@forgezero/agent 0.1.89 → 0.1.90

package/dist/agent-heartbeat.d.ts

@@ -37,6 +37,7 @@ export interface AgentHeartbeatResponse {
     ok: true;
     nodeKey: string;
     intervalSeconds: number;
+    workClaimsEnabled?: boolean;
     desiredAgentRelease?: AgentRelease;
     desiredAgentUpdate?: {
         attemptId: string;
@@ -70,6 +71,8 @@ export interface AgentHeartbeatOptions {
     deploymentIntakeObservation?: () => AgentObservation['deploymentIntake'];
     /** Apply the authenticated desired state before any new deployment claim is allowed. */
     applyDeploymentIntake?: (directive: NonNullable<AgentHeartbeatResponse['deploymentIntake']>) => Promise<void> | void;
+    /** Server lifecycle gate for deployment, migration and delegated bootstrap claims. */
+    applyWorkClaims?: (enabled: boolean) => Promise<void> | void;
     receiptPath?: string;
     now?: () => number;
     /** Stop new lifecycle/deploy claims and await current jobs after candidate readiness. */

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.89";
+var VERSION3 = "0.1.90";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {
@@ -991,6 +991,7 @@ async function heartbeatAgentOnce(options) {
       throw new Error("agent heartbeat deployment-intake directive is invalid");
     await options.applyDeploymentIntake?.(response.deploymentIntake);
   }
+  await options.applyWorkClaims?.(response.workClaimsEnabled === true);
   const desired = response.desiredAgentUpdate ?? (response.desiredAgentRelease ? {
     attemptId: `legacy:${response.desiredAgentRelease.version}`,
     leaseExpiresAtTs: Number.MAX_SAFE_INTEGER,

package/dist/bootstrap.js

@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.89";
+var VERSION = "0.1.90";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -2094,7 +2094,7 @@ function agentUnit(options) {
   if (!validNodeHostname(options.nodeHostname))
     throw new Error("node hostname is invalid");
   if (!options.telemetryEndpoint) {
-    throw new Error("compute Agent provisioning requires OTEL_EXPORTER_OTLP_ENDPOINT as an explicit public HTTPS collector coordinate");
+    throw new Error("compute Agent provisioning requires an explicit supervised OTLP collector coordinate");
   }
   let telemetryEndpoint;
   {
@@ -2102,10 +2102,13 @@ function agentUnit(options) {
     try {
       endpoint2 = new URL(options.telemetryEndpoint);
     } catch {
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL");
+      throw new Error("compute telemetry endpoint must be an absolute collector URL");
+    }
+    const localCollector = endpoint2.protocol === "http:" && endpoint2.hostname === "127.0.0.1" && endpoint2.port === "4318" && endpoint2.pathname === "/";
+    const publicCollector = endpoint2.protocol === "https:" && !endpoint2.username && !endpoint2.password && !endpoint2.search && !endpoint2.hash && isIP3(endpoint2.hostname) === 0 && endpoint2.hostname.includes(".") && endpoint2.hostname !== "localhost" && !endpoint2.hostname.endsWith(".local");
+    if (!localCollector && !publicCollector || endpoint2.username || endpoint2.password || endpoint2.search || endpoint2.hash) {
+      throw new Error("compute telemetry endpoint must be the supervised loopback collector or credential-free public HTTPS");
     }
-    if (endpoint2.protocol !== "https:" || endpoint2.username || endpoint2.password || endpoint2.search || endpoint2.hash || isIP3(endpoint2.hostname) !== 0 || !endpoint2.hostname.includes(".") || endpoint2.hostname === "localhost" || endpoint2.hostname.endsWith(".local"))
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL without credentials, query or fragment");
     telemetryEndpoint = endpoint2.toString().replace(/\/$/, "");
   }
   const bin = options.binPath ?? "fz-agent";
@@ -4415,7 +4418,7 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     if (result.exitCode !== 0)
       problems.push(`${unit} is not active`);
   }
-  for (const socket of [DEFAULT_SOCKET2, CONTROL_SOCKET]) {
+  for (const socket of [DEFAULT_SOCKET2]) {
     services[socket] = host.exists(socket);
     if (!services[socket])
       problems.push(`${socket} is missing`);
@@ -4658,7 +4661,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   }
   let installedAgentPlan;
   if (alreadyEnrolled) {
-    installedAgentPlan = await host.installAgent(config, "bound");
+    installedAgentPlan = await host.installAgent(config, bootstrapManifest ? "bootstrap" : "bound");
   } else if (config.kind === "platform") {
     if (bootstrapManifest)
       installedAgentPlan = await host.installAgent(config, "bootstrap");
@@ -4833,6 +4836,8 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
 `, 384);
       host.remove(config.bootstrapBundle.bundleFile);
       host.remove(config.bootstrapBundle.manifestFile);
+      if (alreadyEnrolled)
+        installedAgentPlan = await host.installAgent(config, "bound");
     }
     if (!alreadyEnrolled) {
       await checked3(host, [
@@ -5044,8 +5049,8 @@ function readBootstrapConfig(path) {
 function planBootstrapAgentInstall(config, phase, context) {
   const { capabilities, hasBinding, hasEnrolCredential, initialBundle } = context;
   if (phase === "bootstrap") {
-    if (config.kind !== "platform" || hasBinding || !initialBundle) {
-      throw new Error("release-one Agent install requires an unbound platform host and verified bootstrap bundle");
+    if (config.kind !== "platform" || !initialBundle) {
+      throw new Error("platform bundle Agent install requires a verified bootstrap bundle");
     }
   } else if (phase === "enrol") {
     if (hasBinding || !hasEnrolCredential) {
@@ -5086,7 +5091,7 @@ function planBootstrapAgentInstall(config, phase, context) {
     runnerLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort, config.runtime.bluePort, config.runtime.greenPort] : [],
     agentLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort] : [],
     nodeHostname: config.nodeHostname,
-    telemetryEndpoint: config.telemetryEndpoint,
+    telemetryEndpoint: config.kind === "platform" ? config.runtime.environment.otlpEndpoint : "http://127.0.0.1:4318",
     binPath: "/usr/local/lib/forgezero/agent/fz-agent",
     sourceBinPath: PACKAGED_AGENT_BIN,
     ...enrolling ? {

