@forgezero/agent 0.1.87 → 0.1.89

package/dist/fz-agent.js

@@ -4,7 +4,7 @@
 // src/index.ts
 import { randomBytes as randomBytes7 } from "crypto";
 import { readFileSync as readFileSync20, writeFileSync as writeFileSync18, existsSync as existsSync23, mkdirSync as mkdirSync18, chmodSync as chmodSync19, lstatSync as lstatSync10, statfsSync as statfsSync3 } from "fs";
-import { cpus as cpus2, totalmem as totalmem2 } from "os";
+import { cpus as cpus3, totalmem as totalmem3 } from "os";
 import { dirname as dirname16, join as join12 } from "path";
 
 // ../access/dist/security.js
@@ -5351,7 +5351,12 @@ async function executeSoftwareOperation(operation) {
     }
     if (software === "nginx") {
       const binary = await run(["/usr/sbin/nginx", "-v"]);
-      return binary.exitCode === 0 ? run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]) : binary;
+      if (binary.exitCode !== 0)
+        return binary;
+      if (!existsSync2("/usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so")) {
+        return { exitCode: 1, output: "Nginx response-header suppression module is unavailable" };
+      }
+      return run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]);
     }
     if (software === "arangodb") {
       const binary = await run(["/usr/sbin/arangod", "--version"]);
@@ -5383,7 +5388,7 @@ async function executeSoftwareOperation(operation) {
   }
   if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client" || software === "git") {
     const packageName = software === "openssh-client" ? "openssh-client" : software === "docker" ? "docker.io" : software;
-    const installed = await aptInstall(packageName);
+    const installed = software === "nginx" ? await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]) : await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
       return installed;
     if (software === "docker") {
@@ -5535,11 +5540,22 @@ async function ensureSoftwareRequirements(requirementsInput, options) {
 }
 
 // src/capacity-calibration.ts
-var percentile95 = (values) => {
+import { cpus, freemem, totalmem } from "os";
+var percentile = (values, quantile) => {
   if (values.length === 0)
     return Number.POSITIVE_INFINITY;
   const sorted = values.toSorted((left, right) => left - right);
-  return sorted[Math.min(sorted.length - 1, Math.ceil(sorted.length * 0.95) - 1)];
+  return sorted[Math.min(sorted.length - 1, Math.ceil(sorted.length * quantile) - 1)];
+};
+var hostSample = () => {
+  let cpuIdle = 0;
+  let cpuTotal = 0;
+  for (const cpu of cpus()) {
+    cpuIdle += cpu.times.idle;
+    cpuTotal += Object.values(cpu.times).reduce((sum, value) => sum + value, 0);
+  }
+  const memoryTotal = totalmem();
+  return { cpuIdle, cpuTotal, memoryUsed: memoryTotal - freemem(), memoryTotal };
 };
 function localCalibrationEndpoint(value) {
   const endpoint = new URL(value);
@@ -5554,9 +5570,12 @@ function validateCapacityCalibrationOptions(options) {
   const requestsPerWorker = options.requestsPerWorker ?? 8;
   const maxP95Ms = options.maxP95Ms ?? 250;
   const maxErrorRate = options.maxErrorRate ?? 0.01;
-  const headroomRatio = options.headroomRatio ?? 0.8;
+  const safetyRatio = options.safetyRatio ?? 0.8;
   const requestTimeoutMs = options.requestTimeoutMs ?? 5000;
-  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(headroomRatio) || headroomRatio < 0.25 || headroomRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000) {
+  const minimumStageDurationMs = options.minimumStageDurationMs ?? 5000;
+  const maxCpuUtilizationPercent = options.maxCpuUtilizationPercent ?? 90;
+  const maxMemoryUtilizationPercent = options.maxMemoryUtilizationPercent ?? 90;
+  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
     throw new Error("Capacity calibration bounds are invalid.");
   }
   return {
@@ -5565,18 +5584,24 @@ function validateCapacityCalibrationOptions(options) {
     requestsPerWorker,
     maxP95Ms,
     maxErrorRate,
-    headroomRatio,
-    requestTimeoutMs
+    safetyRatio,
+    requestTimeoutMs,
+    minimumStageDurationMs,
+    maxCpuUtilizationPercent,
+    maxMemoryUtilizationPercent
   };
 }
-async function stage(endpoint, concurrency, requestsPerWorker, timeoutMs, fetcher) {
+async function stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimumDurationMs, fetcher, sampler) {
   const latencies = [];
   let succeeded = 0;
   let failed = 0;
   let overloaded = 0;
+  const systemBefore = sampler();
   const started = performance.now();
   await Promise.all(Array.from({ length: concurrency }, async () => {
-    for (let request = 0;request < requestsPerWorker; request += 1) {
+    let request = 0;
+    while (request < requestsPerWorker || performance.now() - started < minimumDurationMs) {
+      request += 1;
       const requestStarted = performance.now();
       try {
         const response = await fetcher(endpoint, {
@@ -5600,50 +5625,74 @@ async function stage(endpoint, concurrency, requestsPerWorker, timeoutMs, fetche
       }
     }
   }));
-  const elapsedSeconds = Math.max((performance.now() - started) / 1000, 0.001);
+  const durationMs = Math.max(performance.now() - started, 1);
+  const elapsedSeconds = durationMs / 1000;
+  const systemAfter = sampler();
+  const cpuTotal = Math.max(0, systemAfter.cpuTotal - systemBefore.cpuTotal);
+  const cpuIdle = Math.max(0, systemAfter.cpuIdle - systemBefore.cpuIdle);
+  const cpuUtilizationPercent = cpuTotal === 0 ? 0 : (cpuTotal - cpuIdle) / cpuTotal * 100;
+  const memoryUtilizationPercent = Math.max(systemBefore.memoryTotal > 0 ? systemBefore.memoryUsed / systemBefore.memoryTotal * 100 : 0, systemAfter.memoryTotal > 0 ? systemAfter.memoryUsed / systemAfter.memoryTotal * 100 : 0);
+  const requests = succeeded + failed;
   return {
     concurrency,
-    requests: concurrency * requestsPerWorker,
+    requests,
     succeeded,
     failed,
     overloaded,
-    throughputPerSecond: Number(((succeeded + failed) / elapsedSeconds).toFixed(2)),
-    p95Ms: Number(percentile95(latencies).toFixed(2))
+    successfulRequestsPerSecond: Number((succeeded / elapsedSeconds).toFixed(2)),
+    attemptedRequestsPerSecond: Number((requests / elapsedSeconds).toFixed(2)),
+    durationMs: Number(durationMs.toFixed(2)),
+    errorRate: Number((failed / Math.max(requests, 1)).toFixed(6)),
+    p95Ms: Number(percentile(latencies, 0.95).toFixed(2)),
+    p99Ms: Number(percentile(latencies, 0.99).toFixed(2)),
+    cpuUtilizationPercent: Number(cpuUtilizationPercent.toFixed(2)),
+    memoryUtilizationPercent: Number(memoryUtilizationPercent.toFixed(2))
   };
 }
-async function calibrateHttpConcurrency(options, fetcher = fetch) {
+async function calibrateHttpConcurrency(options, fetcher = fetch, sampler = hostSample) {
   const {
     endpoint,
     maxConcurrency,
     requestsPerWorker,
     maxP95Ms,
     maxErrorRate,
-    headroomRatio,
-    requestTimeoutMs: timeoutMs
+    safetyRatio,
+    requestTimeoutMs: timeoutMs,
+    minimumStageDurationMs,
+    maxCpuUtilizationPercent,
+    maxMemoryUtilizationPercent
   } = validateCapacityCalibrationOptions(options);
   const stages = [];
-  let lastSafe = 1;
+  let lastSafe;
   let stopReason = "maximum-tested";
   for (let concurrency = 1;; concurrency = Math.min(maxConcurrency, concurrency * 2)) {
-    const measured = await stage(endpoint, concurrency, requestsPerWorker, timeoutMs, fetcher);
+    const measured = await stage(endpoint, concurrency, requestsPerWorker, timeoutMs, minimumStageDurationMs, fetcher, sampler);
     stages.push(measured);
-    const errorRate = measured.failed / measured.requests;
     const previous = stages.at(-2);
-    const throughputRegressed = Boolean(previous && concurrency > 1 && measured.throughputPerSecond < previous.throughputPerSecond * 0.9);
-    if (measured.overloaded > 0 || errorRate > maxErrorRate)
+    const throughputRegressed = Boolean(previous && concurrency > 1 && measured.successfulRequestsPerSecond < previous.successfulRequestsPerSecond * 0.9);
+    if (measured.overloaded > 0 || measured.errorRate > maxErrorRate)
       stopReason = "errors";
     else if (measured.p95Ms > maxP95Ms)
       stopReason = "latency";
+    else if (measured.cpuUtilizationPercent > maxCpuUtilizationPercent)
+      stopReason = "cpu";
+    else if (measured.memoryUtilizationPercent > maxMemoryUtilizationPercent)
+      stopReason = "memory";
     else if (throughputRegressed)
       stopReason = "throughput-regression";
     else
-      lastSafe = concurrency;
+      lastSafe = measured;
     if (stopReason !== "maximum-tested" || concurrency === maxConcurrency)
       break;
   }
+  if (!lastSafe)
+    throw new Error("Capacity calibration found no safe request stage.");
   return {
