@forgezero/agent 0.1.65 → 0.1.68

package/dist/fz.js

@@ -4634,7 +4634,7 @@ var VaultError, runtimeEnvironment = () => typeof process !== "undefined" && pro
   } catch {
     return;
   }
-}, VERSION = "0.1.12";
+}, VERSION = "0.1.13";
 var init_dist = __esm(() => {
   init_identity();
   VaultError = class VaultError extends Error {
@@ -4829,13 +4829,36 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.65";
+var VERSION2 = "0.1.68";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
 var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f";
 var OS_CATALOG = [
-  { id: "ubuntu", version: "26.04", architecture: "x64", status: "active" }
+  {
+    id: "ubuntu",
+    version: "26.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-resolute-20260731",
+    imageLabel: "Ubuntu 26.04 LTS Resolute",
+    imageVersion: "2026-07-31",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
+    imageSha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05",
+    confidentialModes: ["sev-snp"]
+  },
+  {
+    id: "ubuntu",
+    version: "24.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-noble-20260705",
+    imageLabel: "Ubuntu 24.04 LTS Noble",
+    imageVersion: "2026-07-05",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/noble/release-20260705/ubuntu-24.04-server-cloudimg-amd64.img",
+    imageSha256: "ffe6203da54deeb6db5d2a98a83f9ec8e55f149d3f7ba622e1abe5fa966ee3d6",
+    confidentialModes: []
+  }
 ];
 var SOFTWARE_CATALOG = [
   { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -4846,7 +4869,12 @@ var SOFTWARE_CATALOG = [
   { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
 var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
   "data-root": "/var/lib/docker",
@@ -10425,13 +10453,13 @@ function validateBuiltInProvider(requirement2, where) {
     return;
   const expected = {
     "forgezero.bun": { capability: "runtime.javascript", versions: ["1.3.14"], keys: ["installScope"] },
-    "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
-    "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
+    "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
+    "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
     "forgezero.arangodb": { capability: "database.arangodb", versions: ["3.11.14"], keys: ["installScope", "runtime", "dataPath", "bind"] },
     "forgezero.cloudflared": { capability: "network.public-tunnel", versions: ["2026.7.3"], keys: ["installScope", "mode"] },
     "forgezero.warp": { capability: "network.private", versions: ["2026.6.822.0-min"], keys: ["installScope", "mode"] },
-    "forgezero.ufw": { capability: "security.firewall", versions: ["ubuntu-26.04"], keys: ["installScope", "defaultIncoming", "defaultOutgoing"] },
-    "forgezero.openssh": { capability: "transport.ssh", versions: ["ubuntu-26.04"], keys: ["installScope", "mode"] },
+    "forgezero.ufw": { capability: "security.firewall", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "defaultIncoming", "defaultOutgoing"] },
+    "forgezero.openssh": { capability: "transport.ssh", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "mode"] },
     "forgezero.systemd": { capability: "service.manager", versions: ["ubuntu-26.04"], keys: ["installScope", "credentials", "serviceSandbox"] }
   };
   const contract = expected[requirement2.provider];
@@ -11587,6 +11615,143 @@ import {
 import { dirname as dirname9 } from "path";
 import { fileURLToPath } from "url";
 
+// src/ubuntu.ts
+var current = OS_CATALOG[0];
+var SUPPORTED_GUEST_IMAGE = Object.freeze({
+  key: current.imageKey,
+  family: `${current.id}-${current.version}`,
+  version: current.imageVersion,
+  label: current.imageLabel,
+  url: current.imageUrl,
+  sha256: current.imageSha256
+});
+var SUPPORTED_GUEST_IMAGES = Object.freeze(OS_CATALOG.filter(({ status }) => status === "active").map(({ id: id2, imageKey, imageLabel, imageVersion, version, confidentialModes }) => ({
+  key: imageKey,
+  label: imageLabel,
+  family: `${id2}-${version}`,
+  version: imageVersion,
+  confidential: confidentialModes.some((mode) => mode === "sev-snp")
+})));
+function assertSupportedGuestImage(imageKey, confidential = false) {
+  const selected = OS_CATALOG.find((entry) => entry.status === "active" && entry.imageKey === imageKey);
+  if (!selected) {
+    throw new Error(`unsupported guest image ${imageKey}; supported images: ${SUPPORTED_GUEST_IMAGES.map(({ key }) => key).join(", ")}`);
+  }
+  if (confidential && !selected.confidentialModes.some((mode) => mode === "sev-snp")) {
+    throw new Error(`guest image ${imageKey} is not approved for SEV-SNP`);
+  }
+}
+
+// src/platform-genesis.ts
+var SAFE_NAME = /^[a-z][a-z0-9-]{0,62}$/;
+var SAFE_POOL = /^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/;
+var PRIVATE_V4 = /^(?:10\.(?:\d{1,3}\.){2}\d{1,3}|192\.168\.(?:\d{1,3})\.(?:\d{1,3})|172\.(?:1[6-9]|2\d|3[01])\.(?:\d{1,3})\.(?:\d{1,3}))$/;
+var integer2 = (value, minimum, maximum, label) => {
+  if (!Number.isInteger(value) || value < minimum || value > maximum) {
+    throw new Error(`platform genesis ${label} is outside the supported range`);
+  }
+  return value;
+};
+function validatePlatformGenesisGuests(guests, expectedCount = 3) {
+  if (!Array.isArray(guests) || guests.length !== expectedCount) {
+    throw new Error(`platform genesis requires exactly ${expectedCount} reviewed guest requests`);
+  }
+  const names = new Set;
+  const addresses = new Set;
+  const pools = new Set;
+  return guests.map((input) => {
+    if (!input || typeof input !== "object" || !SAFE_NAME.test(input.name)) {
+      throw new Error("platform genesis guest name is malformed");
+    }
+    if (!PRIVATE_V4.test(input.address))
+      throw new Error("platform genesis guest address must be private IPv4");
+    if (typeof input.confidential !== "boolean")
+      throw new Error("platform genesis confidential requirement is missing");
+    assertSupportedGuestImage(input.imageKey, input.confidential);
+    if (input.cpuPoolKey !== undefined && !SAFE_POOL.test(input.cpuPoolKey)) {
+      throw new Error("platform genesis CPU pool key is malformed");
+    }
+    if (names.has(input.name) || addresses.has(input.address) || input.cpuPoolKey !== undefined && pools.has(input.cpuPoolKey)) {
+      throw new Error("platform genesis guest names, addresses and explicit CPU pools must be unique");
+    }
+    names.add(input.name);
+    addresses.add(input.address);
+    if (input.cpuPoolKey !== undefined)
+      pools.add(input.cpuPoolKey);
+    const physicalCores = integer2(input.physicalCores, 1, 256, "physical core count");
+    const vcpu = integer2(input.vcpu, 1, 512, "vCPU count");
+    if (vcpu < physicalCores)
+      throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
+    const memoryGib = integer2(input.memoryGib, 1, 8192, "memory");
+    const diskGib = integer2(input.diskGib, 8, 65536, "disk");
+    const egressGuaranteedMbps = integer2(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
+    const egressBurstMbps = integer2(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
+    return {
+      name: input.name,
+      address: input.address,
+      imageKey: input.imageKey,
+      ...input.cpuPoolKey ? { cpuPoolKey: input.cpuPoolKey } : {},
+      physicalCores,
+      vcpu,
+      memoryGib,
+      diskGib,
+      egressGuaranteedMbps,
+      egressBurstMbps,
+      confidential: input.confidential
+    };
+  });
+}
+var publicKey = (value) => {
+  const normalized = value.trim();
+  if (!/^ssh-(?:ed25519|rsa) [A-Za-z0-9+/]+={0,3}(?: [^\r\n]+)?$/.test(normalized)) {
+    throw new Error("platform genesis SSH public key is malformed");
+  }
+  return normalized;
+};
+var claimFor = (guest, keys, action) => {
+  const common = {
+    computeKey: `platform:${guest.name}`,
+    claimToken: "offline-platform-genesis",
+    claimExpiresAtTs: Number.MAX_SAFE_INTEGER,
+    attempt: 1,
+    bootstrap: { kind: "platform-genesis" },
+    spec: {
+      reference: `platform:${guest.name}`,
+      imageKey: guest.imageKey,
+      guestName: guest.name,
+      guestAddress: guest.address,
+      ...guest.cpuPoolKey ? { cpuPoolKey: guest.cpuPoolKey } : {},
+      physicalCores: guest.physicalCores,
+      vcpu: guest.vcpu,
+      memoryGib: guest.memoryGib,
+      diskGib: guest.diskGib,
+      egressGuaranteedMbps: guest.egressGuaranteedMbps,
+      egressBurstMbps: guest.egressBurstMbps,
+      confidential: guest.confidential
+    }
+  };
+  if (action === "delete")
+    return { ...common, action: "delete" };
+  return { ...common, action: "create", access: { sshUser: "forgezero", sshPublicKeys: [...keys] } };
+};
+function platformGenesisClaims(guests, sshPublicKeys) {
+  const reviewed = validatePlatformGenesisGuests(guests);
+  const keys = [...new Set(sshPublicKeys.map(publicKey))];
+  if (keys.length === 0)
+    throw new Error("platform genesis requires at least one operator SSH public key");
