@forgezero/agent 0.1.88 → 0.1.89

package/dist/bootstrap.js

@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.88";
+var VERSION = "0.1.89";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -1698,6 +1698,7 @@ function agentEgressUnit(options) {
   }
   const deploymentEnabled = Boolean(options.repository || bootstrapBundleEnabled || options.pullDeployments);
   const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
+  const agentLoopbackPorts = normalizeEgressTcpPorts(options.agentLoopbackPorts ?? []);
   const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
   if (deploymentEnabled && runnerPublicTcpPorts.length < 1) {
     throw new Error("deployed project runner needs at least one vetted public TCP port");
@@ -1705,8 +1706,10 @@ function agentEgressUnit(options) {
   if (deploymentEnabled)
     systemdAgentEgressDirectives(runnerLoopbackPorts);
   const users = [user, ...deploymentEnabled ? [DEPLOYMENT_RUNNER_USER] : []];
-  const runnerGrant = deploymentEnabled ? ` --loopback-user=${DEPLOYMENT_RUNNER_USER}` + runnerLoopbackPorts.map((port) => ` --loopback-tcp-port=${port}`).join("") + runnerPublicTcpPorts.map((port) => ` --public-tcp-port=${port}`).join("") : "";
-  const policyProof = `ExecStartPost=${bin} egress-policy-check ${users.map((name) => `--user=${name}`).join(" ")}${runnerGrant}`;
+  const portGrantEnabled = deploymentEnabled || agentLoopbackPorts.length > 0;
+  const restrictedUser = deploymentEnabled ? DEPLOYMENT_RUNNER_USER : user;
+  const portGrant = portGrantEnabled ? ` --loopback-user=${restrictedUser}` + (deploymentEnabled ? runnerLoopbackPorts.map((port) => ` --loopback-tcp-port=${port}`).join("") : "") + agentLoopbackPorts.map((port) => ` --shared-loopback-tcp-port=${port}`).join("") + (deploymentEnabled ? runnerPublicTcpPorts.map((port) => ` --public-tcp-port=${port}`).join("") : "") : "";
+  const policyProof = `ExecStartPost=${bin} egress-policy-check ${users.map((name) => `--user=${name}`).join(" ")}${portGrant}`;
   return `[Unit]
 Description=ForgeZero Agent host egress policy
 Documentation=https://www.forgezero.net/docs/agent
@@ -1719,7 +1722,7 @@ Type=notify
 NotifyAccess=all
 User=root
 Group=root
-ExecStart=${bin} egress-policy ${users.map((name) => `--user=${name}`).join(" ")}${runnerGrant}
+ExecStart=${bin} egress-policy ${users.map((name) => `--user=${name}`).join(" ")}${portGrant}
 ${policyProof}
 Restart=on-failure
 RestartSec=2
@@ -2003,7 +2006,7 @@ function agentEnrolmentUnit(options) {
 Requires=forgezero-agent-egress.service
 BindsTo=forgezero-agent-egress.service
 ` : "";
-  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives() : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives(options.agentLoopbackPorts ?? []) : "";
   return `[Unit]
 Description=Bind this machine to its ForgeZero compute
 After=network-online.target
@@ -2040,7 +2043,7 @@ WantedBy=multi-user.target
 function deploymentRunnerUnit(options) {
   const bin = options.binPath ?? "fz-agent";
   const root = options.deployRoot ?? "/opt/forgezero";
-  const agentUser = options.user ?? "forgezero-agent";
+  const agentUser = options.user ?? "forgezero";
   const egressDependency = options.enforceEgress ? `After=forgezero-agent-egress.service
 Requires=forgezero-agent-egress.service
 BindsTo=forgezero-agent-egress.service
@@ -2081,7 +2084,7 @@ RestrictRealtime=true
 MemoryDenyWriteExecute=true
 LockPersonality=true
 ${egressDirectives}
-ReadWritePaths=${root}/releases ${root}/runner-home
+ReadWritePaths=${root}/releases ${root}/runner-home ${root}/slots /etc/nginx/conf.d /var/log/nginx
 
 [Install]
 WantedBy=multi-user.target
@@ -2216,7 +2219,7 @@ function agentUnit(options) {
   const supplementaryGroups = [
     AGENT_UPDATE_GROUP,
     deploymentEnabled ? DEPLOYMENT_GROUP : null,
-    deploymentEnabled ? SOFTWARE_HELPER_GROUP : null,
+    SOFTWARE_HELPER_GROUP,
     lifecycleEnabled ? LIFECYCLE_GROUP : null
   ].filter((value) => value !== null);
   const deploymentGroup = supplementaryGroups.length > 0 ? `SupplementaryGroups=${supplementaryGroups.join(" ")}` : "";
@@ -2225,7 +2228,7 @@ function agentUnit(options) {
     "forgezero-agent-update-helper.service",
     options.enforceEgress ? "forgezero-agent-egress.service" : null,
     deploymentEnabled ? "forgezero-deploy-runner.service" : null,
-    deploymentEnabled ? "forgezero-software-helper.service" : null,
+    "forgezero-software-helper.service",
     lifecycleEnabled ? "forgezero-lifecycle-helper.service" : null,
     warpEnabled ? "warp-svc.service" : null,
     enrolmentEnabled ? "forgezero-agent-enrol.service" : null
@@ -2234,7 +2237,7 @@ function agentUnit(options) {
     "forgezero-agent-update-helper.service",
     options.enforceEgress ? "forgezero-agent-egress.service" : null,
     deploymentEnabled ? "forgezero-deploy-runner.service" : null,