     endpoint: endpoint.toString(),
-    recommendedConcurrency: Math.max(1, Math.floor(lastSafe * headroomRatio)),
+    measuredSustainableRequestsPerSecond: lastSafe.successfulRequestsPerSecond,
+    allowedRequestsPerSecond: Math.max(1, Math.floor(lastSafe.successfulRequestsPerSecond * safetyRatio)),
+    safetyRatio,
+    recommendedConcurrency: Math.max(1, Math.floor(lastSafe.concurrency * safetyRatio)),
     stopReason,
     stages
   };
@@ -5720,8 +5769,11 @@ function capacityCalibration(value, where) {
     "requestsPerWorker",
     "maxP95Ms",
     "maxErrorRate",
-    "headroomRatio",
-    "requestTimeoutMs"
+    "safetyRatio",
+    "requestTimeoutMs",
+    "minimumStageDurationMs",
+    "maxCpuUtilizationPercent",
+    "maxMemoryUtilizationPercent"
   ], where);
   const endpoint = text(calibration.endpoint, `${where}.endpoint`);
   try {
@@ -5745,8 +5797,11 @@ function capacityCalibration(value, where) {
       "requestsPerWorker",
       "maxP95Ms",
       "maxErrorRate",
-      "headroomRatio",
-      "requestTimeoutMs"
+      "safetyRatio",
+      "requestTimeoutMs",
+      "minimumStageDurationMs",
+      "maxCpuUtilizationPercent",
+      "maxMemoryUtilizationPercent"
     ].flatMap((name) => {
       const found = optionalNumber(name);
       return found === undefined ? [] : [[name, found]];
@@ -7867,6 +7922,9 @@ function parseBootstrapBundleManifest(value) {
 }
 
 // src/deployment.ts
+var RELEASE_GROUP = "forgezero-deploy";
+var deploymentAttestationChallenge = (revision) => createHash5("sha256").update("forgezero/deployment-attestation/v1\x00").update(revision, "utf8").digest("hex");
+
 class DeploymentError extends Error {
   code;
   constructor(code, message) {
@@ -7926,6 +7984,7 @@ function persistCapacityCalibration(args) {
   const path2 = join2(args.directory, `${identity}-${args.measuredAtTs}-${randomUUID().slice(0, 8)}.json`);
   const next = `${path2}.next`;
   const recommendedCoordinate = {
+    FZ_REQUESTS_PER_SECOND_LIMIT: String(args.calibration.allowedRequestsPerSecond),
     FZ_CONCURRENCY_LIMIT: String(args.calibration.recommendedConcurrency)
   };
   writeFileSync3(next, `${JSON.stringify({
@@ -7961,6 +8020,10 @@ function createDeploymentManager(options) {
   const activeRevisions = new Map;
   const exec = options.exec ?? spawnExact;
   const projectExec = options.projectExec ?? exec;
+  const releaseGroup = options.releaseGroup ?? RELEASE_GROUP;
+  if (!/^(?:[a-z_][a-z0-9_-]{0,30}|[0-9]{1,10})$/.test(releaseGroup)) {
+    throw new DeploymentError("SOURCE_FAILED", "release group is invalid");
+  }
   const now = options.now ?? Date.now;
   const readDefinition = options.readDefinition ?? ((path2) => JSON.parse(readFileSync3(path2, "utf8")));
   const credentialsDirectory = process.env.CREDENTIALS_DIRECTORY;
@@ -8100,7 +8163,6 @@ function createDeploymentManager(options) {
     const env = await gitEnvironment();
     const releasesDirectory = join2(options.root, "releases");
     await checked({ argv: ["/usr/bin/test", "-d", releasesDirectory] }, "SOURCE_FAILED");
-    await checked({ argv: ["/usr/bin/test", "-w", releasesDirectory] }, "SOURCE_FAILED");
     await checked({ argv: ["/usr/bin/install", "-d", "-m", "0770", release] }, "SOURCE_FAILED");
     if (bootstrapBundle) {
       let metadata;
@@ -8112,7 +8174,14 @@ function createDeploymentManager(options) {
       if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.nlink !== 1 || metadata.size !== bootstrapBundle.manifest.bytes || await sha256File(bootstrapBundle.path) !== bootstrapBundle.manifest.sha256) {
         throw new DeploymentError("SOURCE_FAILED", "The attended bootstrap bundle failed its manifest check.");
       }
-      await checked({ argv: ["git", "bundle", "verify", bootstrapBundle.path], env }, "SOURCE_FAILED");
+      const verifier = `${release}.bundle-verify`;
+      try {
+        await checked({ argv: ["/usr/bin/install", "-d", "-m", "0700", verifier] }, "SOURCE_FAILED");
+        await checked({ argv: ["git", "-C", verifier, "init", "--bare", "--quiet"], env }, "SOURCE_FAILED");
+        await checked({ argv: ["git", "-C", verifier, "bundle", "verify", bootstrapBundle.path], env }, "SOURCE_FAILED");
+      } finally {
+        await exec({ argv: ["/usr/bin/rm", "-rf", "--", verifier] });
+      }
     }
     await checked({
       argv: ["git", "clone", "--quiet", "--no-checkout", "--branch", options.branch, "--depth", "100", options.repository, release],
@@ -8150,6 +8219,10 @@ function createDeploymentManager(options) {
       cwd: release,
       env
     }, "SOURCE_FAILED");
+    if (options.projectExec) {
+      await checked({ argv: ["/bin/chgrp", "-hR", releaseGroup, release] }, "SOURCE_FAILED");
+      await checked({ argv: ["/bin/chmod", "-R", "g+rX,o-rwx", release] }, "SOURCE_FAILED");
+    }
     const head = (await checked({ argv: ["git", "rev-parse", "HEAD"], cwd: release, env }, "SOURCE_FAILED")).output.trim();
     if ((request.revision || bootstrapBundle) && head !== desiredRevision) {
       throw new DeploymentError("SOURCE_FAILED", `Git checked out ${head}, not requested ${desiredRevision}.`);
@@ -8172,7 +8245,7 @@ function createDeploymentManager(options) {
           throw new DeploymentError("PIPELINE_FAILED", "deployment plan requires attestation but this Agent has no source");
         if (options.attestation) {
           try {
-            await options.attestation.report(head);
+            await options.attestation.report(deploymentAttestationChallenge(head));
           } catch (cause) {
             if (assurance === "required")
               throw new DeploymentError("PIPELINE_FAILED", `deployment attestation failed: ${cause.message}`);
@@ -8543,7 +8616,7 @@ function createDeploymentManager(options) {
       }
       return options.cache.get(name);
     };
-    const attest = options.attestation ? async () => ({ report: await options.attestation.report(head), source: options.attestation.name }) : undefined;
+    const attest = options.attestation ? async () => ({ report: await options.attestation.report(deploymentAttestationChallenge(head)), source: options.attestation.name }) : undefined;
     const pipelines = [
       ...["build", "migrate", "release", "health"].map((phase) => {
         return {
@@ -8605,6 +8678,7 @@ function createDeploymentManager(options) {
         ...calibration,
         evidencePath,
         recommendedCoordinate: {
+          FZ_REQUESTS_PER_SECOND_LIMIT: String(calibration.allowedRequestsPerSecond),
           FZ_CONCURRENCY_LIMIT: String(calibration.recommendedConcurrency)
         }
       };
@@ -8753,27 +8827,64 @@ function startControlServer(manager, socketPath = DEFAULT_CONTROL_SOCKET) {
   server.listen(socketPath, () => chmodSync5(socketPath, 384));
   return server;
 }
-function requestControl(request, socketPath = DEFAULT_CONTROL_SOCKET) {
+function requestControl(request, socketPath = DEFAULT_CONTROL_SOCKET, timeoutMs = 30000) {
   return new Promise((resolve, reject) => {
-    const socket = connect(socketPath, () => socket.write(`${JSON.stringify(request)}
-`));
-    let buffer = "";
-    socket.on("data", (chunk) => {
-      buffer += chunk.toString("utf8");
-      const newline = buffer.indexOf(`
-`);
-      if (newline === -1)
+    const deadline = Date.now() + timeoutMs;
+    let settled = false;
+    const finish = (cause, response) => {
+      if (settled)
         return;
-      socket.end();
-      try {
-        resolve(JSON.parse(buffer.slice(0, newline)));
-      } catch (cause) {
+      settled = true;
+      if (cause)
         reject(cause);
+      else
+        resolve(response);
+    };
+    const attempt = () => {
+      if (settled)
+        return;
+      const remaining = deadline - Date.now();
+      if (remaining <= 0)
+        return finish(new Error("agent control socket did not answer before its deadline"));
+      if (!existsSync5(socketPath)) {
+        setTimeout(attempt, Math.min(100, Math.max(1, remaining)));
+        return;
       }
-    });
-    socket.on("error", reject);
+      let buffer = "";
+      const socket = connect(socketPath, () => socket.write(`${JSON.stringify(request)}
+`));
+      socket.setTimeout(remaining, () => {
+        socket.destroy();
+        finish(new Error("agent control socket did not answer before its deadline"));
+      });
+      socket.on("data", (chunk) => {
+        buffer += chunk.toString("utf8");
+        const newline = buffer.indexOf(`
+`);
+        if (newline === -1)
+          return;
+        socket.end();
+        try {
+          finish(undefined, JSON.parse(buffer.slice(0, newline)));
+        } catch (cause) {
+          finish(cause);
+        }
+      });
+      socket.on("error", (cause) => {