+  return reviewed.map((guest) => claimFor(guest, keys, "create"));
+}
+function platformCommunityRehearsalClaims(seedGuests, rehearsalGuest, sshPublicKeys) {
+  const reviewed = validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4);
+  const keys = [...new Set(sshPublicKeys.map(publicKey))];
+  if (keys.length === 0)
+    throw new Error("platform genesis requires at least one operator SSH public key");
+  return reviewed.map((guest) => claimFor(guest, keys, "create"));
+}
+function platformCommunityRehearsalDeletionClaims(seedGuests, rehearsalGuest) {
+  return validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4).map((guest) => claimFor(guest, [], "delete"));
+}
+
 // src/platform-bootstrap-runtime.ts
 var safeAtom = (name, value) => {
   if (!value || /[\0\r\n]/.test(value))
@@ -11618,6 +11783,50 @@ var httpsOrigin = (name, raw) => {
   }
   return value.origin;
 };
+function validatePlatformInitialInventory(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+    throw new Error("initial platform inventory coordinates are invalid");
+  }
+  safeAtom("initialInventory.region.label", value.region.label);
+  if (value.region.city !== undefined)
+    safeAtom("initialInventory.region.city", value.region.city);
+  const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
+    if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
+      "name",
+      "address",
+      "imageKey",
+      "cpuPoolKey",
+      "physicalCores",
+      "vcpu",
+      "memoryGib",
+      "diskGib",
+      "egressGuaranteedMbps",
+      "egressBurstMbps",
+      "confidential",
+      "databaseRole",
+      "databaseAgency"
+    ].includes(key)))
+      throw new Error("initial platform compute contains unknown fields");
+    return compute;
+  }));
+  for (let index = 0;index < computes.length; index += 1) {
+    const declared = value.computes[index];
+    const expectedRole = index === 0 ? "master" : "joiner";
+    if (declared.databaseRole !== expectedRole || declared.databaseAgency !== "member" || declared.confidential !== true) {
+      throw new Error("initial platform inventory requires one master, two joiners, three Agency members and confidential compute");
+    }
+  }
+  return {
+    metalHostname: value.metalHostname,
+    region: { ...value.region },
+    computes: value.computes.map((compute, index) => ({
+      ...computes[index],
+      databaseRole: compute.databaseRole,
+      databaseAgency: compute.databaseAgency,
+      confidential: true
+    }))
+  };
+}
 var systemdValue = (name, raw) => {
   if (/[\0\r\n]/.test(raw))
     throw new Error(`${name} must be single-line.`);
@@ -11703,12 +11912,14 @@ function validatePlatformSharedEnvironment(input) {
       throw new Error("realtime.producer is invalid.");
     }
   }
+  const initialInventory = input.initialInventory ? validatePlatformInitialInventory(input.initialInventory) : undefined;
   return {
     ...input,
     databaseCoordinators: coordinators,
     appOrigin: httpsOrigin("appOrigin", input.appOrigin),
     apiOrigin: httpsOrigin("apiOrigin", input.apiOrigin),
-    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint)
+    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint),
+    ...initialInventory ? { initialInventory } : {}
   };
 }
 function renderPlatformSharedEnvironment(input) {
@@ -11771,7 +11982,8 @@ function renderPlatformSharedEnvironment(input) {
     FZ_CF_TUNNEL_SERVICE: value.cloudflare?.tunnelService ?? "",
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
-    FZ_REALTIME_PRODUCER: value.realtime?.producer ?? ""
+    FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
+    FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
 ` + Object.entries(entries).map(([key, entry]) => `${key}=${systemdValue(key, entry)}`).join(`
@@ -12063,12 +12275,12 @@ async function ensureCloudflarePrivateRoute(config, fetcher = fetch) {
   }
   const path = `/accounts/${config.accountId}/teamnet/routes`;
   const routes = await cf(config, path, {}, fetcher);
-  const current = routes.find((route2) => !route2.deleted_at && route2.network === config.network && (route2.virtual_network_id ?? "") === (config.virtualNetworkId ?? ""));
-  if (current) {
-    if (current.tunnel_id !== config.tunnelId) {
+  const current2 = routes.find((route2) => !route2.deleted_at && route2.network === config.network && (route2.virtual_network_id ?? "") === (config.virtualNetworkId ?? ""));
+  if (current2) {
+    if (current2.tunnel_id !== config.tunnelId) {
       throw new Error(`private route ${config.network} already belongs to another Tunnel`);
     }
-    return { route: current, created: false };
+    return { route: current2, created: false };
   }
   const route = await cf(config, path, {
     method: "POST",
@@ -12117,7 +12329,7 @@ async function ensureCloudflareWarpNetworkIncludes(config, fetcher = fetch) {
 async function configureCloudflareEdge(config, fetcher = fetch) {
   const tunnelPath = `/accounts/${config.accountId}/cfd_tunnel/${config.tunnelId}/configurations`;
   const dnsPath = `/zones/${config.zoneId}/dns_records`;
-  const [current, records] = await Promise.all([
+  const [current2, records] = await Promise.all([
     cf(config, tunnelPath, {}, fetcher),
     cf(config, `${dnsPath}?name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher)
   ]);
@@ -12128,7 +12340,7 @@ async function configureCloudflareEdge(config, fetcher = fetch) {
   if (existingRecord && (existingRecord.type !== "CNAME" || existingRecord.name && existingRecord.name.toLowerCase() !== config.hostname.toLowerCase())) {
     throw new Error(`Cloudflare DNS hostname ${config.hostname} is already owned by an incompatible ${existingRecord.type ?? "unknown"} record`);
   }
-  const existing = current.config?.ingress ?? [];
+  const existing = current2.config?.ingress ?? [];
   const catchAll = existing.filter((rule) => !("hostname" in rule));
   const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
   const desiredIngress = [
@@ -13215,7 +13427,7 @@ async function sha256File(path) {
   });
   return hash.digest("hex");
 }
-var branchName = (value) => {
+var bootstrapBundleBranch = (value) => {
   if (typeof value !== "string" || !/^[A-Za-z0-9](?:[A-Za-z0-9._/-]{0,126}[A-Za-z0-9])?$/.test(value) || value.includes("..") || value.includes("//") || value.startsWith("-")) {
     throw new Error("bootstrap bundle branch is malformed");
   }
@@ -13232,7 +13444,7 @@ function parseBootstrapBundleManifest(value) {
   if (source.format !== BOOTSTRAP_BUNDLE_FORMAT || source.kind !== BOOTSTRAP_BUNDLE_KIND) {
     throw new Error("bootstrap bundle manifest format is unsupported");
   }
-  branchName(source.branch);
+  bootstrapBundleBranch(source.branch);
   if (typeof source.revision !== "string" || !/^[a-f0-9]{40}$/.test(source.revision)) {
     throw new Error("bootstrap bundle revision must be an exact lowercase Git commit");
   }
@@ -13277,7 +13489,7 @@ async function buildBootstrapBundle(input, exec = run) {
   const repositoryRoot = resolve6(input.repositoryRoot);
   const outputPath = resolve6(input.outputPath);
   const manifestPath = `${outputPath}.json`;
-  const branch = branchName(input.branch);
+  const branch = bootstrapBundleBranch(input.branch);
   if (!isAbsolute2(input.outputPath) || outputPath !== input.outputPath) {
     throw new Error("bootstrap bundle output must be a canonical absolute path");
   }
@@ -13502,6 +13714,12 @@ function validateBootstrapConfig(value) {
     throw new Error("Cloudflare Mesh/WARP requires a node-specific Cloudflare handoff");
   }
   if (value.kind === "enrolled-compute") {
+    const os = OS_CATALOG.find((entry) => entry.status === "active" && entry.id === value.operatingSystem?.id && entry.version === value.operatingSystem?.version && entry.architecture === value.operatingSystem?.architecture);
+    if (!os)
+      throw new Error("enrolled compute operating system is not in the active typed OS catalog");
+    if (value.operatingSystem.version === "24.04" && (value.installCloudflared || value.installWarp)) {
+      throw new Error("Cloudflare Tunnel and WARP require the reviewed Ubuntu 26.04 strategy");
+    }
     if (value.gitDeployKey !== undefined && typeof value.gitDeployKey !== "boolean") {
       throw new Error("gitDeployKey must be boolean");
     }
@@ -13533,6 +13751,7 @@ function validateBootstrapConfig(value) {
   if (!value.bootstrapBundle || ![value.bootstrapBundle.bundleFile, value.bootstrapBundle.manifestFile].every((path) => typeof path === "string" && path.startsWith("/") && !/[\r\n\0:]/.test(path))) {
     throw new Error("platform bootstrap requires absolute bundle and manifest paths");
   }
+  bootstrapBundleBranch(value.bootstrapBundle.branch);
   let api;
   try {
     api = new URL(value.apiUrl);
@@ -13587,9 +13806,19 @@ function validateBootstrapConfig(value) {
