@forgezero/agent 0.1.79 → 0.1.81

package/dist/metal-provision.js

@@ -748,6 +748,32 @@ function membersOfLinuxList(value, label) {
     throw new MetalProvisionError(`${label} list overlaps itself`);
   return members;
 }
+function linuxList(members) {
+  const sorted = [...new Set(members)].sort((left, right) => left - right);
+  const ranges = [];
+  for (let index = 0;index < sorted.length; ) {
+    const start = sorted[index];
+    let end = start;
+    while (index + 1 < sorted.length && sorted[index + 1] === end + 1) {
+      index += 1;
+      end = sorted[index];
+    }
+    ranges.push(start === end ? String(start) : `${start}-${end}`);
+    index += 1;
+  }
+  return ranges.join(",");
+}
+function physicalCoreGroups(pool) {
+  const cpus = membersOfLinuxList(pool.cpus, "CPU");
+  if (cpus.length % pool.physicalCores !== 0) {
+    throw new MetalProvisionError("CPU pool threads must divide evenly across physical cores");
+  }
+  const threadsPerCore = cpus.length / pool.physicalCores;
+  if (!Number.isInteger(threadsPerCore) || threadsPerCore < 1 || threadsPerCore > 8) {
+    throw new MetalProvisionError("invalid CPU pool threads-per-core topology");
+  }
+  return Array.from({ length: pool.physicalCores }, (_, core) => Array.from({ length: threadsPerCore }, (_2, thread) => cpus[core + thread * pool.physicalCores]));
+}
 var guestNameFor = (computeKey) => `fzg-${createHash2("sha256").update(computeKey).digest("hex").slice(0, 16)}`;
 var tapNameFor = (computeKey) => `fzt${createHash2("sha256").update(computeKey).digest("hex").slice(0, 12)}`;
 var macForAddress = (address) => {
@@ -805,6 +831,7 @@ function validateMetalProfile(profile) {
     if (!Number.isInteger(pool.physicalCores) || pool.physicalCores < 1 || pool.physicalCores > cpus.length) {
       throw new MetalProvisionError("invalid CPU pool physical-core count");
     }
+    physicalCoreGroups(pool);
     for (const cpu of cpus) {
       if (assigned.has(cpu))
         throw new MetalProvisionError("CPU pools overlap");
@@ -874,26 +901,38 @@ function allocateCpuPool(profile, claim, rows) {
   const prior = rows.find((row) => row.computeKey === claim.computeKey);
   if (prior) {
     const retained = profile.cpuPools.find((pool) => pool.key === prior.cpuPoolKey);
-    if (!retained || retained.cpus !== prior.allowedCpus || retained.memoryNodes !== prior.allowedMemoryNodes) {
+    const groups2 = retained ? physicalCoreGroups(retained) : [];
+    const retainedCpus = new Set(membersOfLinuxList(prior.allowedCpus, "persisted guest CPU"));
+    const matchedGroups = groups2.filter((group) => group.every((cpu) => retainedCpus.has(cpu)));
+    if (!retained || retained.memoryNodes !== prior.allowedMemoryNodes || matchedGroups.length !== claim.spec.physicalCores || matchedGroups.flat().length !== retainedCpus.size || retainedCpus.size < claim.spec.vcpu || claim.spec.cpuPoolKey !== undefined && claim.spec.cpuPoolKey !== retained.key) {
       throw new MetalProvisionError("persisted guest CPU pool no longer matches the host profile");
     }
-    return retained;
+    return {
+      key: retained.key,
+      cpus: prior.allowedCpus,
+      physicalCores: matchedGroups.length,
+      memoryNodes: prior.allowedMemoryNodes
+    };
   }
-  const used = new Set(rows.map((row) => row.cpuPoolKey));
-  if (claim.spec.cpuPoolKey) {
-    const requested = profile.cpuPools.find((pool) => pool.key === claim.spec.cpuPoolKey);
-    if (!requested || used.has(requested.key)) {
-      throw new MetalProvisionError("requested CPU pool is unavailable");
-    }
-    if (requested.physicalCores < claim.spec.physicalCores || membersOfLinuxList(requested.cpus, "CPU").length < claim.spec.vcpu)
-      throw new MetalProvisionError("requested CPU pool cannot satisfy this guest");
