@forgezero/agent 0.1.88 → 0.1.90

package/dist/operator-bootstrap.js

@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.88";
+var VERSION = "0.1.90";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -1698,6 +1698,7 @@ function agentEgressUnit(options) {
   }
   const deploymentEnabled = Boolean(options.repository || bootstrapBundleEnabled || options.pullDeployments);
   const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
+  const agentLoopbackPorts = normalizeEgressTcpPorts(options.agentLoopbackPorts ?? []);
   const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
   if (deploymentEnabled && runnerPublicTcpPorts.length < 1) {
     throw new Error("deployed project runner needs at least one vetted public TCP port");
@@ -1705,8 +1706,10 @@ function agentEgressUnit(options) {
   if (deploymentEnabled)
     systemdAgentEgressDirectives(runnerLoopbackPorts);
   const users = [user, ...deploymentEnabled ? [DEPLOYMENT_RUNNER_USER] : []];
-  const runnerGrant = deploymentEnabled ? ` --loopback-user=${DEPLOYMENT_RUNNER_USER}` + runnerLoopbackPorts.map((port) => ` --loopback-tcp-port=${port}`).join("") + runnerPublicTcpPorts.map((port) => ` --public-tcp-port=${port}`).join("") : "";
-  const policyProof = `ExecStartPost=${bin} egress-policy-check ${users.map((name) => `--user=${name}`).join(" ")}${runnerGrant}`;
+  const portGrantEnabled = deploymentEnabled || agentLoopbackPorts.length > 0;
+  const restrictedUser = deploymentEnabled ? DEPLOYMENT_RUNNER_USER : user;
+  const portGrant = portGrantEnabled ? ` --loopback-user=${restrictedUser}` + (deploymentEnabled ? runnerLoopbackPorts.map((port) => ` --loopback-tcp-port=${port}`).join("") : "") + agentLoopbackPorts.map((port) => ` --shared-loopback-tcp-port=${port}`).join("") + (deploymentEnabled ? runnerPublicTcpPorts.map((port) => ` --public-tcp-port=${port}`).join("") : "") : "";
+  const policyProof = `ExecStartPost=${bin} egress-policy-check ${users.map((name) => `--user=${name}`).join(" ")}${portGrant}`;
   return `[Unit]
 Description=ForgeZero Agent host egress policy
 Documentation=https://www.forgezero.net/docs/agent
@@ -1719,7 +1722,7 @@ Type=notify
 NotifyAccess=all
 User=root
 Group=root
-ExecStart=${bin} egress-policy ${users.map((name) => `--user=${name}`).join(" ")}${runnerGrant}
+ExecStart=${bin} egress-policy ${users.map((name) => `--user=${name}`).join(" ")}${portGrant}
 ${policyProof}
 Restart=on-failure
 RestartSec=2
@@ -2003,7 +2006,7 @@ function agentEnrolmentUnit(options) {
 Requires=forgezero-agent-egress.service
 BindsTo=forgezero-agent-egress.service
 ` : "";
-  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives() : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives(options.agentLoopbackPorts ?? []) : "";
   return `[Unit]
 Description=Bind this machine to its ForgeZero compute
 After=network-online.target
@@ -2040,7 +2043,7 @@ WantedBy=multi-user.target
 function deploymentRunnerUnit(options) {
   const bin = options.binPath ?? "fz-agent";
   const root = options.deployRoot ?? "/opt/forgezero";
-  const agentUser = options.user ?? "forgezero-agent";
+  const agentUser = options.user ?? "forgezero";
   const egressDependency = options.enforceEgress ? `After=forgezero-agent-egress.service
 Requires=forgezero-agent-egress.service
 BindsTo=forgezero-agent-egress.service
@@ -2081,7 +2084,7 @@ RestrictRealtime=true
 MemoryDenyWriteExecute=true
 LockPersonality=true
 ${egressDirectives}
-ReadWritePaths=${root}/releases ${root}/runner-home
+ReadWritePaths=${root}/releases ${root}/runner-home ${root}/slots /etc/nginx/conf.d /var/log/nginx
 
 [Install]
 WantedBy=multi-user.target
@@ -2091,7 +2094,7 @@ function agentUnit(options) {
   if (!validNodeHostname(options.nodeHostname))
     throw new Error("node hostname is invalid");
   if (!options.telemetryEndpoint) {
-    throw new Error("compute Agent provisioning requires OTEL_EXPORTER_OTLP_ENDPOINT as an explicit public HTTPS collector coordinate");
+    throw new Error("compute Agent provisioning requires an explicit supervised OTLP collector coordinate");
   }
   let telemetryEndpoint;
   {
@@ -2099,10 +2102,13 @@ function agentUnit(options) {
     try {
       endpoint2 = new URL(options.telemetryEndpoint);
     } catch {
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL");
+      throw new Error("compute telemetry endpoint must be an absolute collector URL");
+    }
+    const localCollector = endpoint2.protocol === "http:" && endpoint2.hostname === "127.0.0.1" && endpoint2.port === "4318" && endpoint2.pathname === "/";
+    const publicCollector = endpoint2.protocol === "https:" && !endpoint2.username && !endpoint2.password && !endpoint2.search && !endpoint2.hash && isIP3(endpoint2.hostname) === 0 && endpoint2.hostname.includes(".") && endpoint2.hostname !== "localhost" && !endpoint2.hostname.endsWith(".local");
+    if (!localCollector && !publicCollector || endpoint2.username || endpoint2.password || endpoint2.search || endpoint2.hash) {
+      throw new Error("compute telemetry endpoint must be the supervised loopback collector or credential-free public HTTPS");
     }
-    if (endpoint2.protocol !== "https:" || endpoint2.username || endpoint2.password || endpoint2.search || endpoint2.hash || isIP3(endpoint2.hostname) !== 0 || !endpoint2.hostname.includes(".") || endpoint2.hostname === "localhost" || endpoint2.hostname.endsWith(".local"))
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL without credentials, query or fragment");
     telemetryEndpoint = endpoint2.toString().replace(/\/$/, "");
   }
   const bin = options.binPath ?? "fz-agent";
@@ -2216,7 +2222,7 @@ function agentUnit(options) {
   const supplementaryGroups = [
     AGENT_UPDATE_GROUP,
     deploymentEnabled ? DEPLOYMENT_GROUP : null,
-    deploymentEnabled ? SOFTWARE_HELPER_GROUP : null,
+    SOFTWARE_HELPER_GROUP,
     lifecycleEnabled ? LIFECYCLE_GROUP : null
   ].filter((value) => value !== null);
   const deploymentGroup = supplementaryGroups.length > 0 ? `SupplementaryGroups=${supplementaryGroups.join(" ")}` : "";
@@ -2225,7 +2231,7 @@ function agentUnit(options) {
     "forgezero-agent-update-helper.service",
     options.enforceEgress ? "forgezero-agent-egress.service" : null,
     deploymentEnabled ? "forgezero-deploy-runner.service" : null,
-    deploymentEnabled ? "forgezero-software-helper.service" : null,
+    "forgezero-software-helper.service",
     lifecycleEnabled ? "forgezero-lifecycle-helper.service" : null,
     warpEnabled ? "warp-svc.service" : null,
     enrolmentEnabled ? "forgezero-agent-enrol.service" : null