package/dist/fz-agent.js

@@ -9459,6 +9459,10 @@ function startMigrationPull(options) {
   const tick = () => {
     if (stopped || active)
       return;
+    if (options.canClaim && !options.canClaim()) {
+      timer = setTimer(tick, interval);
+      return;
+    }
     active = pullMigrationOnce(options).then((result) => options.onEvent?.(result.status, result)).catch((cause) => options.onEvent?.("poll-failed", cause)).finally(() => {
       active = null;
       if (!stopped)
@@ -9492,7 +9496,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.89";
+var VERSION2 = "0.1.90";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -9905,6 +9909,10 @@ function startSshBootstrapPull(options) {
   const tick = () => {
     if (stopped || active)
       return;
+    if (options.canClaim && !options.canClaim()) {
+      timer = setTimer(tick, interval);
+      return;
+    }
     active = pullSshBootstrapOnce(options).then((result) => options.onEvent?.(result.status, result.status === "idle" ? undefined : {
       computeKey: result.computeKey,
       attempt: result.attempt,
@@ -10176,6 +10184,10 @@ function startMetalAdmissionPull(options) {
   const tick = () => {
     if (stopped || active)
       return;
+    if (options.canClaim && !options.canClaim()) {
+      timer = setTimer(tick, interval);
+      return;
+    }
     active = pullMetalAdmissionOnce(options).then((result) => options.onEvent?.(`metal-admission-${result.status}`, result.status === "idle" ? undefined : result)).catch((cause) => options.onEvent?.("metal-admission-poll-failed", cause)).finally(() => {
       active = null;
       if (!stopped)
@@ -12732,6 +12744,7 @@ async function heartbeatAgentOnce(options) {
       throw new Error("agent heartbeat deployment-intake directive is invalid");
     await options.applyDeploymentIntake?.(response.deploymentIntake);
   }
+  await options.applyWorkClaims?.(response.workClaimsEnabled === true);
   const desired = response.desiredAgentUpdate ?? (response.desiredAgentRelease ? {
     attemptId: `legacy:${response.desiredAgentRelease.version}`,
     leaseExpiresAtTs: Number.MAX_SAFE_INTEGER,
@@ -15628,7 +15641,7 @@ function agentUnit(options) {
   if (!validNodeHostname(options.nodeHostname))
     throw new Error("node hostname is invalid");
   if (!options.telemetryEndpoint) {
-    throw new Error("compute Agent provisioning requires OTEL_EXPORTER_OTLP_ENDPOINT as an explicit public HTTPS collector coordinate");
+    throw new Error("compute Agent provisioning requires an explicit supervised OTLP collector coordinate");
   }
   let telemetryEndpoint;
   {
@@ -15636,10 +15649,13 @@ function agentUnit(options) {
     try {
       endpoint = new URL(options.telemetryEndpoint);
     } catch {
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL");
+      throw new Error("compute telemetry endpoint must be an absolute collector URL");
+    }
+    const localCollector = endpoint.protocol === "http:" && endpoint.hostname === "127.0.0.1" && endpoint.port === "4318" && endpoint.pathname === "/";
+    const publicCollector = endpoint.protocol === "https:" && !endpoint.username && !endpoint.password && !endpoint.search && !endpoint.hash && isIP4(endpoint.hostname) === 0 && endpoint.hostname.includes(".") && endpoint.hostname !== "localhost" && !endpoint.hostname.endsWith(".local");
+    if (!localCollector && !publicCollector || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
+      throw new Error("compute telemetry endpoint must be the supervised loopback collector or credential-free public HTTPS");
     }
-    if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || isIP4(endpoint.hostname) !== 0 || !endpoint.hostname.includes(".") || endpoint.hostname === "localhost" || endpoint.hostname.endsWith(".local"))
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL without credentials, query or fragment");