 }
 function planBootstrap(input, initialized = false) {
   const config = validateBootstrapConfig(structuredClone(input));
+  const enrolledOsVersion = config.kind === "enrolled-compute" ? `ubuntu-${config.operatingSystem.version}` : undefined;
+  const enrolledSoftware = config.kind === "enrolled-compute" ? [...config.software ?? []] : [];
+  if (config.kind === "enrolled-compute") {
+    if (!enrolledSoftware.some(({ id: id2 }) => id2 === "bun"))
+      enrolledSoftware.push({ id: "bun", version: "1.3.14" });
+    if (!enrolledSoftware.some(({ id: id2 }) => id2 === "git"))
+      enrolledSoftware.push({ id: "git", version: enrolledOsVersion });
+    if (!enrolledSoftware.some(({ id: id2 }) => id2 === "ufw"))
+      enrolledSoftware.push({ id: "ufw", version: enrolledOsVersion });
+  }
   const software = config.kind === "enrolled-compute" ? [
-    ...config.software ?? [],
-    ...config.bootstrapRunner && !config.software?.some(({ id: id2 }) => id2 === "openssh-client") ? [{ id: "openssh-client", version: "ubuntu-26.04" }] : [],
+    ...enrolledSoftware,
+    ...config.bootstrapRunner && !enrolledSoftware.some(({ id: id2 }) => id2 === "openssh-client") ? [{ id: "openssh-client", version: enrolledOsVersion }] : [],
     ...config.installCloudflared ? [{ id: "cloudflared", version: "2026.7.3" }] : [],
     ...config.installWarp ? [{ id: "cloudflare-warp", version: "2026.6.822.0-min" }] : []
   ] : [
@@ -13824,9 +14053,8 @@ async function verifyBootstrapBundleOnHost(host, config, verifyGit = false) {
     throw new Error("bootstrap bundle manifest is not valid JSON");
   }
   const manifest = parseBootstrapBundleManifest(parsed);
-  const expectedBranch = config.environment === "production" ? "main" : "dev";
-  if (manifest.branch !== expectedBranch || bundleMetadata && bundleMetadata.size !== manifest.bytes) {
-    throw new Error("bootstrap bundle manifest disagrees with the selected platform environment");
+  if (manifest.branch !== config.bootstrapBundle.branch || bundleMetadata && bundleMetadata.size !== manifest.bytes) {
+    throw new Error("bootstrap bundle manifest disagrees with the reviewed bootstrap bundle coordinates");
   }
   const digest = (await checked3(host, ["/usr/bin/sha256sum", config.bootstrapBundle.bundleFile], "bootstrap bundle digest")).trim().split(/\s+/)[0];
   if (digest !== manifest.sha256)
@@ -13840,6 +14068,7 @@ function bootstrapIdentity(config) {
   if (config.kind === "enrolled-compute")
     return {
       kind: config.kind,
+      operatingSystem: config.operatingSystem,
       apiUrl: config.apiUrl,
       realm: config.realm,
       nodeHostname: config.nodeHostname,
@@ -14453,7 +14682,7 @@ function strictBootstrapDocument(value) {
     "bootstrapRunner"
   ], "bootstrap config");
   if (root.kind === "platform") {
-    exactKeys2(root.bootstrapBundle, ["bundleFile", "manifestFile"], "bootstrap bundle config");
+    exactKeys2(root.bootstrapBundle, ["bundleFile", "manifestFile", "branch"], "bootstrap bundle config");
     exactKeys2(root.firewall, ["enabled", "sshPort", "privateCidrs"], "firewall config");
     if (root.cloudflareHandoff !== undefined)
       exactKeys2(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
@@ -14500,9 +14729,32 @@ function strictBootstrapDocument(value) {
       "otlpTraceSampleRatio",
       "backup",
       "cloudflare",
-      "realtime"
+      "realtime",
+      "initialInventory"
     ], "runtime environment");
     const environment = runtime.environment;
+    if (environment.initialInventory !== undefined) {
+      const inventory = exactKeys2(environment.initialInventory, ["metalHostname", "region", "computes"], "initial inventory");
+      exactKeys2(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
+      if (!Array.isArray(inventory.computes))
+        throw new Error("initial inventory computes must be an array");
+      for (const compute of inventory.computes)
+        exactKeys2(compute, [
+          "name",
+          "address",
+          "imageKey",
+          "cpuPoolKey",
+          "physicalCores",
+          "vcpu",
+          "memoryGib",
+          "diskGib",
+          "egressGuaranteedMbps",
+          "egressBurstMbps",
+          "confidential",
+          "databaseRole",
+          "databaseAgency"
+        ], "initial inventory compute");
+    }
     if (environment.email !== undefined) {
       const email = exactKeys2(environment.email, ["provider", "host", "port", "user", "from", "eu"], "email config");
       if (email.provider === "smtp")
@@ -14519,6 +14771,7 @@ function strictBootstrapDocument(value) {
     if (environment.realtime !== undefined)
       exactKeys2(environment.realtime, ["workerScriptName", "endpoint", "producer"], "realtime runtime config");
   } else if (root.kind === "enrolled-compute") {
+    exactKeys2(root.operatingSystem, ["id", "version", "architecture"], "enrolled compute operating system");
     if (root.cloudflareHandoff !== undefined)
       exactKeys2(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
     if (root.bootstrapRunner !== undefined)
@@ -14850,19 +15103,7 @@ import { join as join8 } from "path";
 // src/metal-provision.ts
 import { dirname as dirname11, isAbsolute as isAbsolute3, join as join7 } from "path";
 import { isIP as isIP4 } from "net";
-
-// src/ubuntu.ts
-var SUPPORTED_GUEST_IMAGE = Object.freeze({
-  key: "ubuntu-resolute-20260731",
-  family: "ubuntu-26.04",
-  version: "2026-07-31",
-  label: "Ubuntu 26.04 LTS Resolute",
-  url: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
-  sha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05"
-});
-
-// src/metal-provision.ts
-var SAFE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/;
+var SAFE_NAME2 = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/;
 var DEVICE = /^[a-zA-Z][a-zA-Z0-9_.-]{0,14}$/;
 var IPV4_PREFIX = /^(?:25[0-5]|2[0-4]\d|1?\d?\d)\.(?:25[0-5]|2[0-4]\d|1?\d?\d)\.(?:25[0-5]|2[0-4]\d|1?\d?\d)$/;
 var LINUX_LIST = /^\d+(?:-\d+)?(?:,\d+(?:-\d+)?)*$/;
@@ -14888,7 +15129,7 @@ function membersOfLinuxList(value, label) {
   return members;
 }
 function validateMetalProfile(profile) {
-  if (!SAFE_NAME.test(profile.volumeGroup))
+  if (!SAFE_NAME2.test(profile.volumeGroup))
     throw new MetalProvisionError("invalid volume group");
   if (!DEVICE.test(profile.bridge))
     throw new MetalProvisionError("invalid bridge");
@@ -14910,9 +15151,16 @@ function validateMetalProfile(profile) {
   if (telemetryEndpoint.protocol !== "https:" || telemetryEndpoint.username || telemetryEndpoint.password || telemetryEndpoint.search || telemetryEndpoint.hash || isIP4(telemetryEndpoint.hostname) !== 0 || !telemetryEndpoint.hostname.includes(".") || telemetryEndpoint.hostname === "localhost" || telemetryEndpoint.hostname.endsWith(".local"))
     throw new MetalProvisionError("Agent telemetry endpoint must be a public HTTPS DNS coordinate without credentials, query or fragment");
   const imageKeys = Object.keys(profile.images);
-  if (imageKeys.length !== 1 || imageKeys[0] !== SUPPORTED_GUEST_IMAGE.key || profile.images[SUPPORTED_GUEST_IMAGE.key]?.sha256 !== SUPPORTED_GUEST_IMAGE.sha256) {
-    throw new MetalProvisionError(`metal profile must contain only the pinned ${SUPPORTED_GUEST_IMAGE.key} image contract`);
+  if (imageKeys.length === 0)
+    throw new MetalProvisionError("metal profile requires at least one pinned guest image");
+  for (const imageKey of imageKeys) {
+    const catalog = OS_CATALOG.find((entry) => entry.status === "active" && entry.imageKey === imageKey);
+    if (!catalog || profile.images[imageKey]?.sha256 !== catalog.imageSha256) {
+      throw new MetalProvisionError(`metal profile image ${imageKey} does not match the pinned OS catalog`);
+    }
   }
+  if (profile.confidential && !imageKeys.some((key) => OS_CATALOG.find((entry) => entry.imageKey === key)?.confidentialModes.some((mode) => mode === "sev-snp")))
+    throw new MetalProvisionError("confidential metal profile requires a pinned SEV-SNP guest image");
   if (!Array.isArray(profile.cpuPools) || profile.cpuPools.length === 0) {
     throw new MetalProvisionError("at least one exclusive CPU pool is required");
   }
@@ -14921,7 +15169,7 @@ function validateMetalProfile(profile) {
   const assignedMemory = new Set;
   let poolsWithMemory = 0;
   for (const pool of profile.cpuPools) {
-    if (!SAFE_NAME.test(pool.key) || keys.has(pool.key))
+    if (!SAFE_NAME2.test(pool.key) || keys.has(pool.key))
       throw new MetalProvisionError("invalid or duplicate CPU pool key");
     keys.add(pool.key);
     const cpus = membersOfLinuxList(pool.cpus, "CPU");
@@ -15163,10 +15411,9 @@ function validateMetalBootstrapConfig(config) {
   if (config.profile.stateDir !== "/etc/forgezero/metal-guests" || config.profile.seedDir !== "/var/lib/forgezero/seed" || config.profile.unitDir !== UNIT_DIRECTORY || config.profile.legacyStateDir !== undefined) {