@@ -2234,7 +2240,7 @@ function agentUnit(options) {
     "forgezero-agent-update-helper.service",
     options.enforceEgress ? "forgezero-agent-egress.service" : null,
     deploymentEnabled ? "forgezero-deploy-runner.service" : null,
-    deploymentEnabled ? "forgezero-software-helper.service" : null,
+    "forgezero-software-helper.service",
     lifecycleEnabled ? "forgezero-lifecycle-helper.service" : null,
     warpEnabled ? "warp-svc.service" : null,
     enrolmentEnabled ? "forgezero-agent-enrol.service" : null
@@ -2249,9 +2255,9 @@ function agentUnit(options) {
   const snpDevice = options.mode === "attested" ? `DevicePolicy=closed
 DeviceAllow=/dev/sev-guest rw` : "";
   const snpPrepare = options.mode === "attested" ? `ExecStartPre=+/bin/chgrp ${VAULT_GROUP} /dev/sev-guest
-ExecStartPre=+/bin/chmod 0640 /dev/sev-guest
+ExecStartPre=+/bin/chmod 0660 /dev/sev-guest
 ` : "";
-  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives() : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives(options.agentLoopbackPorts ?? []) : "";
   return `[Unit]
 Description=ForgeZero node agent (${options.mode})
 Documentation=https://www.forgezero.net/docs/agent
@@ -2382,6 +2388,7 @@ function planProvision(options) {
   const deployRoot = options.deployRoot ?? "/opt/forgezero";
   const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
   const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
+  const agentLoopbackPorts = normalizeEgressTcpPorts(options.agentLoopbackPorts ?? []);
   const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
   const lifecycleEnabled = Boolean(options.pullMigrations && options.lifecycleProfilePath);
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
@@ -2430,8 +2437,9 @@ function planProvision(options) {
   const enabledUnits = [
     "forgezero-agent.socket",
     "forgezero-agent-update-helper.service",
+    "forgezero-software-helper.service",
     ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
-    ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+    ...deploymentEnabled ? ["forgezero-deploy-runner.service"] : [],
     ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
     ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
     ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : [],
@@ -2439,8 +2447,9 @@ function planProvision(options) {
   ];
   const restartedUnits = [
     "forgezero-agent-update-helper.service",
+    "forgezero-software-helper.service",
     ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
-    ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+    ...deploymentEnabled ? ["forgezero-deploy-runner.service"] : [],
     ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
     ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
     ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : []
@@ -2464,9 +2473,9 @@ function planProvision(options) {
       ...options.enforceEgress ? [
         { path: AGENT_EGRESS_UNIT_PATH, unit: agentEgressUnit(options) }
       ] : [],
+      { path: SOFTWARE_HELPER_UNIT_PATH, unit: softwareHelperUnit(options) },
       ...deploymentEnabled ? [
-        { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) },
-        { path: SOFTWARE_HELPER_UNIT_PATH, unit: softwareHelperUnit(options) }
+        { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) }
       ] : [],
       ...enrolmentEnabled ? [
         { path: ENROLMENT_UNIT_PATH, unit: agentEnrolmentUnit(options) }
@@ -2499,24 +2508,29 @@ function planProvision(options) {
       step("Agent update helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", AGENT_UPDATE_GROUP], acceptedExitCodes: [0, 9] }] }),
       ...sourceBinPath && binPath ? [step("root-owned agent runtime", { kind: "install-runtime", source: sourceBinPath, binary: binPath, version: VERSION })] : [],
       ...warpEnabled ? [step("Cloudflare One client for Ubuntu 26.04", { kind: "install-warp" })] : [],
-      ...deploymentEnabled ? [step("deployment isolation group", { kind: "commands", commands: [
-        { argv: ["/usr/sbin/groupadd", "--system", DEPLOYMENT_GROUP], acceptedExitCodes: [0, 9] },
+      step("software strategy helper group", { kind: "commands", commands: [
         { argv: ["/usr/sbin/groupadd", "--system", SOFTWARE_HELPER_GROUP], acceptedExitCodes: [0, 9] }
+      ] }),
+      ...deploymentEnabled ? [step("deployment isolation group", { kind: "commands", commands: [
+        { argv: ["/usr/sbin/groupadd", "--system", DEPLOYMENT_GROUP], acceptedExitCodes: [0, 9] }
       ] })] : [],
       ...lifecycleEnabled ? [step("lifecycle helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", LIFECYCLE_GROUP], acceptedExitCodes: [0, 9] }] })] : [],
       step("service account", { kind: "commands", commands: [{ argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", user], acceptedExitCodes: [0, 9] }] }),
       step("bind service account to vault group", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-g", VAULT_GROUP, user] }] }),
       step("grant verified Agent update access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", AGENT_UPDATE_GROUP, user] }] }),
+      step("grant software helper socket access", { kind: "commands", commands: [
+        { argv: ["/usr/sbin/usermod", "-a", "-G", SOFTWARE_HELPER_GROUP, user] }
+      ] }),
       ...lifecycleEnabled ? [step("grant lifecycle helper socket access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", LIFECYCLE_GROUP, user] }] })] : [],
       ...deploymentEnabled ? [step("credential-free deployment account", { kind: "commands", commands: [
         { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", DEPLOYMENT_GROUP, DEPLOYMENT_RUNNER_USER], acceptedExitCodes: [0, 9] },
         { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", VAULT_GROUP, APPLICATION_RUNTIME_USER], acceptedExitCodes: [0, 9] },
         { argv: ["/usr/sbin/usermod", "-a", "-G", DEPLOYMENT_GROUP, APPLICATION_RUNTIME_USER] },
-        { argv: ["/usr/sbin/usermod", "-a", "-G", `${DEPLOYMENT_GROUP},${SOFTWARE_HELPER_GROUP}`, user] }
+        { argv: ["/usr/sbin/usermod", "-a", "-G", DEPLOYMENT_GROUP, user] }
       ] })] : [],
       step("credential and state directories", { kind: "directories", directories: [
         { path: credentialDir, mode: 448, owner: "root", group: "root" },
-        { path: "/var/lib/forgezero", mode: 488, owner: "root", group: "root" }
+        { path: "/var/lib/forgezero", mode: 488, owner: "root", group: VAULT_GROUP }
       ] }),
       step("encrypted node identity", { kind: "ensure-seed", credential: seedCredentialPath }),
