@forgezero/agent 0.1.67 → 0.1.68

package/README.md

@@ -532,22 +532,26 @@ await readBootstrapBundle(built.bundlePath, built.manifestPath);
 <a id="forgezero-agent-operator-bootstrap"></a>
 ## @forgezero/agent/operator-bootstrap
 
-Pinned-host operator transport that stages owner-only handoffs and invokes the same typed platform bootstrap through the caller-approved SSH agent. This entry exposes 15 named value exports and 15 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Pinned-host operator transport that stages owner-only handoffs and invokes the same typed platform bootstrap through the caller-approved SSH agent. This entry exposes 19 named value exports and 17 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
 import {
   applyOperatorMetalBootstrap,
   applyOperatorPlatformBootstrap,
   applyOperatorPlatformFleetBootstrap,
+  collectOperatorGuestHostKeys,
   createOperatorSshHop,
   operatorPlatformFleetCoordinates,
   planOperatorMetalBootstrap,
   planOperatorPlatformBootstrap,
   planOperatorPlatformFleetBootstrap,
+  readOperatorGuestHostKeyEvidence,
   readOperatorMetalBootstrapRequest,
   readOperatorPlatformBootstrapFleetRequest,
   readOperatorPlatformBootstrapRequest,
   verifyOperatorPlatformFleet,
+  withOperatorGuestTransport,
+  writeOperatorGuestHostKeyEvidence,
   writeOperatorMetalBootstrapRequest,
   writeOperatorPlatformBootstrapFleetRequest,
   writeOperatorPlatformBootstrapRequest,
@@ -556,6 +560,8 @@ import {
 import type {
   OperatorCommand,
   OperatorCommandResult,
+  OperatorGuestHostKeyEvidence,
+  OperatorGuestTransport,
   OperatorMetalBootstrapMode,
   OperatorMetalBootstrapPlan,
   OperatorMetalBootstrapRequest,

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.67";
+var VERSION3 = "0.1.68";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/bootstrap.js

@@ -1396,7 +1396,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.67";
+var VERSION = "0.1.68";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/fz-agent.js

@@ -8588,7 +8588,7 @@ import { join as join3 } from "path";
 import { fileURLToPath } from "url";
 