+        socket.destroy();
+        if ((cause.code === "ENOENT" || cause.code === "ECONNREFUSED") && Date.now() < deadline) {
+          setTimeout(attempt, Math.min(100, Math.max(1, deadline - Date.now())));
+          return;
+        }
+        finish(cause);
+      });
+    };
+    attempt();
   });
 }
+function controlRequestTimeout(operation) {
+  return operation === "deploy" ? 600000 : 30000;
+}
 
 // src/deployment-pull.ts
 var remoteOutcome = (cause) => cause instanceof SignedNodeHttpError && cause.status < 500 ? "refused" : "retryable";
@@ -8917,6 +9028,9 @@ async function pullDeploymentOnce(options) {
       ...target.topology ? { topology: structuredClone(target.topology) } : {}
     })) } : {},
     ...result.capacity ? { capacity: {
+      measuredSustainableRequestsPerSecond: result.capacity.measuredSustainableRequestsPerSecond,
+      allowedRequestsPerSecond: result.capacity.allowedRequestsPerSecond,
+      safetyRatio: result.capacity.safetyRatio,
       recommendedConcurrency: result.capacity.recommendedConcurrency,
       stopReason: result.capacity.stopReason,
       stages: result.capacity.stages.map((stage2) => ({ ...stage2 }))
@@ -9378,7 +9492,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.87";
+var VERSION2 = "0.1.89";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -10271,15 +10385,15 @@ function linuxList(members) {
   return ranges.join(",");
 }
 function physicalCoreGroups(pool) {
-  const cpus = membersOfLinuxList(pool.cpus, "CPU");
-  if (cpus.length % pool.physicalCores !== 0) {
+  const cpus2 = membersOfLinuxList(pool.cpus, "CPU");
+  if (cpus2.length % pool.physicalCores !== 0) {
     throw new MetalProvisionError("CPU pool threads must divide evenly across physical cores");
   }
-  const threadsPerCore = cpus.length / pool.physicalCores;
+  const threadsPerCore = cpus2.length / pool.physicalCores;
   if (!Number.isInteger(threadsPerCore) || threadsPerCore < 1 || threadsPerCore > 8) {
     throw new MetalProvisionError("invalid CPU pool threads-per-core topology");
   }
-  return Array.from({ length: pool.physicalCores }, (_, core) => Array.from({ length: threadsPerCore }, (_2, thread) => cpus[core + thread * pool.physicalCores]));
+  return Array.from({ length: pool.physicalCores }, (_, core) => Array.from({ length: threadsPerCore }, (_2, thread) => cpus2[core + thread * pool.physicalCores]));
 }
 var guestNameFor = (computeKey) => `fzg-${createHash7("sha256").update(computeKey).digest("hex").slice(0, 16)}`;
 var tapNameFor = (computeKey) => `fzt${createHash7("sha256").update(computeKey).digest("hex").slice(0, 12)}`;
@@ -10334,12 +10448,12 @@ function validateMetalProfile(profile) {
     if (!SAFE_NAME.test(pool.key) || keys.has(pool.key))
       throw new MetalProvisionError("invalid or duplicate CPU pool key");
     keys.add(pool.key);
-    const cpus = membersOfLinuxList(pool.cpus, "CPU");
-    if (!Number.isInteger(pool.physicalCores) || pool.physicalCores < 1 || pool.physicalCores > cpus.length) {
+    const cpus2 = membersOfLinuxList(pool.cpus, "CPU");
+    if (!Number.isInteger(pool.physicalCores) || pool.physicalCores < 1 || pool.physicalCores > cpus2.length) {
       throw new MetalProvisionError("invalid CPU pool physical-core count");
     }
     physicalCoreGroups(pool);
-    for (const cpu of cpus) {
+    for (const cpu of cpus2) {
       if (assigned.has(cpu))
         throw new MetalProvisionError("CPU pools overlap");
       assigned.add(cpu);
@@ -11293,13 +11407,13 @@ var memoryDirective = (nodes) => nodes ? `AllowedMemoryNodes=${nodes}
 ` : "";
 function metalGuestSliceUnit(profile) {
   validateMetalProfile(profile);
-  const cpus = compact(profile.cpuPools.flatMap((pool) => members(pool.cpus)));
+  const cpus2 = compact(profile.cpuPools.flatMap((pool) => members(pool.cpus)));
   const nodes = compact(profile.cpuPools.flatMap((pool) => pool.memoryNodes ? members(pool.memoryNodes) : [])) || undefined;
   return `[Unit]
 Description=ForgeZero exclusive guest CPU and memory boundary
 
 [Slice]
-AllowedCPUs=${cpus}
+AllowedCPUs=${cpus2}
 ${memoryDirective(nodes)}`;
 }
 function metalHousekeepingDropIn(profile, kind) {
@@ -11987,7 +12101,7 @@ function probeAgentCandidate(expected, socketPath = DEFAULT_AGENT_CANDIDATE_READ
         return;
       try {
         const value = JSON.parse(buffer.slice(0, newline));
-        finish(value.version === expected.version && typeof value.nodeKey === "string" && typeof value.bound === "boolean" && ["ready", "partial", "unavailable", "unbound"].includes(value.vault ?? ""));
+        finish(value.version === expected.version && value.nodeKey === expected.nodeKey && value.bound === expected.bound && expected.vault.includes(value.vault));
       } catch {
         finish(false);
       }
@@ -12190,13 +12304,18 @@ var restartAgent = async (target2, run2) => {
   }
 };
 var candidateUnit = (target2) => target2 === "compute" ? "forgezero-agent-candidate.service" : "forgezero-metal-agent-candidate.service";
-var startCandidate = async (staged, target2, run2, probe = (expected) => probeAgentCandidate(expected, DEFAULT_AGENT_CANDIDATE_READY_SOCKET)) => {
+var startCandidate = async (staged, target2, expectedNodeKey, run2, probe = (expected) => probeAgentCandidate(expected, DEFAULT_AGENT_CANDIDATE_READY_SOCKET)) => {
   selectAgentCandidate(staged);
   if (!await runOk(run2, "/usr/bin/systemctl", ["restart", candidateUnit(target2)])) {
     clearAgentCandidate(dirname8(staged.currentLink));
     throw new Error(`systemd could not start ${candidateUnit(target2)}`);
   }
-  if (!await probe({ version: staged.version })) {
+  if (!await probe({
+    version: staged.version,
+    nodeKey: expectedNodeKey,
+    bound: true,
+    vault: target2 === "compute" ? ["ready"] : ["unbound"]
+  })) {
     await run2({ command: "/usr/bin/systemctl", args: ["stop", candidateUnit(target2)] });
     clearAgentCandidate(dirname8(staged.currentLink));
     throw new Error("the candidate Agent did not prove its identity and durable state");
@@ -12275,8 +12394,9 @@ async function activateAgentRelease(staged, options = {}) {
   writeUpdateState(journalPath, receiptPath, journal);
   let selectionAttempted = false;
   try {
-    if (!options.candidatePrepared)
-      await startCandidate(staged, target2, run2);
+    if (!options.candidatePrepared) {
+      throw new Error("direct activation requires a separately identity-bound candidate preparation");
+    }
     if (target2 === "compute")
       switchAgentSocketRoute(paths.route, paths.candidate);
     selectionAttempted = true;
@@ -12466,6 +12586,9 @@ function startAgentUpdateHelper(options = {}) {
         }
         if (request.op !== "prepare")
           throw new Error("unknown update operation");
+        if (typeof request.expectedNodeKey !== "string" || request.expectedNodeKey.length < 16 || Buffer.byteLength(request.expectedNodeKey, "utf8") > 512 || /[\0\r\n]/.test(request.expectedNodeKey)) {
+          throw new Error("Agent update expected node identity is invalid");
+        }
         if (busy)
           throw new Error("another Agent update or recovery is already active");
         const prior = readJournal(journalPath, releaseRoot);
@@ -12478,8 +12601,8 @@ function startAgentUpdateHelper(options = {}) {
           currentVersion: request.currentVersion,
           root: releaseRoot
         });
-        await startCandidate(staged, request.target, runCommand);
-        pending = { staged, target: request.target, attemptId };
+        await startCandidate(staged, request.target, request.expectedNodeKey, runCommand);
+        pending = { staged, target: request.target, attemptId, expectedNodeKey: request.expectedNodeKey };
         ownsBusy = false;
         setTimer(() => {
           if (pending?.attemptId !== attemptId)
@@ -12537,13 +12660,13 @@ function requestAgentUpdate(request, socketPath = DEFAULT_AGENT_UPDATE_SOCKET, t
 
 // src/agent-heartbeat.ts
 import { existsSync as existsSync15, readFileSync as readFileSync11, statfsSync as statfsSync2 } from "fs";
-import { cpus, freemem, loadavg, totalmem } from "os";
+import { cpus as cpus2, freemem as freemem2, loadavg, totalmem as totalmem2 } from "os";
 function readAgentHostMetrics() {
   const filesystem = statfsSync2("/");
   return {
-    logicalCpu: cpus().length,
-    memoryBytes: totalmem(),
-    memoryFreeBytes: freemem(),
+    logicalCpu: cpus2().length,
+    memoryBytes: totalmem2(),
+    memoryFreeBytes: freemem2(),
     storageBytes: Number(filesystem.blocks) * Number(filesystem.bsize),
     storageFreeBytes: Number(filesystem.bavail) * Number(filesystem.bsize),
     load1m: loadavg()[0]
@@ -12636,7 +12759,14 @@ async function heartbeatAgentOnce(options) {
       let candidatePrepared = false;