     telemetryEndpoint = endpoint.toString().replace(/\/$/, "");
   }
   const bin = options.binPath ?? "fz-agent";
@@ -16565,7 +16581,7 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     if (result.exitCode !== 0)
       problems.push(`${unit3} is not active`);
   }
-  for (const socket of [DEFAULT_SOCKET, CONTROL_SOCKET]) {
+  for (const socket of [DEFAULT_SOCKET]) {
     services[socket] = host.exists(socket);
     if (!services[socket])
       problems.push(`${socket} is missing`);
@@ -16654,8 +16670,8 @@ async function bootstrapStatus(host = localBootstrapHost()) {
 function planBootstrapAgentInstall(config, phase, context) {
   const { capabilities, hasBinding, hasEnrolCredential, initialBundle } = context;
   if (phase === "bootstrap") {
-    if (config.kind !== "platform" || hasBinding || !initialBundle) {
-      throw new Error("release-one Agent install requires an unbound platform host and verified bootstrap bundle");
+    if (config.kind !== "platform" || !initialBundle) {
+      throw new Error("platform bundle Agent install requires a verified bootstrap bundle");
     }
   } else if (phase === "enrol") {
     if (hasBinding || !hasEnrolCredential) {
@@ -16696,7 +16712,7 @@ function planBootstrapAgentInstall(config, phase, context) {
     runnerLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort, config.runtime.bluePort, config.runtime.greenPort] : [],
     agentLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort] : [],
     nodeHostname: config.nodeHostname,
-    telemetryEndpoint: config.telemetryEndpoint,
+    telemetryEndpoint: config.kind === "platform" ? config.runtime.environment.otlpEndpoint : "http://127.0.0.1:4318",
     binPath: "/usr/local/lib/forgezero/agent/fz-agent",
     sourceBinPath: PACKAGED_AGENT_BIN,
     ...enrolling ? {
@@ -18168,6 +18184,7 @@ if (import.meta.main) {
   if (attestationLoop)
     console.log("[agent] periodic SEV-SNP attestation enabled");
   const migrationEnabled = process.env.FZ_MIGRATION_PULL === "true";
+  let workClaimsEnabled = false;
   if (migrationEnabled && (!binding || !nodeApiUrl)) {
     throw new Error("agent: outbound lifecycle work requires a persisted compute enrolment binding");
   }
@@ -18176,6 +18193,7 @@ if (import.meta.main) {
     nodeKey,
     keys,
     telemetry,
+    canClaim: () => workClaimsEnabled,
     run: (claim) => requestLifecycleAction(claim, process.env.FZ_LIFECYCLE_HELPER_SOCKET ?? DEFAULT_LIFECYCLE_HELPER_SOCKET),
     onEvent: (event, detail) => console.log(`[agent] migration ${event}${detail ? ` ${JSON.stringify(detail)}` : ""}`)
   }) : undefined;
@@ -18194,6 +18212,7 @@ if (import.meta.main) {
     keys,
     sshKeyPath: bootstrapKeyPath,
     targetTelemetryEndpoint: process.env.FZ_BOOTSTRAP_TARGET_OTLP_ENDPOINT,
+    canClaim: () => workClaimsEnabled,
     onEvent: (event) => console.log(`[agent] bootstrap ${event}`)
   }) : undefined;
   if (bootstrapPull)
@@ -18205,6 +18224,7 @@ if (import.meta.main) {
     keys,
     sshKeyPath: bootstrapKeyPath,
     targetTelemetryEndpoint: process.env.FZ_BOOTSTRAP_TARGET_OTLP_ENDPOINT,
+    canClaim: () => workClaimsEnabled,
     onEvent: (event) => console.log(`[agent] ${event}`)
   }) : undefined;
   if (metalAdmissionPull)
@@ -18317,6 +18337,12 @@ if (import.meta.main) {
         deploymentIntake = { ...directive, appliedAtTs: Date.now() };
         console.log(`[agent] deployment intake ${directive.state} generation ${directive.generation}`);
       },
+      applyWorkClaims(enabled) {
+        if (workClaimsEnabled === enabled)
+          return;
+        workClaimsEnabled = enabled;
+        console.log(`[agent] remote work claims ${enabled ? "enabled" : "paused"} by platform lifecycle`);
+      },
       async prepareUpdate() {
         if (updatePrepared)
           return;