-    return requested;
-  }
-  const candidates = profile.cpuPools.filter((pool) => !used.has(pool.key) && pool.physicalCores >= claim.spec.physicalCores && membersOfLinuxList(pool.cpus, "CPU").length >= claim.spec.vcpu).sort((left, right) => left.physicalCores - right.physicalCores || membersOfLinuxList(left.cpus, "CPU").length - membersOfLinuxList(right.cpus, "CPU").length || left.key.localeCompare(right.key));
+  const usedCpus = new Set(rows.flatMap((row) => membersOfLinuxList(row.allowedCpus, "persisted guest CPU")));
+  const candidates = profile.cpuPools.filter((pool) => !claim.spec.cpuPoolKey || pool.key === claim.spec.cpuPoolKey).map((pool) => ({
+    pool,
+    available: physicalCoreGroups(pool).filter((group) => group.every((cpu) => !usedCpus.has(cpu)))
+  })).filter(({ available }) => {
+    const selected2 = available.slice(0, claim.spec.physicalCores);
+    return selected2.length === claim.spec.physicalCores && selected2.flat().length >= claim.spec.vcpu;
+  }).sort((left, right) => left.available.length - right.available.length || left.pool.key.localeCompare(right.pool.key));
   const selected = candidates[0];
-  if (!selected)
-    throw new MetalProvisionError("no exclusive CPU pool can satisfy this guest");
-  return selected;
+  if (!selected) {
+    throw new MetalProvisionError(claim.spec.cpuPoolKey ? "requested CPU pool cannot satisfy this guest" : "no exclusive CPU capacity can satisfy this guest");
+  }
+  const groups = selected.available.slice(0, claim.spec.physicalCores);
+  return {
+    key: selected.pool.key,
+    cpus: linuxList(groups.flat()),
+    physicalCores: groups.length,
+    memoryNodes: selected.pool.memoryNodes
+  };
 }
 var base64 = (value) => Buffer.from(value).toString("base64");
 var yamlFile = (path2, content, permissions) => `  - path: ${JSON.stringify(path2)}

package/dist/operator-bootstrap.js

@@ -1416,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.79";
+var VERSION = "0.1.81";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3089,7 +3089,14 @@ function validatePlatformSharedEnvironment(input) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
-  boundedInteger("seedSyncMembers", input.seedSyncMembers, 1, 64);
+  if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
+    throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
+  }
+  for (const member of input.seedSyncMembers)
+    safeAtom("seedSyncMembers item", member);
+  if (!input.seedSyncMembers.includes(input.nodeHostname)) {
+    throw new Error("seedSyncMembers must include this nodeHostname.");
+  }
   boundedInteger("concurrencyLimit", input.concurrencyLimit, 1, 1e6);
   boundedInteger("drainDeadlineMs", input.drainDeadlineMs, 1000, 300000);
   boundedInteger("otlpFlushIntervalMs", input.otlpFlushIntervalMs, 1000, 300000);
@@ -3169,7 +3176,7 @@ function renderPlatformSharedEnvironment(input) {
     FZ_DB_MASTER: value.databaseMaster ?? "",
     FZ_DB_NETWORK_MODE: value.databaseNetworkMode,
     FZ_SEED_SYNC_PEERS: value.seedSyncPeers.join(","),
-    FZ_SEED_SYNC_MEMBERS: String(value.seedSyncMembers),
+    FZ_SEED_SYNC_MEMBERS: value.seedSyncMembers.join(","),
     FZ_SEED_SYNC_EPOCH: value.seedSyncEpoch,
     FZ_SEED_SYNC_CREDENTIAL: "seed-sync-root",
     FZ_SHARED_DIR: value.sharedDirectory,
@@ -3238,7 +3245,12 @@ function platformApiCredentialSpecs(options) {
   ];
 }
 function renderPlatformApiUnits(input) {
-  for (const path of [input.sharedDirectory, input.sharedEnvironmentFile, input.slotsDirectory]) {
+  for (const path of [
+    input.sharedDirectory,
+    input.sharedEnvironmentFile,
+    input.slotsDirectory,
+    ...input.topologyEnvironmentFile ? [input.topologyEnvironmentFile] : []
+  ]) {
     if (!path.startsWith("/") || /[\r\n]/.test(path))
       throw new Error("Runtime paths must be absolute and single-line.");
