throw new Error("community rehearsal node is invalid");
-  const expected = NODES.get(node);
-  if (!expected)
-    throw new Error("community rehearsal accepts only the dedicated dev-fz-n1..n4 fleet");
-  return { name: node, ...expected };
+  return node;
+};
+var validateCommunityRehearsalTopology = (value) => {
+  if (!Array.isArray(value) || value.length !== 4)
+    throw new Error("community rehearsal requires exactly four reviewed nodes");
+  const rows = value.map((item, index) => {
+    const row = exactObject(item);
+    if (Object.keys(row).some((key) => !["name", "address", "agency", "starter", "readPreferred"].includes(key)) || typeof row.name !== "string" || !SAFE_NAME.test(row.name) || typeof row.address !== "string" || isIP(row.address) !== 4 || typeof row.agency !== "boolean" || typeof row.starter !== "boolean" || typeof row.readPreferred !== "boolean") {
+      throw new Error(`community rehearsal topology node ${index + 1} is invalid`);
+    }
+    return row;
+  });
+  if (new Set(rows.map(({ name }) => name)).size !== rows.length || new Set(rows.map(({ address }) => address)).size !== rows.length) {
+    throw new Error("community rehearsal node names and addresses must be unique");
+  }
+  if (rows.filter(({ agency }) => agency).length !== 3 || rows.filter(({ starter }) => starter).length !== 1 || !rows.find(({ starter }) => starter).agency || rows.filter(({ readPreferred }) => readPreferred).length !== 1 || rows.find(({ readPreferred }) => readPreferred).agency) {
+    throw new Error("community rehearsal requires three Agency voters, one voter starter and one non-voting read-preferred member");
+  }
+  return rows;
 };
 function parseCommunityRehearsalHostRequest(value) {
   const row = exactObject(value);
-  const node = exactNode(row.node);
+  const node = nodeName(row.node);
+  const topology = validateCommunityRehearsalTopology(row.topology);
+  const expected = topology.find((entry) => entry.name === node);
+  if (!expected)
+    throw new Error("community rehearsal node is not present in the reviewed topology");
   const action = row.action;
   if (action === "prepare") {
-    const allowed = ["action", "node", "address", "agency", "release", "archivePath", "archiveSha256", "jwt"];
-    if (Object.keys(row).some((key) => !allowed.includes(key)) || row.address !== node.address || row.agency !== node.agency || typeof row.release !== "string" || !RELEASE.test(row.release) || row.archiveSha256 !== row.release || row.archivePath !== `/tmp/forgezero-community-${row.release}.tar.gz` || typeof row.jwt !== "string" || !/^[a-f0-9]{64}$/.test(row.jwt)) {
+    const allowed = ["action", "node", "address", "agency", "topology", "release", "archivePath", "archiveSha256", "jwt"];
+    if (Object.keys(row).some((key) => !allowed.includes(key)) || row.address !== expected.address || row.agency !== expected.agency || typeof row.release !== "string" || !RELEASE.test(row.release) || row.archiveSha256 !== row.release || row.archivePath !== `/tmp/forgezero-community-${row.release}.tar.gz` || typeof row.jwt !== "string" || !/^[a-f0-9]{64}$/.test(row.jwt)) {
       throw new Error("community rehearsal prepare request does not match the dedicated fleet contract");
     }
-    return row;
+    return { ...row, topology };
   }
   if (action === "cleanup") {
-    if (Object.keys(row).some((key) => !["action", "node"].includes(key))) {
+    if (Object.keys(row).some((key) => !["action", "node", "topology"].includes(key))) {
       throw new Error("community rehearsal cleanup has unknown fields");
     }
-    return { action, node: node.name };
+    return { action, node, topology };
   }
   if (["database-enable", "api-enable", "database-ready", "starter-ready", "api-ready", "database-status", "api-status"].includes(String(action))) {
-    if (Object.keys(row).some((key) => !["action", "node"].includes(key)))
+    if (Object.keys(row).some((key) => !["action", "node", "topology"].includes(key)))
       throw new Error("community rehearsal host action has unknown fields");
-    return { action, node: node.name };
+    return { action, node, topology };
   }
   if (action === "api") {
-    if (Object.keys(row).some((key) => !["action", "node", "operation", "key", "value"].includes(key)) || !["health", "init", "write", "read", "query", "cluster"].includes(String(row.operation)) || row.key !== undefined && (typeof row.key !== "string" || !/^[A-Za-z0-9_.:-]{1,128}$/.test(row.key)) || row.value !== undefined && (typeof row.value !== "string" || row.value.length > 4096)) {
+    if (Object.keys(row).some((key) => !["action", "node", "topology", "operation", "key", "value"].includes(key)) || !["health", "init", "write", "read", "query", "cluster"].includes(String(row.operation)) || row.key !== undefined && (typeof row.key !== "string" || !/^[A-Za-z0-9_.:-]{1,128}$/.test(row.key)) || row.value !== undefined && (typeof row.value !== "string" || row.value.length > 4096)) {
       throw new Error("community rehearsal API request is invalid");
     }
     if ((row.operation === "write" || row.operation === "read") && typeof row.key !== "string")
       throw new Error("community rehearsal API key is required");
     if ((row.operation === "write" || row.operation === "query") && typeof row.value !== "string")
       throw new Error("community rehearsal API value is required");
-    return row;
+    return { ...row, node, topology };
   }