       ...options.generateGitIdentity && gitCredentialPath && gitPublicKeyPath ? [
@@ -2567,19 +2581,26 @@ function planProvision(options) {
         { argv: ["/usr/bin/systemctl", "enable", ...enabledUnits] },
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
         ...restartedUnits.length ? [{ argv: ["/usr/bin/systemctl", "restart", ...restartedUnits] }] : [],
+        { argv: ["/usr/bin/systemctl", "stop", "forgezero-agent-proxy.service"], acceptedExitCodes: [0, 1, 5] },
         { argv: ["/usr/bin/systemctl", "restart", "forgezero-agent.socket"] },
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
         { argv: ["/usr/bin/systemctl", "restart", "forgezero-agent.service"] }
       ] }),
       ...enrolmentEnabled ? [step("prove the compute binding is durable", { kind: "verify-file", path: enrolStatePath })] : [],
-      ...options.enforceEgress ? [step("prove the Agent egress policy is active", { kind: "verify-egress", runnerPublicTcpPorts, runnerLoopbackPorts })] : [],
+      ...options.enforceEgress ? [step("prove the Agent egress policy is active", {
+        kind: "verify-egress",
+        deploymentEnabled,
+        runnerPublicTcpPorts,
+        runnerLoopbackPorts,
+        agentLoopbackPorts
+      })] : [],
       step("prove it is running", { kind: "commands", commands: [{ argv: ["/usr/bin/systemctl", "is-active", "forgezero-agent.service"] }] }),
       step("prove the public Vault socket exists", { kind: "wait-socket", path: options.socketPath, attempts: 100, intervalMs: 100 }),
       step("prove the Agent Vault backend exists", { kind: "wait-socket", path: agentBackendSocketPath(options.socketPath), attempts: 100, intervalMs: 100 }),
       step("prove the Agent update helper exists", { kind: "wait-socket", path: DEFAULT_AGENT_UPDATE_SOCKET, attempts: 100, intervalMs: 100 }),
+      step("prove the software strategy helper socket exists", { kind: "wait-socket", path: DEFAULT_SOFTWARE_HELPER_SOCKET, attempts: 100, intervalMs: 100 }),
       ...deploymentEnabled ? [
-        step("prove the deployment runner socket exists", { kind: "wait-socket", path: DEPLOYMENT_RUNNER_SOCKET, attempts: 100, intervalMs: 100 }),
-        step("prove the software strategy helper socket exists", { kind: "wait-socket", path: DEFAULT_SOFTWARE_HELPER_SOCKET, attempts: 100, intervalMs: 100 })
+        step("prove the deployment runner socket exists", { kind: "wait-socket", path: DEPLOYMENT_RUNNER_SOCKET, attempts: 100, intervalMs: 100 })
       ] : [],
       ...lifecycleEnabled ? [step("prove the lifecycle helper socket exists", { kind: "wait-socket", path: lifecycleHelperSocketPath, attempts: 100, intervalMs: 100 })] : [],
       ...warpEnabled ? [step("prove Cloudflare WARP is connected", { kind: "verify-warp" })] : [],
@@ -2604,6 +2625,25 @@ import {
   writeFileSync as writeFileSync4
 } from "fs";
 import { dirname as dirname5 } from "path";
+function normalizeEd25519PublicKey(output) {
+  const line = output.trim();
+  if (!/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}(?: [^\r\n]{1,256})?$/.test(line))
+    return;
+  const [algorithm, encoded] = line.split(" ", 3);
+  if (algorithm !== "ssh-ed25519" || !encoded)
+    return;
+  let blob;
+  try {
+    blob = Buffer.from(encoded, "base64");
+  } catch {
+    return;
+  }
+  if (blob.length !== 51 || blob.readUInt32BE(0) !== 11 || blob.subarray(4, 15).toString("ascii") !== "ssh-ed25519" || blob.readUInt32BE(15) !== 32)
+    return;
+  if (blob.toString("base64") !== encoded)
+    return;
+  return `${algorithm} ${encoded}`;
+}
 async function readCapabilities(run2) {
   const answers = {};
   const checks = Object.entries(CAPABILITY_CHECKS);
@@ -2743,7 +2783,7 @@ var runProvisionOperation = async (operation) => {
             return result;
         }
         result = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
-        if (result.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(result.stdout)) {
+        if (result.exitCode !== 0 || !normalizeEd25519PublicKey(result.stdout)) {
           return { stdout: "bootstrap SSH private key is not a valid Ed25519 OpenSSH key", exitCode: 1 };
         }
         result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=bootstrap-ssh-key", key, operation.credential]);
@@ -2759,11 +2799,12 @@ var runProvisionOperation = async (operation) => {
           chmodSync2(key, 384);
         }
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
-        if (derived.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(derived.stdout)) {
+        const publicKey = normalizeEd25519PublicKey(derived.stdout);
+        if (derived.exitCode !== 0 || !publicKey) {
           return { stdout: "bootstrap SSH public key derivation failed", exitCode: 1 };
         }
         mkdirSync4(dirname5(operation.publicKey), { recursive: true, mode: 493 });
-        writeFileSync4(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
+        writeFileSync4(operation.publicKey, `${publicKey} forgezero-bootstrap-runner
 `, { mode: 292 });
         chmodSync2(operation.publicKey, 292);
       }
@@ -2806,8 +2847,9 @@ var runProvisionOperation = async (operation) => {
     const policy = await fixed(["/usr/sbin/nft", "--numeric", "list", "table", "inet", "forgezero_agent_egress"]);
     const required = [
       "forgezero-agent-egress-v1",
-      `public-tcp=${operation.runnerPublicTcpPorts.join(",")}`,
-      ...operation.runnerLoopbackPorts.length ? [`:${operation.runnerLoopbackPorts.join(",")}`] : []
+      ...operation.agentLoopbackPorts.length ? [`shared-loopback=${operation.agentLoopbackPorts.join(",")}`] : [],
+      ...operation.deploymentEnabled && operation.runnerPublicTcpPorts.length ? [`public-tcp=${operation.runnerPublicTcpPorts.join(",")}`] : [],
+      ...operation.deploymentEnabled && operation.runnerLoopbackPorts.length ? [`:${operation.runnerLoopbackPorts.join(",")}`] : []
     ];
     return policy.exitCode === 0 && required.every((part) => policy.stdout.includes(part)) ? { stdout: policy.stdout, exitCode: 0 } : { stdout: policy.stdout, exitCode: 1 };
   }
@@ -2873,7 +2915,9 @@ async function applyPlan(plan, run2) {
     const result = await run2(step2.operation);
     transcript.push({ label: step2.label, command: step2.command, exitCode: result.exitCode });
     if (result.exitCode !== 0 && !step2.optional) {
-      throw new Error(`${step2.label} failed (exit ${result.exitCode}): ${step2.command}`);
+      const safeDetail = step2.operation.kind === "ensure-bootstrap-ssh-identity" ? result.stdout.trim().slice(0, 1000) : "";
+      throw new Error(`${step2.label} failed (exit ${result.exitCode}): ${step2.command}${safeDetail ? `
