@forgezero/agent 0.1.88 → 0.1.89

package/dist/fz.js

@@ -4810,9 +4810,8 @@ async function spawnWith(command, env, report = () => {}, options = {}) {
 }
 
 // src/cli/index.ts
-import { chmodSync as chmodSync7, existsSync as existsSync12, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync13, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "fs";
 import { basename as basename3, dirname as dirname14, isAbsolute as isAbsolute7, join as join13, resolve as resolve12 } from "path";
-import { randomBytes as randomBytes10 } from "crypto";
 
 // src/process-input.ts
 async function writeAndCloseProcessInput(input, value) {
@@ -4822,8 +4821,7 @@ async function writeAndCloseProcessInput(input, value) {
 
 // src/cli/index.ts
 init_dist();
-import { fileURLToPath as fileURLToPath4 } from "url";
-import { hostname } from "os";
+import { homedir as homedir2, hostname } from "os";
 
 // src/agent-update.ts
 var DEFAULT_AGENT_RELEASE_ROOT = "/opt/forgezero/agent";
@@ -4842,7 +4840,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.88";
+var VERSION2 = "0.1.89";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4944,9 +4942,12 @@ function validateCapacityCalibrationOptions(options) {
   const requestsPerWorker = options.requestsPerWorker ?? 8;
   const maxP95Ms = options.maxP95Ms ?? 250;
   const maxErrorRate = options.maxErrorRate ?? 0.01;
-  const headroomRatio = options.headroomRatio ?? 0.8;
+  const safetyRatio = options.safetyRatio ?? 0.8;
   const requestTimeoutMs = options.requestTimeoutMs ?? 5000;
-  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(headroomRatio) || headroomRatio < 0.25 || headroomRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000) {
+  const minimumStageDurationMs = options.minimumStageDurationMs ?? 5000;
+  const maxCpuUtilizationPercent = options.maxCpuUtilizationPercent ?? 90;
+  const maxMemoryUtilizationPercent = options.maxMemoryUtilizationPercent ?? 90;
+  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(safetyRatio) || safetyRatio < 0.25 || safetyRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000 || !Number.isSafeInteger(minimumStageDurationMs) || minimumStageDurationMs < 100 || minimumStageDurationMs > 60000 || !Number.isFinite(maxCpuUtilizationPercent) || maxCpuUtilizationPercent < 25 || maxCpuUtilizationPercent > 100 || !Number.isFinite(maxMemoryUtilizationPercent) || maxMemoryUtilizationPercent < 25 || maxMemoryUtilizationPercent > 100) {
     throw new Error("Capacity calibration bounds are invalid.");
   }
   return {
@@ -4955,8 +4956,11 @@ function validateCapacityCalibrationOptions(options) {
     requestsPerWorker,
     maxP95Ms,
     maxErrorRate,
-    headroomRatio,
-    requestTimeoutMs
+    safetyRatio,
+    requestTimeoutMs,
+    minimumStageDurationMs,
+    maxCpuUtilizationPercent,
+    maxMemoryUtilizationPercent
   };
 }
 
@@ -5031,8 +5035,11 @@ function capacityCalibration(value, where) {
     "requestsPerWorker",
     "maxP95Ms",
     "maxErrorRate",
-    "headroomRatio",
-    "requestTimeoutMs"
+    "safetyRatio",
+    "requestTimeoutMs",
+    "minimumStageDurationMs",
+    "maxCpuUtilizationPercent",
+    "maxMemoryUtilizationPercent"
   ], where);
   const endpoint = text(calibration.endpoint, `${where}.endpoint`);
   try {
@@ -5056,8 +5063,11 @@ function capacityCalibration(value, where) {
       "requestsPerWorker",
       "maxP95Ms",
       "maxErrorRate",
-      "headroomRatio",
-      "requestTimeoutMs"
+      "safetyRatio",
+      "requestTimeoutMs",
+      "minimumStageDurationMs",
+      "maxCpuUtilizationPercent",
+      "maxMemoryUtilizationPercent"
     ].flatMap((name) => {
       const found = optionalNumber(name);
       return found === undefined ? [] : [[name, found]];
@@ -5479,6 +5489,7 @@ function agentEgressUnit(options) {
   }
   const deploymentEnabled = Boolean(options.repository || bootstrapBundleEnabled || options.pullDeployments);
   const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
+  const agentLoopbackPorts = normalizeEgressTcpPorts(options.agentLoopbackPorts ?? []);
   const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
   if (deploymentEnabled && runnerPublicTcpPorts.length < 1) {
     throw new Error("deployed project runner needs at least one vetted public TCP port");
@@ -5486,8 +5497,10 @@ function agentEgressUnit(options) {
   if (deploymentEnabled)
     systemdAgentEgressDirectives(runnerLoopbackPorts);
   const users = [user, ...deploymentEnabled ? [DEPLOYMENT_RUNNER_USER] : []];
-  const runnerGrant = deploymentEnabled ? ` --loopback-user=${DEPLOYMENT_RUNNER_USER}` + runnerLoopbackPorts.map((port) => ` --loopback-tcp-port=${port}`).join("") + runnerPublicTcpPorts.map((port) => ` --public-tcp-port=${port}`).join("") : "";
-  const policyProof = `ExecStartPost=${bin} egress-policy-check ${users.map((name) => `--user=${name}`).join(" ")}${runnerGrant}`;
+  const portGrantEnabled = deploymentEnabled || agentLoopbackPorts.length > 0;
+  const restrictedUser = deploymentEnabled ? DEPLOYMENT_RUNNER_USER : user;
+  const portGrant = portGrantEnabled ? ` --loopback-user=${restrictedUser}` + (deploymentEnabled ? runnerLoopbackPorts.map((port) => ` --loopback-tcp-port=${port}`).join("") : "") + agentLoopbackPorts.map((port) => ` --shared-loopback-tcp-port=${port}`).join("") + (deploymentEnabled ? runnerPublicTcpPorts.map((port) => ` --public-tcp-port=${port}`).join("") : "") : "";
+  const policyProof = `ExecStartPost=${bin} egress-policy-check ${users.map((name) => `--user=${name}`).join(" ")}${portGrant}`;
   return `[Unit]
 Description=ForgeZero Agent host egress policy
 Documentation=https://www.forgezero.net/docs/agent
@@ -5500,7 +5513,7 @@ Type=notify
 NotifyAccess=all
 User=root
 Group=root
-ExecStart=${bin} egress-policy ${users.map((name) => `--user=${name}`).join(" ")}${runnerGrant}
+ExecStart=${bin} egress-policy ${users.map((name) => `--user=${name}`).join(" ")}${portGrant}
 ${policyProof}
 Restart=on-failure
 RestartSec=2
@@ -5784,7 +5797,7 @@ function agentEnrolmentUnit(options) {
 Requires=forgezero-agent-egress.service
 BindsTo=forgezero-agent-egress.service
 ` : "";
-  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives() : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives(options.agentLoopbackPorts ?? []) : "";
   return `[Unit]
 Description=Bind this machine to its ForgeZero compute
 After=network-online.target
@@ -5821,7 +5834,7 @@ WantedBy=multi-user.target
 function deploymentRunnerUnit(options) {
   const bin = options.binPath ?? "fz-agent";
   const root = options.deployRoot ?? "/opt/forgezero";
-  const agentUser = options.user ?? "forgezero-agent";
+  const agentUser = options.user ?? "forgezero";
   const egressDependency = options.enforceEgress ? `After=forgezero-agent-egress.service
 Requires=forgezero-agent-egress.service
 BindsTo=forgezero-agent-egress.service
@@ -5862,7 +5875,7 @@ RestrictRealtime=true
 MemoryDenyWriteExecute=true
 LockPersonality=true
 ${egressDirectives}
-ReadWritePaths=${root}/releases ${root}/runner-home
+ReadWritePaths=${root}/releases ${root}/runner-home ${root}/slots /etc/nginx/conf.d /var/log/nginx
 
 [Install]
 WantedBy=multi-user.target
@@ -5997,7 +6010,7 @@ function agentUnit(options) {
   const supplementaryGroups = [
     AGENT_UPDATE_GROUP,
     deploymentEnabled ? DEPLOYMENT_GROUP : null,
-    deploymentEnabled ? SOFTWARE_HELPER_GROUP : null,
+    SOFTWARE_HELPER_GROUP,
     lifecycleEnabled ? LIFECYCLE_GROUP : null
   ].filter((value) => value !== null);
   const deploymentGroup = supplementaryGroups.length > 0 ? `SupplementaryGroups=${supplementaryGroups.join(" ")}` : "";
@@ -6006,7 +6019,7 @@ function agentUnit(options) {
     "forgezero-agent-update-helper.service",
     options.enforceEgress ? "forgezero-agent-egress.service" : null,
     deploymentEnabled ? "forgezero-deploy-runner.service" : null,
-    deploymentEnabled ? "forgezero-software-helper.service" : null,
+    "forgezero-software-helper.service",
     lifecycleEnabled ? "forgezero-lifecycle-helper.service" : null,
     warpEnabled ? "warp-svc.service" : null,