   }
@@ -3252,6 +3264,8 @@ function renderPlatformApiUnits(input) {
   const credentials = input.credentials.map((credential) => `LoadCredentialEncrypted=${credential.name}:${credential.encryptedPath}`).join(`
 `);
   const capacityEnvironment = input.capacityEnvironmentFile ? `EnvironmentFile=-${input.capacityEnvironmentFile}
+` : "";
+  const topologyEnvironment = input.topologyEnvironmentFile ? `EnvironmentFile=-${input.topologyEnvironmentFile}
 ` : "";
   const template = `[Unit]
 Description=ForgeZero (%i slot)
@@ -3265,7 +3279,7 @@ WorkingDirectory=${input.slotsDirectory}/%i
 Environment=NODE_ENV=production
 Environment=FZ_SLOT=%i
 EnvironmentFile=${input.sharedEnvironmentFile}
-${capacityEnvironment}${credentials}
+${capacityEnvironment}${topologyEnvironment}${credentials}
 ExecStart=/usr/local/bin/bun run ${input.slotsDirectory}/%i/src/index.ts
 Restart=always
 RestartSec=2
@@ -4517,7 +4531,8 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       greenPort: runtime.greenPort,
       collectorUnit: runtime.environment.otlpCollectorUnit,
       credentials,
-      capacityEnvironmentFile: "/etc/forgezero/capacity.env"
+      capacityEnvironmentFile: "/etc/forgezero/capacity.env",
+      topologyEnvironmentFile: "/etc/forgezero/deployment-topology.env"
     });
     const edge = renderPlatformNginx({
       publicPort: runtime.environment.publicApiPort,
@@ -5012,6 +5027,17 @@ function membersOfLinuxList(value, label) {
     throw new MetalProvisionError(`${label} list overlaps itself`);
   return members;
 }
+function physicalCoreGroups(pool) {
+  const cpus = membersOfLinuxList(pool.cpus, "CPU");
+  if (cpus.length % pool.physicalCores !== 0) {
+    throw new MetalProvisionError("CPU pool threads must divide evenly across physical cores");
+  }
+  const threadsPerCore = cpus.length / pool.physicalCores;
+  if (!Number.isInteger(threadsPerCore) || threadsPerCore < 1 || threadsPerCore > 8) {
+    throw new MetalProvisionError("invalid CPU pool threads-per-core topology");
+  }
+  return Array.from({ length: pool.physicalCores }, (_, core) => Array.from({ length: threadsPerCore }, (_2, thread) => cpus[core + thread * pool.physicalCores]));
+}
 function validateMetalProfile(profile) {
   if (!SAFE_NAME2.test(profile.volumeGroup))
     throw new MetalProvisionError("invalid volume group");
@@ -5060,6 +5086,7 @@ function validateMetalProfile(profile) {
     if (!Number.isInteger(pool.physicalCores) || pool.physicalCores < 1 || pool.physicalCores > cpus.length) {
       throw new MetalProvisionError("invalid CPU pool physical-core count");
     }
+    physicalCoreGroups(pool);
     for (const cpu of cpus) {
       if (assigned.has(cpu))
         throw new MetalProvisionError("CPU pools overlap");

package/dist/platform-bootstrap-runtime.d.ts

@@ -62,7 +62,8 @@ export interface PlatformSharedEnvironment {
     publicApiPort: number;
     sharedDirectory: string;
     seedSyncPeers: string[];
-    seedSyncMembers: number;
+    /** Exact physical API host identities participating in this seed epoch. */
+    seedSyncMembers: string[];
     seedSyncEpoch: string;
     concurrencyLimit: number;
     drainDeadlineMs: number;
@@ -120,6 +121,8 @@ export interface ApiRuntimeRenderOptions {
     credentials: SystemdCredentialSpec[];
     /** Root-owned calibration override, loaded after the ordinary shared environment. */
     capacityEnvironmentFile?: string;
+    /** Root-owned signed deployment topology, absent until post-genesis reconciliation. */
+    topologyEnvironmentFile?: string;
 }
 export declare function renderPlatformApiUnits(input: ApiRuntimeRenderOptions): {
     template: string;

package/dist/platform-bootstrap-runtime.js

