@forgezero/agent 0.1.96 → 0.1.98

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.96";
+var VERSION3 = "0.1.98";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.96";
+var VERSION = "0.1.98";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3090,7 +3090,7 @@ var httpsOrigin = (name, raw) => {
 };
 var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
@@ -3098,6 +3098,8 @@ function validatePlatformInitialInventory(value) {
     safeAtom("initialInventory.region.city", value.region.city);
   if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
     throw new Error("initial platform deployment evidence is invalid");
+  if (value.attestation !== undefined && (!value.attestation || typeof value.attestation !== "object" || Array.isArray(value.attestation) || Object.keys(value.attestation).some((key) => !["measurement", "tcbFloor"].includes(key)) || !/^[a-f0-9]{96}$/.test(value.attestation.measurement) || !value.attestation.tcbFloor || typeof value.attestation.tcbFloor !== "object" || Array.isArray(value.attestation.tcbFloor) || Object.keys(value.attestation.tcbFloor).some((key) => !["bootLoader", "tee", "snp", "microcode"].includes(key)) || Object.values(value.attestation.tcbFloor).some((component) => !Number.isSafeInteger(component) || component < 0 || component > 255)))
+    throw new Error("initial platform attestation evidence is invalid");
   const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
     if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
       "name",
@@ -3133,6 +3135,9 @@ function validatePlatformInitialInventory(value) {
       databaseAgency: compute.databaseAgency,
       confidential: true
     })),
+    ...value.attestation ? {
+      attestation: { measurement: value.attestation.measurement, tcbFloor: { ...value.attestation.tcbFloor } }
+    } : {},
     ...value.deployment ? { deployment: { ...value.deployment } } : {}
   };
 }
@@ -5006,8 +5011,12 @@ function strictBootstrapDocument(value) {
     ], "runtime environment");
     const environment = runtime.environment;
     if (environment.initialInventory !== undefined) {
-      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes", "deployment"], "initial inventory");
+      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes", "attestation", "deployment"], "initial inventory");
       exactKeys(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
+      if (inventory.attestation !== undefined) {
+        const attestation = exactKeys(inventory.attestation, ["measurement", "tcbFloor"], "initial attestation evidence");
+        exactKeys(attestation.tcbFloor, ["bootLoader", "tee", "snp", "microcode"], "initial attestation TCB floor");
+      }
       if (inventory.deployment !== undefined)
         exactKeys(inventory.deployment, ["source", "branch", "revision", "bundleSha256"], "initial deployment evidence");
       if (!Array.isArray(inventory.computes))

package/dist/fz-agent.js

@@ -9496,7 +9496,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.96";
+var VERSION2 = "0.1.98";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4841,7 +4841,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.96";
+var VERSION2 = "0.1.98";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -12239,7 +12239,7 @@ var httpsOrigin = (name, raw) => {
 };
 var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
@@ -12247,6 +12247,8 @@ function validatePlatformInitialInventory(value) {
     safeAtom("initialInventory.region.city", value.region.city);
   if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
     throw new Error("initial platform deployment evidence is invalid");
+  if (value.attestation !== undefined && (!value.attestation || typeof value.attestation !== "object" || Array.isArray(value.attestation) || Object.keys(value.attestation).some((key) => !["measurement", "tcbFloor"].includes(key)) || !/^[a-f0-9]{96}$/.test(value.attestation.measurement) || !value.attestation.tcbFloor || typeof value.attestation.tcbFloor !== "object" || Array.isArray(value.attestation.tcbFloor) || Object.keys(value.attestation.tcbFloor).some((key) => !["bootLoader", "tee", "snp", "microcode"].includes(key)) || Object.values(value.attestation.tcbFloor).some((component2) => !Number.isSafeInteger(component2) || component2 < 0 || component2 > 255)))
+    throw new Error("initial platform attestation evidence is invalid");
   const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
     if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
       "name",
@@ -12282,6 +12284,9 @@ function validatePlatformInitialInventory(value) {
       databaseAgency: compute.databaseAgency,
       confidential: true
     })),
+    ...value.attestation ? {
+      attestation: { measurement: value.attestation.measurement, tcbFloor: { ...value.attestation.tcbFloor } }
+    } : {},
     ...value.deployment ? { deployment: { ...value.deployment } } : {}
   };
 }
@@ -15391,8 +15396,12 @@ function strictBootstrapDocument(value) {
     ], "runtime environment");
     const environment = runtime.environment;
     if (environment.initialInventory !== undefined) {
-      const inventory = exactKeys2(environment.initialInventory, ["metalHostname", "region", "computes", "deployment"], "initial inventory");
+      const inventory = exactKeys2(environment.initialInventory, ["metalHostname", "region", "computes", "attestation", "deployment"], "initial inventory");
       exactKeys2(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
+      if (inventory.attestation !== undefined) {
+        const attestation = exactKeys2(inventory.attestation, ["measurement", "tcbFloor"], "initial attestation evidence");
+        exactKeys2(attestation.tcbFloor, ["bootLoader", "tee", "snp", "microcode"], "initial attestation TCB floor");
+      }
       if (inventory.deployment !== undefined)
         exactKeys2(inventory.deployment, ["source", "branch", "revision", "bundleSha256"], "initial deployment evidence");
       if (!Array.isArray(inventory.computes))
@@ -17856,7 +17865,7 @@ async function applyAttendedPlatformBootstrap(fleetRequest, cloudflareRequest, a
 }
 