-    deploymentEnabled ? "forgezero-software-helper.service" : null,
+    "forgezero-software-helper.service",
     lifecycleEnabled ? "forgezero-lifecycle-helper.service" : null,
     warpEnabled ? "warp-svc.service" : null,
     enrolmentEnabled ? "forgezero-agent-enrol.service" : null
@@ -2249,9 +2252,9 @@ function agentUnit(options) {
   const snpDevice = options.mode === "attested" ? `DevicePolicy=closed
 DeviceAllow=/dev/sev-guest rw` : "";
   const snpPrepare = options.mode === "attested" ? `ExecStartPre=+/bin/chgrp ${VAULT_GROUP} /dev/sev-guest
-ExecStartPre=+/bin/chmod 0640 /dev/sev-guest
+ExecStartPre=+/bin/chmod 0660 /dev/sev-guest
 ` : "";
-  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives() : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives(options.agentLoopbackPorts ?? []) : "";
   return `[Unit]
 Description=ForgeZero node agent (${options.mode})
 Documentation=https://www.forgezero.net/docs/agent
@@ -2382,6 +2385,7 @@ function planProvision(options) {
   const deployRoot = options.deployRoot ?? "/opt/forgezero";
   const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
   const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
+  const agentLoopbackPorts = normalizeEgressTcpPorts(options.agentLoopbackPorts ?? []);
   const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
   const lifecycleEnabled = Boolean(options.pullMigrations && options.lifecycleProfilePath);
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
@@ -2430,8 +2434,9 @@ function planProvision(options) {
   const enabledUnits = [
     "forgezero-agent.socket",
     "forgezero-agent-update-helper.service",
+    "forgezero-software-helper.service",
     ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
-    ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+    ...deploymentEnabled ? ["forgezero-deploy-runner.service"] : [],
     ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
     ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
     ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : [],
@@ -2439,8 +2444,9 @@ function planProvision(options) {
   ];
   const restartedUnits = [
     "forgezero-agent-update-helper.service",
+    "forgezero-software-helper.service",
     ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
-    ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+    ...deploymentEnabled ? ["forgezero-deploy-runner.service"] : [],
     ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
     ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
     ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : []
@@ -2464,9 +2470,9 @@ function planProvision(options) {
       ...options.enforceEgress ? [
         { path: AGENT_EGRESS_UNIT_PATH, unit: agentEgressUnit(options) }
       ] : [],
+      { path: SOFTWARE_HELPER_UNIT_PATH, unit: softwareHelperUnit(options) },
       ...deploymentEnabled ? [
-        { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) },
-        { path: SOFTWARE_HELPER_UNIT_PATH, unit: softwareHelperUnit(options) }
+        { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) }
       ] : [],
       ...enrolmentEnabled ? [
         { path: ENROLMENT_UNIT_PATH, unit: agentEnrolmentUnit(options) }
@@ -2499,24 +2505,29 @@ function planProvision(options) {
       step("Agent update helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", AGENT_UPDATE_GROUP], acceptedExitCodes: [0, 9] }] }),
       ...sourceBinPath && binPath ? [step("root-owned agent runtime", { kind: "install-runtime", source: sourceBinPath, binary: binPath, version: VERSION })] : [],
       ...warpEnabled ? [step("Cloudflare One client for Ubuntu 26.04", { kind: "install-warp" })] : [],
-      ...deploymentEnabled ? [step("deployment isolation group", { kind: "commands", commands: [
-        { argv: ["/usr/sbin/groupadd", "--system", DEPLOYMENT_GROUP], acceptedExitCodes: [0, 9] },
+      step("software strategy helper group", { kind: "commands", commands: [
         { argv: ["/usr/sbin/groupadd", "--system", SOFTWARE_HELPER_GROUP], acceptedExitCodes: [0, 9] }
+      ] }),
+      ...deploymentEnabled ? [step("deployment isolation group", { kind: "commands", commands: [
+        { argv: ["/usr/sbin/groupadd", "--system", DEPLOYMENT_GROUP], acceptedExitCodes: [0, 9] }
       ] })] : [],
       ...lifecycleEnabled ? [step("lifecycle helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", LIFECYCLE_GROUP], acceptedExitCodes: [0, 9] }] })] : [],
       step("service account", { kind: "commands", commands: [{ argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", user], acceptedExitCodes: [0, 9] }] }),
       step("bind service account to vault group", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-g", VAULT_GROUP, user] }] }),
       step("grant verified Agent update access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", AGENT_UPDATE_GROUP, user] }] }),