 // src/version.ts
-var VERSION2 = "0.1.67";
+var VERSION2 = "0.1.68";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4829,7 +4829,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.67";
+var VERSION2 = "0.1.68";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -16237,6 +16237,48 @@ function writeOperatorMetalBootstrapRequest(path, request) {
   validateMetalRequestValue(request);
   return writeOwnerJson2(path, request, "operator metal request");
 }
+var validateGuestHostKeyEvidenceValue = (value, request) => {
+  const root = exactKeys5(value, ["format", "kind", "metalHostKeySha256", "nodes"], "operator guest host-key evidence");
+  if (root.format !== 1 || root.kind !== "forgezero-operator-guest-host-keys" || typeof root.metalHostKeySha256 !== "string" || !Array.isArray(root.nodes)) {
+    throw new Error("operator guest host-key evidence is malformed");
+  }
+  const nodes = root.nodes.map((value2, index) => {
+    const row2 = exactKeys5(value2, ["name", "address", "hostKey", "hostKeySha256"], `operator guest host key ${index + 1}`);
+    if (typeof row2.name !== "string" || typeof row2.address !== "string") {
+      throw new Error("operator guest host-key identity is malformed");
+    }
+    const hop = validateHop({
+      address: row2.address,
+      port: 22,
+      user: "forgezero",
+      hostKey: row2.hostKey,
+      hostKeySha256: row2.hostKeySha256
+    }, `operator guest host key ${row2.name}`);
+    return { name: row2.name, address: hop.address, hostKey: hop.hostKey, hostKeySha256: hop.hostKeySha256 };
+  });
+  if (new Set(nodes.map(({ name }) => name)).size !== nodes.length || new Set(nodes.map(({ address }) => address)).size !== nodes.length) {
+    throw new Error("operator guest host-key identities must be unique");
+  }
+  if (request) {
+    const expected = nodes.length === request.genesis.nodes.length ? [...request.genesis.nodes] : [...request.genesis.nodes, ...request.genesis.rehearsalNode ? [request.genesis.rehearsalNode] : []];
+    if (root.metalHostKeySha256 !== request.target.hostKeySha256 || ![request.genesis.nodes.length, request.genesis.nodes.length + (request.genesis.rehearsalNode ? 1 : 0)].includes(nodes.length) || nodes.length !== expected.length || expected.some((guest, index) => nodes[index]?.name !== guest.name || nodes[index]?.address !== guest.address)) {
+      throw new Error("operator guest host-key evidence does not match the reviewed Metal request");
+    }
+  }
+  return {
+    format: 1,
+    kind: "forgezero-operator-guest-host-keys",
+    metalHostKeySha256: root.metalHostKeySha256,
+    nodes
+  };
+};
+function readOperatorGuestHostKeyEvidence(path, request) {
+  const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator guest host-key evidence")));
+  return validateGuestHostKeyEvidenceValue(value, request);
+}
+function writeOperatorGuestHostKeyEvidence(path, evidence, request) {
+  return writeOwnerJson2(path, validateGuestHostKeyEvidenceValue(evidence, request), "operator guest host-key evidence");
+}
 function planOperatorMetalBootstrap(request, mode) {
   const config = readMetalBootstrapConfig(request.metalConfigFile);
   const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
@@ -16244,19 +16286,20 @@ function planOperatorMetalBootstrap(request, mode) {
     throw new Error("the reviewed metal request has no rehearsal node");
   }
   const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
+  const genesisNodes = mode === "host-keys" ? request.genesis.nodes.map(({ name }) => name) : mode === "rehearsal-host-keys" ? guestRows(request).map(({ name }) => name) : claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name));
   return {
     kind: "metal-remote",
     mode,
-    mutation: mode !== "status",
+    mutation: !["status", "host-keys", "rehearsal-host-keys"].includes(mode),
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "host-keys" || mode === "rehearsal-host-keys" ? ["verify pinned SSH transport", "collect exact Ed25519 host keys for the reviewed guest addresses"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
       "run typed fz bootstrap metal --apply",
       "remove transient local and remote staging data"
     ],
-    genesisNodes: claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name)),