@@ -811,7 +811,14 @@ function validatePlatformSharedEnvironment(input) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
-  boundedInteger("seedSyncMembers", input.seedSyncMembers, 1, 64);
+  if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
+    throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
+  }
+  for (const member of input.seedSyncMembers)
+    safeAtom("seedSyncMembers item", member);
+  if (!input.seedSyncMembers.includes(input.nodeHostname)) {
+    throw new Error("seedSyncMembers must include this nodeHostname.");
+  }
   boundedInteger("concurrencyLimit", input.concurrencyLimit, 1, 1e6);
   boundedInteger("drainDeadlineMs", input.drainDeadlineMs, 1000, 300000);
   boundedInteger("otlpFlushIntervalMs", input.otlpFlushIntervalMs, 1000, 300000);
@@ -891,7 +898,7 @@ function renderPlatformSharedEnvironment(input) {
     FZ_DB_MASTER: value.databaseMaster ?? "",
     FZ_DB_NETWORK_MODE: value.databaseNetworkMode,
     FZ_SEED_SYNC_PEERS: value.seedSyncPeers.join(","),
-    FZ_SEED_SYNC_MEMBERS: String(value.seedSyncMembers),
+    FZ_SEED_SYNC_MEMBERS: value.seedSyncMembers.join(","),
     FZ_SEED_SYNC_EPOCH: value.seedSyncEpoch,
     FZ_SEED_SYNC_CREDENTIAL: "seed-sync-root",
     FZ_SHARED_DIR: value.sharedDirectory,
@@ -960,7 +967,12 @@ function platformApiCredentialSpecs(options) {
   ];
 }
 function renderPlatformApiUnits(input) {
-  for (const path2 of [input.sharedDirectory, input.sharedEnvironmentFile, input.slotsDirectory]) {
+  for (const path2 of [
+    input.sharedDirectory,
+    input.sharedEnvironmentFile,
+    input.slotsDirectory,
+    ...input.topologyEnvironmentFile ? [input.topologyEnvironmentFile] : []
+  ]) {
     if (!path2.startsWith("/") || /[\r\n]/.test(path2))
       throw new Error("Runtime paths must be absolute and single-line.");
   }
@@ -974,6 +986,8 @@ function renderPlatformApiUnits(input) {
   const credentials = input.credentials.map((credential) => `LoadCredentialEncrypted=${credential.name}:${credential.encryptedPath}`).join(`
 `);
   const capacityEnvironment = input.capacityEnvironmentFile ? `EnvironmentFile=-${input.capacityEnvironmentFile}
+` : "";
+  const topologyEnvironment = input.topologyEnvironmentFile ? `EnvironmentFile=-${input.topologyEnvironmentFile}
 ` : "";
   const template = `[Unit]
 Description=ForgeZero (%i slot)
@@ -987,7 +1001,7 @@ WorkingDirectory=${input.slotsDirectory}/%i
 Environment=NODE_ENV=production
 Environment=FZ_SLOT=%i
 EnvironmentFile=${input.sharedEnvironmentFile}
-${capacityEnvironment}${credentials}
+${capacityEnvironment}${topologyEnvironment}${credentials}
 ExecStart=/usr/local/bin/bun run ${input.slotsDirectory}/%i/src/index.ts
 Restart=always
 RestartSec=2

package/dist/platform-fleet-verification.js

@@ -1649,6 +1649,7 @@ function phasePipeline(definition, phase, profile, executeRelease = false) {
 // src/deployment-connectivity.ts
 import { createHash as createHash3 } from "node:crypto";
 import { mkdirSync as mkdirSync4, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { createConnection } from "node:net";
 import { dirname as dirname4 } from "node:path";
 
 // src/process-input.ts
@@ -1701,6 +1702,21 @@ var defaultHost = {
     const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
     return { exitCode, output: `${stdout}${stderr}` };
   },
+  probe: (address, port, timeoutMs) => new Promise((resolve3) => {
+    const socket = createConnection({ host: address, port });
+    let settled = false;
+    const finish = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      socket.destroy();
+      resolve3(value);
+    };
+    socket.setTimeout(timeoutMs);
+    socket.once("connect", () => finish(true));
+    socket.once("timeout", () => finish(false));
+    socket.once("error", () => finish(false));
+  }),
   sleep: (ms) => Bun.sleep(ms)
 };
 function validate(request) {