     enrolmentEnabled ? "forgezero-agent-enrol.service" : null
@@ -6015,7 +6028,7 @@ function agentUnit(options) {
     "forgezero-agent-update-helper.service",
     options.enforceEgress ? "forgezero-agent-egress.service" : null,
     deploymentEnabled ? "forgezero-deploy-runner.service" : null,
-    deploymentEnabled ? "forgezero-software-helper.service" : null,
+    "forgezero-software-helper.service",
     lifecycleEnabled ? "forgezero-lifecycle-helper.service" : null,
     warpEnabled ? "warp-svc.service" : null,
     enrolmentEnabled ? "forgezero-agent-enrol.service" : null
@@ -6030,9 +6043,9 @@ function agentUnit(options) {
   const snpDevice = options.mode === "attested" ? `DevicePolicy=closed
 DeviceAllow=/dev/sev-guest rw` : "";
   const snpPrepare = options.mode === "attested" ? `ExecStartPre=+/bin/chgrp ${VAULT_GROUP} /dev/sev-guest
-ExecStartPre=+/bin/chmod 0640 /dev/sev-guest
+ExecStartPre=+/bin/chmod 0660 /dev/sev-guest
 ` : "";
-  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives() : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives(options.agentLoopbackPorts ?? []) : "";
   return `[Unit]
 Description=ForgeZero node agent (${options.mode})
 Documentation=https://www.forgezero.net/docs/agent
@@ -6163,6 +6176,7 @@ function planProvision(options) {
   const deployRoot = options.deployRoot ?? "/opt/forgezero";
   const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
   const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
+  const agentLoopbackPorts = normalizeEgressTcpPorts(options.agentLoopbackPorts ?? []);
   const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
   const lifecycleEnabled = Boolean(options.pullMigrations && options.lifecycleProfilePath);
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
@@ -6211,8 +6225,9 @@ function planProvision(options) {
   const enabledUnits = [
     "forgezero-agent.socket",
     "forgezero-agent-update-helper.service",
+    "forgezero-software-helper.service",
     ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
-    ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+    ...deploymentEnabled ? ["forgezero-deploy-runner.service"] : [],
     ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
     ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
     ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : [],
@@ -6220,8 +6235,9 @@ function planProvision(options) {
   ];
   const restartedUnits = [
     "forgezero-agent-update-helper.service",
+    "forgezero-software-helper.service",
     ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
-    ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+    ...deploymentEnabled ? ["forgezero-deploy-runner.service"] : [],
     ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
     ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
     ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : []
@@ -6245,9 +6261,9 @@ function planProvision(options) {
       ...options.enforceEgress ? [
         { path: AGENT_EGRESS_UNIT_PATH, unit: agentEgressUnit(options) }
       ] : [],
+      { path: SOFTWARE_HELPER_UNIT_PATH, unit: softwareHelperUnit(options) },
       ...deploymentEnabled ? [
-        { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) },
-        { path: SOFTWARE_HELPER_UNIT_PATH, unit: softwareHelperUnit(options) }
+        { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) }
       ] : [],
       ...enrolmentEnabled ? [
         { path: ENROLMENT_UNIT_PATH, unit: agentEnrolmentUnit(options) }
@@ -6280,24 +6296,29 @@ function planProvision(options) {
       step("Agent update helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", AGENT_UPDATE_GROUP], acceptedExitCodes: [0, 9] }] }),
       ...sourceBinPath && binPath ? [step("root-owned agent runtime", { kind: "install-runtime", source: sourceBinPath, binary: binPath, version: VERSION2 })] : [],
       ...warpEnabled ? [step("Cloudflare One client for Ubuntu 26.04", { kind: "install-warp" })] : [],
-      ...deploymentEnabled ? [step("deployment isolation group", { kind: "commands", commands: [
-        { argv: ["/usr/sbin/groupadd", "--system", DEPLOYMENT_GROUP], acceptedExitCodes: [0, 9] },
+      step("software strategy helper group", { kind: "commands", commands: [
         { argv: ["/usr/sbin/groupadd", "--system", SOFTWARE_HELPER_GROUP], acceptedExitCodes: [0, 9] }
+      ] }),
+      ...deploymentEnabled ? [step("deployment isolation group", { kind: "commands", commands: [
+        { argv: ["/usr/sbin/groupadd", "--system", DEPLOYMENT_GROUP], acceptedExitCodes: [0, 9] }
       ] })] : [],
       ...lifecycleEnabled ? [step("lifecycle helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", LIFECYCLE_GROUP], acceptedExitCodes: [0, 9] }] })] : [],
       step("service account", { kind: "commands", commands: [{ argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", user], acceptedExitCodes: [0, 9] }] }),
       step("bind service account to vault group", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-g", VAULT_GROUP, user] }] }),
       step("grant verified Agent update access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", AGENT_UPDATE_GROUP, user] }] }),
+      step("grant software helper socket access", { kind: "commands", commands: [
+        { argv: ["/usr/sbin/usermod", "-a", "-G", SOFTWARE_HELPER_GROUP, user] }
+      ] }),
       ...lifecycleEnabled ? [step("grant lifecycle helper socket access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", LIFECYCLE_GROUP, user] }] })] : [],
       ...deploymentEnabled ? [step("credential-free deployment account", { kind: "commands", commands: [
         { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", DEPLOYMENT_GROUP, DEPLOYMENT_RUNNER_USER], acceptedExitCodes: [0, 9] },
         { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", VAULT_GROUP, APPLICATION_RUNTIME_USER], acceptedExitCodes: [0, 9] },
         { argv: ["/usr/sbin/usermod", "-a", "-G", DEPLOYMENT_GROUP, APPLICATION_RUNTIME_USER] },
-        { argv: ["/usr/sbin/usermod", "-a", "-G", `${DEPLOYMENT_GROUP},${SOFTWARE_HELPER_GROUP}`, user] }
+        { argv: ["/usr/sbin/usermod", "-a", "-G", DEPLOYMENT_GROUP, user] }
       ] })] : [],
       step("credential and state directories", { kind: "directories", directories: [
         { path: credentialDir, mode: 448, owner: "root", group: "root" },
-        { path: "/var/lib/forgezero", mode: 488, owner: "root", group: "root" }
+        { path: "/var/lib/forgezero", mode: 488, owner: "root", group: VAULT_GROUP }
       ] }),
       step("encrypted node identity", { kind: "ensure-seed", credential: seedCredentialPath }),
       ...options.generateGitIdentity && gitCredentialPath && gitPublicKeyPath ? [
@@ -6348,19 +6369,26 @@ function planProvision(options) {
         { argv: ["/usr/bin/systemctl", "enable", ...enabledUnits] },
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
         ...restartedUnits.length ? [{ argv: ["/usr/bin/systemctl", "restart", ...restartedUnits] }] : [],
+        { argv: ["/usr/bin/systemctl", "stop", "forgezero-agent-proxy.service"], acceptedExitCodes: [0, 1, 5] },
         { argv: ["/usr/bin/systemctl", "restart", "forgezero-agent.socket"] },
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
         { argv: ["/usr/bin/systemctl", "restart", "forgezero-agent.service"] }
       ] }),
       ...enrolmentEnabled ? [step("prove the compute binding is durable", { kind: "verify-file", path: enrolStatePath })] : [],
-      ...options.enforceEgress ? [step("prove the Agent egress policy is active", { kind: "verify-egress", runnerPublicTcpPorts, runnerLoopbackPorts })] : [],
+      ...options.enforceEgress ? [step("prove the Agent egress policy is active", {
+        kind: "verify-egress",
+        deploymentEnabled,
+        runnerPublicTcpPorts,
+        runnerLoopbackPorts,
+        agentLoopbackPorts
+      })] : [],
       step("prove it is running", { kind: "commands", commands: [{ argv: ["/usr/bin/systemctl", "is-active", "forgezero-agent.service"] }] }),
