@forgezero/agent 0.1.67 → 0.1.69

package/README.md

@@ -532,22 +532,26 @@ await readBootstrapBundle(built.bundlePath, built.manifestPath);
 <a id="forgezero-agent-operator-bootstrap"></a>
 ## @forgezero/agent/operator-bootstrap
 
-Pinned-host operator transport that stages owner-only handoffs and invokes the same typed platform bootstrap through the caller-approved SSH agent. This entry exposes 15 named value exports and 15 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Pinned-host operator transport that stages owner-only handoffs and invokes the same typed platform bootstrap through the caller-approved SSH agent. This entry exposes 19 named value exports and 17 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
 import {
   applyOperatorMetalBootstrap,
   applyOperatorPlatformBootstrap,
   applyOperatorPlatformFleetBootstrap,
+  collectOperatorGuestHostKeys,
   createOperatorSshHop,
   operatorPlatformFleetCoordinates,
   planOperatorMetalBootstrap,
   planOperatorPlatformBootstrap,
   planOperatorPlatformFleetBootstrap,
+  readOperatorGuestHostKeyEvidence,
   readOperatorMetalBootstrapRequest,
   readOperatorPlatformBootstrapFleetRequest,
   readOperatorPlatformBootstrapRequest,
   verifyOperatorPlatformFleet,
+  withOperatorGuestTransport,
+  writeOperatorGuestHostKeyEvidence,
   writeOperatorMetalBootstrapRequest,
   writeOperatorPlatformBootstrapFleetRequest,
   writeOperatorPlatformBootstrapRequest,
@@ -556,6 +560,8 @@ import {
 import type {
   OperatorCommand,
   OperatorCommandResult,
+  OperatorGuestHostKeyEvidence,
+  OperatorGuestTransport,
   OperatorMetalBootstrapMode,
   OperatorMetalBootstrapPlan,
   OperatorMetalBootstrapRequest,

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.67";
+var VERSION3 = "0.1.69";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/attended-platform-bootstrap.d.ts

@@ -0,0 +1,22 @@
+import { finalizeCloudflareBootstrapAcceptance, runAttendedCloudflareBootstrap, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapEvidence } from './cloudflare-bootstrap';
+import { applyOperatorPlatformFleetBootstrap, type OperatorPlatformBootstrapFleetRequest, type OperatorPlatformBootstrapFleetResult } from './operator-bootstrap';
+import type { PlatformBootstrapSecrets } from './bootstrap';
+export interface AttendedPlatformBootstrapResult {
+    kind: 'forgezero-attended-platform-bootstrap';
+    ok: boolean;
+    edge: CloudflareBootstrapEvidence;
+    fleet: OperatorPlatformBootstrapFleetResult;
+    acceptance?: CloudflareBootstrapAcceptanceEvidence;
+    inviteUrl?: string;
+}
+export interface AttendedPlatformBootstrapDependencies {
+    cloudflare?: typeof runAttendedCloudflareBootstrap;
+    fleet?: typeof applyOperatorPlatformFleetBootstrap;
+    finalize?: typeof finalizeCloudflareBootstrapAcceptance;
+}
+/**
+ * The sole attended genesis composition boundary. All non-secret coordinates
+ * are checked before the first Cloudflare or SSH mutation. Secret values exist
+ * only in this call and the authenticated SSH stdin used by the fleet runner.
+ */
+export declare function applyAttendedPlatformBootstrap(fleetRequest: OperatorPlatformBootstrapFleetRequest, cloudflareRequest: AttendedCloudflareBootstrapRequest, acceptancePath: string, secrets: PlatformBootstrapSecrets, dependencies?: AttendedPlatformBootstrapDependencies): Promise<AttendedPlatformBootstrapResult>;

package/dist/bootstrap.js

@@ -1396,7 +1396,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.67";
+var VERSION = "0.1.69";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4380,6 +4380,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   }
   bindBootstrapIntent(host, config);
   const plan = planBootstrap(config, host.exists(STATE_PATH));
+  await checked3(host, ["hostnamectl", "set-hostname", "--static", config.nodeHostname], "compute hostname");
   const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
   host.mkdir(CREDS, 448);
   host.mkdir("/var/lib/forgezero", 448);

package/dist/fz-agent.js

@@ -8588,7 +8588,7 @@ import { join as join3 } from "path";
 import { fileURLToPath } from "url";
 
 // src/version.ts
-var VERSION2 = "0.1.67";
+var VERSION2 = "0.1.69";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4829,7 +4829,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.67";
+var VERSION2 = "0.1.69";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -14399,6 +14399,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   }
   bindBootstrapIntent(host, config);
   const plan = planBootstrap(config, host.exists(STATE_PATH));
+  await checked3(host, ["hostnamectl", "set-hostname", "--static", config.nodeHostname], "compute hostname");
   const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
   host.mkdir(CREDS, 448);
   host.mkdir("/var/lib/forgezero", 448);
@@ -15076,6 +15077,14 @@ async function runCloudflareBootstrapFinalizeCommand(configPath, dependencies =
   return evidence;
 }
 
+// src/operator-bootstrap.ts
+import { createHash as createHash6, randomBytes as randomBytes9 } from "crypto";
+import { chmodSync as chmodSync6, lstatSync as lstatSync7, mkdirSync as mkdirSync12, mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "fs";
+import { isIP as isIP6 } from "net";
+import { tmpdir } from "os";
+import { basename as basename2, dirname as dirname13, isAbsolute as isAbsolute5, join as join10, resolve as resolve9 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+
 // src/metal-bootstrap.ts
 import { createHash as createHash5, randomBytes as randomBytes8 } from "crypto";
 import {
@@ -15986,12 +15995,6 @@ async function metalBootstrapStatus(exec = defaultExec2) {
 }
 