     throw new MetalBootstrapError("metal bootstrap uses fixed state, seed, and systemd unit directories");
   }
-  const image = config.profile.images[Object.keys(config.profile.images)[0]];
-  if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve8(image.path) !== image.path || /[\0\r\n]/.test(image.path)) {
-    throw new MetalBootstrapError("the pinned guest image must use the fixed image directory");
-  }
+  for (const image of Object.values(config.profile.images))
+    if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve8(image.path) !== image.path || /[\0\r\n]/.test(image.path))
+      throw new MetalBootstrapError("every pinned guest image must use the fixed image directory");
   if (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunReleaseSha256 !== SUPPORTED_BUN_RELEASE_SHA256 || config.profile.agentVersion !== VERSION2) {
     throw new MetalBootstrapError("metal guest runtime must use the package-owned Bun and Agent release coordinates");
   }
@@ -15468,9 +15715,11 @@ var preflight = async (config, exec) => {
       throw new MetalBootstrapError("/dev/sev is required by the confidential profile");
     await runChecked(exec, ["/usr/bin/qemu-system-x86_64", "-object", "sev-snp-guest,help"]);
   }
-  const digest = (await runChecked(exec, ["/usr/bin/sha256sum", config.profile.images[Object.keys(config.profile.images)[0]].path])).stdout.split(/\s+/)[0];
-  if (digest !== config.profile.images[Object.keys(config.profile.images)[0]].sha256)
-    throw new MetalBootstrapError("pinned guest image digest mismatch");
+  for (const image of Object.values(config.profile.images)) {
+    const digest = (await runChecked(exec, ["/usr/bin/sha256sum", image.path])).stdout.split(/\s+/)[0];
+    if (digest !== image.sha256)
+      throw new MetalBootstrapError("pinned guest image digest mismatch");
+  }
 };
 var assertSupportedMetalHost = () => {
   if (process.platform !== "linux" || process.arch !== "x64") {
@@ -15482,34 +15731,38 @@ var assertSupportedMetalHost = () => {
   }
 };
 var ensurePinnedGuestImage = async (config, exec) => {
-  const image = config.profile.images[SUPPORTED_GUEST_IMAGE.key];
-  if (existsSync10(image.path))
-    return;
-  mkdirSync11(dirname12(image.path), { recursive: true, mode: 493 });
-  const temporary = `${image.path}.next-${process.pid}`;
-  try {
-    await runChecked(exec, [
-      "/usr/bin/curl",
-      "--fail",
-      "--location",
-      "--proto",
-      "=https",
-      "--tlsv1.2",
-      "--output",
-      temporary,
-      SUPPORTED_GUEST_IMAGE.url
-    ]);
-    const digest = (await runChecked(exec, ["/usr/bin/sha256sum", temporary])).stdout.split(/\s+/)[0];
-    if (digest !== image.sha256)
-      throw new MetalBootstrapError("downloaded guest image digest mismatch");
-    chmodSync5(temporary, 292);
-    chownSync(temporary, 0, 0);
-    renameSync9(temporary, image.path);
-  } catch (cause) {
+  for (const [imageKey, image] of Object.entries(config.profile.images)) {
+    if (existsSync10(image.path))
+      continue;
+    const catalog = OS_CATALOG.find((entry) => entry.status === "active" && entry.imageKey === imageKey);
+    if (!catalog)
+      throw new MetalBootstrapError(`guest image ${imageKey} is not active`);
+    mkdirSync11(dirname12(image.path), { recursive: true, mode: 493 });
+    const temporary = `${image.path}.next-${process.pid}`;
     try {
-      unlinkSync2(temporary);
-    } catch {}
-    throw cause;
+      await runChecked(exec, [
+        "/usr/bin/curl",
+        "--fail",
+        "--location",
+        "--proto",
+        "=https",
+        "--tlsv1.2",
+        "--output",
+        temporary,
+        catalog.imageUrl
+      ]);
+      const digest = (await runChecked(exec, ["/usr/bin/sha256sum", temporary])).stdout.split(/\s+/)[0];
+      if (digest !== image.sha256)
+        throw new MetalBootstrapError("downloaded guest image digest mismatch");
+      chmodSync5(temporary, 292);
+      chownSync(temporary, 0, 0);
+      renameSync9(temporary, image.path);
+    } catch (cause) {
+      try {
+        unlinkSync2(temporary);
+      } catch {}
+      throw cause;
+    }
   }
 };
 async function applyMetalBootstrap(config, options) {
@@ -15669,10 +15922,17 @@ async function metalBootstrapStatus(exec = defaultExec2) {
       ])).exitCode !== 0) {
         problems.push("local OTLP metrics receiver did not accept a proof request");
       }
-      const image = profile.images[Object.keys(profile.images)[0]];
-      if (existsSync10(image.path)) {
+      imageVerified = true;
+      for (const image of Object.values(profile.images)) {
+        if (!existsSync10(image.path)) {
+          imageVerified = false;
+          break;
+        }
         const digest = (await exec(["/usr/bin/sha256sum", image.path])).stdout.split(/\s+/)[0];
-        imageVerified = digest === image.sha256;
+        if (digest !== image.sha256) {
+          imageVerified = false;
+          break;
+        }
       }
       if (!imageVerified)
         problems.push("pinned guest image is absent or has the wrong digest");
@@ -15732,126 +15992,6 @@ import { isIP as isIP6 } from "net";
 import { tmpdir } from "os";
 import { basename as basename2, dirname as dirname13, isAbsolute as isAbsolute5, join as join10, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-
-// src/platform-genesis.ts
-var PLATFORM_GENESIS_ENVIRONMENTS = ["production", "development"];
-var productionShape = {
-  physicalCores: 8,
-  vcpu: 16,
-  memoryGib: 24,
-  diskGib: 200,
-  egressGuaranteedMbps: 1000,
-  egressBurstMbps: 2000
-};
-var developmentShape = {
-  physicalCores: 2,
-  vcpu: 4,
-  memoryGib: 8,
-  diskGib: 64,
-  egressGuaranteedMbps: 100,
-  egressBurstMbps: 250
-};
-var PLATFORM_GENESIS_FLEETS = {
-  production: [1, 2, 3].map((node) => ({
-    name: `fz-n${node}`,
-    address: `10.42.0.${10 + node}`,
-    cpuPoolKey: `node${node}`,
-    ...productionShape
-  })),
-  development: [1, 2, 3].map((node) => ({
-    name: `dev-fz-n${node}`,
-    address: `10.42.0.${20 + node}`,
-    cpuPoolKey: `node${node + 3}`,
-    ...developmentShape
-  }))
-};
-var DEVELOPMENT_COMMUNITY_REHEARSAL_GUEST = {
-  name: "dev-fz-n4",
-  address: "10.42.0.24",
-  cpuPoolKey: "node7",
-  ...developmentShape
-};
-var publicKey = (value) => {
-  const normalized = value.trim();
-  if (!/^ssh-(?:ed25519|rsa) [A-Za-z0-9+/]+={0,3}(?: [^\r\n]+)?$/.test(normalized)) {
-    throw new Error("platform genesis SSH public key is malformed");
-  }
-  return normalized;
-};
-function platformGenesisClaims(environment, sshPublicKeys) {
-  if (!PLATFORM_GENESIS_ENVIRONMENTS.includes(environment)) {
-    throw new Error("platform genesis environment must be production or development");
-  }
-  const keys = [...new Set(sshPublicKeys.map(publicKey))];
-  if (keys.length === 0)
-    throw new Error("platform genesis requires at least one operator SSH public key");
-  return PLATFORM_GENESIS_FLEETS[environment].map((guest) => ({
-    computeKey: `platform:${guest.name}`,
-    claimToken: "offline-platform-genesis",
-    claimExpiresAtTs: Number.MAX_SAFE_INTEGER,
-    attempt: 1,
-    action: "create",
-    bootstrap: { kind: "platform-genesis" },
-    access: { sshUser: "forgezero", sshPublicKeys: keys },
-    spec: {
-      reference: `platform:${guest.name}`,
-      imageKey: SUPPORTED_GUEST_IMAGE.key,
-      guestName: guest.name,
-      guestAddress: guest.address,
-      cpuPoolKey: guest.cpuPoolKey,
-      physicalCores: guest.physicalCores,
-      vcpu: guest.vcpu,
-      memoryGib: guest.memoryGib,
-      diskGib: guest.diskGib,
-      egressGuaranteedMbps: guest.egressGuaranteedMbps,
-      egressBurstMbps: guest.egressBurstMbps,
-      confidential: true
-    }
-  }));
-}
-function platformCommunityRehearsalClaims(sshPublicKeys) {
-  const keys = [...new Set(sshPublicKeys.map(publicKey))];
-  if (keys.length === 0)
-    throw new Error("platform genesis requires at least one operator SSH public key");
-  const seed = platformGenesisClaims("development", keys);
-  const guest = DEVELOPMENT_COMMUNITY_REHEARSAL_GUEST;
-  return [...seed, {
-    computeKey: `platform:${guest.name}`,
-    claimToken: "offline-platform-genesis",
-    claimExpiresAtTs: Number.MAX_SAFE_INTEGER,
-    attempt: 1,
-    action: "create",
-    bootstrap: { kind: "platform-genesis" },
-    access: { sshUser: "forgezero", sshPublicKeys: keys },
-    spec: {
-      reference: `platform:${guest.name}`,
-      imageKey: SUPPORTED_GUEST_IMAGE.key,
-      guestName: guest.name,
-      guestAddress: guest.address,
-      cpuPoolKey: guest.cpuPoolKey,
-      physicalCores: guest.physicalCores,
-      vcpu: guest.vcpu,
-      memoryGib: guest.memoryGib,
-      diskGib: guest.diskGib,
-      egressGuaranteedMbps: guest.egressGuaranteedMbps,
-      egressBurstMbps: guest.egressBurstMbps,
-      confidential: true
-    }