+    genesisNodes,
     secretInputs: config.agentSeedFile ? ["metal-agent-seed"] : []
   };
 }
@@ -16479,6 +16522,53 @@ var copy = async (exec, request, knownHosts, local, remotePath, secret = false)
     `${destination2(request.target)}:${remotePath}`
   ], "secure copy", { secret });
 };
+var guestRows = (request) => [
+  ...request.genesis.nodes,
+  ...request.genesis.rehearsalNode ? [request.genesis.rehearsalNode] : []
+];
+var parsedScannedHostKey = (output, address) => {
+  const keys = output.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.startsWith(`${address} ssh-ed25519 `)).map((line) => line.split(/\s+/).slice(1, 3).join(" "));
+  const unique = [...new Set(keys)];
+  if (unique.length !== 1 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}$/.test(unique[0])) {
+    throw new Error(`guest ${address} did not return one exact Ed25519 host key`);
+  }
+  return unique[0];
+};
+async function collectOperatorGuestHostKeys(request, options = {}, includeRehearsal = false) {
+  publicIdentity(request.target.identityPublicKeyFile);
+  socketPath(request.target.agentSocket);
+  const exec = options.exec ?? defaultExec3;
+  const directory = mkdtempSync(join10(tmpdir(), "forgezero-operator-host-keys-"));
+  try {
+    const knownHosts = writeKnownHosts(request, directory);
+    const nodes = [];
+    for (const guest of includeRehearsal ? guestRows(request) : request.genesis.nodes) {
+      const output = await remote(exec, request, knownHosts, [
+        "/usr/bin/ssh-keyscan",
+        "-T",
+        "10",
+        "-t",
+        "ed25519",
+        guest.address
+      ], `collect ${guest.name} SSH host key`);
+      const hostKey = parsedScannedHostKey(output, guest.address);
+      nodes.push({
+        name: guest.name,
+        address: guest.address,
+        hostKey,
+        hostKeySha256: fingerprint(hostKey)
+      });
+    }
+    return validateGuestHostKeyEvidenceValue({
+      format: 1,
+      kind: "forgezero-operator-guest-host-keys",
+      metalHostKeySha256: request.target.hostKeySha256,
+      nodes
+    }, request);
+  } finally {
+    rmSync7(directory, { recursive: true, force: true });
+  }
+}
 async function stageConfig(config, directory) {
   const rewritten = structuredClone(config);
   const staged = [];
@@ -16658,6 +16748,12 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       const output2 = await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "status"], "remote metal status");
       return { plan, output: output2 };
     }
+    if (mode === "host-keys" || mode === "rehearsal-host-keys") {
+      return {
+        plan,
+        output: JSON.stringify(await collectOperatorGuestHostKeys(request, { ...options, exec }, mode === "rehearsal-host-keys"))
+      };
+    }
     if (mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
       if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
@@ -18002,6 +18098,8 @@ function writePlatformGenesisFleet(directory) {
   const output = genesisOutputDirectory(directory);
   const metalRequestFile = bootstrapAnswer("Owner-only metal remote request containing the reviewed genesis guests");
   const metalRequest = readOperatorMetalBootstrapRequest(metalRequestFile);
+  const guestHostKeysFile = bootstrapAnswer("Owner-only guest host-key evidence file");
+  const guestHostKeys = readOperatorGuestHostKeyEvidence(guestHostKeysFile, metalRequest);
   const fleet = metalRequest.genesis.nodes;
   const metalHostname = readMetalBootstrapConfig(metalRequest.metalConfigFile).metalHostname;
   const template = interactiveBootstrap("platform", fleet);
@@ -18022,16 +18120,28 @@ function writePlatformGenesisFleet(directory) {
     writeBootstrapConfig(path, config);
     return path;
   });
-  const identity = operatorIdentityCoordinates();
-  const useJump = bootstrapBoolean("Reach genesis computes through the Metal SSH jump?", "yes");
-  const jump = useJump ? interactiveOperatorHop("Metal jump", { user: "root" }) : undefined;
   const requests = configs.map((platformConfigFile, index) => {
     const guest = fleet[index];
-    const target = interactiveOperatorHop(`${guest.name} compute`, { address: guest.address, user: "forgezero" });
+    const host = guestHostKeys.nodes.find(({ name }) => name === guest.name);