       step("prove the public Vault socket exists", { kind: "wait-socket", path: options.socketPath, attempts: 100, intervalMs: 100 }),
       step("prove the Agent Vault backend exists", { kind: "wait-socket", path: agentBackendSocketPath(options.socketPath), attempts: 100, intervalMs: 100 }),
       step("prove the Agent update helper exists", { kind: "wait-socket", path: DEFAULT_AGENT_UPDATE_SOCKET, attempts: 100, intervalMs: 100 }),
+      step("prove the software strategy helper socket exists", { kind: "wait-socket", path: DEFAULT_SOFTWARE_HELPER_SOCKET, attempts: 100, intervalMs: 100 }),
       ...deploymentEnabled ? [
-        step("prove the deployment runner socket exists", { kind: "wait-socket", path: DEPLOYMENT_RUNNER_SOCKET, attempts: 100, intervalMs: 100 }),
-        step("prove the software strategy helper socket exists", { kind: "wait-socket", path: DEFAULT_SOFTWARE_HELPER_SOCKET, attempts: 100, intervalMs: 100 })
+        step("prove the deployment runner socket exists", { kind: "wait-socket", path: DEPLOYMENT_RUNNER_SOCKET, attempts: 100, intervalMs: 100 })
       ] : [],
       ...lifecycleEnabled ? [step("prove the lifecycle helper socket exists", { kind: "wait-socket", path: lifecycleHelperSocketPath, attempts: 100, intervalMs: 100 })] : [],
       ...warpEnabled ? [step("prove Cloudflare WARP is connected", { kind: "verify-warp" })] : [],
@@ -6385,6 +6413,25 @@ import {
   writeFileSync as writeFileSync3
 } from "fs";
 import { dirname as dirname3 } from "path";
+function normalizeEd25519PublicKey(output) {
+  const line = output.trim();
+  if (!/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}(?: [^\r\n]{1,256})?$/.test(line))
+    return;
+  const [algorithm, encoded] = line.split(" ", 3);
+  if (algorithm !== "ssh-ed25519" || !encoded)
+    return;
+  let blob;
+  try {
+    blob = Buffer.from(encoded, "base64");
+  } catch {
+    return;
+  }
+  if (blob.length !== 51 || blob.readUInt32BE(0) !== 11 || blob.subarray(4, 15).toString("ascii") !== "ssh-ed25519" || blob.readUInt32BE(15) !== 32)
+    return;
+  if (blob.toString("base64") !== encoded)
+    return;
+  return `${algorithm} ${encoded}`;
+}
 function parseAssignments(value) {
   if (!value?.trim())
     return;
@@ -6557,7 +6604,7 @@ var runProvisionOperation = async (operation) => {
             return result;
         }
         result = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
-        if (result.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(result.stdout)) {
+        if (result.exitCode !== 0 || !normalizeEd25519PublicKey(result.stdout)) {
           return { stdout: "bootstrap SSH private key is not a valid Ed25519 OpenSSH key", exitCode: 1 };
         }
         result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=bootstrap-ssh-key", key, operation.credential]);
@@ -6573,11 +6620,12 @@ var runProvisionOperation = async (operation) => {
           chmodSync(key, 384);
         }
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
-        if (derived.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(derived.stdout)) {
+        const publicKey = normalizeEd25519PublicKey(derived.stdout);
+        if (derived.exitCode !== 0 || !publicKey) {
           return { stdout: "bootstrap SSH public key derivation failed", exitCode: 1 };
         }
         mkdirSync3(dirname3(operation.publicKey), { recursive: true, mode: 493 });
-        writeFileSync3(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
+        writeFileSync3(operation.publicKey, `${publicKey} forgezero-bootstrap-runner
 `, { mode: 292 });
         chmodSync(operation.publicKey, 292);
       }
@@ -6620,8 +6668,9 @@ var runProvisionOperation = async (operation) => {
     const policy = await fixed(["/usr/sbin/nft", "--numeric", "list", "table", "inet", "forgezero_agent_egress"]);
     const required = [
       "forgezero-agent-egress-v1",
-      `public-tcp=${operation.runnerPublicTcpPorts.join(",")}`,
-      ...operation.runnerLoopbackPorts.length ? [`:${operation.runnerLoopbackPorts.join(",")}`] : []
+      ...operation.agentLoopbackPorts.length ? [`shared-loopback=${operation.agentLoopbackPorts.join(",")}`] : [],
+      ...operation.deploymentEnabled && operation.runnerPublicTcpPorts.length ? [`public-tcp=${operation.runnerPublicTcpPorts.join(",")}`] : [],
+      ...operation.deploymentEnabled && operation.runnerLoopbackPorts.length ? [`:${operation.runnerLoopbackPorts.join(",")}`] : []
     ];
     return policy.exitCode === 0 && required.every((part) => policy.stdout.includes(part)) ? { stdout: policy.stdout, exitCode: 0 } : { stdout: policy.stdout, exitCode: 1 };
   }
@@ -6697,7 +6746,9 @@ async function applyPlan(plan, run) {
     const result = await run(step2.operation);
     transcript.push({ label: step2.label, command: step2.command, exitCode: result.exitCode });
     if (result.exitCode !== 0 && !step2.optional) {
-      throw new Error(`${step2.label} failed (exit ${result.exitCode}): ${step2.command}`);
+      const safeDetail = step2.operation.kind === "ensure-bootstrap-ssh-identity" ? result.stdout.trim().slice(0, 1000) : "";
+      throw new Error(`${step2.label} failed (exit ${result.exitCode}): ${step2.command}${safeDetail ? `
+${safeDetail}` : ""}`);
     }
   }
   return transcript;
@@ -12509,12 +12560,26 @@ map $limit_conn_status $forgezero_retry_after { default ''; REJECTED 1; REJECTED
 server {
   listen 127.0.0.1:${input.publicPort};
   server_name _;
+  server_tokens off;
+  more_clear_headers Server X-Powered-By;
   limit_conn forgezero_admission ${concurrencyLimit};
   limit_conn_status 503;
   add_header Retry-After $forgezero_retry_after always;
-  location ^~ /api/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
-  location ^~ /v1/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
-  location / { return 404; }
+  error_page 400 403 404 405 408 413 414 429 500 502 503 504 = @transport_failure;
+  location @transport_failure { internal; return 444; }
+  location / {
+    proxy_pass http://forgezero;
+    proxy_http_version 1.1;
+    proxy_intercept_errors off;
+    proxy_hide_header Server;
+    proxy_hide_header X-Powered-By;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $forgezero_connection;
+    proxy_read_timeout 3600s;
+  }
 }
 `
   };
@@ -14362,7 +14427,7 @@ Type=oneshot
 User=arangodb
 Group=arangodb
 LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
-ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default")quit(0);last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));'
+ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;let ok=false;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default"){ok=true;break;}last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}if(!ok)throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));'
 RemainAfterExit=yes
 TimeoutStartSec=200
 NoNewPrivileges=true
@@ -14488,11 +14553,11 @@ async function seal(host, name, destination2, value) {
 async function verifyBootstrapBundleOnHost(host, config, verifyGit = false) {
   const manifestMetadata = host.inspect?.(config.bootstrapBundle.manifestFile);
   const bundleMetadata = host.inspect?.(config.bootstrapBundle.bundleFile);
-  if (manifestMetadata && (!manifestMetadata.regular || manifestMetadata.symbolic || manifestMetadata.uid !== 0 || manifestMetadata.links !== 1 || (manifestMetadata.mode & 63) !== 0 || manifestMetadata.size > 16 * 1024)) {
-    throw new Error("bootstrap bundle manifest must be a root-owned owner-only regular file");
+  if (manifestMetadata && (!manifestMetadata.regular || manifestMetadata.symbolic || manifestMetadata.uid !== 0 || manifestMetadata.links !== 1 || (manifestMetadata.mode & 18) !== 0 || manifestMetadata.size > 16 * 1024)) {
+    throw new Error("bootstrap bundle manifest must be a root-owned non-writable regular file");
   }
-  if (bundleMetadata && (!bundleMetadata.regular || bundleMetadata.symbolic || bundleMetadata.uid !== 0 || bundleMetadata.links !== 1 || (bundleMetadata.mode & 63) !== 0 || bundleMetadata.size < 1 || bundleMetadata.size > 512 * 1024 * 1024)) {