+${safeDetail}` : ""}`);
     }
   }
   return transcript;
@@ -3371,12 +3415,26 @@ map $limit_conn_status $forgezero_retry_after { default ''; REJECTED 1; REJECTED
 server {
   listen 127.0.0.1:${input.publicPort};
   server_name _;
+  server_tokens off;
+  more_clear_headers Server X-Powered-By;
   limit_conn forgezero_admission ${concurrencyLimit};
   limit_conn_status 503;
   add_header Retry-After $forgezero_retry_after always;
-  location ^~ /api/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
-  location ^~ /v1/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
-  location / { return 404; }
+  error_page 400 403 404 405 408 413 414 429 500 502 503 504 = @transport_failure;
+  location @transport_failure { internal; return 444; }
+  location / {
+    proxy_pass http://forgezero;
+    proxy_http_version 1.1;
+    proxy_intercept_errors off;
+    proxy_hide_header Server;
+    proxy_hide_header X-Powered-By;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $forgezero_connection;
+    proxy_read_timeout 3600s;
+  }
 }
 `
   };
@@ -3988,7 +4046,7 @@ Type=oneshot
 User=arangodb
 Group=arangodb
 LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
-ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default")quit(0);last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));'
+ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;let ok=false;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default"){ok=true;break;}last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}if(!ok)throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));'
 RemainAfterExit=yes
 TimeoutStartSec=200
 NoNewPrivileges=true
@@ -4114,11 +4172,11 @@ async function seal(host, name, destination2, value) {
 async function verifyBootstrapBundleOnHost(host, config, verifyGit = false) {
   const manifestMetadata = host.inspect?.(config.bootstrapBundle.manifestFile);
   const bundleMetadata = host.inspect?.(config.bootstrapBundle.bundleFile);
-  if (manifestMetadata && (!manifestMetadata.regular || manifestMetadata.symbolic || manifestMetadata.uid !== 0 || manifestMetadata.links !== 1 || (manifestMetadata.mode & 63) !== 0 || manifestMetadata.size > 16 * 1024)) {
-    throw new Error("bootstrap bundle manifest must be a root-owned owner-only regular file");
+  if (manifestMetadata && (!manifestMetadata.regular || manifestMetadata.symbolic || manifestMetadata.uid !== 0 || manifestMetadata.links !== 1 || (manifestMetadata.mode & 18) !== 0 || manifestMetadata.size > 16 * 1024)) {
+    throw new Error("bootstrap bundle manifest must be a root-owned non-writable regular file");
   }
-  if (bundleMetadata && (!bundleMetadata.regular || bundleMetadata.symbolic || bundleMetadata.uid !== 0 || bundleMetadata.links !== 1 || (bundleMetadata.mode & 63) !== 0 || bundleMetadata.size < 1 || bundleMetadata.size > 512 * 1024 * 1024)) {
-    throw new Error("bootstrap bundle must be a root-owned owner-only regular file within 512 MiB");
+  if (bundleMetadata && (!bundleMetadata.regular || bundleMetadata.symbolic || bundleMetadata.uid !== 0 || bundleMetadata.links !== 1 || (bundleMetadata.mode & 18) !== 0 || bundleMetadata.size < 1 || bundleMetadata.size > 512 * 1024 * 1024)) {
+    throw new Error("bootstrap bundle must be a root-owned non-writable regular file within 512 MiB");
   }
   if (!host.exists(config.bootstrapBundle.bundleFile) || !host.exists(config.bootstrapBundle.manifestFile)) {
     throw new Error("attended bootstrap bundle and manifest are required for release generation one");
@@ -4137,11 +4195,25 @@ async function verifyBootstrapBundleOnHost(host, config, verifyGit = false) {
   if (digest !== manifest.sha256)
     throw new Error("bootstrap bundle digest does not match its manifest");
   if (verifyGit) {
-    await checked3(host, ["/usr/bin/git", "bundle", "verify", config.bootstrapBundle.bundleFile], "bootstrap Git bundle verification");
+    const verificationRepository = "/run/forgezero-bootstrap-bundle-verify";
+    await checked3(host, ["/usr/bin/rm", "-rf", "--", verificationRepository], "stale bootstrap bundle verifier cleanup");
+    await checked3(host, ["/usr/bin/git", "init", "--bare", "--quiet", verificationRepository], "bootstrap bundle verifier repository");
+    try {
+      await checked3(host, [
+        "/usr/bin/git",
+        "-C",
+        verificationRepository,
+        "bundle",
+        "verify",
+        config.bootstrapBundle.bundleFile
+      ], "bootstrap Git bundle verification");
+    } finally {
+      await checked3(host, ["/usr/bin/rm", "-rf", "--", verificationRepository], "bootstrap bundle verifier cleanup");
+    }
   }
   return manifest;
 }
-function bootstrapIdentity(config) {
+function bootstrapIdentity(config, includeDeploymentEvidence = false) {
   if (config.kind === "enrolled-compute")
     return {
       kind: config.kind,
@@ -4160,7 +4232,13 @@ function bootstrapIdentity(config) {
       bootstrapRunner: config.bootstrapRunner ? { targetTelemetryEndpoint: config.bootstrapRunner.targetTelemetryEndpoint } : null
     };
   const environment = config.runtime.environment;
-  const { cloudflare: _cloudflare, realtime: _realtime, ...stableEnvironment } = environment;
+  const { cloudflare: _cloudflare, realtime: _realtime, initialInventory, ...stableEnvironmentRest } = environment;
+  const stableEnvironment = {
+    ...stableEnvironmentRest,
+    ...initialInventory ? {
+      initialInventory: { ...initialInventory, deployment: includeDeploymentEvidence ? initialInventory.deployment : undefined }
+    } : {}
+  };
   return {
     kind: config.kind,
     environment: config.environment,
@@ -4201,6 +4279,26 @@ function bootstrapIdentity(config) {
 function bootstrapIdentityDigest(config) {
   return createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
 }
+var legacyBootstrapIdentityDigest = (config) => createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config, true))).digest("hex");
+function interruptedPlatformReleaseIdentityDigests(config, releaseEvidence, bootstrapManifest) {
+  if (!config.runtime.environment.initialInventory)
+    return [];
+  const previous = structuredClone(config);
+  previous.runtime.environment.initialInventory.deployment = {
+    source: "bootstrap-bundle",
+    branch: releaseEvidence.branch,
+    revision: releaseEvidence.revision,
+    bundleSha256: releaseEvidence.sha256
+  };
+  const expectedCurrentEpoch = bootstrapManifest ? `${config.environment}-${bootstrapManifest.revision.slice(0, 16)}` : undefined;
+  if (expectedCurrentEpoch && config.runtime.environment.seedSyncEpoch === expectedCurrentEpoch) {