     return writeOperatorPlatformBootstrapRequest(join12(output, `${guest.name}-remote.json`), {
       kind: "platform-remote",
       platformConfigFile,
-      target: { ...target, ...identity, ...jump ? { jump } : {} }
+      target: {
+        address: guest.address,
+        port: 22,
+        user: "forgezero",
+        hostKey: host.hostKey,
+        hostKeySha256: host.hostKeySha256,
+        identityPublicKeyFile: metalRequest.target.identityPublicKeyFile,
+        agentSocket: metalRequest.target.agentSocket,
+        jump: {
+          address: metalRequest.target.address,
+          port: metalRequest.target.port,
+          user: metalRequest.target.user,
+          hostKey: metalRequest.target.hostKey,
+          hostKeySha256: metalRequest.target.hostKeySha256
+        }
+      }
     });
   });
   const fleetRequest = writeOperatorPlatformBootstrapFleetRequest(join12(output, "platform-fleet-remote.json"), requests);
@@ -18232,11 +18342,14 @@ async function cmdBootstrap(options, args) {
     }
     if (operation === "metal" && args[1] === "remote") {
       const mode = args[2];
-      if (!mode || !["apply", "genesis", "rehearsal", "rehearsal-cleanup", "status"].includes(mode) || args[3] !== undefined) {
-        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|status> --bootstrap-config <owner-only-request.json> [--apply]");
+      if (!mode || !["apply", "genesis", "rehearsal", "rehearsal-cleanup", "host-keys", "rehearsal-host-keys", "status"].includes(mode) || args[3] !== undefined) {
+        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status> --bootstrap-config <owner-only-request.json> [--output <owner-only-evidence.json>] [--apply]");
       }
       if (!options.bootstrapConfigPath)
         throw new Error("remote metal bootstrap requires --bootstrap-config");
+      if ((mode === "host-keys" || mode === "rehearsal-host-keys") && !options.outputPath) {
+        throw new Error(`${mode} requires --output <absolute-owner-only-evidence.json>`);
+      }
       const request = readOperatorMetalBootstrapRequest(options.bootstrapConfigPath);
       const plan2 = planOperatorMetalBootstrap(request, mode);
       if (!options.apply) {
@@ -18244,7 +18357,15 @@ async function cmdBootstrap(options, args) {
         out.step("Review the pinned metal target and exact genesis nodes, then repeat with --apply to contact the host.");
         return 0;
       }
-      out.line(JSON.stringify(await applyOperatorMetalBootstrap(request, mode), null, 2));
+      const result2 = await applyOperatorMetalBootstrap(request, mode);
+      if (mode === "host-keys" || mode === "rehearsal-host-keys") {
+        const evidence = JSON.parse(result2.output);
+        const path = writeOperatorGuestHostKeyEvidence(options.outputPath, evidence, request);
+        readOperatorGuestHostKeyEvidence(path, request);
+        out.line(JSON.stringify({ plan: result2.plan, evidencePath: path, mode: "0600" }, null, 2));
+        return 0;
+      }
+      out.line(JSON.stringify(result2, null, 2));
       return 0;
     }
     if (operation === "platform" && args[1] === "cloudflare") {
@@ -18332,7 +18453,7 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (!["platform", "repair"].includes(operation)) {
-      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|status>]|status|repair [--bootstrap-config <path>] [--apply]");
+      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>]|status|repair [--bootstrap-config <path>] [--apply]");
     }
     const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
       throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
@@ -18927,7 +19048,7 @@ function usage() {
 	                         Persist secret-free public-node acceptance, then remove
 	                         the completed non-secret checkpoint and node handoffs
 	 fz bootstrap metal      Plan/install an identity-only physical provisioner
-	 fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|status>
+	 fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>
 	                         Install/bootstrap one pinned blank metal target, then
 	                         provision the exact selected three-node genesis seed
 	 fz bootstrap status     Verify persisted profile and supervised units