package/dist/fz.js

@@ -4840,7 +4840,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.89";
+var VERSION2 = "0.1.90";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -5885,7 +5885,7 @@ function agentUnit(options) {
   if (!validNodeHostname(options.nodeHostname))
     throw new Error("node hostname is invalid");
   if (!options.telemetryEndpoint) {
-    throw new Error("compute Agent provisioning requires OTEL_EXPORTER_OTLP_ENDPOINT as an explicit public HTTPS collector coordinate");
+    throw new Error("compute Agent provisioning requires an explicit supervised OTLP collector coordinate");
   }
   let telemetryEndpoint;
   {
@@ -5893,10 +5893,13 @@ function agentUnit(options) {
     try {
       endpoint = new URL(options.telemetryEndpoint);
     } catch {
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL");
+      throw new Error("compute telemetry endpoint must be an absolute collector URL");
+    }
+    const localCollector = endpoint.protocol === "http:" && endpoint.hostname === "127.0.0.1" && endpoint.port === "4318" && endpoint.pathname === "/";
+    const publicCollector = endpoint.protocol === "https:" && !endpoint.username && !endpoint.password && !endpoint.search && !endpoint.hash && isIP(endpoint.hostname) === 0 && endpoint.hostname.includes(".") && endpoint.hostname !== "localhost" && !endpoint.hostname.endsWith(".local");
+    if (!localCollector && !publicCollector || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
+      throw new Error("compute telemetry endpoint must be the supervised loopback collector or credential-free public HTTPS");
     }
-    if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || isIP(endpoint.hostname) !== 0 || !endpoint.hostname.includes(".") || endpoint.hostname === "localhost" || endpoint.hostname.endsWith(".local"))
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL without credentials, query or fragment");
     telemetryEndpoint = endpoint.toString().replace(/\/$/, "");
   }
   const bin = options.binPath ?? "fz-agent";
@@ -14799,7 +14802,7 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     if (result.exitCode !== 0)
       problems.push(`${unit} is not active`);
   }
-  for (const socket of [DEFAULT_SOCKET, CONTROL_SOCKET]) {
+  for (const socket of [DEFAULT_SOCKET]) {
     services[socket] = host.exists(socket);
     if (!services[socket])
       problems.push(`${socket} is missing`);
@@ -15042,7 +15045,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   }
   let installedAgentPlan;
   if (alreadyEnrolled) {
-    installedAgentPlan = await host.installAgent(config, "bound");
+    installedAgentPlan = await host.installAgent(config, bootstrapManifest ? "bootstrap" : "bound");
   } else if (config.kind === "platform") {
     if (bootstrapManifest)
       installedAgentPlan = await host.installAgent(config, "bootstrap");
@@ -15217,6 +15220,8 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
 `, 384);
       host.remove(config.bootstrapBundle.bundleFile);
       host.remove(config.bootstrapBundle.manifestFile);
+      if (alreadyEnrolled)
+        installedAgentPlan = await host.installAgent(config, "bound");
     }
     if (!alreadyEnrolled) {