 // src/operator-bootstrap.ts
-import { createHash as createHash6, randomBytes as randomBytes9 } from "crypto";
-import { chmodSync as chmodSync6, lstatSync as lstatSync7, mkdirSync as mkdirSync12, mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "fs";
-import { isIP as isIP6 } from "net";
-import { tmpdir } from "os";
-import { basename as basename2, dirname as dirname13, isAbsolute as isAbsolute5, join as join10, resolve as resolve9 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
 var REQUEST_LIMIT = 64 * 1024;
 var SECRET_LIMIT = 256 * 1024;
 var REMOTE_STAGE = "/run/forgezero-operator-bootstrap";
@@ -16129,7 +16132,12 @@ function writeOperatorPlatformBootstrapRequest(path, request) {
 }
 function readOperatorPlatformBootstrapFleetRequest(path) {
   const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator fleet request")));
-  const root = exactKeys5(value, ["kind", "requests"], "operator fleet request");
+  const root = exactKeys5(value, [
+    "kind",
+    "requests",
+    "cloudflareConfigFile",
+    "cloudflareAcceptanceFile"
+  ], "operator fleet request");
   if (root.kind !== "platform-fleet-remote")
     throw new Error("operator fleet kind must be platform-fleet-remote");
   if (!Array.isArray(root.requests) || root.requests.length !== 3 || root.requests.some((entry) => typeof entry !== "string")) {
@@ -16140,10 +16148,25 @@ function readOperatorPlatformBootstrapFleetRequest(path) {
     throw new Error("operator fleet request files must be unique");
   for (const request of requests)
     readOperatorPlatformBootstrapRequest(request);
-  return { kind: "platform-fleet-remote", requests };
+  if (typeof root.cloudflareConfigFile !== "string" || typeof root.cloudflareAcceptanceFile !== "string") {
+    throw new Error("operator fleet requires Cloudflare coordinates and an acceptance evidence path");
+  }
+  const cloudflareConfigFile = canonicalOutputPath(root.cloudflareConfigFile, "operator fleet Cloudflare config");
+  const cloudflareAcceptanceFile = canonicalOutputPath(root.cloudflareAcceptanceFile, "operator fleet Cloudflare acceptance evidence");
+  return {
+    kind: "platform-fleet-remote",
+    requests,
+    cloudflareConfigFile,
+    cloudflareAcceptanceFile
+  };
 }
-function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles) {
-  const request = { kind: "platform-fleet-remote", requests: requestFiles };
+function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles, cloudflare) {
+  const request = {
+    kind: "platform-fleet-remote",
+    requests: requestFiles,
+    cloudflareConfigFile: canonicalOutputPath(cloudflare.configFile, "operator fleet Cloudflare config"),
+    cloudflareAcceptanceFile: canonicalOutputPath(cloudflare.acceptanceFile, "operator fleet Cloudflare acceptance evidence")
+  };
   if (new Set(requestFiles).size !== 3)
     throw new Error("operator fleet request files must be unique");
   for (const file of requestFiles)
@@ -16237,6 +16260,48 @@ function writeOperatorMetalBootstrapRequest(path, request) {
   validateMetalRequestValue(request);
   return writeOwnerJson2(path, request, "operator metal request");
 }
+var validateGuestHostKeyEvidenceValue = (value, request) => {
+  const root = exactKeys5(value, ["format", "kind", "metalHostKeySha256", "nodes"], "operator guest host-key evidence");
+  if (root.format !== 1 || root.kind !== "forgezero-operator-guest-host-keys" || typeof root.metalHostKeySha256 !== "string" || !Array.isArray(root.nodes)) {
+    throw new Error("operator guest host-key evidence is malformed");
+  }
+  const nodes = root.nodes.map((value2, index) => {
+    const row2 = exactKeys5(value2, ["name", "address", "hostKey", "hostKeySha256"], `operator guest host key ${index + 1}`);
+    if (typeof row2.name !== "string" || typeof row2.address !== "string") {
+      throw new Error("operator guest host-key identity is malformed");
+    }
+    const hop = validateHop({
+      address: row2.address,
+      port: 22,
+      user: "forgezero",
+      hostKey: row2.hostKey,
+      hostKeySha256: row2.hostKeySha256
+    }, `operator guest host key ${row2.name}`);
+    return { name: row2.name, address: hop.address, hostKey: hop.hostKey, hostKeySha256: hop.hostKeySha256 };
+  });
+  if (new Set(nodes.map(({ name }) => name)).size !== nodes.length || new Set(nodes.map(({ address }) => address)).size !== nodes.length) {
+    throw new Error("operator guest host-key identities must be unique");
+  }
+  if (request) {
+    const expected = nodes.length === request.genesis.nodes.length ? [...request.genesis.nodes] : [...request.genesis.nodes, ...request.genesis.rehearsalNode ? [request.genesis.rehearsalNode] : []];
+    if (root.metalHostKeySha256 !== request.target.hostKeySha256 || ![request.genesis.nodes.length, request.genesis.nodes.length + (request.genesis.rehearsalNode ? 1 : 0)].includes(nodes.length) || nodes.length !== expected.length || expected.some((guest, index) => nodes[index]?.name !== guest.name || nodes[index]?.address !== guest.address)) {
+      throw new Error("operator guest host-key evidence does not match the reviewed Metal request");
+    }
+  }
+  return {
+    format: 1,
+    kind: "forgezero-operator-guest-host-keys",
+    metalHostKeySha256: root.metalHostKeySha256,
+    nodes
+  };
+};
+function readOperatorGuestHostKeyEvidence(path, request) {
+  const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator guest host-key evidence")));