-    throw new Error("bootstrap bundle must be a root-owned owner-only regular file within 512 MiB");
+  if (bundleMetadata && (!bundleMetadata.regular || bundleMetadata.symbolic || bundleMetadata.uid !== 0 || bundleMetadata.links !== 1 || (bundleMetadata.mode & 18) !== 0 || bundleMetadata.size < 1 || bundleMetadata.size > 512 * 1024 * 1024)) {
+    throw new Error("bootstrap bundle must be a root-owned non-writable regular file within 512 MiB");
   }
   if (!host.exists(config.bootstrapBundle.bundleFile) || !host.exists(config.bootstrapBundle.manifestFile)) {
     throw new Error("attended bootstrap bundle and manifest are required for release generation one");
@@ -14511,11 +14576,25 @@ async function verifyBootstrapBundleOnHost(host, config, verifyGit = false) {
   if (digest !== manifest.sha256)
     throw new Error("bootstrap bundle digest does not match its manifest");
   if (verifyGit) {
-    await checked3(host, ["/usr/bin/git", "bundle", "verify", config.bootstrapBundle.bundleFile], "bootstrap Git bundle verification");
+    const verificationRepository = "/run/forgezero-bootstrap-bundle-verify";
+    await checked3(host, ["/usr/bin/rm", "-rf", "--", verificationRepository], "stale bootstrap bundle verifier cleanup");
+    await checked3(host, ["/usr/bin/git", "init", "--bare", "--quiet", verificationRepository], "bootstrap bundle verifier repository");
+    try {
+      await checked3(host, [
+        "/usr/bin/git",
+        "-C",
+        verificationRepository,
+        "bundle",
+        "verify",
+        config.bootstrapBundle.bundleFile
+      ], "bootstrap Git bundle verification");
+    } finally {
+      await checked3(host, ["/usr/bin/rm", "-rf", "--", verificationRepository], "bootstrap bundle verifier cleanup");
+    }
   }
   return manifest;
 }
-function bootstrapIdentity(config) {
+function bootstrapIdentity(config, includeDeploymentEvidence = false) {
   if (config.kind === "enrolled-compute")
     return {
       kind: config.kind,
@@ -14534,7 +14613,13 @@ function bootstrapIdentity(config) {
       bootstrapRunner: config.bootstrapRunner ? { targetTelemetryEndpoint: config.bootstrapRunner.targetTelemetryEndpoint } : null
     };
   const environment = config.runtime.environment;
-  const { cloudflare: _cloudflare, realtime: _realtime, ...stableEnvironment } = environment;
+  const { cloudflare: _cloudflare, realtime: _realtime, initialInventory, ...stableEnvironmentRest } = environment;
+  const stableEnvironment = {
+    ...stableEnvironmentRest,
+    ...initialInventory ? {
+      initialInventory: { ...initialInventory, deployment: includeDeploymentEvidence ? initialInventory.deployment : undefined }
+    } : {}
+  };
   return {
     kind: config.kind,
     environment: config.environment,
@@ -14575,6 +14660,26 @@ function bootstrapIdentity(config) {
 function bootstrapIdentityDigest(config) {
   return createHash4("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
 }
+var legacyBootstrapIdentityDigest = (config) => createHash4("sha256").update(JSON.stringify(bootstrapIdentity(config, true))).digest("hex");
+function interruptedPlatformReleaseIdentityDigests(config, releaseEvidence, bootstrapManifest) {
+  if (!config.runtime.environment.initialInventory)
+    return [];
+  const previous = structuredClone(config);
+  previous.runtime.environment.initialInventory.deployment = {
+    source: "bootstrap-bundle",
+    branch: releaseEvidence.branch,
+    revision: releaseEvidence.revision,
+    bundleSha256: releaseEvidence.sha256
+  };
+  const expectedCurrentEpoch = bootstrapManifest ? `${config.environment}-${bootstrapManifest.revision.slice(0, 16)}` : undefined;
+  if (expectedCurrentEpoch && config.runtime.environment.seedSyncEpoch === expectedCurrentEpoch) {
+    previous.runtime.environment.seedSyncEpoch = `${config.environment}-${releaseEvidence.revision.slice(0, 16)}`;
+  }
+  return [bootstrapIdentityDigest(previous), legacyBootstrapIdentityDigest(previous)];
+}
+function storedPlatformCoordinatesMatch(state, config) {
+  return state.kind === "platform" && state.profile === config.profile && state.nodeHostname === config.nodeHostname && state.apiUrl === config.apiUrl && state.environment === config.environment && state.databaseRole === config.database.role && state.databaseAgency === config.database.agency && state.databaseReadPreferred === config.database.readPreferred && state.databaseServerMode === config.database.serverMode && (state.databaseAddress ?? null) === (config.database.address ?? null) && JSON.stringify(state.databaseCoordinators ?? []) === JSON.stringify(config.database.coordinators) && state.collectorUnit === config.runtime.environment.otlpCollectorUnit && state.publicApiPort === config.runtime.environment.publicApiPort && state.healthPath === config.runtime.healthPath;
+}
 function parseStoredState(raw) {
   let value;
   try {
@@ -14605,11 +14710,21 @@ function parseStoredIntent(raw) {
   }
   return intent;
 }
-function bindBootstrapIntent(host, config) {
+function bindBootstrapIntent(host, config, previousReleaseDigests = []) {
   const identityDigest = bootstrapIdentityDigest(config);
   if (host.exists(INTENT_PATH)) {
     const intent = parseStoredIntent(host.read(INTENT_PATH));
     if (intent.kind !== config.kind || intent.identityDigest !== identityDigest) {
+      if (previousReleaseDigests.includes(intent.identityDigest) && intent.kind === "platform" && config.kind === "platform") {
+        host.write(INTENT_PATH, `${JSON.stringify({
+          format: 1,
+          kind: config.kind,
+          identityDigest,
+          createdAt: new Date().toISOString()
+        }, null, 2)}
+`, 384);
+        return identityDigest;
+      }
       throw new Error("bootstrap resume coordinates do not match the interrupted host intent");
     }
   } else if (!host.exists(STATE_PATH)) {
@@ -14777,7 +14892,42 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   let installed;
   if (host.exists(STATE_PATH))
     installed = parseStoredState(host.read(STATE_PATH));
-  const bootstrapManifest = config.kind === "platform" && !host.exists(BOOTSTRAP_RELEASE_EVIDENCE) ? await verifyBootstrapBundleOnHost(host, config) : undefined;
+  let bootstrapManifest;
+  let releaseEvidence;
+  if (config.kind === "platform") {
+    const staged = host.exists(config.bootstrapBundle.bundleFile) || host.exists(config.bootstrapBundle.manifestFile);
+    if (staged && !(host.exists(config.bootstrapBundle.bundleFile) && host.exists(config.bootstrapBundle.manifestFile))) {
+      throw new Error("bootstrap bundle and manifest must be staged together");
+    }
+    const reviewed = staged ? await verifyBootstrapBundleOnHost(host, config) : undefined;
+    if (!host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
+      if (!reviewed)
+        throw new Error("attended bootstrap bundle and manifest are required for release generation one");
+      bootstrapManifest = reviewed;
+    } else if (reviewed) {
+      let evidence;
+      try {
+        evidence = JSON.parse(host.read(BOOTSTRAP_RELEASE_EVIDENCE));
+      } catch {
+        throw new Error("bootstrap release evidence is malformed");
+      }
+      if (typeof evidence.revision !== "string" || !/^[a-f0-9]{40}$/.test(evidence.revision) || typeof evidence.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(evidence.sha256) || typeof evidence.branch !== "string")
+        throw new Error("bootstrap release evidence is malformed");
+      releaseEvidence = { revision: evidence.revision, sha256: evidence.sha256, branch: evidence.branch };
+      if (evidence.revision !== reviewed.revision || evidence.sha256 !== reviewed.sha256 || evidence.branch !== reviewed.branch)
+        bootstrapManifest = reviewed;
+    } else if (host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
+      let evidence;
+      try {
+        evidence = JSON.parse(host.read(BOOTSTRAP_RELEASE_EVIDENCE));
+      } catch {
+        throw new Error("bootstrap release evidence is malformed");