       let drained = false;
       try {
-        const update2 = options.applyUpdate ?? ((phase, next, current2, attemptId) => requestAgentUpdate(phase === "prepare" ? { op: "prepare", target: options.updateTarget ?? "compute", release: next, currentVersion: current2, attemptId } : {
+        const update2 = options.applyUpdate ?? ((phase, next, current2, attemptId) => requestAgentUpdate(phase === "prepare" ? {
+          op: "prepare",
+          target: options.updateTarget ?? "compute",
+          release: next,
+          currentVersion: current2,
+          expectedNodeKey: options.nodeKey,
+          attemptId
+        } : {
           op: phase,
           target: options.updateTarget ?? "compute",
           currentVersion: current2,
@@ -13679,30 +13809,71 @@ function requestServiceActivation(request, socketPath = DEFAULT_SOFTWARE_HELPER_
 function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 15 * 60000) {
   validateSoftwareRequirements(requirements);
   return new Promise((resolve6, reject) => {
-    const socket = connect7(socketPath, () => socket.write(`${JSON.stringify({ op: "ensure", requirements })}
-`));
-    let buffer = "";
-    socket.setTimeout(timeoutMs, () => {
-      socket.destroy();
-      reject(new Error("software helper did not answer before its deadline"));
-    });
-    socket.on("data", (chunk) => {
-      buffer += chunk.toString("utf8");
-      const newline = buffer.indexOf(`
-`);
-      if (newline < 0)
+    const deadline = Date.now() + timeoutMs;
+    let settled = false;
+    const finish = (cause, results) => {
+      if (settled)
         return;
-      socket.end();
+      settled = true;
+      if (cause)
+        reject(cause);
+      else
+        resolve6(results);
+    };
+    const attempt = () => {
+      if (settled)
+        return;
+      const remaining = deadline - Date.now();
+      if (remaining <= 0)
+        return finish(new Error("software helper did not answer before its deadline"));
+      if (!existsSync18(socketPath)) {
+        setTimeout(attempt, Math.min(100, Math.max(1, remaining)));
+        return;
+      }
+      let buffer = "";
+      let socket;
       try {
-        const response = JSON.parse(buffer.slice(0, newline));
-        if (!response.ok || !response.results)
-          throw new Error(response.error?.message ?? "software helper refused the request");
-        resolve6(response.results);
+        socket = connect7(socketPath, () => socket.write(`${JSON.stringify({ op: "ensure", requirements })}
+`));
       } catch (cause) {
-        reject(cause);
+        const error = cause;
+        if ((error.code === "ENOENT" || error.code === "ECONNREFUSED") && Date.now() < deadline) {
+          setTimeout(attempt, Math.min(100, Math.max(1, deadline - Date.now())));
+          return;
+        }
+        finish(error);
+        return;
       }
-    });
-    socket.on("error", reject);
+      socket.setTimeout(remaining, () => {
+        socket.destroy();
+        finish(new Error("software helper did not answer before its deadline"));
+      });
+      socket.on("data", (chunk) => {
+        buffer += chunk.toString("utf8");
+        const newline = buffer.indexOf(`
+`);
+        if (newline < 0)
+          return;
+        socket.end();
+        try {
+          const response = JSON.parse(buffer.slice(0, newline));
+          if (!response.ok || !response.results)
+            throw new Error(response.error?.message ?? "software helper refused the request");
+          finish(undefined, response.results);
+        } catch (cause) {
+          finish(cause);
+        }
+      });
+      socket.on("error", (cause) => {
+        socket.destroy();
+        if ((cause.code === "ENOENT" || cause.code === "ECONNREFUSED") && Date.now() < deadline) {
+          setTimeout(attempt, Math.min(100, Math.max(1, deadline - Date.now())));
+          return;
+        }
+        finish(cause);
+      });
+    };
+    attempt();
   });
 }
 
@@ -13791,26 +13962,33 @@ function renderAgentEgressNft(uids, replace = false, loopback) {
     if (!uniqueUids.includes(loopback.uid))
       throw new Error("Loopback egress UID must be protected.");
     const ports = normalizeEgressTcpPorts(loopback.tcpPorts);
+    const sharedPorts = normalizeEgressTcpPorts(loopback.sharedTcpPorts ?? []);
     const publicPorts = loopback.publicTcpPorts === undefined ? undefined : normalizeEgressTcpPorts(loopback.publicTcpPorts);
     if (publicPorts && publicPorts.length < 1) {
       throw new Error("Restricted public egress needs at least one TCP port.");
     }
-    if (ports.length < 1 && !publicPorts) {
+    if (ports.length < 1 && sharedPorts.length < 1 && !publicPorts) {
       throw new Error("Restricted egress needs a loopback or public TCP port.");
     }
-    loopbackComment = (ports.length > 0 ? ` loopback=${loopback.uid}:${ports.join(",")}` : "") + (publicPorts ? ` public-tcp=${publicPorts.join(",")}` : "");
+    loopbackComment = (ports.length > 0 ? ` loopback=${loopback.uid}:${ports.join(",")}` : "") + (sharedPorts.length > 0 ? ` shared-loopback=${sharedPorts.join(",")}` : "") + (publicPorts ? ` public-tcp=${publicPorts.join(",")}` : "");
     loopbackSet = `${ports.length > 0 ? `	set loopback_tcp_ports {
 		type inet_service
 		elements = { ${ports.join(", ")} }
 	}
+` : ""}${sharedPorts.length > 0 ? `	set shared_loopback_tcp_ports {
+		type inet_service
+		elements = { ${sharedPorts.join(", ")} }
+	}
 ` : ""}${publicPorts ? `	set public_tcp_ports {
 		type inet_service
 		elements = { ${publicPorts.join(", ")} }
 	}
 ` : ""}`;
-    loopbackRules = ports.length > 0 ? `		meta skuid ${loopback.uid} tcp dport @loopback_tcp_ports ip daddr 127.0.0.1 accept
+    loopbackRules = `${sharedPorts.length > 0 ? `		meta skuid @service_uids tcp dport @shared_loopback_tcp_ports ip daddr 127.0.0.1 accept
+		meta skuid @service_uids tcp dport @shared_loopback_tcp_ports ip6 daddr ::1 accept
+` : ""}${ports.length > 0 ? `		meta skuid ${loopback.uid} tcp dport @loopback_tcp_ports ip daddr 127.0.0.1 accept
 		meta skuid ${loopback.uid} tcp dport @loopback_tcp_ports ip6 daddr ::1 accept
-` : "";
+` : ""}`;
     restrictedPublicRules = publicPorts ? `		meta skuid ${loopback.uid} tcp dport @public_tcp_ports accept
 		meta skuid ${loopback.uid} reject
 ` : "";
@@ -13905,12 +14083,15 @@ function verifyAgentEgressPolicy(uids, command3 = systemCommand, loopback) {
     if (!uniqueUids.includes(loopback.uid))
       return false;
     const ports = normalizeEgressTcpPorts(loopback.tcpPorts);
+    const sharedPorts = normalizeEgressTcpPorts(loopback.sharedTcpPorts ?? []);
     const publicPorts = loopback.publicTcpPorts === undefined ? undefined : normalizeEgressTcpPorts(loopback.publicTcpPorts);
     if (publicPorts && publicPorts.length < 1)
       return false;
-    if (ports.length < 1 && !publicPorts)
+    if (ports.length < 1 && sharedPorts.length < 1 && !publicPorts)
       return false;
-    loopbackComment = (ports.length > 0 ? ` loopback=${loopback.uid}:${ports.join(",")}` : "") + (publicPorts ? ` public-tcp=${publicPorts.join(",")}` : "");
+    loopbackComment = (ports.length > 0 ? ` loopback=${loopback.uid}:${ports.join(",")}` : "") + (sharedPorts.length > 0 ? ` shared-loopback=${sharedPorts.join(",")}` : "") + (publicPorts ? ` public-tcp=${publicPorts.join(",")}` : "");
+    if (sharedPorts.length > 0)
+      loopbackRequired.push(`elements = { ${sharedPorts.join(", ")} }`, "meta skuid @service_uids tcp dport @shared_loopback_tcp_ports ip daddr 127.0.0.1 accept", "meta skuid @service_uids tcp dport @shared_loopback_tcp_ports ip6 daddr ::1 accept");
     if (ports.length > 0)
       loopbackRequired.push(`elements = { ${ports.join(", ")} }`, `meta skuid ${loopback.uid} tcp dport @loopback_tcp_ports ip daddr 127.0.0.1 accept`, `meta skuid ${loopback.uid} tcp dport @loopback_tcp_ports ip6 daddr ::1 accept`);
     if (publicPorts)
@@ -13949,6 +14130,7 @@ function applyAgentEgressPolicy(options) {
   const loopback = options.loopback ? {
     uid: resolveServiceUid(options.loopback.user, command3),
     tcpPorts: normalizeEgressTcpPorts(options.loopback.tcpPorts),
+    sharedTcpPorts: normalizeEgressTcpPorts(options.loopback.sharedTcpPorts ?? []),
     publicTcpPorts: options.loopback.publicTcpPorts === undefined ? undefined : normalizeEgressTcpPorts(options.loopback.publicTcpPorts)
   } : undefined;
   if (loopback && !uids.includes(loopback.uid))
@@ -13975,6 +14157,7 @@ async function superviseAgentEgressPolicy(options) {
   const loopback = options.loopback ? {
     uid: resolveServiceUid(options.loopback.user, command3),
     tcpPorts: normalizeEgressTcpPorts(options.loopback.tcpPorts),