       await checked3(host, [
@@ -15428,8 +15433,8 @@ function readBootstrapConfig(path) {
 function planBootstrapAgentInstall(config, phase, context) {
   const { capabilities, hasBinding, hasEnrolCredential, initialBundle } = context;
   if (phase === "bootstrap") {
-    if (config.kind !== "platform" || hasBinding || !initialBundle) {
-      throw new Error("release-one Agent install requires an unbound platform host and verified bootstrap bundle");
+    if (config.kind !== "platform" || !initialBundle) {
+      throw new Error("platform bundle Agent install requires a verified bootstrap bundle");
     }
   } else if (phase === "enrol") {
     if (hasBinding || !hasEnrolCredential) {
@@ -15470,7 +15475,7 @@ function planBootstrapAgentInstall(config, phase, context) {
     runnerLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort, config.runtime.bluePort, config.runtime.greenPort] : [],
     agentLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort] : [],
     nodeHostname: config.nodeHostname,
-    telemetryEndpoint: config.telemetryEndpoint,
+    telemetryEndpoint: config.kind === "platform" ? config.runtime.environment.otlpEndpoint : "http://127.0.0.1:4318",
     binPath: "/usr/local/lib/forgezero/agent/fz-agent",
     sourceBinPath: PACKAGED_AGENT_BIN,
     ...enrolling ? {
@@ -17416,7 +17421,7 @@ var remoteRegularFileExists = async (exec, request, knownHosts, path) => {
   throw new Error(`remote initialized-state probe failed${result.output ? `: ${result.output.trim()}` : ""}`);
 };
 async function operatorMetalClusterBootstrapCode(requestInput, options = {}) {
-  const request = validateMetalRequestValue(requestInput);
+  const request = validateMetalRequestValue(requestInput, { validateMetalConfig: false });
   publicIdentity(request.target.identityPublicKeyFile);
   socketPath(request.target.agentSocket);
   const exec = options.exec ?? defaultExec3;
@@ -17912,6 +17917,7 @@ var PROFILES = {
     kvNamespaceTitle: "forgezero dev nodes",
     workerScriptName: "forgezero-api-edge-development",
     region: { key: "in-south", label: "India South", country: "IN" },
+    seedSyncEpoch: "development-23c19168773d69ea",
     agentOtlpEndpoint: "https://otel.forgezero.net",
     privateCidrs: ["10.42.0.0/24"]
   },
@@ -17924,6 +17930,7 @@ var PROFILES = {
     kvNamespaceTitle: "forgezero nodes",
     workerScriptName: "forgezero-api-edge-production",
     region: { key: "in-south", label: "India South", country: "IN" },
+    seedSyncEpoch: "production-genesis-v1",
     agentOtlpEndpoint: "https://otel.forgezero.net",
     privateCidrs: ["10.42.0.0/24"]
   }
@@ -17991,7 +17998,7 @@ function forgeZeroLaunchTemplate(profile, guests, bundle, owner) {
         sharedDirectory: "/opt/forgezero/shared",
         seedSyncPeers: fleet.slice(1).flatMap(({ address }) => [3001, 3002].map((port) => `ws://${address}:${port}/_internal/forgezero/seed-mesh/v2`)),
         seedSyncMembers: nodeHostnames,
-        seedSyncEpoch: `${profile.environment}-${bundle.manifest.revision.slice(0, 16)}`,
+        seedSyncEpoch: profile.seedSyncEpoch,
         concurrencyLimit: 128,
         drainDeadlineMs: 30000,
         otlpEndpoint: "http://127.0.0.1:4318",