+      step("grant software helper socket access", { kind: "commands", commands: [
+        { argv: ["/usr/sbin/usermod", "-a", "-G", SOFTWARE_HELPER_GROUP, user] }
+      ] }),
       ...lifecycleEnabled ? [step("grant lifecycle helper socket access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", LIFECYCLE_GROUP, user] }] })] : [],
       ...deploymentEnabled ? [step("credential-free deployment account", { kind: "commands", commands: [
         { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", DEPLOYMENT_GROUP, DEPLOYMENT_RUNNER_USER], acceptedExitCodes: [0, 9] },
         { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", VAULT_GROUP, APPLICATION_RUNTIME_USER], acceptedExitCodes: [0, 9] },
         { argv: ["/usr/sbin/usermod", "-a", "-G", DEPLOYMENT_GROUP, APPLICATION_RUNTIME_USER] },
-        { argv: ["/usr/sbin/usermod", "-a", "-G", `${DEPLOYMENT_GROUP},${SOFTWARE_HELPER_GROUP}`, user] }
+        { argv: ["/usr/sbin/usermod", "-a", "-G", DEPLOYMENT_GROUP, user] }
       ] })] : [],
       step("credential and state directories", { kind: "directories", directories: [
         { path: credentialDir, mode: 448, owner: "root", group: "root" },
-        { path: "/var/lib/forgezero", mode: 488, owner: "root", group: "root" }
+        { path: "/var/lib/forgezero", mode: 488, owner: "root", group: VAULT_GROUP }
       ] }),
       step("encrypted node identity", { kind: "ensure-seed", credential: seedCredentialPath }),
       ...options.generateGitIdentity && gitCredentialPath && gitPublicKeyPath ? [
@@ -2567,19 +2578,26 @@ function planProvision(options) {
         { argv: ["/usr/bin/systemctl", "enable", ...enabledUnits] },
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
         ...restartedUnits.length ? [{ argv: ["/usr/bin/systemctl", "restart", ...restartedUnits] }] : [],
+        { argv: ["/usr/bin/systemctl", "stop", "forgezero-agent-proxy.service"], acceptedExitCodes: [0, 1, 5] },
         { argv: ["/usr/bin/systemctl", "restart", "forgezero-agent.socket"] },
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
         { argv: ["/usr/bin/systemctl", "restart", "forgezero-agent.service"] }
       ] }),
       ...enrolmentEnabled ? [step("prove the compute binding is durable", { kind: "verify-file", path: enrolStatePath })] : [],
-      ...options.enforceEgress ? [step("prove the Agent egress policy is active", { kind: "verify-egress", runnerPublicTcpPorts, runnerLoopbackPorts })] : [],
+      ...options.enforceEgress ? [step("prove the Agent egress policy is active", {
+        kind: "verify-egress",
+        deploymentEnabled,
+        runnerPublicTcpPorts,
+        runnerLoopbackPorts,
+        agentLoopbackPorts
+      })] : [],
       step("prove it is running", { kind: "commands", commands: [{ argv: ["/usr/bin/systemctl", "is-active", "forgezero-agent.service"] }] }),
       step("prove the public Vault socket exists", { kind: "wait-socket", path: options.socketPath, attempts: 100, intervalMs: 100 }),
       step("prove the Agent Vault backend exists", { kind: "wait-socket", path: agentBackendSocketPath(options.socketPath), attempts: 100, intervalMs: 100 }),
       step("prove the Agent update helper exists", { kind: "wait-socket", path: DEFAULT_AGENT_UPDATE_SOCKET, attempts: 100, intervalMs: 100 }),
+      step("prove the software strategy helper socket exists", { kind: "wait-socket", path: DEFAULT_SOFTWARE_HELPER_SOCKET, attempts: 100, intervalMs: 100 }),
       ...deploymentEnabled ? [
-        step("prove the deployment runner socket exists", { kind: "wait-socket", path: DEPLOYMENT_RUNNER_SOCKET, attempts: 100, intervalMs: 100 }),
-        step("prove the software strategy helper socket exists", { kind: "wait-socket", path: DEFAULT_SOFTWARE_HELPER_SOCKET, attempts: 100, intervalMs: 100 })
+        step("prove the deployment runner socket exists", { kind: "wait-socket", path: DEPLOYMENT_RUNNER_SOCKET, attempts: 100, intervalMs: 100 })
       ] : [],
       ...lifecycleEnabled ? [step("prove the lifecycle helper socket exists", { kind: "wait-socket", path: lifecycleHelperSocketPath, attempts: 100, intervalMs: 100 })] : [],
       ...warpEnabled ? [step("prove Cloudflare WARP is connected", { kind: "verify-warp" })] : [],
@@ -2604,6 +2622,25 @@ import {
   writeFileSync as writeFileSync4
 } from "fs";
 import { dirname as dirname5 } from "path";
+function normalizeEd25519PublicKey(output) {
+  const line = output.trim();
+  if (!/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}(?: [^\r\n]{1,256})?$/.test(line))
+    return;
+  const [algorithm, encoded] = line.split(" ", 3);
+  if (algorithm !== "ssh-ed25519" || !encoded)
+    return;
+  let blob;
+  try {
+    blob = Buffer.from(encoded, "base64");
+  } catch {
+    return;
+  }