+      }
+      if (typeof evidence.revision !== "string" || !/^[a-f0-9]{40}$/.test(evidence.revision) || typeof evidence.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(evidence.sha256) || typeof evidence.branch !== "string")
+        throw new Error("bootstrap release evidence is malformed");
+      releaseEvidence = { revision: evidence.revision, sha256: evidence.sha256, branch: evidence.branch };
+    }
+  }
   let cloudflare;
   if (config.cloudflareHandoff) {
     if (host.exists(config.cloudflareHandoff.handoffFile)) {
@@ -14827,10 +14977,14 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       throw new Error("platform realtime coordinates require a realtime-enabled Cloudflare handoff");
     }
   }
+  let allowInterruptedReleaseRebind = false;
   if (installed) {
-    if (installed.kind !== config.kind || installed.identityDigest !== bootstrapIdentityDigest(config)) {
+    const exactIdentity = installed.kind === config.kind && installed.identityDigest === bootstrapIdentityDigest(config);
+    const boundedReleaseResume = config.kind === "platform" && !host.exists("/var/lib/forgezero/enrolment.json") && host.exists(BOOTSTRAP_RELEASE_EVIDENCE) && storedPlatformCoordinatesMatch(installed, config);
+    if (!exactIdentity && !boundedReleaseResume) {
       throw new Error("bootstrap repair coordinates do not match the installed host identity");
     }
+    allowInterruptedReleaseRebind = !exactIdentity && boundedReleaseResume;
   }
   const platformPrivate = config.kind === "platform" ? (() => {
     if (!secrets)
@@ -14850,10 +15004,14 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (config.kind === "enrolled-compute" && config.bootstrapRunner?.sshPrivateKeyFile && !host.exists(BOOTSTRAP_SSH_CREDENTIAL)) {
     privateFile(host, config.bootstrapRunner.sshPrivateKeyFile, "bootstrap runner SSH private key");
   }
-  bindBootstrapIntent(host, config);
+  let previousReleaseDigests = [];
+  if (!installed && config.kind === "platform" && releaseEvidence && !host.exists("/var/lib/forgezero/enrolment.json")) {
+    previousReleaseDigests = [...interruptedPlatformReleaseIdentityDigests(config, releaseEvidence, bootstrapManifest)];
+  }
+  bindBootstrapIntent(host, config, allowInterruptedReleaseRebind && installed?.identityDigest ? [installed.identityDigest] : previousReleaseDigests);
   const plan = planBootstrap(config, host.exists(STATE_PATH));
   await checked3(host, ["hostnamectl", "set-hostname", "--static", config.nodeHostname], "compute hostname");
-  const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
+  let alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
   host.mkdir(CREDS, 448);
   host.mkdir("/var/lib/forgezero", 448);
   if (!alreadyEnrolled && !host.exists(ENROL_CREDENTIAL)) {
@@ -14882,14 +15040,29 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (connectorCapabilities?.meshConnectorToken && !host.exists(WARP_CONNECTOR_CREDENTIAL)) {
     await seal(host, "CF_WARP_CONNECTOR_TOKEN", WARP_CONNECTOR_CREDENTIAL, connectorCapabilities.meshConnectorToken);
   }
+  let installedAgentPlan;
   if (alreadyEnrolled) {
-    await host.installAgent(config, "bound");
+    installedAgentPlan = await host.installAgent(config, "bound");
   } else if (config.kind === "platform") {
     if (bootstrapManifest)
-      await host.installAgent(config, "bootstrap");
+      installedAgentPlan = await host.installAgent(config, "bootstrap");
+    else if (host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
+      await checked3(host, [
+        "curl",
+        "--fail",
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "10",
+        `http://127.0.0.1:${config.runtime.environment.publicApiPort}${config.runtime.healthPath}`
+      ], "persisted release-one API health");
+      await host.installAgent(config, "enrol");
+      installedAgentPlan = await host.installAgent(config, "bound");
+      alreadyEnrolled = true;
+    }
   } else {
     await host.installAgent(config, "enrol");
-    await host.installAgent(config, "bound");
+    installedAgentPlan = await host.installAgent(config, "bound");
   }
   if (config.kind === "platform" && config.firewall.enabled) {
     await host.ensureSoftware(plan.software.filter(({ id: id2 }) => id2 === "ufw"));
@@ -14969,6 +15142,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await checked3(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
       await checked3(host, ["id", runtime.serviceUser], "existing API service account");
     });
+    await checked3(host, ["usermod", "-a", "-G", DEPLOYMENT_GROUP, runtime.serviceUser], "API deployment group");
     host.mkdir(runtime.environment.sharedDirectory, 488);
     host.mkdir(runtime.slotsDirectory, 493);
     host.write(envPath, renderPlatformSharedEnvironment(runtime.environment), 416);
@@ -14987,7 +15161,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     host.write("/etc/sudoers.d/forgezero-runner", activation.sudoers, 288);
     await checked3(host, ["visudo", "-cf", "/etc/sudoers.d/forgezero-runner"], "activation sudo policy");
     const telemetry = planLocalOtlpProof(runtime.environment.otlpEndpoint, runtime.environment.otlpCollectorUnit);
-    await checked3(host, telemetry.unitCheck.argv, "OTLP collector supervision");
+    await checked3(host, [telemetry.unitCheck.command, ...telemetry.unitCheck.argv], "OTLP collector supervision");
     const otlpStatus = (await checked3(host, [telemetry.receiverCheck.command, ...telemetry.receiverCheck.argv], "OTLP receiver")).trim();
     if (!/^2\d\d$/.test(otlpStatus))
       throw new Error(`OTLP receiver returned HTTP ${otlpStatus || "unknown"}`);
@@ -15020,10 +15194,12 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
 `, 384);
     }
     if (bootstrapManifest) {
+      if (!installedAgentPlan?.user)
+        throw new Error("initial Agent deployment requires the converged Agent user");
       await checked3(host, [
         "runuser",
         "-u",
-        "forgezero-agent",
+        installedAgentPlan.user,
         "--",
         "/usr/local/bin/fz-agent",
         "deploy",
@@ -15050,7 +15226,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
         "--show-error",
         "--max-time",
         "10",
-        `http://127.0.0.1:3000${runtime.healthPath}`
+        `http://127.0.0.1:${runtime.environment.publicApiPort}${runtime.healthPath}`
       ], "release-one API health");
       await host.installAgent(config, "enrol");
       await host.installAgent(config, "bound");
@@ -15291,6 +15467,8 @@ function planBootstrapAgentInstall(config, phase, context) {
     bootstrapTargetTelemetryEndpoint: bound && bootstrapRunner ? platformBootstrapRunner(config) ? config.telemetryEndpoint : config.kind === "enrolled-compute" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined : undefined,
     lifecycleProfilePath: bound && config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
     enforceEgress: true,
+    runnerLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort, config.runtime.bluePort, config.runtime.greenPort] : [],
+    agentLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort] : [],
     nodeHostname: config.nodeHostname,
     telemetryEndpoint: config.telemetryEndpoint,
     binPath: "/usr/local/lib/forgezero/agent/fz-agent",
@@ -15300,7 +15478,7 @@ function planBootstrapAgentInstall(config, phase, context) {
       enrolStatePath: "/var/lib/forgezero/enrolment.json"
     } : bound ? { enrolStatePath: "/var/lib/forgezero/enrolment.json" } : {},
     ...authenticated ? {
-      apiUrl: config.apiUrl,
+      apiUrl: config.kind === "platform" ? `http://127.0.0.1:${config.runtime.environment.publicApiPort}` : config.apiUrl,
       project: config.kind === "enrolled-compute" ? config.realm : "platform",
       environment: config.kind === "enrolled-compute" ? undefined : config.environment,
       nodeLabel: config.kind === "enrolled-compute" ? config.nodeHostname : config.computeReference
@@ -15309,6 +15487,7 @@ function planBootstrapAgentInstall(config, phase, context) {