   throw new Error("unsupported community rehearsal host action");
 }
-var databaseUnit = (node) => {
-  const join2 = node.name === "dev-fz-n1" ? "" : " --starter.join=10.42.0.21";
+var databaseUnit = (node, topology) => {
+  const starter = topology.find((entry) => entry.starter);
+  const join2 = node.starter ? "" : ` --starter.join=${starter.address}`;
   const role = node.agency ? "" : " --cluster.start-agent=false --cluster.start-coordinator=true --cluster.start-dbserver=true";
   return `[Unit]
 Description=ForgeZero isolated Community ${COMMUNITY_REHEARSAL_VERSION} rehearsal cluster
@@ -388,7 +441,10 @@ LockPersonality=true
 WantedBy=multi-user.target
 `;
 };
-var apiUnit = (node) => `[Unit]
+var apiUnit = (node, topology) => {
+  const urls = topology.map(({ address }) => `http://${address}:8529`).join(",");
+  const readPreferred = topology.filter(({ readPreferred: readPreferred2 }) => readPreferred2).map(({ address }) => `http://${address}:8529`).join(",");
+  return `[Unit]
 Description=ForgeZero typed Community cluster rehearsal API
 After=forgezero-rehearsal-db.service network-online.target
 Requires=forgezero-rehearsal-db.service
@@ -403,8 +459,8 @@ Environment=HOST=127.0.0.1
 Environment=PORT=8787
 Environment=NODE_NAME=${node.name}
 Environment=ARANGO_URL=http://127.0.0.1:8529
-Environment=ARANGO_URLS=http://10.42.0.21:8529,http://10.42.0.22:8529,http://10.42.0.23:8529,http://10.42.0.24:8529
-Environment=ARANGO_READ_PREFERRED_URLS=http://10.42.0.24:8529
+Environment=ARANGO_URLS=${urls}
+Environment=ARANGO_READ_PREFERRED_URLS=${readPreferred}
 Environment=ARANGO_READ_PREFERRED_FALLBACK=error
 ExecStart=/usr/local/bin/bun src/index.ts
 Restart=always
@@ -424,8 +480,10 @@ LockPersonality=true
 [Install]
 WantedBy=multi-user.target
 `;
+};
 function planCommunityRehearsalPrepare(request) {
-  const node = exactNode(request.node);
+  const topology = validateCommunityRehearsalTopology(request.topology);
+  const node = topology.find(({ name }) => name === request.node);
   const releaseRoot = `${COMMUNITY_REHEARSAL_ROOT}/releases/${request.release}`;
   return [
     { kind: "exec", argv: ["/usr/sbin/arangod", "--version"] },
@@ -440,13 +498,13 @@ function planCommunityRehearsalPrepare(request) {
 ` },
     { kind: "exec", argv: ["/usr/bin/chmod", "0400", `${COMMUNITY_CREDENTIAL_ROOT}/arangodb-jwt.cred.next`] },
     { kind: "exec", argv: ["/usr/bin/mv", "-f", `${COMMUNITY_CREDENTIAL_ROOT}/arangodb-jwt.cred.next`, `${COMMUNITY_CREDENTIAL_ROOT}/arangodb-jwt.cred`] },
-    { kind: "write", path: "/etc/systemd/system/forgezero-rehearsal-db.service", content: databaseUnit(node), mode: 420 },
+    { kind: "write", path: "/etc/systemd/system/forgezero-rehearsal-db.service", content: databaseUnit(node, topology), mode: 420 },
     { kind: "exec", argv: ["/usr/bin/tar", "-xzf", request.archivePath, "-C", releaseRoot] },
     { kind: "exec", argv: ["/usr/bin/chown", "-R", "forgezero:forgezero", releaseRoot] },
     { kind: "exec", argv: ["/usr/sbin/runuser", "-u", "forgezero", "--", "/usr/local/bin/bun", "install", "--cwd", releaseRoot, "--frozen-lockfile", "--production"] },
     { kind: "unlink", path: `${COMMUNITY_REHEARSAL_ROOT}/current` },
     { kind: "symlink", target: releaseRoot, path: `${COMMUNITY_REHEARSAL_ROOT}/current` },
-    { kind: "write", path: "/etc/systemd/system/forgezero-community-api.service", content: apiUnit(node), mode: 420 },
+    { kind: "write", path: "/etc/systemd/system/forgezero-community-api.service", content: apiUnit(node, topology), mode: 420 },
     { kind: "unlink", path: request.archivePath }
   ];
 }
@@ -524,7 +582,10 @@ var responseFor = async (request) => {
 async function runCommunityRehearsalHost(request) {
   if ((process.getuid?.() ?? -1) !== 0)
     throw new Error("community-rehearsal must run as root");
-  const node = exactNode(request.node);
+  const topology = validateCommunityRehearsalTopology(request.topology);
+  const node = topology.find((entry) => entry.name === request.node);
+  if (!node)
+    throw new Error("community rehearsal node is not present in the reviewed topology");
   if (request.action === "cleanup") {
     await applyOperations(planCommunityRehearsalCleanup());
     return { ok: true, action: request.action, node: node.name };
@@ -561,7 +622,8 @@ async function runCommunityRehearsalHost(request) {
     return { ok: true, action: request.action, node: node.name };
   }
   if (request.action === "database-ready" || request.action === "starter-ready" || request.action === "api-ready") {
-    const url = request.action === "database-ready" ? "http://127.0.0.1:8529/_api/version" : request.action === "starter-ready" ? "http://10.42.0.21:8528/version" : "http://127.0.0.1:8787/health";
+    const starter = topology.find((entry) => entry.starter);
+    const url = request.action === "database-ready" ? "http://127.0.0.1:8529/_api/version" : request.action === "starter-ready" ? `http://${starter.address}:8528/version` : "http://127.0.0.1:8787/health";
     const response2 = await fetch(url, { signal: AbortSignal.timeout(2000) }).catch(() => {
       return;
     });
@@ -578,6 +640,7 @@ async function runCommunityRehearsalHost(request) {
   return { ok: true, action: request.action, node: node.name, operation: request.operation, status: response.status, body };
 }
 export {
+  validateCommunityRehearsalTopology,
   runCommunityRehearsalHost,
   planCommunityRehearsalPrepare,
   planCommunityRehearsalCleanup,