-  }];
-}
-function platformCommunityRehearsalDeletionClaims(sshPublicKeys) {
-  return platformCommunityRehearsalClaims(sshPublicKeys).map((claim) => ({
-    computeKey: claim.computeKey,
-    claimToken: claim.claimToken,
-    claimExpiresAtTs: claim.claimExpiresAtTs,
-    attempt: claim.attempt,
-    action: "delete",
-    bootstrap: { kind: "platform-genesis" },
-    spec: claim.spec
-  }));
-}
-
-// src/operator-bootstrap.ts
 var REQUEST_LIMIT = 64 * 1024;
 var SECRET_LIMIT = 256 * 1024;
 var REMOTE_STAGE = "/run/forgezero-operator-bootstrap";
@@ -16031,10 +16171,44 @@ var validateMetalRequestValue = (value) => {
     throw new Error("metalConfigFile must be an absolute path");
   canonicalOutputPath(root.metalConfigFile, "metalConfigFile");
   readMetalBootstrapConfig(root.metalConfigFile);
-  const genesis = exactKeys5(root.genesis, ["environment", "sshPublicKeyFiles"], "operator metal genesis");
-  if (typeof genesis.environment !== "string" || !PLATFORM_GENESIS_ENVIRONMENTS.includes(genesis.environment)) {
-    throw new Error("operator metal genesis environment must be production or development");
-  }
+  const genesis = exactKeys5(root.genesis, ["nodes", "rehearsalNode", "sshPublicKeyFiles"], "operator metal genesis");
+  const guest = (value2, label) => {
+    const row2 = exactKeys5(value2, [
+      "name",
+      "address",
+      "imageKey",
+      "cpuPoolKey",
+      "physicalCores",
+      "vcpu",
+      "memoryGib",
+      "diskGib",
+      "egressGuaranteedMbps",
+      "egressBurstMbps",
+      "confidential"
+    ], label);
+    if (typeof row2.name !== "string" || typeof row2.address !== "string" || typeof row2.imageKey !== "string" || row2.cpuPoolKey !== undefined && typeof row2.cpuPoolKey !== "string" || !["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps"].every((key) => typeof row2[key] === "number") || typeof row2.confidential !== "boolean") {
+      throw new Error(`${label} has invalid resource coordinates`);
+    }
+    return {
+      name: row2.name,
+      address: row2.address,
+      imageKey: row2.imageKey,
+      ...row2.cpuPoolKey ? { cpuPoolKey: row2.cpuPoolKey } : {},
+      physicalCores: row2.physicalCores,
+      vcpu: row2.vcpu,
+      memoryGib: row2.memoryGib,
+      diskGib: row2.diskGib,
+      egressGuaranteedMbps: row2.egressGuaranteedMbps,
+      egressBurstMbps: row2.egressBurstMbps,
+      confidential: row2.confidential
+    };
+  };
+  if (!Array.isArray(genesis.nodes))
+    throw new Error("operator metal genesis nodes must be an array");
+  const nodes = validatePlatformGenesisGuests(genesis.nodes.map((row2, index) => guest(row2, `operator metal genesis node ${index + 1}`)));
+  const rehearsalNode = genesis.rehearsalNode === undefined ? undefined : guest(genesis.rehearsalNode, "operator metal rehearsal node");
+  if (rehearsalNode)
+    validatePlatformGenesisGuests([...nodes, rehearsalNode], 4);
   if (!Array.isArray(genesis.sshPublicKeyFiles) || genesis.sshPublicKeyFiles.length === 0 || genesis.sshPublicKeyFiles.some((entry) => typeof entry !== "string")) {
     throw new Error("operator metal genesis requires SSH public-key files");
   }
@@ -16049,7 +16223,8 @@ var validateMetalRequestValue = (value) => {
       agentSocket: targetValue.agentSocket
     },
     genesis: {
-      environment: genesis.environment,
+      nodes,
+      ...rehearsalNode ? { rehearsalNode } : {},
       sshPublicKeyFiles: genesis.sshPublicKeyFiles
     }
   };
@@ -16062,26 +16237,69 @@ function writeOperatorMetalBootstrapRequest(path, request) {
   validateMetalRequestValue(request);
   return writeOwnerJson2(path, request, "operator metal request");
 }
+var validateGuestHostKeyEvidenceValue = (value, request) => {
+  const root = exactKeys5(value, ["format", "kind", "metalHostKeySha256", "nodes"], "operator guest host-key evidence");
+  if (root.format !== 1 || root.kind !== "forgezero-operator-guest-host-keys" || typeof root.metalHostKeySha256 !== "string" || !Array.isArray(root.nodes)) {
+    throw new Error("operator guest host-key evidence is malformed");
+  }
+  const nodes = root.nodes.map((value2, index) => {
+    const row2 = exactKeys5(value2, ["name", "address", "hostKey", "hostKeySha256"], `operator guest host key ${index + 1}`);
+    if (typeof row2.name !== "string" || typeof row2.address !== "string") {
+      throw new Error("operator guest host-key identity is malformed");
+    }
+    const hop = validateHop({
+      address: row2.address,
+      port: 22,
+      user: "forgezero",
+      hostKey: row2.hostKey,
+      hostKeySha256: row2.hostKeySha256
+    }, `operator guest host key ${row2.name}`);
+    return { name: row2.name, address: hop.address, hostKey: hop.hostKey, hostKeySha256: hop.hostKeySha256 };
+  });
+  if (new Set(nodes.map(({ name }) => name)).size !== nodes.length || new Set(nodes.map(({ address }) => address)).size !== nodes.length) {
+    throw new Error("operator guest host-key identities must be unique");
+  }
+  if (request) {
+    const expected = nodes.length === request.genesis.nodes.length ? [...request.genesis.nodes] : [...request.genesis.nodes, ...request.genesis.rehearsalNode ? [request.genesis.rehearsalNode] : []];
+    if (root.metalHostKeySha256 !== request.target.hostKeySha256 || ![request.genesis.nodes.length, request.genesis.nodes.length + (request.genesis.rehearsalNode ? 1 : 0)].includes(nodes.length) || nodes.length !== expected.length || expected.some((guest, index) => nodes[index]?.name !== guest.name || nodes[index]?.address !== guest.address)) {
+      throw new Error("operator guest host-key evidence does not match the reviewed Metal request");
+    }
+  }
+  return {
+    format: 1,
+    kind: "forgezero-operator-guest-host-keys",
+    metalHostKeySha256: root.metalHostKeySha256,
+    nodes
+  };
+};
+function readOperatorGuestHostKeyEvidence(path, request) {
+  const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator guest host-key evidence")));
+  return validateGuestHostKeyEvidenceValue(value, request);
+}
+function writeOperatorGuestHostKeyEvidence(path, evidence, request) {
+  return writeOwnerJson2(path, validateGuestHostKeyEvidenceValue(evidence, request), "operator guest host-key evidence");
+}
 function planOperatorMetalBootstrap(request, mode) {
   const config = readMetalBootstrapConfig(request.metalConfigFile);
-  if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && request.genesis.environment !== "development") {
-    throw new Error("the disposable four-node Community rehearsal is development-only");
-  }
   const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
-  const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(keys) : platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
+  if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
+    throw new Error("the reviewed metal request has no rehearsal node");
+  }
+  const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
+  const genesisNodes = mode === "host-keys" ? request.genesis.nodes.map(({ name }) => name) : mode === "rehearsal-host-keys" ? guestRows(request).map(({ name }) => name) : claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name));
   return {
     kind: "metal-remote",
     mode,
-    mutation: mode !== "status",
+    mutation: !["status", "host-keys", "rehearsal-host-keys"].includes(mode),
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the fixed three-node seed plus ordinary n4 Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact disposable dev-fz-n1..n4 guests and their owned disks, units, seed data and inventory" : "send three fixed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "host-keys" || mode === "rehearsal-host-keys" ? ["verify pinned SSH transport", "collect exact Ed25519 host keys for the reviewed guest addresses"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
       "run typed fz bootstrap metal --apply",
       "remove transient local and remote staging data"
     ],
-    genesisNodes: claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name)),
+    genesisNodes,
     secretInputs: config.agentSeedFile ? ["metal-agent-seed"] : []
   };
 }
@@ -16146,9 +16364,7 @@ function validatedPlatformFleet(fleet) {
     return config;
   });
   const environment = configs[0].environment;
-  const expected = PLATFORM_GENESIS_FLEETS[environment];
-  if (!expected || expected.length !== 3)
-    throw new Error("operator fleet environment is invalid");
+  const expected = configs.map((config) => ({ name: config.computeReference, address: config.database.address }));
   const identity = fleetConfigIdentity(configs[0]);
   const operatorIdentity = `${requests[0].target.identityPublicKeyFile}\x00${requests[0].target.agentSocket}`;
   const jumpIdentity = JSON.stringify(requests[0].target.jump ?? null);
@@ -16306,6 +16522,53 @@ var copy = async (exec, request, knownHosts, local, remotePath, secret = false)