+  return validateGuestHostKeyEvidenceValue(value, request);
+}
+function writeOperatorGuestHostKeyEvidence(path, evidence, request) {
+  return writeOwnerJson2(path, validateGuestHostKeyEvidenceValue(evidence, request), "operator guest host-key evidence");
+}
 function planOperatorMetalBootstrap(request, mode) {
   const config = readMetalBootstrapConfig(request.metalConfigFile);
   const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
@@ -16244,19 +16309,20 @@ function planOperatorMetalBootstrap(request, mode) {
     throw new Error("the reviewed metal request has no rehearsal node");
   }
   const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
+  const genesisNodes = mode === "host-keys" ? request.genesis.nodes.map(({ name }) => name) : mode === "rehearsal-host-keys" ? guestRows(request).map(({ name }) => name) : claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name));
   return {
     kind: "metal-remote",
     mode,
-    mutation: mode !== "status",
+    mutation: !["status", "host-keys", "rehearsal-host-keys"].includes(mode),
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "host-keys" || mode === "rehearsal-host-keys" ? ["verify pinned SSH transport", "collect exact Ed25519 host keys for the reviewed guest addresses"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
       "run typed fz bootstrap metal --apply",
       "remove transient local and remote staging data"
     ],
-    genesisNodes: claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name)),
+    genesisNodes,
     secretInputs: config.agentSeedFile ? ["metal-agent-seed"] : []
   };
 }
@@ -16353,6 +16419,20 @@ function validatedPlatformFleet(fleet) {
   }
   return { requests, configs, environment };
 }
+function operatorPlatformFleetCoordinates(fleet) {
+  const { requests, configs, environment } = validatedPlatformFleet(fleet);
+  return {
+    environment,
+    appOrigin: configs[0].runtime.environment.appOrigin,
+    apiOrigin: configs[0].runtime.environment.apiOrigin,
+    nodes: configs.map((config, index) => ({
+      computeReference: config.computeReference,
+      address: requests[index].target.address,
+      nodeHostname: config.nodeHostname,
+      databaseRole: config.database.role
+    }))
+  };
+}
 function planOperatorPlatformFleetBootstrap(fleet, mode) {
   const { requests, configs, environment } = validatedPlatformFleet(fleet);
   const secretInputs = mode === "apply" ? attendedSecretNames(configs[0]) : [];
@@ -16479,6 +16559,53 @@ var copy = async (exec, request, knownHosts, local, remotePath, secret = false)
     `${destination2(request.target)}:${remotePath}`
   ], "secure copy", { secret });
 };
+var guestRows = (request) => [
+  ...request.genesis.nodes,
+  ...request.genesis.rehearsalNode ? [request.genesis.rehearsalNode] : []
+];
+var parsedScannedHostKey = (output, address) => {
+  const keys = output.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.startsWith(`${address} ssh-ed25519 `)).map((line) => line.split(/\s+/).slice(1, 3).join(" "));
+  const unique = [...new Set(keys)];
+  if (unique.length !== 1 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}$/.test(unique[0])) {
+    throw new Error(`guest ${address} did not return one exact Ed25519 host key`);
+  }
+  return unique[0];
+};
+async function collectOperatorGuestHostKeys(request, options = {}, includeRehearsal = false) {
+  publicIdentity(request.target.identityPublicKeyFile);
+  socketPath(request.target.agentSocket);
+  const exec = options.exec ?? defaultExec3;
+  const directory = mkdtempSync(join10(tmpdir(), "forgezero-operator-host-keys-"));
+  try {
+    const knownHosts = writeKnownHosts(request, directory);
+    const nodes = [];
+    for (const guest of includeRehearsal ? guestRows(request) : request.genesis.nodes) {
+      const output = await remote(exec, request, knownHosts, [
+        "/usr/bin/ssh-keyscan",
+        "-T",
+        "10",
+        "-t",
+        "ed25519",
+        guest.address
+      ], `collect ${guest.name} SSH host key`);
+      const hostKey = parsedScannedHostKey(output, guest.address);
+      nodes.push({
+        name: guest.name,
+        address: guest.address,
+        hostKey,
+        hostKeySha256: fingerprint(hostKey)
+      });
+    }
+    return validateGuestHostKeyEvidenceValue({
+      format: 1,
+      kind: "forgezero-operator-guest-host-keys",
+      metalHostKeySha256: request.target.hostKeySha256,
+      nodes
+    }, request);
+  } finally {
+    rmSync7(directory, { recursive: true, force: true });
+  }
+}
 async function stageConfig(config, directory) {
   const rewritten = structuredClone(config);
   const staged = [];
@@ -16658,6 +16785,12 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       const output2 = await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "status"], "remote metal status");
       return { plan, output: output2 };
     }
+    if (mode === "host-keys" || mode === "rehearsal-host-keys") {
+      return {
+        plan,
+        output: JSON.stringify(await collectOperatorGuestHostKeys(request, { ...options, exec }, mode === "rehearsal-host-keys"))
+      };
+    }
     if (mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
       if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
@@ -16701,6 +16834,47 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
   }
 }
 