+    previous.runtime.environment.seedSyncEpoch = `${config.environment}-${releaseEvidence.revision.slice(0, 16)}`;
+  }
+  return [bootstrapIdentityDigest(previous), legacyBootstrapIdentityDigest(previous)];
+}
+function storedPlatformCoordinatesMatch(state, config) {
+  return state.kind === "platform" && state.profile === config.profile && state.nodeHostname === config.nodeHostname && state.apiUrl === config.apiUrl && state.environment === config.environment && state.databaseRole === config.database.role && state.databaseAgency === config.database.agency && state.databaseReadPreferred === config.database.readPreferred && state.databaseServerMode === config.database.serverMode && (state.databaseAddress ?? null) === (config.database.address ?? null) && JSON.stringify(state.databaseCoordinators ?? []) === JSON.stringify(config.database.coordinators) && state.collectorUnit === config.runtime.environment.otlpCollectorUnit && state.publicApiPort === config.runtime.environment.publicApiPort && state.healthPath === config.runtime.healthPath;
+}
 function parseStoredState(raw) {
   let value;
   try {
@@ -4231,11 +4329,21 @@ function parseStoredIntent(raw) {
   }
   return intent;
 }
-function bindBootstrapIntent(host, config) {
+function bindBootstrapIntent(host, config, previousReleaseDigests = []) {
   const identityDigest = bootstrapIdentityDigest(config);
   if (host.exists(INTENT_PATH)) {
     const intent = parseStoredIntent(host.read(INTENT_PATH));
     if (intent.kind !== config.kind || intent.identityDigest !== identityDigest) {
+      if (previousReleaseDigests.includes(intent.identityDigest) && intent.kind === "platform" && config.kind === "platform") {
+        host.write(INTENT_PATH, `${JSON.stringify({
+          format: 1,
+          kind: config.kind,
+          identityDigest,
+          createdAt: new Date().toISOString()
+        }, null, 2)}
+`, 384);
+        return identityDigest;
+      }
       throw new Error("bootstrap resume coordinates do not match the interrupted host intent");
     }
   } else if (!host.exists(STATE_PATH)) {
@@ -4310,7 +4418,7 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     if (result.exitCode !== 0)
       problems.push(`${unit} is not active`);
   }
-  for (const socket of [DEFAULT_SOCKET2, CONTROL_SOCKET]) {
+  for (const socket of [DEFAULT_SOCKET2]) {
     services[socket] = host.exists(socket);
     if (!services[socket])
       problems.push(`${socket} is missing`);
@@ -4403,7 +4511,42 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   let installed;
   if (host.exists(STATE_PATH))
     installed = parseStoredState(host.read(STATE_PATH));
-  const bootstrapManifest = config.kind === "platform" && !host.exists(BOOTSTRAP_RELEASE_EVIDENCE) ? await verifyBootstrapBundleOnHost(host, config) : undefined;
+  let bootstrapManifest;
+  let releaseEvidence;
+  if (config.kind === "platform") {
+    const staged = host.exists(config.bootstrapBundle.bundleFile) || host.exists(config.bootstrapBundle.manifestFile);
+    if (staged && !(host.exists(config.bootstrapBundle.bundleFile) && host.exists(config.bootstrapBundle.manifestFile))) {
+      throw new Error("bootstrap bundle and manifest must be staged together");
+    }
+    const reviewed = staged ? await verifyBootstrapBundleOnHost(host, config) : undefined;
+    if (!host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
+      if (!reviewed)
+        throw new Error("attended bootstrap bundle and manifest are required for release generation one");
+      bootstrapManifest = reviewed;
+    } else if (reviewed) {
+      let evidence;
+      try {
+        evidence = JSON.parse(host.read(BOOTSTRAP_RELEASE_EVIDENCE));
+      } catch {
+        throw new Error("bootstrap release evidence is malformed");
+      }
+      if (typeof evidence.revision !== "string" || !/^[a-f0-9]{40}$/.test(evidence.revision) || typeof evidence.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(evidence.sha256) || typeof evidence.branch !== "string")
+        throw new Error("bootstrap release evidence is malformed");
+      releaseEvidence = { revision: evidence.revision, sha256: evidence.sha256, branch: evidence.branch };
+      if (evidence.revision !== reviewed.revision || evidence.sha256 !== reviewed.sha256 || evidence.branch !== reviewed.branch)
+        bootstrapManifest = reviewed;
+    } else if (host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
+      let evidence;
+      try {
+        evidence = JSON.parse(host.read(BOOTSTRAP_RELEASE_EVIDENCE));
+      } catch {
+        throw new Error("bootstrap release evidence is malformed");
+      }
+      if (typeof evidence.revision !== "string" || !/^[a-f0-9]{40}$/.test(evidence.revision) || typeof evidence.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(evidence.sha256) || typeof evidence.branch !== "string")
+        throw new Error("bootstrap release evidence is malformed");
+      releaseEvidence = { revision: evidence.revision, sha256: evidence.sha256, branch: evidence.branch };
+    }
+  }
   let cloudflare;
   if (config.cloudflareHandoff) {
     if (host.exists(config.cloudflareHandoff.handoffFile)) {
@@ -4453,10 +4596,14 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       throw new Error("platform realtime coordinates require a realtime-enabled Cloudflare handoff");
     }
   }
+  let allowInterruptedReleaseRebind = false;
   if (installed) {
-    if (installed.kind !== config.kind || installed.identityDigest !== bootstrapIdentityDigest(config)) {
+    const exactIdentity = installed.kind === config.kind && installed.identityDigest === bootstrapIdentityDigest(config);
+    const boundedReleaseResume = config.kind === "platform" && !host.exists("/var/lib/forgezero/enrolment.json") && host.exists(BOOTSTRAP_RELEASE_EVIDENCE) && storedPlatformCoordinatesMatch(installed, config);
+    if (!exactIdentity && !boundedReleaseResume) {
       throw new Error("bootstrap repair coordinates do not match the installed host identity");
     }
+    allowInterruptedReleaseRebind = !exactIdentity && boundedReleaseResume;
   }
   const platformPrivate = config.kind === "platform" ? (() => {
     if (!secrets)
@@ -4476,10 +4623,14 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (config.kind === "enrolled-compute" && config.bootstrapRunner?.sshPrivateKeyFile && !host.exists(BOOTSTRAP_SSH_CREDENTIAL)) {
     privateFile(host, config.bootstrapRunner.sshPrivateKeyFile, "bootstrap runner SSH private key");
   }
-  bindBootstrapIntent(host, config);
+  let previousReleaseDigests = [];