+    sharedTcpPorts: normalizeEgressTcpPorts(options.loopback.sharedTcpPorts ?? []),
     publicTcpPorts: options.loopback.publicTcpPorts === undefined ? undefined : normalizeEgressTcpPorts(options.loopback.publicTcpPorts)
   } : undefined;
   (options.notifyReady ?? (() => {
@@ -14714,11 +14897,29 @@ var replaceLink = (path2, target2) => {
   symlinkSync6(target2, pending);
   renameSync13(pending, path2);
 };
+var assertReleaseLinksContained = (path2) => {
+  const root = realpathSync5(path2);
+  const visit = (current2) => {
+    const metadata = lstatSync4(current2);
+    if (metadata.isSymbolicLink()) {
+      const target2 = realpathSync5(current2);
+      if (target2 !== root && !target2.startsWith(`${root}/`)) {
+        throw new Error("release contains a symbolic link outside its immutable root");
+      }
+      return;
+    }
+    if (metadata.isDirectory())
+      for (const name of readdirSync4(current2))
+        visit(join10(current2, name));
+  };
+  visit(root);
+};
 var secureRelease = (path2, uid, gid) => {
+  assertReleaseLinksContained(path2);
   const visit = (current2) => {
     const metadata = lstatSync4(current2);
     if (metadata.isSymbolicLink())
-      throw new Error("release contains a symbolic link");
+      return;
     chownSync(current2, uid, gid);
     chmodSync16(current2, metadata.isDirectory() ? 365 : 292);
     if (metadata.isDirectory())
@@ -14744,7 +14945,7 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const sleep2 = options.sleep ?? Bun.sleep;
   const slots = join10(normalized.root, "slots");
   mkdirSync14(slots, { recursive: true, mode: 493 });
-  const slotFile = join10(normalized.root, ".forge-slot");
+  const slotFile = join10(slots, ".active");
   const previousSlot = existsSync19(slotFile) ? readFileSync14(slotFile, "utf8").trim() : undefined;
   const target2 = previousSlot === "blue" ? "green" : "blue";
   const port = target2 === "blue" ? normalized.bluePort : normalized.greenPort;
@@ -14794,6 +14995,7 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const test = await exec(["/usr/sbin/nginx", "-t"]);
   const reload = test.exitCode === 0 ? await exec(["/usr/sbin/nginx", "-s", "reload"]) : test;
   if (reload.exitCode !== 0) {
+    const refusal = (reload.output || test.output).trim().slice(0, 2000);
     if (existsSync19(backup))
       renameSync13(backup, upstream);
     else
@@ -14801,7 +15003,7 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
     await exec(["/usr/sbin/nginx", "-t"]);
     await exec(["/usr/sbin/nginx", "-s", "reload"]);
     await stopTarget();
-    throw new Error("nginx refused the promoted upstream");
+    throw new Error(`nginx refused the promoted upstream${refusal ? `: ${refusal}` : ""}`);
   }
   rmSync10(backup, { force: true });
   writeFileSync14(slotFile, `${target2}
@@ -14833,7 +15035,7 @@ var checked8 = async (run2, argv2, expected = 0) => {
   return result;
 };
 var activeSlot = () => {
-  const slot = readFileSync15("/opt/forgezero/.forge-slot", "utf8").trim();
+  const slot = readFileSync15("/opt/forgezero/slots/.active", "utf8").trim();
   if (slot !== "blue" && slot !== "green")
     throw new Error("invalid active slot");
   return slot;
@@ -15030,6 +15232,7 @@ function agentEgressUnit(options) {
   }
   const deploymentEnabled = Boolean(options.repository || bootstrapBundleEnabled || options.pullDeployments);
   const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
+  const agentLoopbackPorts = normalizeEgressTcpPorts(options.agentLoopbackPorts ?? []);
   const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
   if (deploymentEnabled && runnerPublicTcpPorts.length < 1) {
     throw new Error("deployed project runner needs at least one vetted public TCP port");
@@ -15037,8 +15240,10 @@ function agentEgressUnit(options) {
   if (deploymentEnabled)
     systemdAgentEgressDirectives(runnerLoopbackPorts);
   const users = [user, ...deploymentEnabled ? [DEPLOYMENT_RUNNER_USER] : []];
-  const runnerGrant = deploymentEnabled ? ` --loopback-user=${DEPLOYMENT_RUNNER_USER}` + runnerLoopbackPorts.map((port) => ` --loopback-tcp-port=${port}`).join("") + runnerPublicTcpPorts.map((port) => ` --public-tcp-port=${port}`).join("") : "";
-  const policyProof = `ExecStartPost=${bin} egress-policy-check ${users.map((name) => `--user=${name}`).join(" ")}${runnerGrant}`;
+  const portGrantEnabled = deploymentEnabled || agentLoopbackPorts.length > 0;
+  const restrictedUser = deploymentEnabled ? DEPLOYMENT_RUNNER_USER : user;
+  const portGrant = portGrantEnabled ? ` --loopback-user=${restrictedUser}` + (deploymentEnabled ? runnerLoopbackPorts.map((port) => ` --loopback-tcp-port=${port}`).join("") : "") + agentLoopbackPorts.map((port) => ` --shared-loopback-tcp-port=${port}`).join("") + (deploymentEnabled ? runnerPublicTcpPorts.map((port) => ` --public-tcp-port=${port}`).join("") : "") : "";
+  const policyProof = `ExecStartPost=${bin} egress-policy-check ${users.map((name) => `--user=${name}`).join(" ")}${portGrant}`;
   return `[Unit]
 Description=ForgeZero Agent host egress policy
 Documentation=https://www.forgezero.net/docs/agent
@@ -15051,7 +15256,7 @@ Type=notify
 NotifyAccess=all
 User=root
 Group=root
-ExecStart=${bin} egress-policy ${users.map((name) => `--user=${name}`).join(" ")}${runnerGrant}
+ExecStart=${bin} egress-policy ${users.map((name) => `--user=${name}`).join(" ")}${portGrant}
 ${policyProof}
 Restart=on-failure
 RestartSec=2
@@ -15335,7 +15540,7 @@ function agentEnrolmentUnit(options) {
 Requires=forgezero-agent-egress.service
 BindsTo=forgezero-agent-egress.service
 ` : "";
-  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives() : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives(options.agentLoopbackPorts ?? []) : "";
   return `[Unit]
 Description=Bind this machine to its ForgeZero compute
 After=network-online.target
@@ -15372,7 +15577,7 @@ WantedBy=multi-user.target
 function deploymentRunnerUnit(options) {
   const bin = options.binPath ?? "fz-agent";
   const root = options.deployRoot ?? "/opt/forgezero";
-  const agentUser = options.user ?? "forgezero-agent";
+  const agentUser = options.user ?? "forgezero";
   const egressDependency = options.enforceEgress ? `After=forgezero-agent-egress.service
 Requires=forgezero-agent-egress.service
 BindsTo=forgezero-agent-egress.service
@@ -15413,7 +15618,7 @@ RestrictRealtime=true
 MemoryDenyWriteExecute=true
 LockPersonality=true
 ${egressDirectives}
-ReadWritePaths=${root}/releases ${root}/runner-home
+ReadWritePaths=${root}/releases ${root}/runner-home ${root}/slots /etc/nginx/conf.d /var/log/nginx
 
 [Install]
 WantedBy=multi-user.target
@@ -15548,7 +15753,7 @@ function agentUnit(options) {
   const supplementaryGroups = [
     AGENT_UPDATE_GROUP,
     deploymentEnabled ? DEPLOYMENT_GROUP : null,
-    deploymentEnabled ? SOFTWARE_HELPER_GROUP : null,
+    SOFTWARE_HELPER_GROUP,
     lifecycleEnabled ? LIFECYCLE_GROUP : null
   ].filter((value) => value !== null);
   const deploymentGroup = supplementaryGroups.length > 0 ? `SupplementaryGroups=${supplementaryGroups.join(" ")}` : "";
@@ -15557,7 +15762,7 @@ function agentUnit(options) {
     "forgezero-agent-update-helper.service",
     options.enforceEgress ? "forgezero-agent-egress.service" : null,
     deploymentEnabled ? "forgezero-deploy-runner.service" : null,
-    deploymentEnabled ? "forgezero-software-helper.service" : null,
+    "forgezero-software-helper.service",
     lifecycleEnabled ? "forgezero-lifecycle-helper.service" : null,
     warpEnabled ? "warp-svc.service" : null,
     enrolmentEnabled ? "forgezero-agent-enrol.service" : null
@@ -15566,7 +15771,7 @@ function agentUnit(options) {
     "forgezero-agent-update-helper.service",
     options.enforceEgress ? "forgezero-agent-egress.service" : null,
     deploymentEnabled ? "forgezero-deploy-runner.service" : null,
-    deploymentEnabled ? "forgezero-software-helper.service" : null,
+    "forgezero-software-helper.service",
     lifecycleEnabled ? "forgezero-lifecycle-helper.service" : null,
     warpEnabled ? "warp-svc.service" : null,
     enrolmentEnabled ? "forgezero-agent-enrol.service" : null
@@ -15581,9 +15786,9 @@ function agentUnit(options) {
   const snpDevice = options.mode === "attested" ? `DevicePolicy=closed
 DeviceAllow=/dev/sev-guest rw` : "";
   const snpPrepare = options.mode === "attested" ? `ExecStartPre=+/bin/chgrp ${VAULT_GROUP} /dev/sev-guest
-ExecStartPre=+/bin/chmod 0640 /dev/sev-guest
+ExecStartPre=+/bin/chmod 0660 /dev/sev-guest
 ` : "";
-  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives() : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives(options.agentLoopbackPorts ?? []) : "";
   return `[Unit]
 Description=ForgeZero node agent (${options.mode})