@@ -1715,7 +1731,7 @@ function validate(request) {
   } else if (request.capabilities.public)
     throw new Error("unexpected public deployment capability");
   if (privateIntent?.mode === "cloudflare-warp") {
-    if (!NAME2.test(privateIntent.credential) || privateIntent.network.length < 1 || privateIntent.network.length > 128 || !request.capabilities.private || !UUID.test(request.capabilities.private.connectorId) || !TOKEN.test(request.capabilities.private.connectorToken)) {
+    if (!NAME2.test(privateIntent.credential) || privateIntent.network.length < 1 || privateIntent.network.length > 128 || !request.capabilities.private || !UUID.test(request.capabilities.private.connectorId) || !UUID.test(request.capabilities.private.siteRouteId) || !TOKEN.test(request.capabilities.private.connectorToken)) {
       throw new Error("private deployment connectivity is malformed");
     }
   } else if (request.capabilities.private)
@@ -1725,6 +1741,22 @@ async function applyDeploymentConnectivity(request, host = defaultHost) {
   validate(request);
   const id = idFor(request.key);
   const evidence = { key: request.key };
+  const topology = request.topology;
+  if (topology) {
+    const values = [topology.localRelayAddress, ...topology.localPeerAddresses, ...topology.remoteRelayAddresses];
+    const identities = [
+      topology.nodeIdentity,
+      ...topology.localPeerIdentities,
+      ...topology.remoteRelayIdentities,
+      ...topology.memberIdentities
+    ];
+    if (!/^[A-Za-z0-9.-]{1,253}$/.test(topology.site) || !/^(?:\d{1,3}\.){3}0\/24$/.test(topology.siteCidr) || values.some((value) => !/^(?:\d{1,3}\.){3}\d{1,3}$/.test(value)) || identities.some((value) => !/^[A-Za-z0-9.-]{1,253}$/.test(value)) || topology.localPeerIdentities.length !== topology.localPeerAddresses.length || topology.remoteRelayIdentities.length !== topology.remoteRelayAddresses.length || topology.memberIdentities.length < 1 || topology.memberIdentities.length > 1024 || new Set(topology.memberIdentities).size !== topology.memberIdentities.length || !topology.memberIdentities.includes(topology.nodeIdentity) || !/^sha256:[a-f0-9]{64}$/.test(topology.generation) || (topology.role === "member" ? topology.remoteRelayAddresses.length !== 0 : topology.remoteSiteCidrs.length !== topology.remoteRelayAddresses.length) || topology.remoteSiteCidrs.some((value) => !/^(?:\d{1,3}\.){3}0\/24$/.test(value)) || new Set(topology.remoteSiteCidrs).size !== topology.remoteSiteCidrs.length || !Number.isSafeInteger(topology.healthPort) || topology.healthPort < 1 || topology.healthPort > 65535 || topology.routedTcpPorts.length < 1 || topology.routedTcpPorts.length > 64 || new Set(topology.routedTcpPorts).size !== topology.routedTcpPorts.length || !topology.routedTcpPorts.includes(topology.healthPort) || topology.routedTcpPorts.some((port) => !Number.isSafeInteger(port) || port < 1 || port > 65535) || topology.role === "member" && topology.transport !== "private-lan") {
+      throw new Error("deployment topology is malformed");
+    }
+    if (request.intent.private?.mode === "cloudflare-warp" !== (topology.transport === "cloudflare-warp")) {
+      throw new Error("deployment topology transport differs from private connectivity intent");
+    }
+  }
   if (request.intent.public?.mode === "cloudflare-tunnel") {
     const capability = request.capabilities.public;
     const credentialName = `FZ_TUNNEL_${id.toUpperCase()}`;
@@ -1762,6 +1794,12 @@ WantedBy=multi-user.target
     const capability = request.capabilities.private;
     const credentialPath = "/etc/forgezero/creds/CF_WARP_CONNECTOR_TOKEN.cred";
     const unit = "forgezero-deployment-mesh.service";
+    const forwarding = "/etc/sysctl.d/99-forgezero-mesh.conf";
+    host.write(forwarding, `net.ipv4.ip_forward = 1