+// src/attended-platform-bootstrap.ts
+var invitationFrom = (fleet, master) => {
+  const output = fleet.outcomes.find(({ computeReference }) => computeReference === master)?.output;
+  try {
+    const parsed = JSON.parse(output ?? "");
+    if (typeof parsed.launch?.inviteUrl === "string")
+      return parsed.launch.inviteUrl;
+  } catch {}
+  throw new Error("platform bootstrap completed without the initial custodian invitation");
+};
+async function applyAttendedPlatformBootstrap(fleetRequest, cloudflareRequest, acceptancePath, secrets, dependencies = {}) {
+  if (cloudflareRequest.mode !== "apply")
+    throw new Error("attended platform bootstrap requires Cloudflare apply mode");
+  if (!secrets.cloudflareTunnelToken || !secrets.cloudflareApiToken) {
+    throw new Error("attended platform bootstrap requires both Cloudflare tokens");
+  }
+  const fleetCoordinates = operatorPlatformFleetCoordinates(fleetRequest);
+  if (cloudflareRequest.coordinates.nodes.length !== fleetCoordinates.nodes.length || fleetCoordinates.nodes.some((node, index) => {
+    const edge2 = cloudflareRequest.coordinates.nodes[index];
+    return edge2?.nodeName !== node.computeReference || edge2.hostname !== node.nodeHostname || edge2.service !== "http://127.0.0.1:3000";
+  })) {
+    throw new Error("Cloudflare coordinates do not match the exact reviewed platform fleet");
+  }
+  const edge = await (dependencies.cloudflare ?? runAttendedCloudflareBootstrap)({
+    ...cloudflareRequest,
+    tokens: {
+      tunnelToken: secrets.cloudflareTunnelToken,
+      apiToken: secrets.cloudflareApiToken
+    }
+  });
+  const fleet = await (dependencies.fleet ?? applyOperatorPlatformFleetBootstrap)(fleetRequest, "apply", { secrets });
+  if (!fleet.ok)
+    return { kind: "forgezero-attended-platform-bootstrap", ok: false, edge, fleet };
+  const inviteUrl = invitationFrom(fleet, fleetCoordinates.nodes[0].computeReference);
+  const acceptance = await (dependencies.finalize ?? finalizeCloudflareBootstrapAcceptance)({
+    checkpointPath: edge.checkpointFile,
+    acceptancePath
+  });
+  return { kind: "forgezero-attended-platform-bootstrap", ok: true, edge, fleet, acceptance, inviteUrl };
+}
+
 // src/platform-genesis-config.ts
 function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname, region) {
   const fleet = validatePlatformGenesisGuests(guests);
@@ -18002,9 +18176,12 @@ function writePlatformGenesisFleet(directory) {
   const output = genesisOutputDirectory(directory);
   const metalRequestFile = bootstrapAnswer("Owner-only metal remote request containing the reviewed genesis guests");
   const metalRequest = readOperatorMetalBootstrapRequest(metalRequestFile);
+  const guestHostKeysFile = bootstrapAnswer("Owner-only guest host-key evidence file");
+  const guestHostKeys = readOperatorGuestHostKeyEvidence(guestHostKeysFile, metalRequest);
   const fleet = metalRequest.genesis.nodes;
   const metalHostname = readMetalBootstrapConfig(metalRequest.metalConfigFile).metalHostname;
-  const template = interactiveBootstrap("platform", fleet);
+  const checkpointPath = join12(output, "cloudflare-handoff.json");
+  const template = interactiveBootstrap("platform", fleet, checkpointPath);
   const region = {
     label: bootstrapAnswer(`Region ${template.runtime.environment.nodeRegion} display label`),
     country: bootstrapAnswer("Region ISO 3166-1 alpha-2 country code").toUpperCase(),
@@ -18012,32 +18189,65 @@ function writePlatformGenesisFleet(directory) {
   };
   const nodes = fleet.map((guest, index) => index === 0 ? {
     nodeHostname: template.nodeHostname,
-    cloudflareHandoffFile: template.cloudflareHandoff.handoffFile
+    cloudflareHandoffFile: cloudflareHostHandoffPath(checkpointPath, guest.name)
   } : {
     nodeHostname: bootstrapAnswer(`${guest.name} public node hostname`),
-    cloudflareHandoffFile: bootstrapAnswer(`${guest.name} node-specific Cloudflare host handoff`)
+    cloudflareHandoffFile: cloudflareHostHandoffPath(checkpointPath, guest.name)
   });
+  const realtimeEnabled = bootstrapBoolean("Configure existing Worker realtime fan-out?", "yes");
+  const cloudflareConfig = writeBootstrapConfig(join12(output, "cloudflare.json"), createCloudflareBootstrapCommandConfig({
+    checkpointPath,
+    coordinates: {
+      accountId: bootstrapAnswer("Cloudflare account id"),
+      zoneId: bootstrapAnswer("Cloudflare zone id"),
+      kvNamespaceId: bootstrapAnswer("Existing Worker-bound KV namespace id"),
+      ...realtimeEnabled ? { realtime: {
+        workerScriptName: bootstrapAnswer("Existing Worker script name"),
+        endpoint: bootstrapAnswer("Stable public Worker HTTPS endpoint"),
+        producer: bootstrapAnswer("Realtime producer identity", "platform-api")
+      } } : {},
+      nodes: fleet.map((guest, index) => ({
+        nodeName: guest.name,
+        hostname: nodes[index].nodeHostname,
+        service: "http://127.0.0.1:3000",
+        tunnelName: bootstrapAnswer(`${guest.name} Tunnel name`, guest.name)
+      }))
+    }
+  }));
+  const cloudflareAcceptance = join12(output, "cloudflare-acceptance.json");
   const configs = platformGenesisBootstrapConfigs(template, fleet, nodes, metalHostname, region).map((config) => {
     const path = `${output}/${config.computeReference}-platform.json`;
     writeBootstrapConfig(path, config);
     return path;
   });
-  const identity = operatorIdentityCoordinates();
-  const useJump = bootstrapBoolean("Reach genesis computes through the Metal SSH jump?", "yes");
-  const jump = useJump ? interactiveOperatorHop("Metal jump", { user: "root" }) : undefined;
   const requests = configs.map((platformConfigFile, index) => {
     const guest = fleet[index];
-    const target = interactiveOperatorHop(`${guest.name} compute`, { address: guest.address, user: "forgezero" });
+    const host = guestHostKeys.nodes.find(({ name }) => name === guest.name);
     return writeOperatorPlatformBootstrapRequest(join12(output, `${guest.name}-remote.json`), {
       kind: "platform-remote",
       platformConfigFile,
-      target: { ...target, ...identity, ...jump ? { jump } : {} }
+      target: {
+        address: guest.address,
+        port: 22,
+        user: "forgezero",
+        hostKey: host.hostKey,
+        hostKeySha256: host.hostKeySha256,
+        identityPublicKeyFile: metalRequest.target.identityPublicKeyFile,
+        agentSocket: metalRequest.target.agentSocket,
+        jump: {
+          address: metalRequest.target.address,
+          port: metalRequest.target.port,
+          user: metalRequest.target.user,
+          hostKey: metalRequest.target.hostKey,
+          hostKeySha256: metalRequest.target.hostKeySha256
+        }
+      }
     });
   });
-  const fleetRequest = writeOperatorPlatformBootstrapFleetRequest(join12(output, "platform-fleet-remote.json"), requests);
-  return { configs, requests, fleetRequest };
+  const fleetRequest = writeOperatorPlatformBootstrapFleetRequest(join12(output, "platform-fleet-remote.json"), requests, { configFile: cloudflareConfig, acceptanceFile: cloudflareAcceptance });
+  return { configs, requests, fleetRequest, cloudflareConfig, cloudflareAcceptance };
 }
-function interactiveBootstrap(kind, genesisGuests) {
+function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint) {
   if (!process.stdin.isTTY)
     throw new Error("non-interactive bootstrap requires --bootstrap-config <private-json-file>");
   const environment = bootstrapAnswer("Environment (production/development)", "production");
@@ -18077,7 +18287,7 @@ function interactiveBootstrap(kind, genesisGuests) {
   const backupRegion = backupEndpoint ? bootstrapAnswer("Backup S3 region") : undefined;
   const backupBucket = backupEndpoint ? bootstrapAnswer("Backup S3 bucket") : undefined;
   const backupAccessKeyId = backupEndpoint ? bootstrapAnswer("Backup S3 access-key id") : undefined;
-  const cloudflareHandoffFile = bootstrapAnswer(genesis ? `${computeReference} node-specific Cloudflare host handoff` : "Node-specific Cloudflare host handoff (blank for no public edge)", genesis ? undefined : "");
+  const cloudflareHandoffFile = genesis ? cloudflareHostHandoffPath(genesisCloudflareCheckpoint, computeReference) : bootstrapAnswer("Node-specific Cloudflare host handoff (blank for no public edge)", "");