 Documentation=https://www.forgezero.net/docs/agent
@@ -15714,6 +15919,7 @@ function planProvision(options) {
   const deployRoot = options.deployRoot ?? "/opt/forgezero";
   const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
   const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
+  const agentLoopbackPorts = normalizeEgressTcpPorts(options.agentLoopbackPorts ?? []);
   const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
   const lifecycleEnabled = Boolean(options.pullMigrations && options.lifecycleProfilePath);
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
@@ -15762,8 +15968,9 @@ function planProvision(options) {
   const enabledUnits = [
     "forgezero-agent.socket",
     "forgezero-agent-update-helper.service",
+    "forgezero-software-helper.service",
     ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
-    ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+    ...deploymentEnabled ? ["forgezero-deploy-runner.service"] : [],
     ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
     ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
     ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : [],
@@ -15771,8 +15978,9 @@ function planProvision(options) {
   ];
   const restartedUnits = [
     "forgezero-agent-update-helper.service",
+    "forgezero-software-helper.service",
     ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
-    ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+    ...deploymentEnabled ? ["forgezero-deploy-runner.service"] : [],
     ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
     ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
     ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : []
@@ -15796,9 +16004,9 @@ function planProvision(options) {
       ...options.enforceEgress ? [
         { path: AGENT_EGRESS_UNIT_PATH, unit: agentEgressUnit(options) }
       ] : [],
+      { path: SOFTWARE_HELPER_UNIT_PATH, unit: softwareHelperUnit(options) },
       ...deploymentEnabled ? [
-        { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) },
-        { path: SOFTWARE_HELPER_UNIT_PATH, unit: softwareHelperUnit(options) }
+        { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) }
       ] : [],
       ...enrolmentEnabled ? [
         { path: ENROLMENT_UNIT_PATH, unit: agentEnrolmentUnit(options) }
@@ -15831,24 +16039,29 @@ function planProvision(options) {
       step2("Agent update helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", AGENT_UPDATE_GROUP], acceptedExitCodes: [0, 9] }] }),
       ...sourceBinPath && binPath ? [step2("root-owned agent runtime", { kind: "install-runtime", source: sourceBinPath, binary: binPath, version: VERSION2 })] : [],
       ...warpEnabled ? [step2("Cloudflare One client for Ubuntu 26.04", { kind: "install-warp" })] : [],
-      ...deploymentEnabled ? [step2("deployment isolation group", { kind: "commands", commands: [
-        { argv: ["/usr/sbin/groupadd", "--system", DEPLOYMENT_GROUP], acceptedExitCodes: [0, 9] },
+      step2("software strategy helper group", { kind: "commands", commands: [
         { argv: ["/usr/sbin/groupadd", "--system", SOFTWARE_HELPER_GROUP], acceptedExitCodes: [0, 9] }
+      ] }),
+      ...deploymentEnabled ? [step2("deployment isolation group", { kind: "commands", commands: [
+        { argv: ["/usr/sbin/groupadd", "--system", DEPLOYMENT_GROUP], acceptedExitCodes: [0, 9] }
       ] })] : [],
       ...lifecycleEnabled ? [step2("lifecycle helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", LIFECYCLE_GROUP], acceptedExitCodes: [0, 9] }] })] : [],
       step2("service account", { kind: "commands", commands: [{ argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", user], acceptedExitCodes: [0, 9] }] }),
       step2("bind service account to vault group", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-g", VAULT_GROUP, user] }] }),
       step2("grant verified Agent update access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", AGENT_UPDATE_GROUP, user] }] }),
+      step2("grant software helper socket access", { kind: "commands", commands: [
+        { argv: ["/usr/sbin/usermod", "-a", "-G", SOFTWARE_HELPER_GROUP, user] }
+      ] }),
       ...lifecycleEnabled ? [step2("grant lifecycle helper socket access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", LIFECYCLE_GROUP, user] }] })] : [],
       ...deploymentEnabled ? [step2("credential-free deployment account", { kind: "commands", commands: [
         { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", DEPLOYMENT_GROUP, DEPLOYMENT_RUNNER_USER], acceptedExitCodes: [0, 9] },
         { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", VAULT_GROUP, APPLICATION_RUNTIME_USER], acceptedExitCodes: [0, 9] },
         { argv: ["/usr/sbin/usermod", "-a", "-G", DEPLOYMENT_GROUP, APPLICATION_RUNTIME_USER] },
-        { argv: ["/usr/sbin/usermod", "-a", "-G", `${DEPLOYMENT_GROUP},${SOFTWARE_HELPER_GROUP}`, user] }
+        { argv: ["/usr/sbin/usermod", "-a", "-G", DEPLOYMENT_GROUP, user] }
       ] })] : [],
       step2("credential and state directories", { kind: "directories", directories: [
         { path: credentialDir, mode: 448, owner: "root", group: "root" },
-        { path: "/var/lib/forgezero", mode: 488, owner: "root", group: "root" }
+        { path: "/var/lib/forgezero", mode: 488, owner: "root", group: VAULT_GROUP }
       ] }),
       step2("encrypted node identity", { kind: "ensure-seed", credential: seedCredentialPath }),
       ...options.generateGitIdentity && gitCredentialPath && gitPublicKeyPath ? [
@@ -15899,19 +16112,26 @@ function planProvision(options) {
         { argv: ["/usr/bin/systemctl", "enable", ...enabledUnits] },
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
         ...restartedUnits.length ? [{ argv: ["/usr/bin/systemctl", "restart", ...restartedUnits] }] : [],
+        { argv: ["/usr/bin/systemctl", "stop", "forgezero-agent-proxy.service"], acceptedExitCodes: [0, 1, 5] },
         { argv: ["/usr/bin/systemctl", "restart", "forgezero-agent.socket"] },
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
         { argv: ["/usr/bin/systemctl", "restart", "forgezero-agent.service"] }
       ] }),
       ...enrolmentEnabled ? [step2("prove the compute binding is durable", { kind: "verify-file", path: enrolStatePath })] : [],
-      ...options.enforceEgress ? [step2("prove the Agent egress policy is active", { kind: "verify-egress", runnerPublicTcpPorts, runnerLoopbackPorts })] : [],
+      ...options.enforceEgress ? [step2("prove the Agent egress policy is active", {
+        kind: "verify-egress",
+        deploymentEnabled,
+        runnerPublicTcpPorts,
+        runnerLoopbackPorts,
+        agentLoopbackPorts
+      })] : [],
       step2("prove it is running", { kind: "commands", commands: [{ argv: ["/usr/bin/systemctl", "is-active", "forgezero-agent.service"] }] }),
       step2("prove the public Vault socket exists", { kind: "wait-socket", path: options.socketPath, attempts: 100, intervalMs: 100 }),
       step2("prove the Agent Vault backend exists", { kind: "wait-socket", path: agentBackendSocketPath(options.socketPath), attempts: 100, intervalMs: 100 }),
       step2("prove the Agent update helper exists", { kind: "wait-socket", path: DEFAULT_AGENT_UPDATE_SOCKET, attempts: 100, intervalMs: 100 }),
+      step2("prove the software strategy helper socket exists", { kind: "wait-socket", path: DEFAULT_SOFTWARE_HELPER_SOCKET, attempts: 100, intervalMs: 100 }),
       ...deploymentEnabled ? [
-        step2("prove the deployment runner socket exists", { kind: "wait-socket", path: DEPLOYMENT_RUNNER_SOCKET, attempts: 100, intervalMs: 100 }),
-        step2("prove the software strategy helper socket exists", { kind: "wait-socket", path: DEFAULT_SOFTWARE_HELPER_SOCKET, attempts: 100, intervalMs: 100 })
+        step2("prove the deployment runner socket exists", { kind: "wait-socket", path: DEPLOYMENT_RUNNER_SOCKET, attempts: 100, intervalMs: 100 })
       ] : [],
       ...lifecycleEnabled ? [step2("prove the lifecycle helper socket exists", { kind: "wait-socket", path: lifecycleHelperSocketPath, attempts: 100, intervalMs: 100 })] : [],
       ...warpEnabled ? [step2("prove Cloudflare WARP is connected", { kind: "verify-warp" })] : [],
@@ -15936,6 +16156,25 @@ import {
   writeFileSync as writeFileSync15
 } from "fs";
 import { dirname as dirname13 } from "path";
+function normalizeEd25519PublicKey(output) {
+  const line = output.trim();
+  if (!/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}(?: [^\r\n]{1,256})?$/.test(line))
+    return;
+  const [algorithm, encoded] = line.split(" ", 3);
+  if (algorithm !== "ssh-ed25519" || !encoded)
+    return;
+  let blob;
+  try {