     `${destination2(request.target)}:${remotePath}`
   ], "secure copy", { secret });
 };
+var guestRows = (request) => [
+  ...request.genesis.nodes,
+  ...request.genesis.rehearsalNode ? [request.genesis.rehearsalNode] : []
+];
+var parsedScannedHostKey = (output, address) => {
+  const keys = output.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.startsWith(`${address} ssh-ed25519 `)).map((line) => line.split(/\s+/).slice(1, 3).join(" "));
+  const unique = [...new Set(keys)];
+  if (unique.length !== 1 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}$/.test(unique[0])) {
+    throw new Error(`guest ${address} did not return one exact Ed25519 host key`);
+  }
+  return unique[0];
+};
+async function collectOperatorGuestHostKeys(request, options = {}, includeRehearsal = false) {
+  publicIdentity(request.target.identityPublicKeyFile);
+  socketPath(request.target.agentSocket);
+  const exec = options.exec ?? defaultExec3;
+  const directory = mkdtempSync(join10(tmpdir(), "forgezero-operator-host-keys-"));
+  try {
+    const knownHosts = writeKnownHosts(request, directory);
+    const nodes = [];
+    for (const guest of includeRehearsal ? guestRows(request) : request.genesis.nodes) {
+      const output = await remote(exec, request, knownHosts, [
+        "/usr/bin/ssh-keyscan",
+        "-T",
+        "10",
+        "-t",
+        "ed25519",
+        guest.address
+      ], `collect ${guest.name} SSH host key`);
+      const hostKey = parsedScannedHostKey(output, guest.address);
+      nodes.push({
+        name: guest.name,
+        address: guest.address,
+        hostKey,
+        hostKeySha256: fingerprint(hostKey)
+      });
+    }
+    return validateGuestHostKeyEvidenceValue({
+      format: 1,
+      kind: "forgezero-operator-guest-host-keys",
+      metalHostKeySha256: request.target.hostKeySha256,
+      nodes
+    }, request);
+  } finally {
+    rmSync7(directory, { recursive: true, force: true });
+  }
+}
 async function stageConfig(config, directory) {
   const rewritten = structuredClone(config);
   const staged = [];
@@ -16319,13 +16582,17 @@ async function stageConfig(config, directory) {
       rewritten.cloudflareHandoff.handoffFile = remotePath;
   }
   const bundle = await readBootstrapBundle(config.bootstrapBundle.bundleFile, config.bootstrapBundle.manifestFile);
+  if (bundle.manifest.branch !== config.bootstrapBundle.branch) {
+    throw new Error("reviewed bootstrap config branch does not match the bundle manifest");
+  }
   const bundleFiles = [
     { source: bundle.bundlePath, name: "bootstrap-api.bundle" },
     { source: bundle.manifestPath, name: "bootstrap-api.bundle.json" }
   ];
   rewritten.bootstrapBundle = {
     bundleFile: `${REMOTE_STAGE}/bootstrap-api.bundle`,
-    manifestFile: `${REMOTE_STAGE}/bootstrap-api.bundle.json`
+    manifestFile: `${REMOTE_STAGE}/bootstrap-api.bundle.json`,
+    branch: bundle.manifest.branch
   };
   const path = join10(directory, "platform-config.json");
   writeFileSync12(path, `${JSON.stringify(rewritten, null, 2)}
@@ -16481,15 +16748,24 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       const output2 = await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "status"], "remote metal status");
       return { plan, output: output2 };
     }
+    if (mode === "host-keys" || mode === "rehearsal-host-keys") {
+      return {
+        plan,
+        output: JSON.stringify(await collectOperatorGuestHostKeys(request, { ...options, exec }, mode === "rehearsal-host-keys"))
+      };
+    }
     if (mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
+      if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
+        throw new Error("the reviewed metal request has no rehearsal node");
+      }
       const outputs = [];
-      const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(keys) : platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
+      const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
       for (const claim of claims) {
         outputs.push(await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz-agent", "metal-apply", "--claim=-"], `provision ${claim.spec.guestName}`, false, `${JSON.stringify(claim)}
 `));
       }
-      return { plan, output: JSON.stringify({ environment: request.genesis.environment, nodes: plan.genesisNodes, outputs }) };
+      return { plan, output: JSON.stringify({ nodes: plan.genesisNodes, outputs }) };
     }
     const config = readMetalBootstrapConfig(request.metalConfigFile);
     const staged = stageMetalConfig(config, directory);
@@ -16522,15 +16798,36 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
 }
 
 // src/platform-genesis-config.ts
-function platformGenesisBootstrapConfigs(template, nodes) {
-  const environment = template.environment;
-  const fleet = PLATFORM_GENESIS_FLEETS[environment];
-  if (!fleet || nodes.length !== 3)
-    throw new Error("platform genesis requires exactly three selected-profile node coordinates");
+function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname, region) {
+  const fleet = validatePlatformGenesisGuests(guests);
+  if (!/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(metalHostname)) {
+    throw new Error("platform genesis requires the reviewed metal hostname");
+  }
+  if (fleet.some(({ confidential }) => !confidential)) {
+    throw new Error("platform genesis requires confidential compute");
+  }
+  if (nodes.length !== 3)
+    throw new Error("platform genesis requires exactly three node coordinates");
   if (nodes.some((node) => !node.nodeHostname || !node.cloudflareHandoffFile)) {
     throw new Error("every platform genesis node requires its public hostname and node-specific Cloudflare handoff");
   }
   const coordinators = fleet.map((guest) => `http://${guest.address}:8529`);
+  const initialInventory = {
+    metalHostname,
+    region: {
+      key: template.runtime.environment.nodeRegion,
+      label: region.label,
+      country: region.country,
+      ...region.city ? { city: region.city } : {},
+      confidentialCapable: true
+    },
+    computes: fleet.map((guest, index) => ({
+      ...guest,
+      confidential: guest.confidential,
+      databaseRole: index === 0 ? "master" : "joiner",
+      databaseAgency: "member"
+    }))
+  };
   return fleet.map((guest, index) => {
     const node = nodes[index];
     const master = fleet[0].address;
@@ -16561,6 +16858,7 @@ function platformGenesisBootstrapConfigs(template, nodes) {
       nodeHostname: node.nodeHostname,
       seedSyncPeers: fleet.filter((_, peer) => peer !== index).map((peer) => `ws://${peer.address}:${config.runtime.bluePort}/internal/seed`),
       seedSyncMembers: 3,
+      initialInventory,
       custodianEmail: index === 0 ? template.runtime.environment.custodianEmail : undefined
     };
     return validateBootstrapConfig(config);
@@ -17586,6 +17884,12 @@ var bootstrapNumber = (question, fallback) => {
     throw new Error(`${question} must be an integer`);
   return value;
 };
+var bootstrapBoolean = (question, fallback) => {
+  const value = bootstrapAnswer(`${question} (yes/no)`, fallback).toLowerCase();
+  if (value !== "yes" && value !== "no")
+    throw new Error(`${question} must be yes or no`);
+  return value === "yes";
+};
 async function bootstrapSecret(question) {
   if (!process.stdin.isTTY)
     throw new Error(`${question} requires an interactive terminal`);
@@ -17623,7 +17927,7 @@ var parseCpuPools = (value) => value.split(";").map((entry) => entry.trim()).fil
 function interactiveMetalBootstrap() {
   if (!process.stdin.isTTY)
     throw new Error("interactive metal config generation requires a terminal");
-  const confidential = bootstrapAnswer("Require SEV-SNP confidential guests? (yes/no)", "yes") === "yes";
+  const confidential = bootstrapBoolean("Require SEV-SNP confidential guests?", "yes");
   const subnetPrefix = bootstrapAnswer("Guest IPv4 subnet prefix", "10.42.0");
   return validateMetalBootstrapConfig({
     kind: "metal",
@@ -17643,12 +17947,10 @@ function interactiveMetalBootstrap() {
       unitDir: "/etc/systemd/system",
       apiUrl: bootstrapAnswer("Platform public API URL"),
       agentTelemetryEndpoint: bootstrapAnswer("Public HTTPS Agent OTLP endpoint"),
-      images: {
-        [SUPPORTED_GUEST_IMAGE.key]: {
-          path: `/var/lib/forgezero/images/${SUPPORTED_GUEST_IMAGE.key}.img`,
-          sha256: SUPPORTED_GUEST_IMAGE.sha256
-        }
-      },
+      images: Object.fromEntries(OS_CATALOG.filter(({ status }) => status === "active").map((image) => [
+        image.imageKey,
+        { path: `/var/lib/forgezero/images/${image.imageKey}.img`, sha256: image.imageSha256 }
+      ])),
       cpuPools: parseCpuPools(bootstrapAnswer("CPU pools (key|cpus|physical-cores|memory-nodes;...)", "node1|8-15,72-79|8|1;node2|16-23,80-87|8|2;node3|24-31,88-95|8|3;node4|32-39,96-103|8|4;node5|40-47,104-111|8|5;node6|48-55,112-119|8|6;node7|56-63,120-127|8|7")),