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.89";
+var VERSION = "0.1.90";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/migration-pull.d.ts

@@ -39,6 +39,7 @@ export interface MigrationPullOptions {
     clearTimer?: (handle: unknown) => void;
     onEvent?: (event: string, detail?: unknown) => void;
     telemetry?: AgentOperationTelemetry;
+    canClaim?: () => boolean;
 }
 export type MigrationPullResult = {
     status: 'idle';

package/dist/migration-pull.js

@@ -188,6 +188,10 @@ function startMigrationPull(options) {
   const tick = () => {
     if (stopped || active)
       return;
+    if (options.canClaim && !options.canClaim()) {
+      timer = setTimer(tick, interval);
+      return;
+    }
     active = pullMigrationOnce(options).then((result) => options.onEvent?.(result.status, result)).catch((cause) => options.onEvent?.("poll-failed", cause)).finally(() => {
       active = null;
       if (!stopped)

package/dist/operator-bootstrap.js

@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.89";
+var VERSION = "0.1.90";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -2094,7 +2094,7 @@ function agentUnit(options) {
   if (!validNodeHostname(options.nodeHostname))
     throw new Error("node hostname is invalid");
   if (!options.telemetryEndpoint) {
-    throw new Error("compute Agent provisioning requires OTEL_EXPORTER_OTLP_ENDPOINT as an explicit public HTTPS collector coordinate");
+    throw new Error("compute Agent provisioning requires an explicit supervised OTLP collector coordinate");
   }
   let telemetryEndpoint;
   {
@@ -2102,10 +2102,13 @@ function agentUnit(options) {
     try {
       endpoint2 = new URL(options.telemetryEndpoint);
     } catch {
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL");
+      throw new Error("compute telemetry endpoint must be an absolute collector URL");
+    }
+    const localCollector = endpoint2.protocol === "http:" && endpoint2.hostname === "127.0.0.1" && endpoint2.port === "4318" && endpoint2.pathname === "/";
+    const publicCollector = endpoint2.protocol === "https:" && !endpoint2.username && !endpoint2.password && !endpoint2.search && !endpoint2.hash && isIP3(endpoint2.hostname) === 0 && endpoint2.hostname.includes(".") && endpoint2.hostname !== "localhost" && !endpoint2.hostname.endsWith(".local");
+    if (!localCollector && !publicCollector || endpoint2.username || endpoint2.password || endpoint2.search || endpoint2.hash) {
+      throw new Error("compute telemetry endpoint must be the supervised loopback collector or credential-free public HTTPS");
     }
-    if (endpoint2.protocol !== "https:" || endpoint2.username || endpoint2.password || endpoint2.search || endpoint2.hash || isIP3(endpoint2.hostname) !== 0 || !endpoint2.hostname.includes(".") || endpoint2.hostname === "localhost" || endpoint2.hostname.endsWith(".local"))
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL without credentials, query or fragment");
     telemetryEndpoint = endpoint2.toString().replace(/\/$/, "");
   }
   const bin = options.binPath ?? "fz-agent";
@@ -4415,7 +4418,7 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     if (result.exitCode !== 0)
       problems.push(`${unit} is not active`);
   }
-  for (const socket of [DEFAULT_SOCKET2, CONTROL_SOCKET]) {
+  for (const socket of [DEFAULT_SOCKET2]) {
     services[socket] = host.exists(socket);
     if (!services[socket])
       problems.push(`${socket} is missing`);
@@ -4658,7 +4661,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   }
   let installedAgentPlan;
   if (alreadyEnrolled) {
-    installedAgentPlan = await host.installAgent(config, "bound");
+    installedAgentPlan = await host.installAgent(config, bootstrapManifest ? "bootstrap" : "bound");
   } else if (config.kind === "platform") {
     if (bootstrapManifest)
       installedAgentPlan = await host.installAgent(config, "bootstrap");
@@ -4833,6 +4836,8 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
 `, 384);
       host.remove(config.bootstrapBundle.bundleFile);
       host.remove(config.bootstrapBundle.manifestFile);
+      if (alreadyEnrolled)
+        installedAgentPlan = await host.installAgent(config, "bound");
     }
     if (!alreadyEnrolled) {
       await checked3(host, [
@@ -5044,8 +5049,8 @@ function readBootstrapConfig(path) {
 function planBootstrapAgentInstall(config, phase, context) {
   const { capabilities, hasBinding, hasEnrolCredential, initialBundle } = context;
   if (phase === "bootstrap") {
-    if (config.kind !== "platform" || hasBinding || !initialBundle) {
-      throw new Error("release-one Agent install requires an unbound platform host and verified bootstrap bundle");
+    if (config.kind !== "platform" || !initialBundle) {
+      throw new Error("platform bundle Agent install requires a verified bootstrap bundle");
     }
   } else if (phase === "enrol") {
     if (hasBinding || !hasEnrolCredential) {
@@ -5086,7 +5091,7 @@ function planBootstrapAgentInstall(config, phase, context) {
     runnerLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort, config.runtime.bluePort, config.runtime.greenPort] : [],
     agentLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort] : [],
     nodeHostname: config.nodeHostname,
-    telemetryEndpoint: config.telemetryEndpoint,
+    telemetryEndpoint: config.kind === "platform" ? config.runtime.environment.otlpEndpoint : "http://127.0.0.1:4318",
     binPath: "/usr/local/lib/forgezero/agent/fz-agent",
     sourceBinPath: PACKAGED_AGENT_BIN,
     ...enrolling ? {
@@ -6768,7 +6773,7 @@ var remoteRegularFileExists = async (exec, request, knownHosts, path) => {
   throw new Error(`remote initialized-state probe failed${result.output ? `: ${result.output.trim()}` : ""}`);
 };
 async function operatorMetalClusterBootstrapCode(requestInput, options = {}) {
-  const request = validateMetalRequestValue(requestInput);
+  const request = validateMetalRequestValue(requestInput, { validateMetalConfig: false });
   publicIdentity(request.target.identityPublicKeyFile);
   socketPath(request.target.agentSocket);
   const exec = options.exec ?? defaultExec3;