+    blob = Buffer.from(encoded, "base64");
+  } catch {
+    return;
+  }
+  if (blob.length !== 51 || blob.readUInt32BE(0) !== 11 || blob.subarray(4, 15).toString("ascii") !== "ssh-ed25519" || blob.readUInt32BE(15) !== 32)
+    return;
+  if (blob.toString("base64") !== encoded)
+    return;
+  return `${algorithm} ${encoded}`;
+}
 async function readCapabilities(run2) {
   const answers = {};
   const checks = Object.entries(CAPABILITY_CHECKS);
@@ -16075,7 +16314,7 @@ var runProvisionOperation = async (operation) => {
             return result;
         }
         result = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
-        if (result.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(result.stdout)) {
+        if (result.exitCode !== 0 || !normalizeEd25519PublicKey(result.stdout)) {
           return { stdout: "bootstrap SSH private key is not a valid Ed25519 OpenSSH key", exitCode: 1 };
         }
         result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=bootstrap-ssh-key", key, operation.credential]);
@@ -16091,11 +16330,12 @@ var runProvisionOperation = async (operation) => {
           chmodSync17(key, 384);
         }
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
-        if (derived.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(derived.stdout)) {
+        const publicKey = normalizeEd25519PublicKey(derived.stdout);
+        if (derived.exitCode !== 0 || !publicKey) {
           return { stdout: "bootstrap SSH public key derivation failed", exitCode: 1 };
         }
         mkdirSync15(dirname13(operation.publicKey), { recursive: true, mode: 493 });
-        writeFileSync15(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
+        writeFileSync15(operation.publicKey, `${publicKey} forgezero-bootstrap-runner
 `, { mode: 292 });
         chmodSync17(operation.publicKey, 292);
       }
@@ -16138,8 +16378,9 @@ var runProvisionOperation = async (operation) => {
     const policy = await fixed(["/usr/sbin/nft", "--numeric", "list", "table", "inet", "forgezero_agent_egress"]);
     const required = [
       "forgezero-agent-egress-v1",
-      `public-tcp=${operation.runnerPublicTcpPorts.join(",")}`,
-      ...operation.runnerLoopbackPorts.length ? [`:${operation.runnerLoopbackPorts.join(",")}`] : []
+      ...operation.agentLoopbackPorts.length ? [`shared-loopback=${operation.agentLoopbackPorts.join(",")}`] : [],
+      ...operation.deploymentEnabled && operation.runnerPublicTcpPorts.length ? [`public-tcp=${operation.runnerPublicTcpPorts.join(",")}`] : [],
+      ...operation.deploymentEnabled && operation.runnerLoopbackPorts.length ? [`:${operation.runnerLoopbackPorts.join(",")}`] : []
     ];
     return policy.exitCode === 0 && required.every((part) => policy.stdout.includes(part)) ? { stdout: policy.stdout, exitCode: 0 } : { stdout: policy.stdout, exitCode: 1 };
   }
@@ -16205,7 +16446,9 @@ async function applyPlan(plan, run2) {
     const result = await run2(step3.operation);
     transcript.push({ label: step3.label, command: step3.command, exitCode: result.exitCode });
     if (result.exitCode !== 0 && !step3.optional) {
-      throw new Error(`${step3.label} failed (exit ${result.exitCode}): ${step3.command}`);
+      const safeDetail = step3.operation.kind === "ensure-bootstrap-ssh-identity" ? result.stdout.trim().slice(0, 1000) : "";
+      throw new Error(`${step3.label} failed (exit ${result.exitCode}): ${step3.command}${safeDetail ? `
+${safeDetail}` : ""}`);
     }
   }
   return transcript;
@@ -16232,7 +16475,6 @@ var SEED_CREDENTIAL = `${CREDS}/seed-sync-root.cred`;
 var BACKUP_RECOVERY_CREDENTIAL = `${CREDS}/backup-recovery-root.cred`;
 var BOOTSTRAP_SSH_CREDENTIAL = `${CREDS}/bootstrap-ssh-key.cred`;
 var BOOTSTRAP_SSH_PUBLIC_KEY = "/etc/forgezero/bootstrap/runner.pub";
-var BOOTSTRAP_RELEASE_EVIDENCE = "/var/lib/forgezero/bootstrap-release.json";
 var LIFECYCLE_PROFILE = "/etc/forgezero/lifecycle.json";
 var CONTROL_SOCKET = "/run/forgezero/control.sock";
 var CLOUDFLARED_METRICS_ADDRESS = "127.0.0.1:20241";
@@ -16451,6 +16693,8 @@ function planBootstrapAgentInstall(config, phase, context) {
     bootstrapTargetTelemetryEndpoint: bound && bootstrapRunner ? platformBootstrapRunner(config) ? config.telemetryEndpoint : config.kind === "enrolled-compute" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined : undefined,
     lifecycleProfilePath: bound && config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
     enforceEgress: true,
+    runnerLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort, config.runtime.bluePort, config.runtime.greenPort] : [],
+    agentLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort] : [],
     nodeHostname: config.nodeHostname,
     telemetryEndpoint: config.telemetryEndpoint,
     binPath: "/usr/local/lib/forgezero/agent/fz-agent",
@@ -16460,7 +16704,7 @@ function planBootstrapAgentInstall(config, phase, context) {
       enrolStatePath: "/var/lib/forgezero/enrolment.json"
     } : bound ? { enrolStatePath: "/var/lib/forgezero/enrolment.json" } : {},
     ...authenticated ? {
-      apiUrl: config.apiUrl,
+      apiUrl: config.kind === "platform" ? `http://127.0.0.1:${config.runtime.environment.publicApiPort}` : config.apiUrl,
       project: config.kind === "enrolled-compute" ? config.realm : "platform",
       environment: config.kind === "enrolled-compute" ? undefined : config.environment,
       nodeLabel: config.kind === "enrolled-compute" ? config.nodeHostname : config.computeReference
@@ -16469,6 +16713,7 @@ function planBootstrapAgentInstall(config, phase, context) {
   return planInstall(options);
 }
 function localBootstrapHost() {
+  let softwareClientUser;
   const execute3 = async (argv2, options = {}) => {
     const child = Bun.spawn([...argv2], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
     if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
@@ -16501,10 +16746,12 @@ function localBootstrapHost() {
     exec: execute3,
     sleep: (milliseconds) => Bun.sleep(milliseconds),
     async ensureSoftware(requirements) {
+      if (!softwareClientUser)
+        throw new Error("Agent must be converged before software requirements are applied");
       const result = await execute3([
         "runuser",
         "-u",
-        "forgezero-agent",
+        softwareClientUser,
         "--",
         "/usr/local/bin/fz-agent",
         "software-ensure",
@@ -16518,7 +16765,7 @@ function localBootstrapHost() {
       const capabilities = await readCapabilities(localRunner);
       const hasBinding = existsSync22("/var/lib/forgezero/enrolment.json");
       const hasEnrolCredential = existsSync22(ENROL_CREDENTIAL);
-      const initialBundle = config.kind === "platform" && !existsSync22(BOOTSTRAP_RELEASE_EVIDENCE) ? {
+      const initialBundle = config.kind === "platform" && phase === "bootstrap" && existsSync22(config.bootstrapBundle.bundleFile) && existsSync22(config.bootstrapBundle.manifestFile) ? {
         path: config.bootstrapBundle.bundleFile,
         manifestPath: config.bootstrapBundle.manifestFile,
         manifest: parseBootstrapBundleManifest(JSON.parse(readFileSync17(config.bootstrapBundle.manifestFile, "utf8")))
@@ -16549,6 +16796,7 @@ function localBootstrapHost() {
         writeFileSync16(unit3.path, unit3.unit, { mode: 420 });
       }
       await applyPlan(plan, localRunner);
+      softwareClientUser = plan.user;
       return plan;
     }
   };
@@ -17202,6 +17450,14 @@ async function initializeVaultReplica(cache) {
     return { state: "unavailable", loaded: 0, failed: [] };
   }
 }
+async function attemptInitialAttestation(attempt, onDeferred) {
+  try {
+    return { verified: true, result: await attempt() };
+  } catch (cause) {
+    onDeferred(cause);
+    return { verified: false };
+  }
+}
 function runAgent(config = {}) {
   const seed = config.seed ?? configuredAgentSeed({
     credential: config.seedCredential,
@@ -17370,16 +17626,18 @@ if (import.meta.main) {
     const loopbackUser = args.find((arg) => arg.startsWith("--loopback-user="))?.slice("--loopback-user=".length);
     const parsePorts = (prefix) => args.filter((arg) => arg.startsWith(prefix)).map((arg) => Number(arg.slice(prefix.length)));
     const loopbackTcpPorts = parsePorts("--loopback-tcp-port=");
+    const sharedLoopbackTcpPorts = parsePorts("--shared-loopback-tcp-port=");
     const publicTcpPorts = parsePorts("--public-tcp-port=");
-    if (!loopbackUser && (loopbackTcpPorts.length > 0 || publicTcpPorts.length > 0)) {
+    if (!loopbackUser && (loopbackTcpPorts.length > 0 || sharedLoopbackTcpPorts.length > 0 || publicTcpPorts.length > 0)) {
       throw new Error("egress-policy port grants require --loopback-user=<service-user>");
     }