+  if (!installed && config.kind === "platform" && releaseEvidence && !host.exists("/var/lib/forgezero/enrolment.json")) {
+    previousReleaseDigests = [...interruptedPlatformReleaseIdentityDigests(config, releaseEvidence, bootstrapManifest)];
+  }
+  bindBootstrapIntent(host, config, allowInterruptedReleaseRebind && installed?.identityDigest ? [installed.identityDigest] : previousReleaseDigests);
   const plan = planBootstrap(config, host.exists(STATE_PATH));
   await checked3(host, ["hostnamectl", "set-hostname", "--static", config.nodeHostname], "compute hostname");
-  const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
+  let alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
   host.mkdir(CREDS, 448);
   host.mkdir("/var/lib/forgezero", 448);
   if (!alreadyEnrolled && !host.exists(ENROL_CREDENTIAL)) {
@@ -4508,14 +4659,29 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (connectorCapabilities?.meshConnectorToken && !host.exists(WARP_CONNECTOR_CREDENTIAL)) {
     await seal(host, "CF_WARP_CONNECTOR_TOKEN", WARP_CONNECTOR_CREDENTIAL, connectorCapabilities.meshConnectorToken);
   }
+  let installedAgentPlan;
   if (alreadyEnrolled) {
-    await host.installAgent(config, "bound");
+    installedAgentPlan = await host.installAgent(config, bootstrapManifest ? "bootstrap" : "bound");
   } else if (config.kind === "platform") {
     if (bootstrapManifest)
-      await host.installAgent(config, "bootstrap");
+      installedAgentPlan = await host.installAgent(config, "bootstrap");
+    else if (host.exists(BOOTSTRAP_RELEASE_EVIDENCE)) {
+      await checked3(host, [
+        "curl",
+        "--fail",
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "10",
+        `http://127.0.0.1:${config.runtime.environment.publicApiPort}${config.runtime.healthPath}`
+      ], "persisted release-one API health");
+      await host.installAgent(config, "enrol");
+      installedAgentPlan = await host.installAgent(config, "bound");
+      alreadyEnrolled = true;
+    }
   } else {
     await host.installAgent(config, "enrol");
-    await host.installAgent(config, "bound");
+    installedAgentPlan = await host.installAgent(config, "bound");
   }
   if (config.kind === "platform" && config.firewall.enabled) {
     await host.ensureSoftware(plan.software.filter(({ id }) => id === "ufw"));
@@ -4595,6 +4761,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await checked3(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
       await checked3(host, ["id", runtime.serviceUser], "existing API service account");
     });
+    await checked3(host, ["usermod", "-a", "-G", DEPLOYMENT_GROUP, runtime.serviceUser], "API deployment group");
     host.mkdir(runtime.environment.sharedDirectory, 488);
     host.mkdir(runtime.slotsDirectory, 493);
     host.write(envPath, renderPlatformSharedEnvironment(runtime.environment), 416);
@@ -4613,7 +4780,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     host.write("/etc/sudoers.d/forgezero-runner", activation.sudoers, 288);
     await checked3(host, ["visudo", "-cf", "/etc/sudoers.d/forgezero-runner"], "activation sudo policy");
     const telemetry = planLocalOtlpProof(runtime.environment.otlpEndpoint, runtime.environment.otlpCollectorUnit);
-    await checked3(host, telemetry.unitCheck.argv, "OTLP collector supervision");
+    await checked3(host, [telemetry.unitCheck.command, ...telemetry.unitCheck.argv], "OTLP collector supervision");
     const otlpStatus = (await checked3(host, [telemetry.receiverCheck.command, ...telemetry.receiverCheck.argv], "OTLP receiver")).trim();
     if (!/^2\d\d$/.test(otlpStatus))
       throw new Error(`OTLP receiver returned HTTP ${otlpStatus || "unknown"}`);
@@ -4646,10 +4813,12 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
 `, 384);
     }
     if (bootstrapManifest) {
+      if (!installedAgentPlan?.user)
+        throw new Error("initial Agent deployment requires the converged Agent user");
       await checked3(host, [
         "runuser",
         "-u",
-        "forgezero-agent",
+        installedAgentPlan.user,
         "--",
         "/usr/local/bin/fz-agent",
         "deploy",
@@ -4667,6 +4836,8 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
 `, 384);
       host.remove(config.bootstrapBundle.bundleFile);
       host.remove(config.bootstrapBundle.manifestFile);
+      if (alreadyEnrolled)
+        installedAgentPlan = await host.installAgent(config, "bound");
     }
     if (!alreadyEnrolled) {
       await checked3(host, [
@@ -4676,7 +4847,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
         "--show-error",
         "--max-time",
         "10",
-        `http://127.0.0.1:3000${runtime.healthPath}`
+        `http://127.0.0.1:${runtime.environment.publicApiPort}${runtime.healthPath}`
       ], "release-one API health");
       await host.installAgent(config, "enrol");
       await host.installAgent(config, "bound");
@@ -4878,8 +5049,8 @@ function readBootstrapConfig(path) {
 function planBootstrapAgentInstall(config, phase, context) {
   const { capabilities, hasBinding, hasEnrolCredential, initialBundle } = context;
   if (phase === "bootstrap") {
-    if (config.kind !== "platform" || hasBinding || !initialBundle) {
-      throw new Error("release-one Agent install requires an unbound platform host and verified bootstrap bundle");
+    if (config.kind !== "platform" || !initialBundle) {
+      throw new Error("platform bundle Agent install requires a verified bootstrap bundle");
     }
   } else if (phase === "enrol") {
     if (hasBinding || !hasEnrolCredential) {
@@ -4917,8 +5088,10 @@ function planBootstrapAgentInstall(config, phase, context) {
     bootstrapTargetTelemetryEndpoint: bound && bootstrapRunner ? platformBootstrapRunner(config) ? config.telemetryEndpoint : config.kind === "enrolled-compute" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined : undefined,
     lifecycleProfilePath: bound && config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
     enforceEgress: true,
+    runnerLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort, config.runtime.bluePort, config.runtime.greenPort] : [],
+    agentLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort] : [],
     nodeHostname: config.nodeHostname,
-    telemetryEndpoint: config.telemetryEndpoint,
+    telemetryEndpoint: config.kind === "platform" ? config.runtime.environment.otlpEndpoint : "http://127.0.0.1:4318",
     binPath: "/usr/local/lib/forgezero/agent/fz-agent",
     sourceBinPath: PACKAGED_AGENT_BIN,
     ...enrolling ? {
@@ -4926,7 +5099,7 @@ function planBootstrapAgentInstall(config, phase, context) {