       housekeepingCpus: bootstrapAnswer("Host housekeeping CPU list", "0-7,64-71"),
       housekeepingMemoryNodes: bootstrapAnswer("Host housekeeping memory nodes", "0"),
@@ -17683,7 +17985,7 @@ async function interactiveCloudflareBootstrap() {
   };
   const zoneName = bootstrapAnswer("Cloudflare DNS zone name", "forgezero.net");
   const kvNamespaceTitle = bootstrapAnswer("Existing Worker-bound KV namespace title");
-  const realtimeEnabled = bootstrapAnswer("Configure existing Worker realtime fan-out? (yes/no)", "yes") === "yes";
+  const realtimeEnabled = bootstrapBoolean("Configure existing Worker realtime fan-out?", "yes");
   const workerScriptName = realtimeEnabled ? bootstrapAnswer("Existing Worker script name") : undefined;
   const discovered = await discoverCloudflareBootstrapCommandResources({
     zoneName,
@@ -17694,12 +17996,12 @@ async function interactiveCloudflareBootstrap() {
   const nodeCount = bootstrapNumber("Number of public API nodes", "3");
   if (nodeCount < 1 || nodeCount > 32)
     throw new Error("Number of public API nodes must be between 1 and 32");
-  const meshEnabled = bootstrapAnswer("Configure private Mesh/WARP routes? (yes/no)", "no") === "yes";
+  const meshEnabled = bootstrapBoolean("Configure private Mesh/WARP routes?", "no");
   const meshDevicePolicyId = meshEnabled ? bootstrapAnswer("Existing Mesh device policy id") : undefined;
   const nodes = Array.from({ length: nodeCount }, (_, index) => {
     const ordinal = index + 1;
     const nodeName = bootstrapAnswer(`Node ${ordinal} inventory name`);
-    const nodeMesh = meshEnabled && bootstrapAnswer(`Configure Mesh routes for ${nodeName}? (yes/no)`, "yes") === "yes";
+    const nodeMesh = meshEnabled && bootstrapBoolean(`Configure Mesh routes for ${nodeName}?`, "yes");
     return {
       nodeName,
       hostname: bootstrapAnswer(`${nodeName} public hostname`),
@@ -17709,7 +18011,7 @@ async function interactiveCloudflareBootstrap() {
         mesh: {
           connectorName: bootstrapAnswer(`${nodeName} Mesh connector name`, `${nodeName}-mesh`),
           routes: bootstrapList(`${nodeName} private CIDR routes`),
-          highAvailability: bootstrapAnswer(`${nodeName} shares a highly available Mesh connector? (yes/no)`, "no") === "yes"
+          highAvailability: bootstrapBoolean(`${nodeName} shares a highly available Mesh connector?`, "no")
         }
       } : {}
     };
@@ -17756,6 +18058,28 @@ function operatorIdentityCoordinates() {
     agentSocket: bootstrapAnswer("Bitwarden SSH agent socket", process.env.SSH_AUTH_SOCK)
   };
 }
+function interactiveGenesisGuests() {
+  const node = (index) => ({
+    name: bootstrapAnswer(`Guest ${index} name`),
+    address: bootstrapAnswer(`Guest ${index} private IPv4`),
+    imageKey: bootstrapAnswer(`Guest ${index} OS image key`, SUPPORTED_GUEST_IMAGE.key),
+    cpuPoolKey: bootstrapAnswer(`Guest ${index} exclusive CPU pool key`),
+    physicalCores: bootstrapNumber(`Guest ${index} physical cores`),
+    vcpu: bootstrapNumber(`Guest ${index} vCPUs`),
+    memoryGib: bootstrapNumber(`Guest ${index} memory GiB`),
+    diskGib: bootstrapNumber(`Guest ${index} disk GiB`),
+    egressGuaranteedMbps: bootstrapNumber(`Guest ${index} guaranteed egress Mbps`),
+    egressBurstMbps: bootstrapNumber(`Guest ${index} burst egress Mbps`),
+    confidential: bootstrapBoolean(`Guest ${index} requires confidential SEV-SNP compute?`)
+  });
+  const nodes = [
+    node(1),
+    node(2),
+    node(3)
+  ];
+  const rehearsalNode = bootstrapBoolean("Configure an optional fourth rehearsal guest?", "yes") ? node(4) : undefined;
+  return { nodes, ...rehearsalNode ? { rehearsalNode } : {} };
+}
 function writeMetalOperatorFiles(directory) {
   const output = genesisOutputDirectory(directory);
   const config = interactiveMetalBootstrap();
@@ -17766,17 +18090,24 @@ function writeMetalOperatorFiles(directory) {
     kind: "metal-remote",
     metalConfigFile: metalConfig,
     target: { ...target, ...identity },
-    genesis: {
-      environment: bootstrapAnswer("Genesis environment (production/development)", "development"),
-      sshPublicKeyFiles: [identity.identityPublicKeyFile]
-    }
+    genesis: { ...interactiveGenesisGuests(), sshPublicKeyFiles: [identity.identityPublicKeyFile] }
   });
   return { metalConfig, remoteRequest };
 }
 function writePlatformGenesisFleet(directory) {
   const output = genesisOutputDirectory(directory);
-  const template = interactiveBootstrap("platform", true);
-  const fleet = PLATFORM_GENESIS_FLEETS[template.environment];
+  const metalRequestFile = bootstrapAnswer("Owner-only metal remote request containing the reviewed genesis guests");
+  const metalRequest = readOperatorMetalBootstrapRequest(metalRequestFile);
+  const guestHostKeysFile = bootstrapAnswer("Owner-only guest host-key evidence file");
+  const guestHostKeys = readOperatorGuestHostKeyEvidence(guestHostKeysFile, metalRequest);
+  const fleet = metalRequest.genesis.nodes;
+  const metalHostname = readMetalBootstrapConfig(metalRequest.metalConfigFile).metalHostname;
+  const template = interactiveBootstrap("platform", fleet);
+  const region = {
+    label: bootstrapAnswer(`Region ${template.runtime.environment.nodeRegion} display label`),
+    country: bootstrapAnswer("Region ISO 3166-1 alpha-2 country code").toUpperCase(),
+    city: bootstrapAnswer("Region city")
+  };
   const nodes = fleet.map((guest, index) => index === 0 ? {
     nodeHostname: template.nodeHostname,
     cloudflareHandoffFile: template.cloudflareHandoff.handoffFile
@@ -17784,34 +18115,47 @@ function writePlatformGenesisFleet(directory) {
     nodeHostname: bootstrapAnswer(`${guest.name} public node hostname`),
     cloudflareHandoffFile: bootstrapAnswer(`${guest.name} node-specific Cloudflare host handoff`)
   });
-  const configs = platformGenesisBootstrapConfigs(template, nodes).map((config) => {
+  const configs = platformGenesisBootstrapConfigs(template, fleet, nodes, metalHostname, region).map((config) => {
     const path = `${output}/${config.computeReference}-platform.json`;
     writeBootstrapConfig(path, config);
     return path;
   });
-  const identity = operatorIdentityCoordinates();
-  const useJump = bootstrapAnswer("Reach genesis computes through the Metal SSH jump? (yes/no)", "yes") === "yes";
-  const jump = useJump ? interactiveOperatorHop("Metal jump", { user: "root" }) : undefined;
   const requests = configs.map((platformConfigFile, index) => {
     const guest = fleet[index];
-    const target = interactiveOperatorHop(`${guest.name} compute`, { address: guest.address, user: "forgezero" });
+    const host = guestHostKeys.nodes.find(({ name }) => name === guest.name);
     return writeOperatorPlatformBootstrapRequest(join12(output, `${guest.name}-remote.json`), {
       kind: "platform-remote",
       platformConfigFile,
-      target: { ...target, ...identity, ...jump ? { jump } : {} }
+      target: {
+        address: guest.address,
+        port: 22,
+        user: "forgezero",
+        hostKey: host.hostKey,
+        hostKeySha256: host.hostKeySha256,
+        identityPublicKeyFile: metalRequest.target.identityPublicKeyFile,
+        agentSocket: metalRequest.target.agentSocket,
+        jump: {
+          address: metalRequest.target.address,
+          port: metalRequest.target.port,
+          user: metalRequest.target.user,
+          hostKey: metalRequest.target.hostKey,
+          hostKeySha256: metalRequest.target.hostKeySha256
+        }
+      }
     });
   });
   const fleetRequest = writeOperatorPlatformBootstrapFleetRequest(join12(output, "platform-fleet-remote.json"), requests);
   return { configs, requests, fleetRequest };
 }
-function interactiveBootstrap(kind, genesis = false) {
+function interactiveBootstrap(kind, genesisGuests) {
   if (!process.stdin.isTTY)
     throw new Error("non-interactive bootstrap requires --bootstrap-config <private-json-file>");
   const environment = bootstrapAnswer("Environment (production/development)", "production");
   if (environment !== "production" && environment !== "development") {
     throw new Error("Environment must be production or development");
   }
-  const fleet = genesis ? PLATFORM_GENESIS_FLEETS[environment] : undefined;
+  const genesis = genesisGuests !== undefined;
+  const fleet = genesisGuests;
   const profile = genesis ? "platform-db-api" : bootstrapAnswer("Profile (platform-db-api/platform-api)", "platform-db-api");
   const role = genesis ? "master" : profile === "platform-api" ? "none" : bootstrapAnswer("Database role (master/joiner)", "master");
   const agency = genesis ? "member" : role === "master" ? "member" : role === "none" ? "none" : bootstrapAnswer("Agency participation (member/none)", "member");