package/dist/definition.js

@@ -21,7 +21,30 @@ var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cb
 var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
 var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
 var OS_CATALOG = [
-  { id: "ubuntu", version: "26.04", architecture: "x64", status: "active" }
+  {
+    id: "ubuntu",
+    version: "26.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-resolute-20260731",
+    imageLabel: "Ubuntu 26.04 LTS Resolute",
+    imageVersion: "2026-07-31",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
+    imageSha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05",
+    confidentialModes: ["sev-snp"]
+  },
+  {
+    id: "ubuntu",
+    version: "24.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-noble-20260705",
+    imageLabel: "Ubuntu 24.04 LTS Noble",
+    imageVersion: "2026-07-05",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/noble/release-20260705/ubuntu-24.04-server-cloudimg-amd64.img",
+    imageSha256: "ffe6203da54deeb6db5d2a98a83f9ec8e55f149d3f7ba622e1abe5fa966ee3d6",
+    confidentialModes: []
+  }
 ];
 var SOFTWARE_CATALOG = [
   { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -32,7 +55,12 @@ var SOFTWARE_CATALOG = [
   { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
@@ -45,6 +73,15 @@ var UBUNTU_2604_X64 = [
   { requirement: { id: "openssh-client", version: "ubuntu-26.04" } },
   { requirement: { id: "git", version: "ubuntu-26.04" } }
 ];
+var UBUNTU_2404_X64 = [
+  { requirement: { id: "bun", version: "1.3.14" } },
+  { requirement: { id: "docker", version: "ubuntu-24.04" } },
+  { requirement: { id: "nginx", version: "ubuntu-24.04" } },
+  { requirement: { id: "ufw", version: "ubuntu-24.04" } },
+  { requirement: { id: "openssh-client", version: "ubuntu-24.04" } },
+  { requirement: { id: "git", version: "ubuntu-24.04" } }
+];
+var strategiesFor = (observation) => observation.os.id === "ubuntu" && observation.architecture === "x64" ? observation.os.versionId === "26.04" ? UBUNTU_2604_X64 : observation.os.versionId === "24.04" ? UBUNTU_2404_X64 : undefined : undefined;
 var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var DOCKER_DAEMON_PATH = "/etc/docker/daemon.json";
 var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
@@ -91,7 +128,7 @@ var aptInstall = async (name) => {
 };
 async function executeSoftwareOperation(operation) {
   const { software, version } = operation;
-  if (!UBUNTU_2604_X64.some(({ requirement }) => requirement.id === software && requirement.version === version)) {
+  if (![...UBUNTU_2604_X64, ...UBUNTU_2404_X64].some(({ requirement }) => requirement.id === software && requirement.version === version)) {
     return { exitCode: 2, output: "unsupported software operation" };
   }
   if (operation.kind === "check") {
@@ -261,7 +298,7 @@ async function ensureSoftwareRequirements(requirementsInput, options) {
   }
   const results = [];
   for (const requirement of requirements) {
-    const strategy = UBUNTU_2604_X64.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
+    const strategy = strategiesFor(observation)?.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
     if (!strategy)
       throw new Error(`unsupported software requirement: ${requirement.id}@${requirement.version}`);
     const before = await options.exec({ kind: "check", software: requirement.id, version: requirement.version });