-    if (loopbackUser && loopbackTcpPorts.length < 1 && publicTcpPorts.length < 1) {
+    if (loopbackUser && loopbackTcpPorts.length < 1 && sharedLoopbackTcpPorts.length < 1 && publicTcpPorts.length < 1) {
       throw new Error("egress-policy restricted user requires an explicit TCP port grant");
     }
     const loopback = loopbackUser ? {
       user: loopbackUser,
       tcpPorts: loopbackTcpPorts,
+      sharedTcpPorts: sharedLoopbackTcpPorts,
       publicTcpPorts: publicTcpPorts.length > 0 ? publicTcpPorts : undefined
     } : undefined;
     if (command3 === "egress-policy-check") {
@@ -17387,6 +17645,7 @@ if (import.meta.main) {
       const grant = loopback ? {
         uid: resolveServiceUid(loopback.user),
         tcpPorts: loopback.tcpPorts,
+        sharedTcpPorts: loopback.sharedTcpPorts,
         publicTcpPorts: loopback.publicTcpPorts
       } : undefined;
       if (!verifyAgentEgressPolicy(uids, undefined, grant))
@@ -17641,8 +17900,8 @@ if (import.meta.main) {
       ...request,
       publicKeys: { ed25519: keys2.ed25519.publicKey, mlDsa: keys2.mlDsa.publicKey },
       preflight: {
-        vcpu: cpus2().length,
-        memoryGib: Math.max(1, Math.floor(totalmem2() / 1024 ** 3)),
+        vcpu: cpus3().length,
+        memoryGib: Math.max(1, Math.floor(totalmem3() / 1024 ** 3)),
         diskGib: Math.max(1, Math.floor(Number(filesystem.blocks) * Number(filesystem.bsize) / 1024 ** 3)),
         kvm: existsSync23("/dev/kvm"),
         snpHost: existsSync23("/dev/sev"),
@@ -17768,7 +18027,7 @@ if (import.meta.main) {
       key: keyArg?.slice("--key=".length) ?? ""
     } : { op: command3 };
     try {
-      const response = await requestControl(request, socketPath);
+      const response = await requestControl(request, socketPath, controlRequestTimeout(request.op));
       console.log(JSON.stringify(response, null, 2));
       process.exit(response.ok ? 0 : 1);
     } catch (cause) {
@@ -17820,14 +18079,17 @@ if (import.meta.main) {
   let secretCache;
   let vaultSync;
   let initialVaultState = "unbound";
+  let initialAttestationVerified = !attestationSource;
   if (binding && attestationSource && nodeApiUrl) {
-    const result = await telemetry.observe("attestation.refresh", () => attestNodeOnce({
+    const initial = await attemptInitialAttestation(() => telemetry.observe("attestation.refresh", () => attestNodeOnce({
       apiUrl: nodeApiUrl,
       nodeKey,
       keys,
       source: attestationSource
-    }));
-    console.log(`[agent] initial SEV-SNP attestation verified ${result.measurement.slice(0, 16)}\u2026`);
+    })), (cause) => console.error(`[agent] initial SEV-SNP attestation deferred: ${cause.message}`));
+    initialAttestationVerified = initial.verified;
+    if (initial.verified)
+      console.log(`[agent] initial SEV-SNP attestation verified ${initial.result.measurement.slice(0, 16)}\u2026`);
   }
   if (binding && nodeApiUrl) {
     secretCache = createNodeVaultCache({
@@ -17836,21 +18098,35 @@ if (import.meta.main) {
       keys,
       projectKey: binding.projectKey
     });
-    const initialVault = await telemetry.observe("vault.sync", () => initializeVaultReplica(secretCache), (result) => result.state === "ready" ? "success" : "failed");
-    initialVaultState = initialVault.state;
-    running.setVault(secretCache, binding.projectKey);
-    vaultSync = startNodeVaultSync(secretCache, {
-      telemetry,
-      onEvent: (event, detail) => console.log(`[agent] vault ${event}${detail ? ` ${JSON.stringify(detail)}` : ""}`)
-    });
-    if (initialVault.state === "ready") {
-      console.log(`[agent] in-memory vault loaded for every environment in project ${binding.projectKey}`);
-    } else if (initialVault.state === "partial") {
-      console.error(`[agent] vault replica partial (${initialVault.loaded} loaded, ${initialVault.failed.length} unavailable); ` + "explicit same-name systemd deployment fallbacks remain available");
-    } else {
-      console.error("[agent] vault replica unavailable; authenticated refresh remains active and only explicit " + "same-name systemd deployment fallbacks are available");
-    }
   }
+  let vaultActivation;
+  const activateVaultReplica = () => {
+    if (!binding || !secretCache || vaultSync)
+      return Promise.resolve();
+    if (vaultActivation)
+      return vaultActivation;
+    vaultActivation = (async () => {
+      const initialVault = await telemetry.observe("vault.sync", () => initializeVaultReplica(secretCache), (result) => result.state === "ready" ? "success" : "failed");
+      initialVaultState = initialVault.state;
+      running.setVault(secretCache, binding.projectKey);
+      vaultSync = startNodeVaultSync(secretCache, {
+        telemetry,
+        onEvent: (event, detail) => console.log(`[agent] vault ${event}${detail ? ` ${JSON.stringify(detail)}` : ""}`)
+      });
+      if (initialVault.state === "ready") {
+        console.log(`[agent] in-memory vault loaded for every environment in project ${binding.projectKey}`);
+      } else if (initialVault.state === "partial") {
+        console.error(`[agent] vault replica partial (${initialVault.loaded} loaded, ${initialVault.failed.length} unavailable); ` + "explicit same-name systemd deployment fallbacks remain available");
+      } else {
+        console.error("[agent] vault replica unavailable; authenticated refresh remains active and only explicit " + "same-name systemd deployment fallbacks are available");
+      }
+    })().finally(() => {
+      vaultActivation = undefined;
+    });
+    return vaultActivation;
+  };
+  if (initialAttestationVerified)
+    await activateVaultReplica();
   if (handoverCandidate) {
     const ready = startAgentCandidateReady({
       version: VERSION2,
@@ -17882,8 +18158,12 @@ if (import.meta.main) {
     keys,
     telemetry,
     source: attestationSource,
-    immediate: !binding,
-    onEvent: (event, detail) => console.log(`[agent] attestation ${event}${detail ? ` ${detail instanceof Error ? detail.message : JSON.stringify(detail)}` : ""}`)
+    immediate: !initialAttestationVerified,
+    onEvent: (event, detail) => {
+      console.log(`[agent] attestation ${event}${detail ? ` ${detail instanceof Error ? detail.message : JSON.stringify(detail)}` : ""}`);
+      if (event === "verified")
+        activateVaultReplica().catch((cause) => console.error(`[agent] vault activation deferred: ${cause.message}`));
+    }
   }) : undefined;
   if (attestationLoop)
     console.log("[agent] periodic SEV-SNP attestation enabled");
@@ -17974,6 +18254,7 @@ if (import.meta.main) {
       gitCredentialPath: process.env.CREDENTIALS_DIRECTORY ? `${process.env.CREDENTIALS_DIRECTORY}/git-deploy-key` : undefined,
       knownHostsPath: source.knownHosts ? join12(root, "cache", `known-hosts-${key}`) : undefined,
       knownHostsContent: source.knownHosts,
+      attestation: attestationSource,
       cache: deploymentSecrets,
       capacityEvidenceDirectory: process.env.FZ_CAPACITY_EVIDENCE_DIR ?? join12(root, "cache", "capacity"),
       ensureSoftware: (requirements) => requestSoftware(requirements, process.env.FZ_SOFTWARE_HELPER_SOCKET ?? DEFAULT_SOFTWARE_HELPER_SOCKET),
@@ -17983,10 +18264,10 @@ if (import.meta.main) {
       applyConnectivity: (request) => requestDeploymentConnectivity(request, process.env.FZ_SOFTWARE_HELPER_SOCKET ?? DEFAULT_SOFTWARE_HELPER_SOCKET),
       projectExec: process.env.FZ_DEPLOY_RUNNER_SOCKET ? (input) => requestDeploymentCommand(input, process.env.FZ_DEPLOY_RUNNER_SOCKET) : undefined
     });
-    const staticManager = repository && branch && profile ? createDeploymentManager(managerOptions({ repository, branch, profile }, process.env.FZ_DEPLOY_KEY ?? `${repository}:${branch}:${profile}`)) : bootstrapBundle && branch && profile ? createDeploymentManager({
+    const staticManager = bootstrapBundle && branch && profile ? createDeploymentManager({
       ...managerOptions({ repository: bootstrapBundle.path, branch, profile }, process.env.FZ_DEPLOY_KEY ?? `bootstrap:${bootstrapBundle.manifest.sha256}:${profile}`),
       bootstrapBundle
-    }) : undefined;
+    }) : repository && branch && profile ? createDeploymentManager(managerOptions({ repository, branch, profile }, process.env.FZ_DEPLOY_KEY ?? `${repository}:${branch}:${profile}`)) : undefined;
     if (staticManager)
       managers.set("__static__", staticManager);
     const control = staticManager ? startControlServer(staticManager, process.env.FZ_CONTROL_SOCKET ?? DEFAULT_CONTROL_SOCKET) : undefined;
@@ -18260,6 +18541,7 @@ export {
   cloudInit,
   calibrateHttpConcurrency,
   attestNodeOnce,
+  attemptInitialAttestation,
   assertSupportedGuestImage,
   applyMetalIsolation,
   applyAgentEgressPolicy,