       enrolStatePath: "/var/lib/forgezero/enrolment.json"
     } : bound ? { enrolStatePath: "/var/lib/forgezero/enrolment.json" } : {},
     ...authenticated ? {
-      apiUrl: config.apiUrl,
+      apiUrl: config.kind === "platform" ? `http://127.0.0.1:${config.runtime.environment.publicApiPort}` : config.apiUrl,
       project: config.kind === "enrolled-compute" ? config.realm : "platform",
       environment: config.kind === "enrolled-compute" ? undefined : config.environment,
       nodeLabel: config.kind === "enrolled-compute" ? config.nodeHostname : config.computeReference
@@ -4935,6 +5108,7 @@ function planBootstrapAgentInstall(config, phase, context) {
   return planInstall(options);
 }
 function localBootstrapHost() {
+  let softwareClientUser;
   const execute = async (argv, options = {}) => {
     const child = Bun.spawn([...argv], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
     if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
@@ -4967,10 +5141,12 @@ function localBootstrapHost() {
     exec: execute,
     sleep: (milliseconds) => Bun.sleep(milliseconds),
     async ensureSoftware(requirements) {
+      if (!softwareClientUser)
+        throw new Error("Agent must be converged before software requirements are applied");
       const result = await execute([
         "runuser",
         "-u",
-        "forgezero-agent",
+        softwareClientUser,
         "--",
         "/usr/local/bin/fz-agent",
         "software-ensure",
@@ -4984,7 +5160,7 @@ function localBootstrapHost() {
       const capabilities = await readCapabilities(localRunner);
       const hasBinding = existsSync5("/var/lib/forgezero/enrolment.json");
       const hasEnrolCredential = existsSync5(ENROL_CREDENTIAL);
-      const initialBundle = config.kind === "platform" && !existsSync5(BOOTSTRAP_RELEASE_EVIDENCE) ? {
+      const initialBundle = config.kind === "platform" && phase === "bootstrap" && existsSync5(config.bootstrapBundle.bundleFile) && existsSync5(config.bootstrapBundle.manifestFile) ? {
         path: config.bootstrapBundle.bundleFile,
         manifestPath: config.bootstrapBundle.manifestFile,
         manifest: parseBootstrapBundleManifest(JSON.parse(readFileSync5(config.bootstrapBundle.manifestFile, "utf8")))
@@ -5015,6 +5191,7 @@ function localBootstrapHost() {
         writeFileSync5(unit.path, unit.unit, { mode: 420 });
       }
       await applyPlan(plan, localRunner);
+      softwareClientUser = plan.user;
       return plan;
     }
   };
@@ -5987,11 +6164,26 @@ async function metalBootstrapStatus(exec = defaultExec2) {
 
 // src/operator-bootstrap.ts
 import { createHash as createHash4, randomBytes as randomBytes5 } from "crypto";
-import { chmodSync as chmodSync5, lstatSync as lstatSync5, mkdirSync as mkdirSync8, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
+import { chmodSync as chmodSync5, existsSync as existsSync7, lstatSync as lstatSync5, mkdirSync as mkdirSync8, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
 import { isIP as isIP6 } from "net";
 import { tmpdir } from "os";
 import { basename, dirname as dirname9, isAbsolute as isAbsolute4, join as join6, resolve as resolve6 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
+function operatorPackagedBinary(name) {
+  const candidates = [
+    fileURLToPath2(new URL(`./${name}`, import.meta.url)),
+    fileURLToPath2(new URL(`../dist/${name}`, import.meta.url))
+  ];
+  const found = candidates.find(existsSync7);
+  if (!found)
+    throw new Error(`packaged ${name} is missing; checked ${candidates.join(" and ")}`);
+  return found;
+}
+var operatorPackagedFzCliPath = () => operatorPackagedBinary("fz.js");
+var operatorPackagedAgentPath = () => operatorPackagedBinary("fz-agent.js");
+var operatorPackagedGitSshPath = () => operatorPackagedBinary("fz-git-ssh.js");
+var PLATFORM_CLUSTER_CREDENTIAL_NAME = "forgezero-platform-cluster-bootstrap-code";
+var PLATFORM_CLUSTER_CREDENTIAL_PATH = `/etc/forgezero/creds/${PLATFORM_CLUSTER_CREDENTIAL_NAME}.cred`;
 var REQUEST_LIMIT = 64 * 1024;
 var SECRET_LIMIT = 256 * 1024;
 var REMOTE_STAGE = "/run/forgezero-operator-bootstrap";
@@ -6434,9 +6626,11 @@ function operatorPlatformFleetCoordinates(fleet) {
 function planOperatorPlatformFleetBootstrap(fleet, mode) {
   const { requests, configs, environment } = validatedPlatformFleet(fleet);
   const secretInputs = mode === "apply" ? attendedSecretNames(configs[0]) : [];
-  for (const config of configs.slice(1)) {
-    if (JSON.stringify(attendedSecretNames(config)) !== JSON.stringify(secretInputs)) {
-      throw new Error("operator fleet configs do not share one attended secret schema");
+  if (mode === "apply") {
+    for (const config of configs.slice(1)) {
+      if (JSON.stringify(attendedSecretNames(config)) !== JSON.stringify(secretInputs)) {
+        throw new Error("operator fleet configs do not share one attended secret schema");
+      }
     }
   }
   return {
@@ -6474,9 +6668,33 @@ var defaultExec3 = async (argv, options = {}) => {
   ]);
   return {
     exitCode,
-    output: options.secret ? options.safeStdout && exitCode === 0 ? stdout.slice(0, 65536) : "" : `${stdout}${stderr}`.slice(0, 65536)
+    output: options.secret ? exitCode === 0 ? options.safeStdout ? stdout.slice(0, 65536) : "" : redactOperatorSecretDiagnostic(stderr, options.stdin) : `${stdout}${stderr}`.slice(0, 65536)
   };
 };
+function redactOperatorSecretDiagnostic(stderr, stdin) {
+  if (!stdin)
+    return "";
+  let parsed;
+  try {
+    parsed = JSON.parse(stdin);
+  } catch {
+    return "";
+  }
+  const values = [];
+  const visit = (value) => {
+    if (typeof value === "string" && value)
+      values.push(value);
+    else if (Array.isArray(value))
+      value.forEach(visit);
+    else if (value && typeof value === "object")
+      Object.values(value).forEach(visit);
+  };
+  visit(parsed);
+  let safe = stderr.slice(0, 16384);
+  for (const value of values.sort((left, right) => right.length - left.length))
+    safe = safe.replaceAll(value, "[REDACTED]");
+  return safe.slice(0, 8192);
+}
 var checked5 = async (exec, argv, label, options) => {
   const result = await exec(argv, options);
   if (result.exitCode !== 0)
@@ -6519,7 +6737,7 @@ var sshOptions = (request, knownHosts, scp = false) => [
   "-o",
   "ClearAllForwardings=yes",
   "-o",
-  "ConnectTimeout=10",
+  "ConnectTimeout=30",
   "-o",
   request.target.jump ? `ProxyJump=${destination2(request.target.jump)}:${request.target.jump.port}` : "ProxyJump=none",
   scp ? "-P" : "-p",