package/dist/deploy-compiler.js

@@ -92,13 +92,13 @@ function validateBuiltInProvider(requirement2, where) {
     return;
   const expected = {
     "forgezero.bun": { capability: "runtime.javascript", versions: ["1.3.14"], keys: ["installScope"] },
-    "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
-    "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
+    "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
+    "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
     "forgezero.arangodb": { capability: "database.arangodb", versions: ["3.11.14"], keys: ["installScope", "runtime", "dataPath", "bind"] },
     "forgezero.cloudflared": { capability: "network.public-tunnel", versions: ["2026.7.3"], keys: ["installScope", "mode"] },
     "forgezero.warp": { capability: "network.private", versions: ["2026.6.822.0-min"], keys: ["installScope", "mode"] },
-    "forgezero.ufw": { capability: "security.firewall", versions: ["ubuntu-26.04"], keys: ["installScope", "defaultIncoming", "defaultOutgoing"] },
-    "forgezero.openssh": { capability: "transport.ssh", versions: ["ubuntu-26.04"], keys: ["installScope", "mode"] },
+    "forgezero.ufw": { capability: "security.firewall", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "defaultIncoming", "defaultOutgoing"] },
+    "forgezero.openssh": { capability: "transport.ssh", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "mode"] },
     "forgezero.systemd": { capability: "service.manager", versions: ["ubuntu-26.04"], keys: ["installScope", "credentials", "serviceSandbox"] }
   };
   const contract = expected[requirement2.provider];

package/dist/deploy-file.js

@@ -21,7 +21,30 @@ var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cb
 var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
 var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
 var OS_CATALOG = [
-  { id: "ubuntu", version: "26.04", architecture: "x64", status: "active" }
+  {
+    id: "ubuntu",
+    version: "26.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-resolute-20260731",
+    imageLabel: "Ubuntu 26.04 LTS Resolute",
+    imageVersion: "2026-07-31",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
+    imageSha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05",
+    confidentialModes: ["sev-snp"]
+  },
+  {
+    id: "ubuntu",
+    version: "24.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-noble-20260705",
+    imageLabel: "Ubuntu 24.04 LTS Noble",
+    imageVersion: "2026-07-05",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/noble/release-20260705/ubuntu-24.04-server-cloudimg-amd64.img",
+    imageSha256: "ffe6203da54deeb6db5d2a98a83f9ec8e55f149d3f7ba622e1abe5fa966ee3d6",
+    confidentialModes: []
+  }
 ];
 var SOFTWARE_CATALOG = [
   { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -32,7 +55,12 @@ var SOFTWARE_CATALOG = [
   { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
@@ -45,6 +73,15 @@ var UBUNTU_2604_X64 = [
   { requirement: { id: "openssh-client", version: "ubuntu-26.04" } },
   { requirement: { id: "git", version: "ubuntu-26.04" } }
 ];
+var UBUNTU_2404_X64 = [
+  { requirement: { id: "bun", version: "1.3.14" } },
+  { requirement: { id: "docker", version: "ubuntu-24.04" } },
+  { requirement: { id: "nginx", version: "ubuntu-24.04" } },
+  { requirement: { id: "ufw", version: "ubuntu-24.04" } },
+  { requirement: { id: "openssh-client", version: "ubuntu-24.04" } },
+  { requirement: { id: "git", version: "ubuntu-24.04" } }
+];
+var strategiesFor = (observation) => observation.os.id === "ubuntu" && observation.architecture === "x64" ? observation.os.versionId === "26.04" ? UBUNTU_2604_X64 : observation.os.versionId === "24.04" ? UBUNTU_2404_X64 : undefined : undefined;
 var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var DOCKER_DAEMON_PATH = "/etc/docker/daemon.json";
 var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
@@ -91,7 +128,7 @@ var aptInstall = async (name) => {
 };
 async function executeSoftwareOperation(operation) {
   const { software, version } = operation;
-  if (!UBUNTU_2604_X64.some(({ requirement }) => requirement.id === software && requirement.version === version)) {
+  if (![...UBUNTU_2604_X64, ...UBUNTU_2404_X64].some(({ requirement }) => requirement.id === software && requirement.version === version)) {
     return { exitCode: 2, output: "unsupported software operation" };
   }
   if (operation.kind === "check") {
@@ -261,7 +298,7 @@ async function ensureSoftwareRequirements(requirementsInput, options) {
   }
   const results = [];
   for (const requirement of requirements) {
-    const strategy = UBUNTU_2604_X64.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
+    const strategy = strategiesFor(observation)?.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
     if (!strategy)
       throw new Error(`unsupported software requirement: ${requirement.id}@${requirement.version}`);
     const before = await options.exec({ kind: "check", software: requirement.id, version: requirement.version });