package/dist/platform-fleet-verification.js

@@ -2908,7 +2908,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.89";
+var VERSION3 = "0.1.90";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -3440,7 +3440,7 @@ function agentUnit(options) {
   if (!validNodeHostname(options.nodeHostname))
     throw new Error("node hostname is invalid");
   if (!options.telemetryEndpoint) {
-    throw new Error("compute Agent provisioning requires OTEL_EXPORTER_OTLP_ENDPOINT as an explicit public HTTPS collector coordinate");
+    throw new Error("compute Agent provisioning requires an explicit supervised OTLP collector coordinate");
   }
   let telemetryEndpoint;
   {
@@ -3448,10 +3448,13 @@ function agentUnit(options) {
     try {
       endpoint = new URL(options.telemetryEndpoint);
     } catch {
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL");
+      throw new Error("compute telemetry endpoint must be an absolute collector URL");
+    }
+    const localCollector = endpoint.protocol === "http:" && endpoint.hostname === "127.0.0.1" && endpoint.port === "4318" && endpoint.pathname === "/";
+    const publicCollector = endpoint.protocol === "https:" && !endpoint.username && !endpoint.password && !endpoint.search && !endpoint.hash && isIP(endpoint.hostname) === 0 && endpoint.hostname.includes(".") && endpoint.hostname !== "localhost" && !endpoint.hostname.endsWith(".local");
+    if (!localCollector && !publicCollector || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
+      throw new Error("compute telemetry endpoint must be the supervised loopback collector or credential-free public HTTPS");
     }
-    if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || isIP(endpoint.hostname) !== 0 || !endpoint.hostname.includes(".") || endpoint.hostname === "localhost" || endpoint.hostname.endsWith(".local"))
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL without credentials, query or fragment");
     telemetryEndpoint = endpoint.toString().replace(/\/$/, "");
   }
   const bin = options.binPath ?? "fz-agent";
@@ -5220,7 +5223,7 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     if (result.exitCode !== 0)
       problems.push(`${unit2} is not active`);
   }
-  for (const socket of [DEFAULT_SOCKET2, CONTROL_SOCKET]) {
+  for (const socket of [DEFAULT_SOCKET2]) {
     services[socket] = host.exists(socket);
     if (!services[socket])
       problems.push(`${socket} is missing`);
@@ -5309,8 +5312,8 @@ async function bootstrapStatus(host = localBootstrapHost()) {
 function planBootstrapAgentInstall(config, phase, context) {
   const { capabilities, hasBinding, hasEnrolCredential, initialBundle } = context;
   if (phase === "bootstrap") {
-    if (config.kind !== "platform" || hasBinding || !initialBundle) {
-      throw new Error("release-one Agent install requires an unbound platform host and verified bootstrap bundle");
+    if (config.kind !== "platform" || !initialBundle) {
+      throw new Error("platform bundle Agent install requires a verified bootstrap bundle");
     }
   } else if (phase === "enrol") {
     if (hasBinding || !hasEnrolCredential) {
@@ -5351,7 +5354,7 @@ function planBootstrapAgentInstall(config, phase, context) {
     runnerLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort, config.runtime.bluePort, config.runtime.greenPort] : [],
     agentLoopbackPorts: config.kind === "platform" ? [config.runtime.environment.publicApiPort] : [],
     nodeHostname: config.nodeHostname,
-    telemetryEndpoint: config.telemetryEndpoint,
+    telemetryEndpoint: config.kind === "platform" ? config.runtime.environment.otlpEndpoint : "http://127.0.0.1:4318",
     binPath: "/usr/local/lib/forgezero/agent/fz-agent",
     sourceBinPath: PACKAGED_AGENT_BIN,
     ...enrolling ? {