+  if (blob.length !== 51 || blob.readUInt32BE(0) !== 11 || blob.subarray(4, 15).toString("ascii") !== "ssh-ed25519" || blob.readUInt32BE(15) !== 32)
+    return;
+  if (blob.toString("base64") !== encoded)
+    return;
+  return `${algorithm} ${encoded}`;
+}
 async function readCapabilities(run2) {
   const answers = {};
   const checks = Object.entries(CAPABILITY_CHECKS);
@@ -2743,7 +2780,7 @@ var runProvisionOperation = async (operation) => {
             return result;
         }
         result = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
-        if (result.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(result.stdout)) {
+        if (result.exitCode !== 0 || !normalizeEd25519PublicKey(result.stdout)) {
           return { stdout: "bootstrap SSH private key is not a valid Ed25519 OpenSSH key", exitCode: 1 };
         }
         result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=bootstrap-ssh-key", key, operation.credential]);
@@ -2759,11 +2796,12 @@ var runProvisionOperation = async (operation) => {
           chmodSync2(key, 384);
         }
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
-        if (derived.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(derived.stdout)) {
+        const publicKey = normalizeEd25519PublicKey(derived.stdout);
+        if (derived.exitCode !== 0 || !publicKey) {
           return { stdout: "bootstrap SSH public key derivation failed", exitCode: 1 };
         }
         mkdirSync4(dirname5(operation.publicKey), { recursive: true, mode: 493 });
-        writeFileSync4(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
+        writeFileSync4(operation.publicKey, `${publicKey} forgezero-bootstrap-runner
 `, { mode: 292 });
         chmodSync2(operation.publicKey, 292);
       }
@@ -2806,8 +2844,9 @@ var runProvisionOperation = async (operation) => {
     const policy = await fixed(["/usr/sbin/nft", "--numeric", "list", "table", "inet", "forgezero_agent_egress"]);
     const required = [
       "forgezero-agent-egress-v1",
-      `public-tcp=${operation.runnerPublicTcpPorts.join(",")}`,
-      ...operation.runnerLoopbackPorts.length ? [`:${operation.runnerLoopbackPorts.join(",")}`] : []
+      ...operation.agentLoopbackPorts.length ? [`shared-loopback=${operation.agentLoopbackPorts.join(",")}`] : [],
+      ...operation.deploymentEnabled && operation.runnerPublicTcpPorts.length ? [`public-tcp=${operation.runnerPublicTcpPorts.join(",")}`] : [],
+      ...operation.deploymentEnabled && operation.runnerLoopbackPorts.length ? [`:${operation.runnerLoopbackPorts.join(",")}`] : []
     ];
     return policy.exitCode === 0 && required.every((part) => policy.stdout.includes(part)) ? { stdout: policy.stdout, exitCode: 0 } : { stdout: policy.stdout, exitCode: 1 };
   }
@@ -2873,7 +2912,9 @@ async function applyPlan(plan, run2) {
     const result = await run2(step2.operation);
     transcript.push({ label: step2.label, command: step2.command, exitCode: result.exitCode });
     if (result.exitCode !== 0 && !step2.optional) {
-      throw new Error(`${step2.label} failed (exit ${result.exitCode}): ${step2.command}`);
+      const safeDetail = step2.operation.kind === "ensure-bootstrap-ssh-identity" ? result.stdout.trim().slice(0, 1000) : "";
+      throw new Error(`${step2.label} failed (exit ${result.exitCode}): ${step2.command}${safeDetail ? `
+${safeDetail}` : ""}`);
     }
   }
   return transcript;
@@ -3371,12 +3412,26 @@ map $limit_conn_status $forgezero_retry_after { default ''; REJECTED 1; REJECTED
 server {
   listen 127.0.0.1:${input.publicPort};
   server_name _;
+  server_tokens off;
+  more_clear_headers Server X-Powered-By;
   limit_conn forgezero_admission ${concurrencyLimit};
   limit_conn_status 503;
   add_header Retry-After $forgezero_retry_after always;
-  location ^~ /api/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
-  location ^~ /v1/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
-  location / { return 404; }
+  error_page 400 403 404 405 408 413 414 429 500 502 503 504 = @transport_failure;
+  location @transport_failure { internal; return 444; }
+  location / {
+    proxy_pass http://forgezero;
+    proxy_http_version 1.1;
+    proxy_intercept_errors off;
+    proxy_hide_header Server;
+    proxy_hide_header X-Powered-By;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $forgezero_connection;
+    proxy_read_timeout 3600s;
+  }
 }
 `
   };
@@ -3988,7 +4043,7 @@ Type=oneshot
 User=arangodb
 Group=arangodb
 LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
-ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default")quit(0);last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));'
+ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;let ok=false;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default"){ok=true;break;}last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}if(!ok)throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));'