package/dist/deploy-plan-runner.js

@@ -92,13 +92,13 @@ function validateBuiltInProvider(requirement2, where) {
     return;
   const expected = {
     "forgezero.bun": { capability: "runtime.javascript", versions: ["1.3.14"], keys: ["installScope"] },
-    "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
-    "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
+    "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
+    "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
     "forgezero.arangodb": { capability: "database.arangodb", versions: ["3.11.14"], keys: ["installScope", "runtime", "dataPath", "bind"] },
     "forgezero.cloudflared": { capability: "network.public-tunnel", versions: ["2026.7.3"], keys: ["installScope", "mode"] },
     "forgezero.warp": { capability: "network.private", versions: ["2026.6.822.0-min"], keys: ["installScope", "mode"] },
-    "forgezero.ufw": { capability: "security.firewall", versions: ["ubuntu-26.04"], keys: ["installScope", "defaultIncoming", "defaultOutgoing"] },
-    "forgezero.openssh": { capability: "transport.ssh", versions: ["ubuntu-26.04"], keys: ["installScope", "mode"] },
+    "forgezero.ufw": { capability: "security.firewall", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "defaultIncoming", "defaultOutgoing"] },
+    "forgezero.openssh": { capability: "transport.ssh", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "mode"] },
     "forgezero.systemd": { capability: "service.manager", versions: ["ubuntu-26.04"], keys: ["installScope", "credentials", "serviceSandbox"] }
   };
   const contract = expected[requirement2.provider];

package/dist/deploy-plan.js

@@ -92,13 +92,13 @@ function validateBuiltInProvider(requirement2, where) {
     return;
   const expected = {
     "forgezero.bun": { capability: "runtime.javascript", versions: ["1.3.14"], keys: ["installScope"] },
-    "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
-    "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
+    "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
+    "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
     "forgezero.arangodb": { capability: "database.arangodb", versions: ["3.11.14"], keys: ["installScope", "runtime", "dataPath", "bind"] },
     "forgezero.cloudflared": { capability: "network.public-tunnel", versions: ["2026.7.3"], keys: ["installScope", "mode"] },
     "forgezero.warp": { capability: "network.private", versions: ["2026.6.822.0-min"], keys: ["installScope", "mode"] },
-    "forgezero.ufw": { capability: "security.firewall", versions: ["ubuntu-26.04"], keys: ["installScope", "defaultIncoming", "defaultOutgoing"] },
-    "forgezero.openssh": { capability: "transport.ssh", versions: ["ubuntu-26.04"], keys: ["installScope", "mode"] },
+    "forgezero.ufw": { capability: "security.firewall", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "defaultIncoming", "defaultOutgoing"] },
+    "forgezero.openssh": { capability: "transport.ssh", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "mode"] },
     "forgezero.systemd": { capability: "service.manager", versions: ["ubuntu-26.04"], keys: ["installScope", "credentials", "serviceSandbox"] }
   };
   const contract = expected[requirement2.provider];