package/dist/metal-bootstrap.js

@@ -354,7 +354,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.67";
+var VERSION = "0.1.68";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.d.ts

@@ -26,6 +26,17 @@ export interface OperatorMetalBootstrapRequest {
         sshPublicKeyFiles: string[];
     };
 }
+export interface OperatorGuestHostKeyEvidence {
+    format: 1;
+    kind: 'forgezero-operator-guest-host-keys';
+    metalHostKeySha256: string;
+    nodes: readonly {
+        name: string;
+        address: string;
+        hostKey: string;
+        hostKeySha256: string;
+    }[];
+}
 export interface OperatorPlatformBootstrapFleetRequest {
     kind: 'platform-fleet-remote';
     requests: readonly [string, string, string];
@@ -66,7 +77,7 @@ export interface OperatorPlatformFleetCoordinates {
     }[];
 }
 export type OperatorPlatformBootstrapMode = 'apply' | 'status';
-export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'rehearsal' | 'rehearsal-cleanup' | 'status';
+export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'rehearsal' | 'rehearsal-cleanup' | 'host-keys' | 'rehearsal-host-keys' | 'status';
 export interface OperatorPlatformBootstrapPlan {
     kind: 'platform-remote';
     mode: OperatorPlatformBootstrapMode;
@@ -115,11 +126,27 @@ export declare function readOperatorPlatformBootstrapFleetRequest(path: string):
 export declare function writeOperatorPlatformBootstrapFleetRequest(path: string, requestFiles: readonly [string, string, string]): string;
 export declare function readOperatorMetalBootstrapRequest(path: string): OperatorMetalBootstrapRequest;
 export declare function writeOperatorMetalBootstrapRequest(path: string, request: OperatorMetalBootstrapRequest): string;
+export declare function readOperatorGuestHostKeyEvidence(path: string, request?: OperatorMetalBootstrapRequest): OperatorGuestHostKeyEvidence;
+export declare function writeOperatorGuestHostKeyEvidence(path: string, evidence: OperatorGuestHostKeyEvidence, request?: OperatorMetalBootstrapRequest): string;
 export declare function planOperatorMetalBootstrap(request: OperatorMetalBootstrapRequest, mode: OperatorMetalBootstrapMode): OperatorMetalBootstrapPlan;
 export declare function planOperatorPlatformBootstrap(request: OperatorPlatformBootstrapRequest, mode: OperatorPlatformBootstrapMode): OperatorPlatformBootstrapPlan;
 /** Exact non-secret coordinates derived from the same reviewed files bootstrap applies. */
 export declare function operatorPlatformFleetCoordinates(fleet: OperatorPlatformBootstrapFleetRequest): OperatorPlatformFleetCoordinates;
 export declare function planOperatorPlatformFleetBootstrap(fleet: OperatorPlatformBootstrapFleetRequest, mode: OperatorPlatformBootstrapMode): OperatorPlatformBootstrapFleetPlan;
+export declare function collectOperatorGuestHostKeys(request: OperatorMetalBootstrapRequest, options?: OperatorPlatformBootstrapOptions, includeRehearsal?: boolean): Promise<OperatorGuestHostKeyEvidence>;
+export interface OperatorGuestTransport {
+    run(nodeName: string, argv: readonly string[], options?: {
+        stdin?: string;
+        secret?: boolean;
+        allowFailure?: boolean;
+    }): Promise<OperatorCommandResult>;
+    copy(nodeName: string, localPath: string, remotePath: string): Promise<void>;
+}
+/**
+ * Execute a bounded callback through the same pinned Metal jump, operator
+ * public identity selector and reviewed guest host keys used by bootstrap.
+ */
+export declare function withOperatorGuestTransport<T>(request: OperatorMetalBootstrapRequest, evidence: OperatorGuestHostKeyEvidence, callback: (transport: OperatorGuestTransport) => Promise<T>, options?: OperatorPlatformBootstrapOptions): Promise<T>;
 /**
  * Run one reviewed operator action. No private SSH key, credential value or
  * management token is placed in argv; OpenSSH selects the matching private key