 RemainAfterExit=yes
 TimeoutStartSec=200
 NoNewPrivileges=true
@@ -4114,11 +4169,11 @@ async function seal(host, name, destination2, value) {
 async function verifyBootstrapBundleOnHost(host, config, verifyGit = false) {
   const manifestMetadata = host.inspect?.(config.bootstrapBundle.manifestFile);
   const bundleMetadata = host.inspect?.(config.bootstrapBundle.bundleFile);
-  if (manifestMetadata && (!manifestMetadata.regular || manifestMetadata.symbolic || manifestMetadata.uid !== 0 || manifestMetadata.links !== 1 || (manifestMetadata.mode & 63) !== 0 || manifestMetadata.size > 16 * 1024)) {
-    throw new Error("bootstrap bundle manifest must be a root-owned owner-only regular file");
+  if (manifestMetadata && (!manifestMetadata.regular || manifestMetadata.symbolic || manifestMetadata.uid !== 0 || manifestMetadata.links !== 1 || (manifestMetadata.mode & 18) !== 0 || manifestMetadata.size > 16 * 1024)) {
+    throw new Error("bootstrap bundle manifest must be a root-owned non-writable regular file");
   }
-  if (bundleMetadata && (!bundleMetadata.regular || bundleMetadata.symbolic || bundleMetadata.uid !== 0 || bundleMetadata.links !== 1 || (bundleMetadata.mode & 63) !== 0 || bundleMetadata.size < 1 || bundleMetadata.size > 512 * 1024 * 1024)) {
-    throw new Error("bootstrap bundle must be a root-owned owner-only regular file within 512 MiB");
+  if (bundleMetadata && (!bundleMetadata.regular || bundleMetadata.symbolic || bundleMetadata.uid !== 0 || bundleMetadata.links !== 1 || (bundleMetadata.mode & 18) !== 0 || bundleMetadata.size < 1 || bundleMetadata.size > 512 * 1024 * 1024)) {
+    throw new Error("bootstrap bundle must be a root-owned non-writable regular file within 512 MiB");
   }
   if (!host.exists(config.bootstrapBundle.bundleFile) || !host.exists(config.bootstrapBundle.manifestFile)) {
     throw new Error("attended bootstrap bundle and manifest are required for release generation one");
@@ -4137,11 +4192,25 @@ async function verifyBootstrapBundleOnHost(host, config, verifyGit = false) {
   if (digest !== manifest.sha256)
     throw new Error("bootstrap bundle digest does not match its manifest");
   if (verifyGit) {
-    await checked3(host, ["/usr/bin/git", "bundle", "verify", config.bootstrapBundle.bundleFile], "bootstrap Git bundle verification");
+    const verificationRepository = "/run/forgezero-bootstrap-bundle-verify";
+    await checked3(host, ["/usr/bin/rm", "-rf", "--", verificationRepository], "stale bootstrap bundle verifier cleanup");
+    await checked3(host, ["/usr/bin/git", "init", "--bare", "--quiet", verificationRepository], "bootstrap bundle verifier repository");
+    try {
+      await checked3(host, [
+        "/usr/bin/git",
+        "-C",
+        verificationRepository,
+        "bundle",
+        "verify",
+        config.bootstrapBundle.bundleFile
+      ], "bootstrap Git bundle verification");
+    } finally {
+      await checked3(host, ["/usr/bin/rm", "-rf", "--", verificationRepository], "bootstrap bundle verifier cleanup");
+    }
   }
   return manifest;
 }
-function bootstrapIdentity(config) {
+function bootstrapIdentity(config, includeDeploymentEvidence = false) {
   if (config.kind === "enrolled-compute")
     return {
       kind: config.kind,
@@ -4160,7 +4229,13 @@ function bootstrapIdentity(config) {
       bootstrapRunner: config.bootstrapRunner ? { targetTelemetryEndpoint: config.bootstrapRunner.targetTelemetryEndpoint } : null
     };
   const environment = config.runtime.environment;
-  const { cloudflare: _cloudflare, realtime: _realtime, ...stableEnvironment } = environment;
+  const { cloudflare: _cloudflare, realtime: _realtime, initialInventory, ...stableEnvironmentRest } = environment;
+  const stableEnvironment = {
+    ...stableEnvironmentRest,
+    ...initialInventory ? {
+      initialInventory: { ...initialInventory, deployment: includeDeploymentEvidence ? initialInventory.deployment : undefined }
+    } : {}
+  };
   return {
     kind: config.kind,
     environment: config.environment,
@@ -4201,6 +4276,26 @@ function bootstrapIdentity(config) {
 function bootstrapIdentityDigest(config) {
   return createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
 }
+var legacyBootstrapIdentityDigest = (config) => createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config, true))).digest("hex");
+function interruptedPlatformReleaseIdentityDigests(config, releaseEvidence, bootstrapManifest) {
+  if (!config.runtime.environment.initialInventory)
+    return [];
+  const previous = structuredClone(config);
+  previous.runtime.environment.initialInventory.deployment = {
+    source: "bootstrap-bundle",
+    branch: releaseEvidence.branch,
+    revision: releaseEvidence.revision,
+    bundleSha256: releaseEvidence.sha256
+  };