+net.ipv6.conf.all.forwarding = 1
+net.ipv6.conf.all.accept_ra = 2
+`, 420);
+    await checked2(host, ["/usr/sbin/sysctl", "-p", forwarding], "Mesh subnet forwarding");
     await host.seal("CF_WARP_CONNECTOR_TOKEN", credentialPath, capability.connectorToken);
     host.write(`/etc/systemd/system/${unit}`, `[Unit]
 Description=ForgeZero deployment Mesh/WARP connector
@@ -1796,6 +1834,95 @@ WantedBy=multi-user.target
     if (!evidence.private)
       throw new Error("WARP connector readiness failed");
   }
+  if (topology) {
+    const syncAddresses = topology.role === "relay" ? [...topology.localPeerAddresses, ...topology.remoteRelayAddresses] : [topology.localRelayAddress];
+    const topologyEpoch = `topology-${topology.generation.slice("sha256:".length, "sha256:".length + 48)}`;
+    host.write("/etc/forgezero/deployment-topology.env", [
+      `FZ_TOPOLOGY_NODE_IDENTITY=${topology.nodeIdentity}`,
+      `FZ_TOPOLOGY_PEER_ADDRESSES=${[...new Set(syncAddresses)].join(",")}`,
+      `FZ_TOPOLOGY_MEMBERS=${topology.memberIdentities.join(",")}`,
+      `FZ_TOPOLOGY_EPOCH=${topologyEpoch}`,
+      `FZ_TOPOLOGY_SITE=${topology.site}`,
+      `FZ_TOPOLOGY_ROLE=${topology.role}`,
+      `FZ_TOPOLOGY_TRANSPORT=${topology.transport}`,
+      ""
+    ].join(`
+`), 384);
+    const routeUnit = "forgezero-deployment-topology.service";
+    const routeUnitPath = `/etc/systemd/system/${routeUnit}`;
+    const routePairs = topology.role === "member" ? topology.remoteSiteCidrs.map((network) => ({ network, via: topology.localRelayAddress })) : topology.transport === "private-lan" ? topology.remoteSiteCidrs.map((network, index) => ({ network, via: topology.remoteRelayAddresses[index] })) : [];
+    for (const { via } of routePairs) {
+      await checked2(host, ["/usr/sbin/ip", "route", "get", via], `private route gateway ${via}`);
+    }
+    await host.exec(["/usr/bin/systemctl", "disable", "--now", routeUnit]);
+    const forwarding = topology.role !== "member" && topology.remoteSiteCidrs.length > 0 ? `ExecStart=/usr/sbin/sysctl -w net.ipv4.ip_forward=1
+` : "";
+    const starts = routePairs.map(({ network, via }) => `ExecStart=/usr/sbin/ip route replace ${network} via ${via}`).join(`
+`);
+    const stops = routePairs.map(({ network, via }) => `ExecStop=-/usr/sbin/ip route del ${network} via ${via}`).join(`
+`);
+    const noOp = !forwarding && !starts ? `ExecStart=/usr/bin/true
+` : "";
+    host.write(routeUnitPath, `[Unit]
+Description=ForgeZero fenced deployment site routing
+After=network-online.target${topology.transport === "cloudflare-warp" ? " forgezero-deployment-mesh.service" : ""}
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+${forwarding}${noOp}${starts}${starts ? `
+` : ""}${stops}${stops ? `
+` : ""}
+[Install]
+WantedBy=multi-user.target
+`, 420);
+    for (const source of [...new Set([topology.siteCidr, ...topology.remoteSiteCidrs])]) {
+      for (const port of topology.routedTcpPorts) {
+        await checked2(host, ["/usr/sbin/ufw", "allow", "from", source, "to", "any", "port", String(port), "proto", "tcp"], `private service ${source}:${port}`);
+      }
+    }
+    if (topology.role !== "member")
+      for (const remoteCidr of topology.remoteSiteCidrs) {
+        for (const port of topology.routedTcpPorts) {
+          await checked2(host, [
+            "/usr/sbin/ufw",
+            "route",
+            "allow",
+            "proto",
+            "tcp",
+            "from",
+            topology.siteCidr,
+            "to",
+            remoteCidr,
+            "port",
+            String(port)
+          ], `private routed service ${topology.siteCidr}->${remoteCidr}:${port}`);
+        }
+      }
+    await checked2(host, ["/usr/bin/systemctl", "daemon-reload"], "topology daemon reload");