   return planInstall(options);
 }
 function localBootstrapHost() {
+  let softwareClientUser;
   const execute = async (argv2, options = {}) => {
     const child = Bun.spawn([...argv2], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
     if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
@@ -15341,10 +15520,12 @@ function localBootstrapHost() {
     exec: execute,
     sleep: (milliseconds) => Bun.sleep(milliseconds),
     async ensureSoftware(requirements) {
+      if (!softwareClientUser)
+        throw new Error("Agent must be converged before software requirements are applied");
       const result = await execute([
         "runuser",
         "-u",
-        "forgezero-agent",
+        softwareClientUser,
         "--",
         "/usr/local/bin/fz-agent",
         "software-ensure",
@@ -15358,7 +15539,7 @@ function localBootstrapHost() {
       const capabilities = await readCapabilities(localRunner);
       const hasBinding = existsSync9("/var/lib/forgezero/enrolment.json");
       const hasEnrolCredential = existsSync9(ENROL_CREDENTIAL);
-      const initialBundle = config.kind === "platform" && !existsSync9(BOOTSTRAP_RELEASE_EVIDENCE) ? {
+      const initialBundle = config.kind === "platform" && phase === "bootstrap" && existsSync9(config.bootstrapBundle.bundleFile) && existsSync9(config.bootstrapBundle.manifestFile) ? {
         path: config.bootstrapBundle.bundleFile,
         manifestPath: config.bootstrapBundle.manifestFile,
         manifest: parseBootstrapBundleManifest(JSON.parse(readFileSync9(config.bootstrapBundle.manifestFile, "utf8")))
@@ -15389,6 +15570,7 @@ function localBootstrapHost() {
         writeFileSync9(unit.path, unit.unit, { mode: 420 });
       }
       await applyPlan(plan, localRunner);
+      softwareClientUser = plan.user;
       return plan;
     }
   };
@@ -15658,7 +15840,7 @@ async function runCloudflareBootstrapFinalizeCommand(configPath, dependencies =
 
 // src/operator-bootstrap.ts
 import { createHash as createHash6, randomBytes as randomBytes9 } from "crypto";
-import { chmodSync as chmodSync6, lstatSync as lstatSync7, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "fs";
+import { chmodSync as chmodSync6, existsSync as existsSync11, lstatSync as lstatSync7, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "fs";
 import { isIP as isIP6 } from "net";
 import { tmpdir as tmpdir2 } from "os";
 import { basename as basename2, dirname as dirname13, isAbsolute as isAbsolute5, join as join11, resolve as resolve9 } from "path";
@@ -16630,6 +16812,21 @@ async function metalBootstrapStatus(exec = defaultExec2) {
 }
 
 // src/operator-bootstrap.ts
+function operatorPackagedBinary(name) {
+  const candidates = [
+    fileURLToPath3(new URL(`./${name}`, import.meta.url)),
+    fileURLToPath3(new URL(`../dist/${name}`, import.meta.url))
+  ];
+  const found = candidates.find(existsSync11);
+  if (!found)
+    throw new Error(`packaged ${name} is missing; checked ${candidates.join(" and ")}`);
+  return found;
+}
+var operatorPackagedFzCliPath = () => operatorPackagedBinary("fz.js");
+var operatorPackagedAgentPath = () => operatorPackagedBinary("fz-agent.js");
+var operatorPackagedGitSshPath = () => operatorPackagedBinary("fz-git-ssh.js");
+var PLATFORM_CLUSTER_CREDENTIAL_NAME = "forgezero-platform-cluster-bootstrap-code";
+var PLATFORM_CLUSTER_CREDENTIAL_PATH = `/etc/forgezero/creds/${PLATFORM_CLUSTER_CREDENTIAL_NAME}.cred`;
 var REQUEST_LIMIT = 64 * 1024;
 var SECRET_LIMIT = 256 * 1024;
 var REMOTE_STAGE = "/run/forgezero-operator-bootstrap";
@@ -17072,9 +17269,11 @@ function operatorPlatformFleetCoordinates(fleet) {
 function planOperatorPlatformFleetBootstrap(fleet, mode) {
   const { requests, configs, environment } = validatedPlatformFleet(fleet);
   const secretInputs = mode === "apply" ? attendedSecretNames(configs[0]) : [];
-  for (const config of configs.slice(1)) {
-    if (JSON.stringify(attendedSecretNames(config)) !== JSON.stringify(secretInputs)) {
-      throw new Error("operator fleet configs do not share one attended secret schema");
+  if (mode === "apply") {
+    for (const config of configs.slice(1)) {
+      if (JSON.stringify(attendedSecretNames(config)) !== JSON.stringify(secretInputs)) {
+        throw new Error("operator fleet configs do not share one attended secret schema");
+      }
     }
   }
   return {
@@ -17112,9 +17311,33 @@ var defaultExec3 = async (argv2, options = {}) => {
   ]);
   return {
     exitCode,
-    output: options.secret ? options.safeStdout && exitCode === 0 ? stdout.slice(0, 65536) : "" : `${stdout}${stderr}`.slice(0, 65536)
+    output: options.secret ? exitCode === 0 ? options.safeStdout ? stdout.slice(0, 65536) : "" : redactOperatorSecretDiagnostic(stderr, options.stdin) : `${stdout}${stderr}`.slice(0, 65536)
   };
 };
+function redactOperatorSecretDiagnostic(stderr, stdin) {
+  if (!stdin)
+    return "";
+  let parsed;
+  try {
+    parsed = JSON.parse(stdin);
+  } catch {
+    return "";
+  }
+  const values = [];
+  const visit = (value) => {
+    if (typeof value === "string" && value)
+      values.push(value);
+    else if (Array.isArray(value))
+      value.forEach(visit);
+    else if (value && typeof value === "object")
+      Object.values(value).forEach(visit);
+  };
+  visit(parsed);
+  let safe = stderr.slice(0, 16384);
+  for (const value of values.sort((left, right) => right.length - left.length))
+    safe = safe.replaceAll(value, "[REDACTED]");
+  return safe.slice(0, 8192);
+}
 var checked5 = async (exec, argv2, label, options) => {
   const result = await exec(argv2, options);
   if (result.exitCode !== 0)
@@ -17157,7 +17380,7 @@ var sshOptions = (request, knownHosts, scp = false) => [
   "-o",
   "ClearAllForwardings=yes",
   "-o",
-  "ConnectTimeout=10",
+  "ConnectTimeout=30",
   "-o",
   request.target.jump ? `ProxyJump=${destination2(request.target.jump)}:${request.target.jump.port}` : "ProxyJump=none",
   scp ? "-P" : "-p",
@@ -17192,6 +17415,93 @@ var remoteRegularFileExists = async (exec, request, knownHosts, path) => {
     return false;
   throw new Error(`remote initialized-state probe failed${result.output ? `: ${result.output.trim()}` : ""}`);
 };
+async function operatorMetalClusterBootstrapCode(requestInput, options = {}) {
+  const request = validateMetalRequestValue(requestInput);
+  publicIdentity(request.target.identityPublicKeyFile);
+  socketPath(request.target.agentSocket);
+  const exec = options.exec ?? defaultExec3;
+  const directory = mkdtempSync2(join11(tmpdir2(), "forgezero-operator-metal-credential-"));
+  try {
+    const knownHosts = writeKnownHosts(request, directory);
+    const probe = await exec([
+      "ssh",
+      ...sshOptions(request, knownHosts),
+      destination2(request.target),
+      "--",
+      "/usr/bin/sudo",
+      "-n",
+      "/usr/bin/test",
+      "-f",
+      PLATFORM_CLUSTER_CREDENTIAL_PATH
+    ]);
+    if (probe.exitCode !== 0 && probe.exitCode !== 1) {
+      throw new Error("Metal cluster credential probe failed");
+    }
+    if (probe.exitCode === 1) {
+      const value2 = randomBytes9(32).toString("hex");
+      await remote(exec, request, knownHosts, [
+        "/usr/bin/sudo",
+        "-n",
+        "/usr/bin/install",
+        "-d",
+        "-o",
+        "root",
+        "-g",
+        "root",
+        "-m",
+        "0700",
+        dirname13(PLATFORM_CLUSTER_CREDENTIAL_PATH)
+      ], "Metal credential directory");
+      await remote(exec, request, knownHosts, [
+        "/usr/bin/sudo",
+        "-n",
+        "/usr/bin/systemd-creds",
+        "encrypt",
+        `--name=${PLATFORM_CLUSTER_CREDENTIAL_NAME}`,
+        "-",
+        PLATFORM_CLUSTER_CREDENTIAL_PATH
+      ], "seal Metal cluster credential", true, `${value2}
+`);
+      await remote(exec, request, knownHosts, [
+        "/usr/bin/sudo",
+        "-n",
+        "/usr/bin/chown",
+        "root:root",
+        PLATFORM_CLUSTER_CREDENTIAL_PATH
+      ], "own Metal cluster credential");
+      await remote(exec, request, knownHosts, [