package/dist/platform-launch-profile.d.ts

@@ -17,6 +17,7 @@ export interface ForgeZeroLaunchProfile {
         city?: string;
     };
     agentOtlpEndpoint: string;
+    seedSyncEpoch: string;
     privateCidrs: readonly string[];
     nodeHostname(nodeIndex: number): string;
 }

package/dist/provision.js

@@ -2908,7 +2908,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.89";
+var VERSION3 = "0.1.90";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -3440,7 +3440,7 @@ function agentUnit(options) {
   if (!validNodeHostname(options.nodeHostname))
     throw new Error("node hostname is invalid");
   if (!options.telemetryEndpoint) {
-    throw new Error("compute Agent provisioning requires OTEL_EXPORTER_OTLP_ENDPOINT as an explicit public HTTPS collector coordinate");
+    throw new Error("compute Agent provisioning requires an explicit supervised OTLP collector coordinate");
   }
   let telemetryEndpoint;
   {
@@ -3448,10 +3448,13 @@ function agentUnit(options) {
     try {
       endpoint = new URL(options.telemetryEndpoint);
     } catch {
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL");
+      throw new Error("compute telemetry endpoint must be an absolute collector URL");
+    }
+    const localCollector = endpoint.protocol === "http:" && endpoint.hostname === "127.0.0.1" && endpoint.port === "4318" && endpoint.pathname === "/";
+    const publicCollector = endpoint.protocol === "https:" && !endpoint.username && !endpoint.password && !endpoint.search && !endpoint.hash && isIP(endpoint.hostname) === 0 && endpoint.hostname.includes(".") && endpoint.hostname !== "localhost" && !endpoint.hostname.endsWith(".local");
+    if (!localCollector && !publicCollector || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
+      throw new Error("compute telemetry endpoint must be the supervised loopback collector or credential-free public HTTPS");
     }
-    if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || isIP(endpoint.hostname) !== 0 || !endpoint.hostname.includes(".") || endpoint.hostname === "localhost" || endpoint.hostname.endsWith(".local"))
-      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL without credentials, query or fragment");
     telemetryEndpoint = endpoint.toString().replace(/\/$/, "");
   }
   const bin = options.binPath ?? "fz-agent";

package/dist/ssh-bootstrap.d.ts

@@ -129,6 +129,7 @@ export interface SshBootstrapPullOptions {
     onEvent?: (event: string, detail?: unknown) => void;
     telemetry?: AgentOperationTelemetry;
     resolveHost?: GitHostResolver;
+    canClaim?: () => boolean;
 }
 export type SshBootstrapResult = {
     status: 'idle';

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.89";
+export declare const VERSION = "0.1.90";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.89",
+  "version": "0.1.90",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",