+    await checked2(host, ["/usr/bin/systemctl", "enable", "--now", routeUnit], "topology routes");
+    const probes = topology.role === "member" ? [topology.localRelayAddress] : topology.remoteRelayAddresses;
+    for (const address of [...new Set(probes)]) {
+      await checked2(host, ["/usr/sbin/ip", "route", "get", address], `private route ${address}`);
+      let ready = false;
+      for (let attempt = 0;attempt < 10; attempt += 1) {
+        if (await host.probe(address, topology.healthPort, 2000)) {
+          ready = true;
+          break;
+        }
+        await host.sleep(1000);
+      }
+      if (!ready)
+        throw new Error(`private topology relay ${address}:${topology.healthPort} is unreachable`);
+    }
+    evidence.topology = {
+      site: topology.site,
+      siteCidr: topology.siteCidr,
+      role: topology.role,
+      probed: [...new Set(probes)]
+    };
+  }
   return evidence;
 }
 
@@ -2520,7 +2647,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.79";
+var VERSION3 = "0.1.81";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -3780,7 +3907,14 @@ function validatePlatformSharedEnvironment(input) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
-  boundedInteger("seedSyncMembers", input.seedSyncMembers, 1, 64);
+  if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
+    throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
+  }
+  for (const member of input.seedSyncMembers)
+    safeAtom("seedSyncMembers item", member);
+  if (!input.seedSyncMembers.includes(input.nodeHostname)) {
+    throw new Error("seedSyncMembers must include this nodeHostname.");
+  }
   boundedInteger("concurrencyLimit", input.concurrencyLimit, 1, 1e6);
   boundedInteger("drainDeadlineMs", input.drainDeadlineMs, 1000, 300000);
   boundedInteger("otlpFlushIntervalMs", input.otlpFlushIntervalMs, 1000, 300000);
@@ -3860,7 +3994,7 @@ function renderPlatformSharedEnvironment(input) {
     FZ_DB_MASTER: value.databaseMaster ?? "",
     FZ_DB_NETWORK_MODE: value.databaseNetworkMode,
     FZ_SEED_SYNC_PEERS: value.seedSyncPeers.join(","),
-    FZ_SEED_SYNC_MEMBERS: String(value.seedSyncMembers),
+    FZ_SEED_SYNC_MEMBERS: value.seedSyncMembers.join(","),
     FZ_SEED_SYNC_EPOCH: value.seedSyncEpoch,
     FZ_SEED_SYNC_CREDENTIAL: "seed-sync-root",
     FZ_SHARED_DIR: value.sharedDirectory,
@@ -3929,7 +4063,12 @@ function platformApiCredentialSpecs(options) {
   ];
 }
 function renderPlatformApiUnits(input) {
-  for (const path2 of [input.sharedDirectory, input.sharedEnvironmentFile, input.slotsDirectory]) {
+  for (const path2 of [
+    input.sharedDirectory,
+    input.sharedEnvironmentFile,
+    input.slotsDirectory,
+    ...input.topologyEnvironmentFile ? [input.topologyEnvironmentFile] : []
+  ]) {
     if (!path2.startsWith("/") || /[\r\n]/.test(path2))
       throw new Error("Runtime paths must be absolute and single-line.");
   }
@@ -3943,6 +4082,8 @@ function renderPlatformApiUnits(input) {
   const credentials = input.credentials.map((credential) => `LoadCredentialEncrypted=${credential.name}:${credential.encryptedPath}`).join(`
 `);
   const capacityEnvironment = input.capacityEnvironmentFile ? `EnvironmentFile=-${input.capacityEnvironmentFile}
+` : "";
+  const topologyEnvironment = input.topologyEnvironmentFile ? `EnvironmentFile=-${input.topologyEnvironmentFile}
 ` : "";
   const template = `[Unit]
 Description=ForgeZero (%i slot)
@@ -3956,7 +4097,7 @@ WorkingDirectory=${input.slotsDirectory}/%i
 Environment=NODE_ENV=production
 Environment=FZ_SLOT=%i
 EnvironmentFile=${input.sharedEnvironmentFile}
-${capacityEnvironment}${credentials}
+${capacityEnvironment}${topologyEnvironment}${credentials}
 ExecStart=/usr/local/bin/bun run ${input.slotsDirectory}/%i/src/index.ts
 Restart=always
 RestartSec=2