   const cloudflareNodeName = cloudflareHandoffFile ? bootstrapAnswer("Cloudflare handoff node name", computeReference) : undefined;
   const databaseNetworkMode = "private-lan";
   const enrolmentSource = genesis ? "genesis-derived" : bootstrapAnswer("Enrolment source (genesis-derived/api-token)", "genesis-derived");
@@ -18183,19 +18393,49 @@ async function cmdBootstrap(options, args) {
         throw new Error("remote platform fleet bootstrap requires --bootstrap-config");
       const fleet = readOperatorPlatformBootstrapFleetRequest(options.bootstrapConfigPath);
       const plan2 = planOperatorPlatformFleetBootstrap(fleet, mode);
+      const cloudflare = readCloudflareBootstrapCommandConfig(fleet.cloudflareConfigFile, options.apply && mode === "apply" ? "apply" : "plan");
+      const coordinates = operatorPlatformFleetCoordinates(fleet);
+      if (cloudflare.coordinates.nodes.length !== coordinates.nodes.length || coordinates.nodes.some((node, index) => {
+        const edge = cloudflare.coordinates.nodes[index];
+        return edge?.nodeName !== node.computeReference || edge.hostname !== node.nodeHostname || edge.service !== "http://127.0.0.1:3000";
+      })) {
+        throw new Error("Cloudflare coordinates do not match the exact reviewed platform fleet");
+      }
       if (!options.apply) {
-        out.line(JSON.stringify(plan2, null, 2));
-        out.step("Review all three pinned targets and shared secret names, then repeat with --apply.");
+        out.line(JSON.stringify({
+          kind: "forgezero-attended-platform-bootstrap-plan",
+          mutation: true,
+          cloudflare: {
+            checkpointFile: cloudflare.checkpointPath,
+            nodes: cloudflare.coordinates.nodes.map(({ nodeName, hostname: hostname2 }) => ({ nodeName, hostname: hostname2 }))
+          },
+          fleet: plan2,
+          acceptanceFile: fleet.cloudflareAcceptanceFile,
+          completion: ["public ingress verified", "initial custodian invitation printed"]
+        }, null, 2));
+        out.step("Review the complete Tunnel, hostname, bundle, credential and three-node plan, then repeat with --apply.");
         return 0;
       }
       const first = readOperatorPlatformBootstrapRequest(fleet.requests[0]);
       const firstConfig = readBootstrapConfig(first.platformConfigFile);
       if (firstConfig.kind !== "platform")
         throw new Error("remote platform fleet requires platform configs");
+      if (mode === "status") {
+        const result3 = await applyOperatorPlatformFleetBootstrap(fleet, mode);
+        out.line(JSON.stringify(result3, null, 2));
+        return result3.ok ? 0 : 1;
+      }
       const secrets2 = mode === "apply" ? await promptPlatformBootstrapSecrets(firstConfig) : undefined;
-      const result2 = await applyOperatorPlatformFleetBootstrap(fleet, mode, { secrets: secrets2 });
+      if (!secrets2?.cloudflareTunnelToken || !secrets2.cloudflareApiToken) {
+        throw new Error("attended platform bootstrap requires both Cloudflare tokens");
+      }
+      const result2 = await applyAttendedPlatformBootstrap(fleet, cloudflare, fleet.cloudflareAcceptanceFile, secrets2);
       out.line(JSON.stringify(result2, null, 2));
-      return result2.ok ? 0 : 1;
+      if (!result2.ok)
+        return 1;
+      out.line();
+      out.step(`Initial custodian invitation: ${result2.inviteUrl}`);
+      return 0;
     }
     if (operation === "platform" && args[1] === "remote") {
       const mode = args[2];
@@ -18232,11 +18472,14 @@ async function cmdBootstrap(options, args) {
     }
     if (operation === "metal" && args[1] === "remote") {
       const mode = args[2];
-      if (!mode || !["apply", "genesis", "rehearsal", "rehearsal-cleanup", "status"].includes(mode) || args[3] !== undefined) {
-        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|status> --bootstrap-config <owner-only-request.json> [--apply]");
+      if (!mode || !["apply", "genesis", "rehearsal", "rehearsal-cleanup", "host-keys", "rehearsal-host-keys", "status"].includes(mode) || args[3] !== undefined) {
+        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status> --bootstrap-config <owner-only-request.json> [--output <owner-only-evidence.json>] [--apply]");
       }
       if (!options.bootstrapConfigPath)
         throw new Error("remote metal bootstrap requires --bootstrap-config");
+      if ((mode === "host-keys" || mode === "rehearsal-host-keys") && !options.outputPath) {
+        throw new Error(`${mode} requires --output <absolute-owner-only-evidence.json>`);
+      }
       const request = readOperatorMetalBootstrapRequest(options.bootstrapConfigPath);
       const plan2 = planOperatorMetalBootstrap(request, mode);
       if (!options.apply) {
@@ -18244,7 +18487,15 @@ async function cmdBootstrap(options, args) {
         out.step("Review the pinned metal target and exact genesis nodes, then repeat with --apply to contact the host.");
         return 0;
       }
-      out.line(JSON.stringify(await applyOperatorMetalBootstrap(request, mode), null, 2));
+      const result2 = await applyOperatorMetalBootstrap(request, mode);
+      if (mode === "host-keys" || mode === "rehearsal-host-keys") {
+        const evidence = JSON.parse(result2.output);
+        const path = writeOperatorGuestHostKeyEvidence(options.outputPath, evidence, request);
+        readOperatorGuestHostKeyEvidence(path, request);
+        out.line(JSON.stringify({ plan: result2.plan, evidencePath: path, mode: "0600" }, null, 2));
+        return 0;
+      }
+      out.line(JSON.stringify(result2, null, 2));
       return 0;
     }
     if (operation === "platform" && args[1] === "cloudflare") {
@@ -18332,7 +18583,7 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (!["platform", "repair"].includes(operation)) {
-      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|status>]|status|repair [--bootstrap-config <path>] [--apply]");
+      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>]|status|repair [--bootstrap-config <path>] [--apply]");
     }
     const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
       throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
@@ -18911,14 +19162,16 @@ function usage() {
 	                         Run typed bootstrap from the operator laptop through
 	                         a pinned host; apply copies and verifies that bundle
 	 fz bootstrap platform fleet <apply|status>
-	                         Validate the exact three-node genesis identity, prompt
-	                         shared secrets once and run all pinned nodes concurrently
+	                         One attended genesis operation: reconcile public
+	                         hostnames/Tunnels, seal credentials, deploy the bundle,
+	                         run all three nodes, verify ingress and print the invite
 	 fz bootstrap platform   Install/repair a typed elastic platform compute
 	 fz bootstrap config <metal|platform|cloudflare>
 	                         Write validated owner-only metal config+remote request,
-	                         Cloudflare file, or complete three-node platform request set
+	                         low-level Cloudflare file, or the complete three-node
+	                         platform + Cloudflare request set
 	 fz bootstrap platform cloudflare
-	                         Plan/apply attended Tunnel and DNS reconciliation
+	                         Low-level resume/diagnostic Tunnel and DNS reconciliation
 	                         using hidden management and KV/Worker runtime token prompts
 	 fz bootstrap platform cloudflare verify
 	                         From the operator laptop, prove every ordinary public
@@ -18927,7 +19180,7 @@ function usage() {
 	                         Persist secret-free public-node acceptance, then remove
 	                         the completed non-secret checkpoint and node handoffs
 	 fz bootstrap metal      Plan/install an identity-only physical provisioner
-	 fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|status>
+	 fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>
 	                         Install/bootstrap one pinned blank metal target, then
 	                         provision the exact selected three-node genesis seed
 	 fz bootstrap status     Verify persisted profile and supervised units