+  const expectedCurrentEpoch = bootstrapManifest ? `${config.environment}-${bootstrapManifest.revision.slice(0, 16)}` : undefined;
+  if (expectedCurrentEpoch && config.runtime.environment.seedSyncEpoch === expectedCurrentEpoch) {
+    previous.runtime.environment.seedSyncEpoch = `${config.environment}-${releaseEvidence.revision.slice(0, 16)}`;
+  }
+  return [bootstrapIdentityDigest(previous), legacyBootstrapIdentityDigest(previous)];
+}
+function storedPlatformCoordinatesMatch(state, config) {
+  return state.kind === "platform" && state.profile === config.profile && state.nodeHostname === config.nodeHostname && state.apiUrl === config.apiUrl && state.environment === config.environment && state.databaseRole === config.database.role && state.databaseAgency === config.database.agency && state.databaseReadPreferred === config.database.readPreferred && state.databaseServerMode === config.database.serverMode && (state.databaseAddress ?? null) === (config.database.address ?? null) && JSON.stringify(state.databaseCoordinators ?? []) === JSON.stringify(config.database.coordinators) && state.collectorUnit === config.runtime.environment.otlpCollectorUnit && state.publicApiPort === config.runtime.environment.publicApiPort && state.healthPath === config.runtime.healthPath;
+}
 function parseStoredState(raw) {
   let value;
   try {
@@ -4231,11 +4326,21 @@ function parseStoredIntent(raw) {
   }
   return intent;
 }
-function bindBootstrapIntent(host, config) {
+function bindBootstrapIntent(host, config, previousReleaseDigests = []) {
   const identityDigest = bootstrapIdentityDigest(config);
   if (host.exists(INTENT_PATH)) {
     const intent = parseStoredIntent(host.read(INTENT_PATH));
     if (intent.kind !== config.kind || intent.identityDigest !== identityDigest) {
+      if (previousReleaseDigests.includes(intent.identityDigest) && intent.kind === "platform" && config.kind === "platform") {
+        host.write(INTENT_PATH, `${JSON.stringify({
+          format: 1,
+          kind: config.kind,
+          identityDigest,
+          createdAt: new Date().toISOString()
+        }, null, 2)}
+`, 384);
+        return identityDigest;
+      }
       throw new Error("bootstrap resume coordinates do not match the interrupted host intent");
     }
   } else if (!host.exists(STATE_PATH)) {
@@ -4403,7 +4508,42 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   let installed;
   if (host.exists(STATE_PATH))
     installed = parseStoredState(host.read(STATE_PATH));
-  const bootstrapManifest = config.kind === "platform" && !host.exists(BOOTSTRAP_RELEASE_EVIDENCE) ? await verifyBootstrapBundleOnHost(host, config) : undefined;
+  let bootstrapManifest;
+  let releaseEvidence;
+  if (config.kind === "platform") {
+    const staged = host.exists(config.bootstrapBundle.bundleFile) || host.exists(config.bootstrapBundle.manifestFile);
+    if (staged && !(host.exists(config.bootstrapBundle.bundleFile) && host.exists(config.bootstrapBundle.manifestFile))) {
+      throw new Error("bootstrap bundle and manifest must be staged together");
+    }
+    const reviewed = staged ? await verifyBootstrapBundleOnHost(host, config) : undefined;
+    if (!host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
+      if (!reviewed)
+        throw new Error("attended bootstrap bundle and manifest are required for release generation one");
+      bootstrapManifest = reviewed;
+    } else if (reviewed) {
+      let evidence;
+      try {
+        evidence = JSON.parse(host.read(BOOTSTRAP_RELEASE_EVIDENCE));
+      } catch {
+        throw new Error("bootstrap release evidence is malformed");
+      }
+      if (typeof evidence.revision !== "string" || !/^[a-f0-9]{40}$/.test(evidence.revision) || typeof evidence.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(evidence.sha256) || typeof evidence.branch !== "string")
+        throw new Error("bootstrap release evidence is malformed");
+      releaseEvidence = { revision: evidence.revision, sha256: evidence.sha256, branch: evidence.branch };
+      if (evidence.revision !== reviewed.revision || evidence.sha256 !== reviewed.sha256 || evidence.branch !== reviewed.branch)
+        bootstrapManifest = reviewed;
+    } else if (host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
+      let evidence;
+      try {
+        evidence = JSON.parse(host.read(BOOTSTRAP_RELEASE_EVIDENCE));
+      } catch {
+        throw new Error("bootstrap release evidence is malformed");
+      }
+      if (typeof evidence.revision !== "string" || !/^[a-f0-9]{40}$/.test(evidence.revision) || typeof evidence.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(evidence.sha256) || typeof evidence.branch !== "string")
+        throw new Error("bootstrap release evidence is malformed");
+      releaseEvidence = { revision: evidence.revision, sha256: evidence.sha256, branch: evidence.branch };