+        "/usr/bin/sudo",
+        "-n",
+        "/usr/bin/chmod",
+        "0600",
+        PLATFORM_CLUSTER_CREDENTIAL_PATH
+      ], "protect Metal cluster credential");
+    }
+    const metadata = await remote(exec, request, knownHosts, [
+      "/usr/bin/sudo",
+      "-n",
+      "/usr/bin/stat",
+      "--format=%u:%g:%a:%h",
+      PLATFORM_CLUSTER_CREDENTIAL_PATH
+    ], "verify Metal cluster credential");
+    if (metadata !== "0:0:600:1")
+      throw new Error("Metal cluster credential is not one root-owned 0600 file");
+    const value = await remote(exec, request, knownHosts, [
+      "/usr/bin/sudo",
+      "-n",
+      "/usr/bin/systemd-creds",
+      "decrypt",
+      `--name=${PLATFORM_CLUSTER_CREDENTIAL_NAME}`,
+      PLATFORM_CLUSTER_CREDENTIAL_PATH,
+      "-"
+    ], "open Metal cluster credential", true, undefined, true);
+    if (!/^[a-f0-9]{64}$/i.test(value))
+      throw new Error("Metal cluster credential is invalid");
+    return value;
+  } finally {
+    rmSync7(directory, { recursive: true, force: true });
+  }
+}
 var copy = async (exec, request, knownHosts, local, remotePath, secret = false) => {
   safeRemoteArg(remotePath);
   await checked5(exec, [
@@ -17308,9 +17618,9 @@ async function verifiedBunArchive(directory, fetcher) {
 }
 async function installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options) {
   const artifacts = [
-    [options.fzCliPath ?? fileURLToPath3(new URL("./fz.js", import.meta.url)), "fz.js"],
-    [options.fzAgentPath ?? fileURLToPath3(new URL("./fz-agent.js", import.meta.url)), "fz-agent.js"],
-    [options.fzGitSshPath ?? fileURLToPath3(new URL("./fz-git-ssh.js", import.meta.url)), "fz-git-ssh.js"]
+    [options.fzCliPath ?? operatorPackagedFzCliPath(), "fz.js"],
+    [options.fzAgentPath ?? operatorPackagedAgentPath(), "fz-agent.js"],
+    [options.fzGitSshPath ?? operatorPackagedGitSshPath(), "fz-git-ssh.js"]
   ];
   for (const [artifact] of artifacts) {
     if (!readFileSync12(artifact).length)
@@ -17347,6 +17657,7 @@ async function installPackagedAgent(request, knownHosts, exec, directory, remote
   for (const [, name] of artifacts)
     await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0755", `${remoteTemp}/${name}`, `/usr/local/lib/forgezero/agent/${name}`], "remote Agent install");
   await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/agent/fz.js", "/usr/local/bin/fz"], "remote fz link");
+  await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/agent/fz-agent", "/usr/local/bin/fz-agent"], "remote fz-agent link");
 }
 async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
   const plan = planOperatorPlatformBootstrap(request, mode);
@@ -17373,8 +17684,10 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
       await copy(exec, request, knownHosts, join11(directory, name), `${remoteTemp}/${name}`, true);
     for (const bundle of staged.bundleFiles)
       await copy(exec, request, knownHosts, bundle.source, `${remoteTemp}/${bundle.name}`, true);
-    for (const name of ["platform-config.json", ...staged.files, ...staged.bundleFiles.map(({ name: name2 }) => name2)])
+    for (const name of ["platform-config.json", ...staged.files])
       await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0600", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote bootstrap handoff", true);
+    for (const { name } of staged.bundleFiles)
+      await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0644", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote bootstrap bundle", true);
     const command = ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "platform", "credentials-stdin"];
     command.push("--bootstrap-config", `${REMOTE_STAGE}/platform-config.json`, "--apply");
     const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap", mode === "apply", secrets ? `${JSON.stringify(secrets)}
@@ -17596,7 +17909,7 @@ var PROFILES = {
     appOrigin: "https://dev.forgezero.net",
     apiOrigin: "https://dev-api.forgezero.net",
     zoneName: "forgezero.net",
-    kvNamespaceTitle: "forgezero-dev-nodes",
+    kvNamespaceTitle: "forgezero dev nodes",
     workerScriptName: "forgezero-api-edge-development",
     region: { key: "in-south", label: "India South", country: "IN" },
     agentOtlpEndpoint: "https://otel.forgezero.net",
@@ -17608,7 +17921,7 @@ var PROFILES = {
     appOrigin: "https://www.forgezero.net",
     apiOrigin: "https://api.forgezero.net",
     zoneName: "forgezero.net",
-    kvNamespaceTitle: "forgezero-nodes",
+    kvNamespaceTitle: "forgezero nodes",
     workerScriptName: "forgezero-api-edge-production",
     region: { key: "in-south", label: "India South", country: "IN" },
     agentOtlpEndpoint: "https://otel.forgezero.net",
@@ -17707,7 +18020,7 @@ function forgeZeroLaunchTemplate(profile, guests, bundle, owner) {
 // src/host-maintenance.ts
 import { lstatSync as lstatSync8, readFileSync as readFileSync13 } from "fs";
 var ROOT = "/opt/forgezero";
-var SLOT_FILE = `${ROOT}/.forge-slot`;
+var SLOT_FILE = `${ROOT}/slots/.active`;
 var SHARED_ENV = `${ROOT}/shared/.env`;
 var JWT = "/etc/forgezero/creds/arangodb-jwt.cred";
 var FZ = "/usr/local/bin/fz";
@@ -17836,7 +18149,7 @@ async function applyHostMaintenance(request, runtime = localRuntime()) {
 }
 
 // src/cli/maintenance.ts
-import { existsSync as existsSync11, lstatSync as lstatSync9, readFileSync as readFileSync14, realpathSync as realpathSync5 } from "fs";
+import { existsSync as existsSync12, lstatSync as lstatSync9, readFileSync as readFileSync14, realpathSync as realpathSync5 } from "fs";
 import { isAbsolute as isAbsolute6, join as join12, relative as relative2, resolve as resolve10 } from "path";
 var API_OPERATION_ENTRYPOINTS = {
   "dev-reset": ["src", "server", "maintenance", "dev-reset.ts"],
@@ -17907,7 +18220,7 @@ function unsupportedRepositoryCliOption(argv2) {
 }
 function manifestName(root) {
   const manifestPath = join12(root, "package.json");
-  if (!existsSync11(manifestPath)) {
+  if (!existsSync12(manifestPath)) {
     throw new Error(`No package.json exists at repository root ${root}.`);
   }
   let parsed;
@@ -17923,7 +18236,7 @@ function manifestName(root) {
 }
 function checkedEntrypoint(root, parts) {
   const candidate = join12(root, ...parts);
-  if (!existsSync11(candidate) || !lstatSync9(candidate).isFile()) {
+  if (!existsSync12(candidate) || !lstatSync9(candidate).isFile()) {
     throw new Error(`The reviewed operation entrypoint is missing: ${candidate}`);
   }
   if (lstatSync9(candidate).isSymbolicLink()) {
@@ -18046,7 +18359,7 @@ function planAppBuild(input) {
 
 // src/cli/index.ts
 var DEFAULT_MODE = (THRESHOLD_MODES.find((mode) => mode.threshold === 1 && mode.total === 1) ?? THRESHOLD_MODES[0]).id;
-var PACKAGED_AGENT_BIN2 = fileURLToPath4(new URL("./fz-agent.js", import.meta.url));
+var PACKAGED_AGENT_BIN2 = operatorPackagedAgentPath();
 function parseOptions(argv2) {
   const options = {
     api: process.env.FZ_API ?? "http://localhost:8787",
@@ -18792,7 +19105,7 @@ async function cmdAgent(options, args) {
       out.ok(`Wrote ${auxiliary.path}`);
     }
     if (options.enrol) {
-      if (!existsSync12(enrolStatePath) && !existsSync12(enrolTokenCredentialPath)) {
+      if (!existsSync13(enrolStatePath) && !existsSync13(enrolTokenCredentialPath)) {
         const token = await bootstrapSecret("ForgeZero one-time enrolment token");
         if (!/^fze_[A-Za-z0-9_-]{40,100}$/.test(token))
           throw new Error("A valid fze_ enrolment token was not provided.");
@@ -18811,7 +19124,7 @@ async function cmdAgent(options, args) {
     for (const step3 of transcript)
       out.ok(step3.label);
     out.ok("Agent service and socket verified");
-    if (gitIdentity.gitPublicKeyPath && existsSync12(gitIdentity.gitPublicKeyPath)) {
+    if (gitIdentity.gitPublicKeyPath && existsSync13(gitIdentity.gitPublicKeyPath)) {
       out.line();
       out.line("  Compatibility SSH deploy public key:");
       out.line();
@@ -18855,7 +19168,6 @@ async function bootstrapSecret(question) {