package/dist/metal-bootstrap.js

@@ -354,7 +354,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.67";
+var VERSION = "0.1.69";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.d.ts

@@ -26,9 +26,24 @@ export interface OperatorMetalBootstrapRequest {
         sshPublicKeyFiles: string[];
     };
 }
+export interface OperatorGuestHostKeyEvidence {
+    format: 1;
+    kind: 'forgezero-operator-guest-host-keys';
+    metalHostKeySha256: string;
+    nodes: readonly {
+        name: string;
+        address: string;
+        hostKey: string;
+        hostKeySha256: string;
+    }[];
+}
 export interface OperatorPlatformBootstrapFleetRequest {
     kind: 'platform-fleet-remote';
     requests: readonly [string, string, string];
+    /** Reviewed non-secret coordinates for the attended Tunnel/DNS/KV/DO phase. */
+    cloudflareConfigFile: string;
+    /** Secret-free evidence retained after checkpoint and host handoffs are consumed. */
+    cloudflareAcceptanceFile: string;
 }
 export interface OperatorPlatformBootstrapFleetPlan {
     kind: 'platform-fleet-remote';
@@ -66,7 +81,7 @@ export interface OperatorPlatformFleetCoordinates {
     }[];
 }
 export type OperatorPlatformBootstrapMode = 'apply' | 'status';
-export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'rehearsal' | 'rehearsal-cleanup' | 'status';
+export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'rehearsal' | 'rehearsal-cleanup' | 'host-keys' | 'rehearsal-host-keys' | 'status';
 export interface OperatorPlatformBootstrapPlan {
     kind: 'platform-remote';
     mode: OperatorPlatformBootstrapMode;
@@ -112,14 +127,33 @@ export declare function createOperatorSshHop(input: Omit<OperatorSshHop, 'hostKe
 export declare function readOperatorPlatformBootstrapRequest(path: string): OperatorPlatformBootstrapRequest;
 export declare function writeOperatorPlatformBootstrapRequest(path: string, request: OperatorPlatformBootstrapRequest): string;
 export declare function readOperatorPlatformBootstrapFleetRequest(path: string): OperatorPlatformBootstrapFleetRequest;
-export declare function writeOperatorPlatformBootstrapFleetRequest(path: string, requestFiles: readonly [string, string, string]): string;
+export declare function writeOperatorPlatformBootstrapFleetRequest(path: string, requestFiles: readonly [string, string, string], cloudflare: {
+    configFile: string;
+    acceptanceFile: string;
+}): string;
 export declare function readOperatorMetalBootstrapRequest(path: string): OperatorMetalBootstrapRequest;
 export declare function writeOperatorMetalBootstrapRequest(path: string, request: OperatorMetalBootstrapRequest): string;
+export declare function readOperatorGuestHostKeyEvidence(path: string, request?: OperatorMetalBootstrapRequest): OperatorGuestHostKeyEvidence;
+export declare function writeOperatorGuestHostKeyEvidence(path: string, evidence: OperatorGuestHostKeyEvidence, request?: OperatorMetalBootstrapRequest): string;
 export declare function planOperatorMetalBootstrap(request: OperatorMetalBootstrapRequest, mode: OperatorMetalBootstrapMode): OperatorMetalBootstrapPlan;
 export declare function planOperatorPlatformBootstrap(request: OperatorPlatformBootstrapRequest, mode: OperatorPlatformBootstrapMode): OperatorPlatformBootstrapPlan;
 /** Exact non-secret coordinates derived from the same reviewed files bootstrap applies. */
 export declare function operatorPlatformFleetCoordinates(fleet: OperatorPlatformBootstrapFleetRequest): OperatorPlatformFleetCoordinates;
 export declare function planOperatorPlatformFleetBootstrap(fleet: OperatorPlatformBootstrapFleetRequest, mode: OperatorPlatformBootstrapMode): OperatorPlatformBootstrapFleetPlan;
+export declare function collectOperatorGuestHostKeys(request: OperatorMetalBootstrapRequest, options?: OperatorPlatformBootstrapOptions, includeRehearsal?: boolean): Promise<OperatorGuestHostKeyEvidence>;
+export interface OperatorGuestTransport {
+    run(nodeName: string, argv: readonly string[], options?: {
+        stdin?: string;
+        secret?: boolean;
+        allowFailure?: boolean;
+    }): Promise<OperatorCommandResult>;
+    copy(nodeName: string, localPath: string, remotePath: string): Promise<void>;
+}
+/**
+ * Execute a bounded callback through the same pinned Metal jump, operator
+ * public identity selector and reviewed guest host keys used by bootstrap.
+ */
+export declare function withOperatorGuestTransport<T>(request: OperatorMetalBootstrapRequest, evidence: OperatorGuestHostKeyEvidence, callback: (transport: OperatorGuestTransport) => Promise<T>, options?: OperatorPlatformBootstrapOptions): Promise<T>;
 /**
  * Run one reviewed operator action. No private SSH key, credential value or
  * management token is placed in argv; OpenSSH selects the matching private key