+    }
+  }
   let cloudflare;
   if (config.cloudflareHandoff) {
     if (host.exists(config.cloudflareHandoff.handoffFile)) {
@@ -4453,10 +4593,14 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       throw new Error("platform realtime coordinates require a realtime-enabled Cloudflare handoff");
     }
   }
+  let allowInterruptedReleaseRebind = false;
   if (installed) {
-    if (installed.kind !== config.kind || installed.identityDigest !== bootstrapIdentityDigest(config)) {
+    const exactIdentity = installed.kind === config.kind && installed.identityDigest === bootstrapIdentityDigest(config);
+    const boundedReleaseResume = config.kind === "platform" && !host.exists("/var/lib/forgezero/enrolment.json") && host.exists(BOOTSTRAP_RELEASE_EVIDENCE) && storedPlatformCoordinatesMatch(installed, config);
+    if (!exactIdentity && !boundedReleaseResume) {
       throw new Error("bootstrap repair coordinates do not match the installed host identity");
     }
+    allowInterruptedReleaseRebind = !exactIdentity && boundedReleaseResume;
   }
   const platformPrivate = config.kind === "platform" ? (() => {
     if (!secrets)
@@ -4476,10 +4620,14 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (config.kind === "enrolled-compute" && config.bootstrapRunner?.sshPrivateKeyFile && !host.exists(BOOTSTRAP_SSH_CREDENTIAL)) {
     privateFile(host, config.bootstrapRunner.sshPrivateKeyFile, "bootstrap runner SSH private key");
   }
-  bindBootstrapIntent(host, config);
+  let previousReleaseDigests = [];
+  if (!installed && config.kind === "platform" && releaseEvidence && !host.exists("/var/lib/forgezero/enrolment.json")) {
+    previousReleaseDigests = [...interruptedPlatformReleaseIdentityDigests(config, releaseEvidence, bootstrapManifest)];
+  }
+  bindBootstrapIntent(host, config, allowInterruptedReleaseRebind && installed?.identityDigest ? [installed.identityDigest] : previousReleaseDigests);
   const plan = planBootstrap(config, host.exists(STATE_PATH));
   await checked3(host, ["hostnamectl", "set-hostname", "--static", config.nodeHostname], "compute hostname");
-  const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
+  let alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
   host.mkdir(CREDS, 448);
   host.mkdir("/var/lib/forgezero", 448);
   if (!alreadyEnrolled && !host.exists(ENROL_CREDENTIAL)) {
@@ -4508,14 +4656,29 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (connectorCapabilities?.meshConnectorToken && !host.exists(WARP_CONNECTOR_CREDENTIAL)) {
     await seal(host, "CF_WARP_CONNECTOR_TOKEN", WARP_CONNECTOR_CREDENTIAL, connectorCapabilities.meshConnectorToken);
   }
+  let installedAgentPlan;
   if (alreadyEnrolled) {
-    await host.installAgent(config, "bound");
+    installedAgentPlan = await host.installAgent(config, "bound");
   } else if (config.kind === "platform") {
     if (bootstrapManifest)
-      await host.installAgent(config, "bootstrap");
+      installedAgentPlan = await host.installAgent(config, "bootstrap");
+    else if (host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
+      await checked3(host, [
+        "curl",
+        "--fail",
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "10",
+        `http://127.0.0.1:${config.runtime.environment.publicApiPort}${config.runtime.healthPath}`
+      ], "persisted release-one API health");
+      await host.installAgent(config, "enrol");
+      installedAgentPlan = await host.installAgent(config, "bound");
+      alreadyEnrolled = true;
+    }
   } else {
     await host.installAgent(config, "enrol");
-    await host.installAgent(config, "bound");
+    installedAgentPlan = await host.installAgent(config, "bound");
   }
   if (config.kind === "platform" && config.firewall.enabled) {
     await host.ensureSoftware(plan.software.filter(({ id }) => id === "ufw"));
@@ -4595,6 +4758,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await checked3(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
       await checked3(host, ["id", runtime.serviceUser], "existing API service account");
     });
+    await checked3(host, ["usermod", "-a", "-G", DEPLOYMENT_GROUP, runtime.serviceUser], "API deployment group");
     host.mkdir(runtime.environment.sharedDirectory, 488);
     host.mkdir(runtime.slotsDirectory, 493);
     host.write(envPath, renderPlatformSharedEnvironment(runtime.environment), 416);
@@ -4613,7 +4777,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     host.write("/etc/sudoers.d/forgezero-runner", activation.sudoers, 288);
     await checked3(host, ["visudo", "-cf", "/etc/sudoers.d/forgezero-runner"], "activation sudo policy");
     const telemetry = planLocalOtlpProof(runtime.environment.otlpEndpoint, runtime.environment.otlpCollectorUnit);
-    await checked3(host, telemetry.unitCheck.argv, "OTLP collector supervision");