@@ -6554,6 +6772,93 @@ var remoteRegularFileExists = async (exec, request, knownHosts, path) => {
     return false;
   throw new Error(`remote initialized-state probe failed${result.output ? `: ${result.output.trim()}` : ""}`);
 };
+async function operatorMetalClusterBootstrapCode(requestInput, options = {}) {
+  const request = validateMetalRequestValue(requestInput, { validateMetalConfig: false });
+  publicIdentity(request.target.identityPublicKeyFile);
+  socketPath(request.target.agentSocket);
+  const exec = options.exec ?? defaultExec3;
+  const directory = mkdtempSync(join6(tmpdir(), "forgezero-operator-metal-credential-"));
+  try {
+    const knownHosts = writeKnownHosts(request, directory);
+    const probe = await exec([
+      "ssh",
+      ...sshOptions(request, knownHosts),
+      destination2(request.target),
+      "--",
+      "/usr/bin/sudo",
+      "-n",
+      "/usr/bin/test",
+      "-f",
+      PLATFORM_CLUSTER_CREDENTIAL_PATH
+    ]);
+    if (probe.exitCode !== 0 && probe.exitCode !== 1) {
+      throw new Error("Metal cluster credential probe failed");
+    }
+    if (probe.exitCode === 1) {
+      const value2 = randomBytes5(32).toString("hex");
+      await remote(exec, request, knownHosts, [
+        "/usr/bin/sudo",
+        "-n",
+        "/usr/bin/install",
+        "-d",
+        "-o",
+        "root",
+        "-g",
+        "root",
+        "-m",
+        "0700",
+        dirname9(PLATFORM_CLUSTER_CREDENTIAL_PATH)
+      ], "Metal credential directory");
+      await remote(exec, request, knownHosts, [
+        "/usr/bin/sudo",
+        "-n",
+        "/usr/bin/systemd-creds",
+        "encrypt",
+        `--name=${PLATFORM_CLUSTER_CREDENTIAL_NAME}`,
+        "-",
+        PLATFORM_CLUSTER_CREDENTIAL_PATH
+      ], "seal Metal cluster credential", true, `${value2}
+`);
+      await remote(exec, request, knownHosts, [
+        "/usr/bin/sudo",
+        "-n",
+        "/usr/bin/chown",
+        "root:root",
+        PLATFORM_CLUSTER_CREDENTIAL_PATH
+      ], "own Metal cluster credential");
+      await remote(exec, request, knownHosts, [
+        "/usr/bin/sudo",
+        "-n",
+        "/usr/bin/chmod",
+        "0600",
+        PLATFORM_CLUSTER_CREDENTIAL_PATH
+      ], "protect Metal cluster credential");
+    }
+    const metadata = await remote(exec, request, knownHosts, [
+      "/usr/bin/sudo",
+      "-n",
+      "/usr/bin/stat",
+      "--format=%u:%g:%a:%h",
+      PLATFORM_CLUSTER_CREDENTIAL_PATH
+    ], "verify Metal cluster credential");
+    if (metadata !== "0:0:600:1")
+      throw new Error("Metal cluster credential is not one root-owned 0600 file");
+    const value = await remote(exec, request, knownHosts, [
+      "/usr/bin/sudo",
+      "-n",
+      "/usr/bin/systemd-creds",
+      "decrypt",
+      `--name=${PLATFORM_CLUSTER_CREDENTIAL_NAME}`,
+      PLATFORM_CLUSTER_CREDENTIAL_PATH,
+      "-"
+    ], "open Metal cluster credential", true, undefined, true);
+    if (!/^[a-f0-9]{64}$/i.test(value))
+      throw new Error("Metal cluster credential is invalid");
+    return value;
+  } finally {
+    rmSync6(directory, { recursive: true, force: true });
+  }
+}
 var copy = async (exec, request, knownHosts, local, remotePath, secret = false) => {
   safeRemoteArg(remotePath);
   await checked5(exec, [
@@ -6733,9 +7038,9 @@ async function verifiedBunArchive(directory, fetcher) {
 }
 async function installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options) {
   const artifacts = [
-    [options.fzCliPath ?? fileURLToPath2(new URL("./fz.js", import.meta.url)), "fz.js"],
-    [options.fzAgentPath ?? fileURLToPath2(new URL("./fz-agent.js", import.meta.url)), "fz-agent.js"],
-    [options.fzGitSshPath ?? fileURLToPath2(new URL("./fz-git-ssh.js", import.meta.url)), "fz-git-ssh.js"]
+    [options.fzCliPath ?? operatorPackagedFzCliPath(), "fz.js"],
+    [options.fzAgentPath ?? operatorPackagedAgentPath(), "fz-agent.js"],
+    [options.fzGitSshPath ?? operatorPackagedGitSshPath(), "fz-git-ssh.js"]
   ];
   for (const [artifact] of artifacts) {
     if (!readFileSync7(artifact).length)
@@ -6772,6 +7077,7 @@ async function installPackagedAgent(request, knownHosts, exec, directory, remote
   for (const [, name] of artifacts)
     await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0755", `${remoteTemp}/${name}`, `/usr/local/lib/forgezero/agent/${name}`], "remote Agent install");
   await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/agent/fz.js", "/usr/local/bin/fz"], "remote fz link");
+  await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/agent/fz-agent", "/usr/local/bin/fz-agent"], "remote fz-agent link");
 }
 async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
   const plan = planOperatorPlatformBootstrap(request, mode);
@@ -6798,8 +7104,10 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
       await copy(exec, request, knownHosts, join6(directory, name), `${remoteTemp}/${name}`, true);
     for (const bundle of staged.bundleFiles)
       await copy(exec, request, knownHosts, bundle.source, `${remoteTemp}/${bundle.name}`, true);
-    for (const name of ["platform-config.json", ...staged.files, ...staged.bundleFiles.map(({ name: name2 }) => name2)])
+    for (const name of ["platform-config.json", ...staged.files])
       await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0600", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote bootstrap handoff", true);
+    for (const { name } of staged.bundleFiles)
+      await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0644", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote bootstrap bundle", true);
     const command = ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "platform", "credentials-stdin"];
     command.push("--bootstrap-config", `${REMOTE_STAGE}/platform-config.json`, "--apply");
     const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap", mode === "apply", secrets ? `${JSON.stringify(secrets)}
@@ -6939,6 +7247,7 @@ export {
   writeOperatorGuestHostKeyEvidence,
   withOperatorGuestTransport,
   verifyOperatorPlatformFleet,
+  redactOperatorSecretDiagnostic,
   readOperatorPlatformBootstrapRequest,
   readOperatorPlatformBootstrapFleetRequest,
   readOperatorMetalBootstrapRequest,
@@ -6947,6 +7256,10 @@ export {
   planOperatorPlatformBootstrap,
   planOperatorMetalBootstrap,
   operatorPlatformFleetCoordinates,
+  operatorPackagedGitSshPath,
+  operatorPackagedFzCliPath,
+  operatorPackagedAgentPath,
+  operatorMetalClusterBootstrapCode,
   createOperatorSshHop,
   collectOperatorGuestHostKeys,
   applyOperatorPlatformFleetBootstrap,