package/dist/operator-bootstrap.js

@@ -1396,7 +1396,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.67";
+var VERSION = "0.1.69";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4380,6 +4380,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   }
   bindBootstrapIntent(host, config);
   const plan = planBootstrap(config, host.exists(STATE_PATH));
+  await checked3(host, ["hostnamectl", "set-hostname", "--static", config.nodeHostname], "compute hostname");
   const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
   host.mkdir(CREDS, 448);
   host.mkdir("/var/lib/forgezero", 448);
@@ -5971,7 +5972,12 @@ function writeOperatorPlatformBootstrapRequest(path, request) {
 }
 function readOperatorPlatformBootstrapFleetRequest(path) {
   const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator fleet request")));
-  const root = exactKeys3(value, ["kind", "requests"], "operator fleet request");
+  const root = exactKeys3(value, [
+    "kind",
+    "requests",
+    "cloudflareConfigFile",
+    "cloudflareAcceptanceFile"
+  ], "operator fleet request");
   if (root.kind !== "platform-fleet-remote")
     throw new Error("operator fleet kind must be platform-fleet-remote");
   if (!Array.isArray(root.requests) || root.requests.length !== 3 || root.requests.some((entry) => typeof entry !== "string")) {
@@ -5982,10 +5988,25 @@ function readOperatorPlatformBootstrapFleetRequest(path) {
     throw new Error("operator fleet request files must be unique");
   for (const request of requests)
     readOperatorPlatformBootstrapRequest(request);
-  return { kind: "platform-fleet-remote", requests };
+  if (typeof root.cloudflareConfigFile !== "string" || typeof root.cloudflareAcceptanceFile !== "string") {
+    throw new Error("operator fleet requires Cloudflare coordinates and an acceptance evidence path");
+  }
+  const cloudflareConfigFile = canonicalOutputPath(root.cloudflareConfigFile, "operator fleet Cloudflare config");
+  const cloudflareAcceptanceFile = canonicalOutputPath(root.cloudflareAcceptanceFile, "operator fleet Cloudflare acceptance evidence");
+  return {
+    kind: "platform-fleet-remote",
+    requests,
+    cloudflareConfigFile,
+    cloudflareAcceptanceFile
+  };
 }
-function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles) {
-  const request = { kind: "platform-fleet-remote", requests: requestFiles };
+function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles, cloudflare) {
+  const request = {
+    kind: "platform-fleet-remote",
+    requests: requestFiles,
+    cloudflareConfigFile: canonicalOutputPath(cloudflare.configFile, "operator fleet Cloudflare config"),
+    cloudflareAcceptanceFile: canonicalOutputPath(cloudflare.acceptanceFile, "operator fleet Cloudflare acceptance evidence")
+  };
   if (new Set(requestFiles).size !== 3)
     throw new Error("operator fleet request files must be unique");
   for (const file of requestFiles)
@@ -6079,6 +6100,48 @@ function writeOperatorMetalBootstrapRequest(path, request) {
   validateMetalRequestValue(request);
   return writeOwnerJson2(path, request, "operator metal request");
 }
+var validateGuestHostKeyEvidenceValue = (value, request) => {
+  const root = exactKeys3(value, ["format", "kind", "metalHostKeySha256", "nodes"], "operator guest host-key evidence");
+  if (root.format !== 1 || root.kind !== "forgezero-operator-guest-host-keys" || typeof root.metalHostKeySha256 !== "string" || !Array.isArray(root.nodes)) {
+    throw new Error("operator guest host-key evidence is malformed");
+  }
+  const nodes = root.nodes.map((value2, index) => {
+    const row = exactKeys3(value2, ["name", "address", "hostKey", "hostKeySha256"], `operator guest host key ${index + 1}`);
+    if (typeof row.name !== "string" || typeof row.address !== "string") {
+      throw new Error("operator guest host-key identity is malformed");
+    }
+    const hop = validateHop({
+      address: row.address,
+      port: 22,
+      user: "forgezero",
+      hostKey: row.hostKey,
+      hostKeySha256: row.hostKeySha256
+    }, `operator guest host key ${row.name}`);
+    return { name: row.name, address: hop.address, hostKey: hop.hostKey, hostKeySha256: hop.hostKeySha256 };
+  });
+  if (new Set(nodes.map(({ name }) => name)).size !== nodes.length || new Set(nodes.map(({ address }) => address)).size !== nodes.length) {
+    throw new Error("operator guest host-key identities must be unique");
+  }
+  if (request) {
+    const expected = nodes.length === request.genesis.nodes.length ? [...request.genesis.nodes] : [...request.genesis.nodes, ...request.genesis.rehearsalNode ? [request.genesis.rehearsalNode] : []];
+    if (root.metalHostKeySha256 !== request.target.hostKeySha256 || ![request.genesis.nodes.length, request.genesis.nodes.length + (request.genesis.rehearsalNode ? 1 : 0)].includes(nodes.length) || nodes.length !== expected.length || expected.some((guest, index) => nodes[index]?.name !== guest.name || nodes[index]?.address !== guest.address)) {
+      throw new Error("operator guest host-key evidence does not match the reviewed Metal request");
+    }
+  }
+  return {
+    format: 1,
+    kind: "forgezero-operator-guest-host-keys",
+    metalHostKeySha256: root.metalHostKeySha256,
+    nodes
+  };
+};
+function readOperatorGuestHostKeyEvidence(path, request) {
+  const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator guest host-key evidence")));
+  return validateGuestHostKeyEvidenceValue(value, request);
+}
+function writeOperatorGuestHostKeyEvidence(path, evidence, request) {
+  return writeOwnerJson2(path, validateGuestHostKeyEvidenceValue(evidence, request), "operator guest host-key evidence");
+}
 function planOperatorMetalBootstrap(request, mode) {
   const config = readMetalBootstrapConfig(request.metalConfigFile);
   const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
@@ -6086,19 +6149,20 @@ function planOperatorMetalBootstrap(request, mode) {
     throw new Error("the reviewed metal request has no rehearsal node");
   }
   const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
+  const genesisNodes = mode === "host-keys" ? request.genesis.nodes.map(({ name }) => name) : mode === "rehearsal-host-keys" ? guestRows(request).map(({ name }) => name) : claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name));
   return {
     kind: "metal-remote",
     mode,
-    mutation: mode !== "status",
+    mutation: !["status", "host-keys", "rehearsal-host-keys"].includes(mode),
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "host-keys" || mode === "rehearsal-host-keys" ? ["verify pinned SSH transport", "collect exact Ed25519 host keys for the reviewed guest addresses"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
       "run typed fz bootstrap metal --apply",
       "remove transient local and remote staging data"
     ],