+    await checked3(host, [telemetry.unitCheck.command, ...telemetry.unitCheck.argv], "OTLP collector supervision");
     const otlpStatus = (await checked3(host, [telemetry.receiverCheck.command, ...telemetry.receiverCheck.argv], "OTLP receiver")).trim();
     if (!/^2\d\d$/.test(otlpStatus))
       throw new Error(`OTLP receiver returned HTTP ${otlpStatus || "unknown"}`);
@@ -4646,10 +4810,12 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
 `, 384);
     }
     if (bootstrapManifest) {
+      if (!installedAgentPlan?.user)
+        throw new Error("initial Agent deployment requires the converged Agent user");
       await checked3(host, [
         "runuser",
         "-u",
-        "forgezero-agent",
+        installedAgentPlan.user,
         "--",
         "/usr/local/bin/fz-agent",
         "deploy",
@@ -4676,7 +4842,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
         "--show-error",
         "--max-time",
         "10",
-        `http://127.0.0.1:3000${runtime.healthPath}`
+        `http://127.0.0.1:${runtime.environment.publicApiPort}${runtime.healthPath}`
       ], "release-one API health");
       await host.installAgent(config, "enrol");
       await host.installAgent(config, "bound");
@@ -4917,6 +5083,8 @@ function planBootstrapAgentInstall(config, phase, context) {
     bootstrapTargetTelemetryEndpoint: bound && bootstrapRunner ? platformBootstrapRunner(config) ? config.telemetryEndpoint : config.kind === "enrolled-compute" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined : undefined,
     lifecycleProfilePath: bound && config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
     enforceEgress: true,
+    runnerLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort, config.runtime.bluePort, config.runtime.greenPort] : [],
+    agentLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort] : [],
     nodeHostname: config.nodeHostname,
     telemetryEndpoint: config.telemetryEndpoint,
     binPath: "/usr/local/lib/forgezero/agent/fz-agent",
@@ -4926,7 +5094,7 @@ function planBootstrapAgentInstall(config, phase, context) {
       enrolStatePath: "/var/lib/forgezero/enrolment.json"
     } : bound ? { enrolStatePath: "/var/lib/forgezero/enrolment.json" } : {},
     ...authenticated ? {
-      apiUrl: config.apiUrl,
+      apiUrl: config.kind === "platform" ? `http://127.0.0.1:${config.runtime.environment.publicApiPort}` : config.apiUrl,
       project: config.kind === "enrolled-compute" ? config.realm : "platform",
       environment: config.kind === "enrolled-compute" ? undefined : config.environment,
       nodeLabel: config.kind === "enrolled-compute" ? config.nodeHostname : config.computeReference
@@ -4935,6 +5103,7 @@ function planBootstrapAgentInstall(config, phase, context) {
   return planInstall(options);
 }
 function localBootstrapHost() {
+  let softwareClientUser;
   const execute = async (argv, options = {}) => {
     const child = Bun.spawn([...argv], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
     if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
@@ -4967,10 +5136,12 @@ function localBootstrapHost() {
     exec: execute,
     sleep: (milliseconds) => Bun.sleep(milliseconds),
     async ensureSoftware(requirements) {
+      if (!softwareClientUser)
+        throw new Error("Agent must be converged before software requirements are applied");
       const result = await execute([
         "runuser",
         "-u",
-        "forgezero-agent",
+        softwareClientUser,
         "--",
         "/usr/local/bin/fz-agent",
         "software-ensure",
@@ -4984,7 +5155,7 @@ function localBootstrapHost() {
       const capabilities = await readCapabilities(localRunner);
       const hasBinding = existsSync5("/var/lib/forgezero/enrolment.json");
       const hasEnrolCredential = existsSync5(ENROL_CREDENTIAL);
-      const initialBundle = config.kind === "platform" && !existsSync5(BOOTSTRAP_RELEASE_EVIDENCE) ? {
+      const initialBundle = config.kind === "platform" && phase === "bootstrap" && existsSync5(config.bootstrapBundle.bundleFile) && existsSync5(config.bootstrapBundle.manifestFile) ? {
         path: config.bootstrapBundle.bundleFile,
         manifestPath: config.bootstrapBundle.manifestFile,
         manifest: parseBootstrapBundleManifest(JSON.parse(readFileSync5(config.bootstrapBundle.manifestFile, "utf8")))
@@ -5015,6 +5186,7 @@ function localBootstrapHost() {
         writeFileSync5(unit.path, unit.unit, { mode: 420 });
       }
       await applyPlan(plan, localRunner);
+      softwareClientUser = plan.user;
       return plan;
     }
   };
@@ -5028,6 +5200,8 @@ export {
   planBootstrapAgentInstall,
   planBootstrap,
   localBootstrapHost,
+  legacyBootstrapIdentityDigest,
+  interruptedPlatformReleaseIdentityDigests,
   bootstrapStatus,
   bootstrapIdentityDigest,
   applyBootstrap,