package/dist/operator-bootstrap.js

@@ -1396,7 +1396,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.67";
+var VERSION = "0.1.68";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -6079,6 +6079,48 @@ function writeOperatorMetalBootstrapRequest(path, request) {
   validateMetalRequestValue(request);
   return writeOwnerJson2(path, request, "operator metal request");
 }
+var validateGuestHostKeyEvidenceValue = (value, request) => {
+  const root = exactKeys3(value, ["format", "kind", "metalHostKeySha256", "nodes"], "operator guest host-key evidence");
+  if (root.format !== 1 || root.kind !== "forgezero-operator-guest-host-keys" || typeof root.metalHostKeySha256 !== "string" || !Array.isArray(root.nodes)) {
+    throw new Error("operator guest host-key evidence is malformed");
+  }
+  const nodes = root.nodes.map((value2, index) => {
+    const row = exactKeys3(value2, ["name", "address", "hostKey", "hostKeySha256"], `operator guest host key ${index + 1}`);
+    if (typeof row.name !== "string" || typeof row.address !== "string") {
+      throw new Error("operator guest host-key identity is malformed");
+    }
+    const hop = validateHop({
+      address: row.address,
+      port: 22,
+      user: "forgezero",
+      hostKey: row.hostKey,
+      hostKeySha256: row.hostKeySha256
+    }, `operator guest host key ${row.name}`);
+    return { name: row.name, address: hop.address, hostKey: hop.hostKey, hostKeySha256: hop.hostKeySha256 };
+  });
+  if (new Set(nodes.map(({ name }) => name)).size !== nodes.length || new Set(nodes.map(({ address }) => address)).size !== nodes.length) {
+    throw new Error("operator guest host-key identities must be unique");
+  }
+  if (request) {
+    const expected = nodes.length === request.genesis.nodes.length ? [...request.genesis.nodes] : [...request.genesis.nodes, ...request.genesis.rehearsalNode ? [request.genesis.rehearsalNode] : []];
+    if (root.metalHostKeySha256 !== request.target.hostKeySha256 || ![request.genesis.nodes.length, request.genesis.nodes.length + (request.genesis.rehearsalNode ? 1 : 0)].includes(nodes.length) || nodes.length !== expected.length || expected.some((guest, index) => nodes[index]?.name !== guest.name || nodes[index]?.address !== guest.address)) {
+      throw new Error("operator guest host-key evidence does not match the reviewed Metal request");
+    }
+  }
+  return {
+    format: 1,
+    kind: "forgezero-operator-guest-host-keys",
+    metalHostKeySha256: root.metalHostKeySha256,
+    nodes
+  };
+};
+function readOperatorGuestHostKeyEvidence(path, request) {
+  const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator guest host-key evidence")));
+  return validateGuestHostKeyEvidenceValue(value, request);
+}
+function writeOperatorGuestHostKeyEvidence(path, evidence, request) {
+  return writeOwnerJson2(path, validateGuestHostKeyEvidenceValue(evidence, request), "operator guest host-key evidence");
+}
 function planOperatorMetalBootstrap(request, mode) {
   const config = readMetalBootstrapConfig(request.metalConfigFile);
   const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
@@ -6086,19 +6128,20 @@ function planOperatorMetalBootstrap(request, mode) {
     throw new Error("the reviewed metal request has no rehearsal node");
   }
   const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
+  const genesisNodes = mode === "host-keys" ? request.genesis.nodes.map(({ name }) => name) : mode === "rehearsal-host-keys" ? guestRows(request).map(({ name }) => name) : claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name));
   return {
     kind: "metal-remote",
     mode,
-    mutation: mode !== "status",
+    mutation: !["status", "host-keys", "rehearsal-host-keys"].includes(mode),
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "host-keys" || mode === "rehearsal-host-keys" ? ["verify pinned SSH transport", "collect exact Ed25519 host keys for the reviewed guest addresses"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
       "run typed fz bootstrap metal --apply",
       "remove transient local and remote staging data"
     ],
-    genesisNodes: claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name)),
+    genesisNodes,
     secretInputs: config.agentSeedFile ? ["metal-agent-seed"] : []
   };
 }
@@ -6335,6 +6378,116 @@ var copy = async (exec, request, knownHosts, local, remotePath, secret = false)
     `${destination2(request.target)}:${remotePath}`
   ], "secure copy", { secret });
 };
+var guestRows = (request) => [
+  ...request.genesis.nodes,
+  ...request.genesis.rehearsalNode ? [request.genesis.rehearsalNode] : []
+];
+var parsedScannedHostKey = (output, address) => {
+  const keys = output.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.startsWith(`${address} ssh-ed25519 `)).map((line) => line.split(/\s+/).slice(1, 3).join(" "));
+  const unique = [...new Set(keys)];
+  if (unique.length !== 1 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}$/.test(unique[0])) {
+    throw new Error(`guest ${address} did not return one exact Ed25519 host key`);
+  }
+  return unique[0];
+};
+async function collectOperatorGuestHostKeys(request, options = {}, includeRehearsal = false) {
+  publicIdentity(request.target.identityPublicKeyFile);
+  socketPath(request.target.agentSocket);
+  const exec = options.exec ?? defaultExec3;
+  const directory = mkdtempSync(join6(tmpdir(), "forgezero-operator-host-keys-"));
+  try {
+    const knownHosts = writeKnownHosts(request, directory);