-    genesisNodes: claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name)),
+    genesisNodes,
     secretInputs: config.agentSeedFile ? ["metal-agent-seed"] : []
   };
 }
@@ -6335,6 +6399,116 @@ var copy = async (exec, request, knownHosts, local, remotePath, secret = false)
     `${destination2(request.target)}:${remotePath}`
   ], "secure copy", { secret });
 };
+var guestRows = (request) => [
+  ...request.genesis.nodes,
+  ...request.genesis.rehearsalNode ? [request.genesis.rehearsalNode] : []
+];
+var parsedScannedHostKey = (output, address) => {
+  const keys = output.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.startsWith(`${address} ssh-ed25519 `)).map((line) => line.split(/\s+/).slice(1, 3).join(" "));
+  const unique = [...new Set(keys)];
+  if (unique.length !== 1 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}$/.test(unique[0])) {
+    throw new Error(`guest ${address} did not return one exact Ed25519 host key`);
+  }
+  return unique[0];
+};
+async function collectOperatorGuestHostKeys(request, options = {}, includeRehearsal = false) {
+  publicIdentity(request.target.identityPublicKeyFile);
+  socketPath(request.target.agentSocket);
+  const exec = options.exec ?? defaultExec3;
+  const directory = mkdtempSync(join6(tmpdir(), "forgezero-operator-host-keys-"));
+  try {
+    const knownHosts = writeKnownHosts(request, directory);
+    const nodes = [];
+    for (const guest of includeRehearsal ? guestRows(request) : request.genesis.nodes) {
+      const output = await remote(exec, request, knownHosts, [
+        "/usr/bin/ssh-keyscan",
+        "-T",
+        "10",
+        "-t",
+        "ed25519",
+        guest.address
+      ], `collect ${guest.name} SSH host key`);
+      const hostKey = parsedScannedHostKey(output, guest.address);
+      nodes.push({
+        name: guest.name,
+        address: guest.address,
+        hostKey,
+        hostKeySha256: fingerprint(hostKey)
+      });
+    }
+    return validateGuestHostKeyEvidenceValue({
+      format: 1,
+      kind: "forgezero-operator-guest-host-keys",
+      metalHostKeySha256: request.target.hostKeySha256,
+      nodes
+    }, request);
+  } finally {
+    rmSync6(directory, { recursive: true, force: true });
+  }
+}
+async function withOperatorGuestTransport(request, evidence, callback, options = {}) {
+  const reviewed = validateGuestHostKeyEvidenceValue(evidence, request);
+  publicIdentity(request.target.identityPublicKeyFile);
+  socketPath(request.target.agentSocket);
+  const exec = options.exec ?? defaultExec3;
+  const directory = mkdtempSync(join6(tmpdir(), "forgezero-operator-guest-transport-"));
+  try {
+    const byName = new Map(reviewed.nodes.map((node) => [node.name, node]));
+    const requests = new Map;
+    const knownHosts = new Map;
+    for (const node of reviewed.nodes) {
+      const nodeDirectory = join6(directory, node.name);
+      mkdirSync8(nodeDirectory, { mode: 448 });
+      const guestRequest = {
+        target: {
+          address: node.address,
+          port: 22,
+          user: "forgezero",
+          hostKey: node.hostKey,
+          hostKeySha256: node.hostKeySha256,
+          identityPublicKeyFile: request.target.identityPublicKeyFile,
+          agentSocket: request.target.agentSocket,
+          jump: {
+            address: request.target.address,
+            port: request.target.port,
+            user: request.target.user,
+            hostKey: request.target.hostKey,
+            hostKeySha256: request.target.hostKeySha256
+          }
+        }
+      };
+      requests.set(node.name, guestRequest);
+      knownHosts.set(node.name, writeKnownHosts(guestRequest, nodeDirectory));
+    }
+    const transport = {
+      async run(nodeName, argv, runOptions = {}) {
+        if (!byName.has(nodeName))
+          throw new Error(`guest transport node ${nodeName} is not reviewed`);
+        argv.forEach(safeRemoteArg);
+        const nodeRequest = requests.get(nodeName);
+        const result = await exec([
+          "ssh",
+          ...sshOptions(nodeRequest, knownHosts.get(nodeName)),
+          destination2(nodeRequest.target),
+          "--",
+          ...argv
+        ], { stdin: runOptions.stdin, secret: runOptions.secret });
+        if (result.exitCode !== 0 && !runOptions.allowFailure) {
+          throw new Error(`${nodeName} remote operation failed${result.output ? `: ${result.output.trim()}` : ""}`);
+        }
+        return result;
+      },
+      async copy(nodeName, localPath, remotePath) {
+        if (!byName.has(nodeName))
+          throw new Error(`guest transport node ${nodeName} is not reviewed`);
+        await copy(exec, requests.get(nodeName), knownHosts.get(nodeName), localPath, remotePath);
+      }
+    };
+    return await callback(transport);
+  } finally {
+    rmSync6(directory, { recursive: true, force: true });
+  }
+}
 async function stageConfig(config, directory) {
   const rewritten = structuredClone(config);
   const staged = [];
@@ -6546,6 +6720,12 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       const output2 = await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "status"], "remote metal status");
       return { plan, output: output2 };
     }
+    if (mode === "host-keys" || mode === "rehearsal-host-keys") {
+      return {
+        plan,
+        output: JSON.stringify(await collectOperatorGuestHostKeys(request, { ...options, exec }, mode === "rehearsal-host-keys"))
+      };
+    }
     if (mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
       if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
@@ -6592,15 +6772,19 @@ export {
   writeOperatorPlatformBootstrapRequest,
   writeOperatorPlatformBootstrapFleetRequest,
   writeOperatorMetalBootstrapRequest,
+  writeOperatorGuestHostKeyEvidence,
+  withOperatorGuestTransport,
   verifyOperatorPlatformFleet,
   readOperatorPlatformBootstrapRequest,
   readOperatorPlatformBootstrapFleetRequest,
   readOperatorMetalBootstrapRequest,
+  readOperatorGuestHostKeyEvidence,
   planOperatorPlatformFleetBootstrap,
   planOperatorPlatformBootstrap,
   planOperatorMetalBootstrap,
   operatorPlatformFleetCoordinates,
   createOperatorSshHop,
+  collectOperatorGuestHostKeys,
   applyOperatorPlatformFleetBootstrap,
   applyOperatorPlatformBootstrap,
   applyOperatorMetalBootstrap

package/dist/platform-fleet-verification.js

@@ -2125,7 +2125,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.67";
+var VERSION3 = "0.1.69";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -2125,7 +2125,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.67";
+var VERSION3 = "0.1.69";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.67";
+export declare const VERSION = "0.1.69";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.67",
+  "version": "0.1.69",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",