     throw new Error(`${question} was not provided`);
   return value;
 }
-var PLATFORM_CLUSTER_CREDENTIAL = "forgezero-platform-cluster-bootstrap-code";
 function readPlatformLaunchEnvironment(path) {
   const absolute2 = resolve12(path);
   const stat2 = lstatSync10(absolute2);
@@ -18915,37 +19227,6 @@ function readPlatformLaunchEnvironment(path) {
     cloudflareApiToken: requiredValue("CF_API_TOKEN")
   };
 }
-async function platformLaunchClusterBootstrapCode(outputDirectory) {
-  const path = join13(dirname14(outputDirectory), `${PLATFORM_CLUSTER_CREDENTIAL}.cred`);
-  if (existsSync12(path)) {
-    const stat2 = lstatSync10(path);
-    if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.nlink !== 1 || typeof process.getuid === "function" && stat2.uid !== process.getuid() || (stat2.mode & 63) !== 0) {
-      throw new Error(`platform cluster credential must be one owner-only regular file: ${path}`);
-    }
-    const child2 = Bun.spawn(["systemd-creds", "decrypt", `--name=${PLATFORM_CLUSTER_CREDENTIAL}`, path, "-"], { stdin: "ignore", stdout: "pipe", stderr: "pipe" });
-    const [stdout, stderr2, exitCode2] = await Promise.all([
-      new Response(child2.stdout).text(),
-      new Response(child2.stderr).text(),
-      child2.exited
-    ]);
-    if (exitCode2 !== 0)
-      throw new Error(`cannot open the retained platform cluster credential: ${stderr2.trim()}`);
-    const value2 = stdout.trim();
-    if (!/^[a-f0-9]{64}$/i.test(value2))
-      throw new Error("retained platform cluster credential is invalid");
-    return value2;
-  }
-  mkdirSync13(dirname14(path), { recursive: true, mode: 448 });
-  const value = randomBytes10(32).toString("hex");
-  const child = Bun.spawn(["systemd-creds", "encrypt", `--name=${PLATFORM_CLUSTER_CREDENTIAL}`, "-", path], { stdin: "pipe", stdout: "pipe", stderr: "pipe" });
-  await writeAndCloseProcessInput(child.stdin, `${value}
-`);
-  const [stderr, exitCode] = await Promise.all([new Response(child.stderr).text(), child.exited]);
-  if (exitCode !== 0)
-    throw new Error(`cannot retain the platform cluster credential: ${stderr.trim()}`);
-  chmodSync7(path, 384);
-  return value;
-}
 async function promptPlatformBootstrapSecrets(config, generatedClusterBootstrapCode) {
   return validatePlatformBootstrapSecrets(config, {
     clusterBootstrapCode: generatedClusterBootstrapCode ?? await bootstrapSecret("Shared 64-hex cluster bootstrap code"),
@@ -19082,7 +19363,7 @@ async function interactiveCloudflareBootstrap() {
 function genesisOutputDirectory(path) {
   if (!isAbsolute7(path) || resolve12(path) !== path)
     throw new Error("--output must be a canonical absolute directory");
-  if (!existsSync12(path))
+  if (!existsSync13(path))
     mkdirSync13(path, { recursive: true, mode: 448 });
   const metadata = lstatSync10(path);
   const uid = process.getuid?.();
@@ -19260,14 +19541,14 @@ async function prepareForgeZeroPlatformLaunch(environment, outputDirectory, proj
     [metalRequestFile, "reviewed Metal request"],
     [guestHostKeysFile, "pinned genesis guest host-key evidence"]
   ]) {
-    if (!existsSync12(path))
+    if (!existsSync13(path))
       throw new Error(`${label} is missing at ${path}`);
   }
   const root = resolve12(projectRoot);
   const nestedApi = join13(root, "api");
-  const repositoryRoot = existsSync12(join13(nestedApi, "package.json")) ? nestedApi : root;
+  const repositoryRoot = existsSync13(join13(nestedApi, "package.json")) ? nestedApi : root;
   const bundlePath = join13(base, "api.bundle");
-  const bundle = existsSync12(bundlePath) || existsSync12(`${bundlePath}.json`) ? await readBootstrapBundle(bundlePath) : await buildBootstrapBundle({ repositoryRoot, outputPath: bundlePath, branch: profile.branch });
+  const bundle = existsSync13(bundlePath) || existsSync13(`${bundlePath}.json`) ? await readBootstrapBundle(bundlePath) : await buildBootstrapBundle({ repositoryRoot, outputPath: bundlePath, branch: profile.branch });
   if (bundle.manifest.branch !== profile.branch) {
     throw new Error(`existing bootstrap bundle is for ${bundle.manifest.branch}, expected ${profile.branch}`);
   }
@@ -19476,14 +19757,17 @@ async function cmdBootstrap(options, args) {
       if (environment === "production" && options.bootstrapSecretsEnvFile) {
         throw new Error("production platform launch requires interactive hidden secret prompts");
       }
-      const outputDirectory = options.outputPath ?? `/secure/forgezero/${environment}/genesis`;
+      const outputDirectory = options.outputPath ?? join13(homedir2(), ".forgezero-secure", environment, "genesis");
       const environmentInput = options.bootstrapSecretsEnvFile ? readPlatformLaunchEnvironment(options.bootstrapSecretsEnvFile) : undefined;
-      const generated = await prepareForgeZeroPlatformLaunch(environment, outputDirectory, options.projectRoot, environmentInput?.owner);
-      const fleet = readOperatorPlatformBootstrapFleetRequest(generated.fleetRequest);
+      const existingFleetPath = join13(outputDirectory, "platform-fleet-remote.json");
+      const fleet = existsSync13(existingFleetPath) ? readOperatorPlatformBootstrapFleetRequest(existingFleetPath) : readOperatorPlatformBootstrapFleetRequest((await prepareForgeZeroPlatformLaunch(environment, outputDirectory, options.projectRoot, environmentInput?.owner)).fleetRequest);
+      if (planOperatorPlatformFleetBootstrap(fleet, "apply").environment !== environment) {
+        throw new Error("existing platform fleet does not match the selected launch profile");
+      }
       if (options.apply && !environmentInput && bootstrapAnswer("Type APPLY to run the reviewed Cloudflare and three-compute plan") !== "APPLY") {
         throw new Error("attended platform bootstrap was not confirmed");
       }
-      return await runAttendedPlatformFleet(fleet, options.apply, options.apply ? await platformLaunchClusterBootstrapCode(outputDirectory) : undefined, environmentInput);
+      return await runAttendedPlatformFleet(fleet, options.apply, options.apply ? await operatorMetalClusterBootstrapCode(readOperatorMetalBootstrapRequest(join13(dirname14(outputDirectory), "metal", "metal-remote.json"), { validateMetalConfig: false })) : undefined, environmentInput);
     }
     if (operation === "platform" && args[1] === "fleet") {
       const mode = args[2];
@@ -19606,8 +19890,8 @@ async function cmdBootstrap(options, args) {
     if (credentialStdin && args[2] !== undefined)
       throw new Error("platform credential stdin accepts no additional positional arguments");
     const installedBootstrapKind = () => resolveInstalledBootstrapKind({
-      metal: existsSync12(METAL_BOOTSTRAP_STATE_PATH),
-      compute: existsSync12(BOOTSTRAP_STATE_PATH)
+      metal: existsSync13(METAL_BOOTSTRAP_STATE_PATH),
+      compute: existsSync13(BOOTSTRAP_STATE_PATH)
     });
     if (operation === "status") {
       if (installedBootstrapKind() === "metal") {
@@ -19978,7 +20262,7 @@ function projectFromCheckout(options) {
   try {
     return loadConfig({
       cwd: options.projectRoot,
-      readFile: (path) => existsSync12(path) ? readFileSync16(path, "utf8") : undefined
+      readFile: (path) => existsSync13(path) ? readFileSync16(path, "utf8") : undefined
     }).config.project;
   } catch (cause) {
     throw new Error(`No --project was given and the checkout has no usable .fz/config.json: ${cause instanceof Error ? cause.message : String(cause)}`);
@@ -20100,7 +20384,7 @@ async function cmdDeploy(options, args) {
       return problems.length === 0 ? 0 : 1;
     }
     if (operation === "check" || operation === "sync") {
-      if (existsSync12(resolve12(options.projectRoot, DEPLOY_SOURCE_FILE))) {
+      if (existsSync13(resolve12(options.projectRoot, DEPLOY_SOURCE_FILE))) {
         const expected = await compileDeploymentProject(options.projectRoot, { write: false });
         const actual = inspectCompiledDeployment(options.projectRoot);
         const current2 = canonicalJson(expected.plan) === canonicalJson(actual.plan);