@@ -17819,12 +18163,13 @@ function interactiveBootstrap(kind, genesis = false) {
   const address = genesis ? fleet[0].address : role === "none" ? undefined : bootstrapAnswer("Private database address");
   const master = role === "joiner" ? bootstrapAnswer("Master starter private address") : undefined;
   const coordinators = genesis ? fleet.map((guest) => `http://${guest.address}:8529`) : bootstrapAnswer("Writable Coordinator origins (comma-separated)").split(",").map((item) => item.trim()).filter(Boolean);
-  const computeReference = genesis ? fleet[0].name : bootstrapAnswer("API-owned compute reference", environment === "production" ? "fz-n1" : "dev-fz-n1");
+  const computeReference = genesis ? fleet[0].name : bootstrapAnswer("API-owned compute reference");
   const nodeHostname = bootstrapAnswer(genesis ? `${computeReference} public node hostname` : "Public node hostname");
   const apiUrl = bootstrapAnswer("Platform API URL");
   const appOrigin = bootstrapAnswer("Public App origin");
   const bundleFile = bootstrapAnswer("Bootstrap API Git bundle (absolute path)");
   const manifestFile = bootstrapAnswer("Bootstrap bundle manifest (absolute path)", `${bundleFile}.json`);
+  const bundleBranch = bootstrapAnswer("Bootstrap bundle Git branch");
   const telemetryEndpoint = bootstrapAnswer("Public HTTPS Agent OTLP endpoint");
   const collectorUnit = FORGEZERO_OTEL_COLLECTOR_UNIT;
   const replicationFactor = Number(bootstrapAnswer("Database replication factor", "3"));
@@ -17837,7 +18182,7 @@ function interactiveBootstrap(kind, genesis = false) {
   const smtpHost = emailProvider === "smtp" ? bootstrapAnswer("SMTP host") : undefined;
   const smtpPort = emailProvider === "smtp" ? Number(bootstrapAnswer("SMTP port", "587")) : undefined;
   const smtpUser = emailProvider === "smtp" ? bootstrapAnswer("SMTP user") : undefined;
-  const jetemailEu = emailProvider === "jetemail" ? bootstrapAnswer("Use JetEmail EU processing? (yes/no)", "no") === "yes" : undefined;
+  const jetemailEu = emailProvider === "jetemail" ? bootstrapBoolean("Use JetEmail EU processing?", "no") : undefined;
   const backupEndpoint = bootstrapAnswer("Backup S3 HTTPS endpoint (blank to disable)", "");
   const backupRegion = backupEndpoint ? bootstrapAnswer("Backup S3 region") : undefined;
   const backupBucket = backupEndpoint ? bootstrapAnswer("Backup S3 bucket") : undefined;
@@ -17853,7 +18198,7 @@ function interactiveBootstrap(kind, genesis = false) {
     computeReference,
     nodeHostname,
     apiUrl,
-    bootstrapBundle: { bundleFile, manifestFile },
+    bootstrapBundle: { bundleFile, manifestFile, branch: bundleBranch },
     telemetryEndpoint,
     database: {
       role,
@@ -17907,12 +18252,12 @@ function interactiveBootstrap(kind, genesis = false) {
       keepReleases: 5
     },
     firewall: {
-      enabled: bootstrapAnswer("Enable host firewall? (yes/no)", "yes") === "yes",
+      enabled: bootstrapBoolean("Enable host firewall?", "yes"),
       sshPort: Number(bootstrapAnswer("SSH port", "22")),
       privateCidrs: bootstrapAnswer("Private cluster CIDRs (comma-separated)").split(",").map((item) => item.trim()).filter(Boolean)
     },
     installCloudflared: Boolean(cloudflareHandoffFile),
-    installWarp: !genesis && cloudflareHandoffFile ? bootstrapAnswer("Configure Cloudflare Mesh/WARP from this handoff? (yes/no)", "no") === "yes" : false,
+    installWarp: !genesis && cloudflareHandoffFile ? bootstrapBoolean("Configure Cloudflare Mesh/WARP from this handoff?", "no") : false,
     ...cloudflareHandoffFile && cloudflareNodeName ? {
       cloudflareHandoff: { handoffFile: cloudflareHandoffFile, nodeName: cloudflareNodeName }
     } : {}
@@ -17997,11 +18342,14 @@ async function cmdBootstrap(options, args) {
     }
     if (operation === "metal" && args[1] === "remote") {
       const mode = args[2];
-      if (!mode || !["apply", "genesis", "rehearsal", "rehearsal-cleanup", "status"].includes(mode) || args[3] !== undefined) {
-        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|status> --bootstrap-config <owner-only-request.json> [--apply]");
+      if (!mode || !["apply", "genesis", "rehearsal", "rehearsal-cleanup", "host-keys", "rehearsal-host-keys", "status"].includes(mode) || args[3] !== undefined) {
+        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status> --bootstrap-config <owner-only-request.json> [--output <owner-only-evidence.json>] [--apply]");
       }
       if (!options.bootstrapConfigPath)
         throw new Error("remote metal bootstrap requires --bootstrap-config");
+      if ((mode === "host-keys" || mode === "rehearsal-host-keys") && !options.outputPath) {
+        throw new Error(`${mode} requires --output <absolute-owner-only-evidence.json>`);
+      }
       const request = readOperatorMetalBootstrapRequest(options.bootstrapConfigPath);
       const plan2 = planOperatorMetalBootstrap(request, mode);
       if (!options.apply) {
@@ -18009,7 +18357,15 @@ async function cmdBootstrap(options, args) {
         out.step("Review the pinned metal target and exact genesis nodes, then repeat with --apply to contact the host.");
         return 0;
       }
-      out.line(JSON.stringify(await applyOperatorMetalBootstrap(request, mode), null, 2));
+      const result2 = await applyOperatorMetalBootstrap(request, mode);
+      if (mode === "host-keys" || mode === "rehearsal-host-keys") {
+        const evidence = JSON.parse(result2.output);
+        const path = writeOperatorGuestHostKeyEvidence(options.outputPath, evidence, request);
+        readOperatorGuestHostKeyEvidence(path, request);
+        out.line(JSON.stringify({ plan: result2.plan, evidencePath: path, mode: "0600" }, null, 2));
+        return 0;
+      }
+      out.line(JSON.stringify(result2, null, 2));
       return 0;
     }
     if (operation === "platform" && args[1] === "cloudflare") {
@@ -18097,7 +18453,7 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (!["platform", "repair"].includes(operation)) {
-      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|status>]|status|repair [--bootstrap-config <path>] [--apply]");
+      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>]|status|repair [--bootstrap-config <path>] [--apply]");
     }
     const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
       throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
@@ -18501,9 +18857,9 @@ async function cmdDeploy(options, args) {
       if (existsSync12(resolve11(options.projectRoot, DEPLOY_SOURCE_FILE))) {
         const expected = await compileDeploymentProject(options.projectRoot, { write: false });
         const actual = inspectCompiledDeployment(options.projectRoot);
-        const current = canonicalJson(expected.plan) === canonicalJson(actual.plan);
+        const current2 = canonicalJson(expected.plan) === canonicalJson(actual.plan);
         const problems = [
-          ...current ? [] : [`${DEPLOY_PLAN_FILE} is stale; run \`fz deploy compile\``],
+          ...current2 ? [] : [`${DEPLOY_PLAN_FILE} is stale; run \`fz deploy compile\``],
           ...canonicalJson(expected.plan).includes("pipeline-todo") ? ["typed plan contains safe initialization blockers"] : []
         ];
         const summary = { source: expected.source, output: actual.path, digest: actual.digest, version: actual.plan.version, name: actual.plan.name, ready: problems.length === 0, problems };
@@ -18692,7 +19048,7 @@ function usage() {
 	                         Persist secret-free public-node acceptance, then remove
 	                         the completed non-secret checkpoint and node handoffs
 	 fz bootstrap metal      Plan/install an identity-only physical provisioner
-	 fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|status>
+	 fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>
 	                         Install/bootstrap one pinned blank metal target, then
 	                         provision the exact selected three-node genesis seed
 	 fz bootstrap status     Verify persisted profile and supervised units
@@ -18723,8 +19079,9 @@ function usage() {
 	                         Verify recovered data and bounded cluster topology
 	 fz db consolidate       Plan/apply a digest-bound offline schema consolidation
 	 fz rehearse community-cluster-api
-	                         Plan the fixed four-node Community 3.11.14 rehearsal;
-	                         --apply also requires its exact disposable-fleet confirmation
+	                         Plan the reviewed four-node Community 3.11.14 rehearsal;
+	                         requires --request=<metal-remote.json>; mutation also requires
+	                         the exact disposable-fleet confirmation printed by the plan
 	 fz rehearse platform-fleet
 	                         Verify a development or production fleet; use --plan offline
 	 fz rehearse platform-recovery