+    const nodes = [];
+    for (const guest of includeRehearsal ? guestRows(request) : request.genesis.nodes) {
+      const output = await remote(exec, request, knownHosts, [
+        "/usr/bin/ssh-keyscan",
+        "-T",
+        "10",
+        "-t",
+        "ed25519",
+        guest.address
+      ], `collect ${guest.name} SSH host key`);
+      const hostKey = parsedScannedHostKey(output, guest.address);
+      nodes.push({
+        name: guest.name,
+        address: guest.address,
+        hostKey,
+        hostKeySha256: fingerprint(hostKey)
+      });
+    }
+    return validateGuestHostKeyEvidenceValue({
+      format: 1,
+      kind: "forgezero-operator-guest-host-keys",
+      metalHostKeySha256: request.target.hostKeySha256,
+      nodes
+    }, request);
+  } finally {
+    rmSync6(directory, { recursive: true, force: true });
+  }
+}
+async function withOperatorGuestTransport(request, evidence, callback, options = {}) {
+  const reviewed = validateGuestHostKeyEvidenceValue(evidence, request);
+  publicIdentity(request.target.identityPublicKeyFile);
+  socketPath(request.target.agentSocket);
+  const exec = options.exec ?? defaultExec3;
+  const directory = mkdtempSync(join6(tmpdir(), "forgezero-operator-guest-transport-"));
+  try {
+    const byName = new Map(reviewed.nodes.map((node) => [node.name, node]));
+    const requests = new Map;
+    const knownHosts = new Map;
+    for (const node of reviewed.nodes) {
+      const nodeDirectory = join6(directory, node.name);
+      mkdirSync8(nodeDirectory, { mode: 448 });
+      const guestRequest = {
+        target: {
+          address: node.address,
+          port: 22,
+          user: "forgezero",
+          hostKey: node.hostKey,
+          hostKeySha256: node.hostKeySha256,
+          identityPublicKeyFile: request.target.identityPublicKeyFile,
+          agentSocket: request.target.agentSocket,
+          jump: {
+            address: request.target.address,
+            port: request.target.port,
+            user: request.target.user,
+            hostKey: request.target.hostKey,
+            hostKeySha256: request.target.hostKeySha256
+          }
+        }
+      };
+      requests.set(node.name, guestRequest);
+      knownHosts.set(node.name, writeKnownHosts(guestRequest, nodeDirectory));
+    }
+    const transport = {
+      async run(nodeName, argv, runOptions = {}) {
+        if (!byName.has(nodeName))
+          throw new Error(`guest transport node ${nodeName} is not reviewed`);
+        argv.forEach(safeRemoteArg);
+        const nodeRequest = requests.get(nodeName);
+        const result = await exec([
+          "ssh",
+          ...sshOptions(nodeRequest, knownHosts.get(nodeName)),
+          destination2(nodeRequest.target),
+          "--",
+          ...argv
+        ], { stdin: runOptions.stdin, secret: runOptions.secret });
+        if (result.exitCode !== 0 && !runOptions.allowFailure) {
+          throw new Error(`${nodeName} remote operation failed${result.output ? `: ${result.output.trim()}` : ""}`);
+        }
+        return result;
+      },
+      async copy(nodeName, localPath, remotePath) {
+        if (!byName.has(nodeName))
+          throw new Error(`guest transport node ${nodeName} is not reviewed`);
+        await copy(exec, requests.get(nodeName), knownHosts.get(nodeName), localPath, remotePath);
+      }
+    };
+    return await callback(transport);
+  } finally {
+    rmSync6(directory, { recursive: true, force: true });
+  }
+}
 async function stageConfig(config, directory) {
   const rewritten = structuredClone(config);
   const staged = [];
@@ -6546,6 +6699,12 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       const output2 = await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "status"], "remote metal status");
       return { plan, output: output2 };
     }
+    if (mode === "host-keys" || mode === "rehearsal-host-keys") {
+      return {
+        plan,
+        output: JSON.stringify(await collectOperatorGuestHostKeys(request, { ...options, exec }, mode === "rehearsal-host-keys"))
+      };
+    }
     if (mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
       if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
@@ -6592,15 +6751,19 @@ export {
   writeOperatorPlatformBootstrapRequest,
   writeOperatorPlatformBootstrapFleetRequest,
   writeOperatorMetalBootstrapRequest,
+  writeOperatorGuestHostKeyEvidence,
+  withOperatorGuestTransport,
   verifyOperatorPlatformFleet,
   readOperatorPlatformBootstrapRequest,
   readOperatorPlatformBootstrapFleetRequest,
   readOperatorMetalBootstrapRequest,
+  readOperatorGuestHostKeyEvidence,
   planOperatorPlatformFleetBootstrap,
   planOperatorPlatformBootstrap,
   planOperatorMetalBootstrap,
   operatorPlatformFleetCoordinates,
   createOperatorSshHop,
+  collectOperatorGuestHostKeys,
   applyOperatorPlatformFleetBootstrap,
   applyOperatorPlatformBootstrap,
   applyOperatorMetalBootstrap

package/dist/platform-fleet-verification.js

@@ -2125,7 +2125,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.67";
+var VERSION3 = "0.1.68";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -2125,7 +2125,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.67";
+var VERSION3 = "0.1.68";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.67";
+export declare const VERSION = "0.1.68";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.67",
+  "version": "0.1.68",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",