 // src/platform-genesis-config.ts
-function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname, region, deployment) {
+function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname, region, deployment, attestation) {
   const fleet = validatePlatformGenesisGuests(guests);
   if (!/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(metalHostname)) {
     throw new Error("platform genesis requires the reviewed metal hostname");
@@ -17885,6 +17894,7 @@ function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname,
       databaseRole: index === 0 ? "master" : "joiner",
       databaseAgency: "member"
     })),
+    ...attestation ? { attestation } : {},
     ...deployment ? { deployment } : {}
   };
   return fleet.map((guest, index) => {
@@ -17940,7 +17950,11 @@ var PROFILES = {
     seedSyncEpoch: "development-23c19168773d69ea",
     collectorExport: LOCAL_DEBUG_OTEL_EXPORT,
     agentOtlpEndpoint: "http://127.0.0.1:4318",
-    privateCidrs: ["10.42.0.0/24"]
+    privateCidrs: ["10.42.0.0/24"],
+    attestation: {
+      measurement: "2d4e66719b19f00c13560e286b1e32ab724ee35d5422473fb183b7dc48a425a9afea74e6625e26911eefbbfbda59b55e",
+      tcbFloor: { bootLoader: 4, tee: 0, snp: 29, microcode: 222 }
+    }
   },
   production: {
     environment: "production",
@@ -19510,7 +19524,7 @@ function writePlatformGenesisFleet(directory, preset) {
     branch: preset.profile.branch,
     revision: preset.bundle.manifest.revision,
     bundleSha256: preset.bundle.manifest.sha256
-  } : undefined).map((config) => {
+  } : undefined, preset?.profile.attestation).map((config) => {
     const path = `${output}/${config.computeReference}-platform.json`;
     if (preset)
       writeDerivedLaunchFile(path, (temporary) => writeBootstrapConfig(temporary, config));

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.96";
+var VERSION = "0.1.98";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.96";
+var VERSION = "0.1.98";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3090,7 +3090,7 @@ var httpsOrigin = (name, raw) => {
 };
 var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
@@ -3098,6 +3098,8 @@ function validatePlatformInitialInventory(value) {
     safeAtom("initialInventory.region.city", value.region.city);
   if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
     throw new Error("initial platform deployment evidence is invalid");
+  if (value.attestation !== undefined && (!value.attestation || typeof value.attestation !== "object" || Array.isArray(value.attestation) || Object.keys(value.attestation).some((key) => !["measurement", "tcbFloor"].includes(key)) || !/^[a-f0-9]{96}$/.test(value.attestation.measurement) || !value.attestation.tcbFloor || typeof value.attestation.tcbFloor !== "object" || Array.isArray(value.attestation.tcbFloor) || Object.keys(value.attestation.tcbFloor).some((key) => !["bootLoader", "tee", "snp", "microcode"].includes(key)) || Object.values(value.attestation.tcbFloor).some((component) => !Number.isSafeInteger(component) || component < 0 || component > 255)))
+    throw new Error("initial platform attestation evidence is invalid");
   const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
     if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
       "name",
@@ -3133,6 +3135,9 @@ function validatePlatformInitialInventory(value) {
       databaseAgency: compute.databaseAgency,
       confidential: true
     })),
+    ...value.attestation ? {
+      attestation: { measurement: value.attestation.measurement, tcbFloor: { ...value.attestation.tcbFloor } }
+    } : {},
     ...value.deployment ? { deployment: { ...value.deployment } } : {}
   };
 }
@@ -5006,8 +5011,12 @@ function strictBootstrapDocument(value) {
     ], "runtime environment");
     const environment = runtime.environment;
     if (environment.initialInventory !== undefined) {
-      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes", "deployment"], "initial inventory");
+      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes", "attestation", "deployment"], "initial inventory");
       exactKeys(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
+      if (inventory.attestation !== undefined) {
+        const attestation = exactKeys(inventory.attestation, ["measurement", "tcbFloor"], "initial attestation evidence");
+        exactKeys(attestation.tcbFloor, ["bootLoader", "tee", "snp", "microcode"], "initial attestation TCB floor");
+      }
       if (inventory.deployment !== undefined)
         exactKeys(inventory.deployment, ["source", "branch", "revision", "bundleSha256"], "initial deployment evidence");
       if (!Array.isArray(inventory.computes))

package/dist/platform-bootstrap-runtime.d.ts

@@ -31,6 +31,16 @@ export interface PlatformInitialInventory {
         PlatformInitialInventoryCompute,
         PlatformInitialInventoryCompute
     ];
+    /** Reviewed evidence for the exact confidential image used by this fleet. */
+    attestation?: {
+        measurement: string;
+        tcbFloor: {
+            bootLoader: number;
+            tee: number;
+            snp: number;
+            microcode: number;
+        };
+    };
     /** Generation-one release evidence; external Git automation is connected after custody opens Vault. */
     deployment?: {
         source: 'bootstrap-bundle';

package/dist/platform-bootstrap-runtime.js

@@ -730,7 +730,7 @@ var httpsOrigin = (name, raw) => {
 };
 var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
@@ -738,6 +738,8 @@ function validatePlatformInitialInventory(value) {
     safeAtom("initialInventory.region.city", value.region.city);
   if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
     throw new Error("initial platform deployment evidence is invalid");
+  if (value.attestation !== undefined && (!value.attestation || typeof value.attestation !== "object" || Array.isArray(value.attestation) || Object.keys(value.attestation).some((key) => !["measurement", "tcbFloor"].includes(key)) || !/^[a-f0-9]{96}$/.test(value.attestation.measurement) || !value.attestation.tcbFloor || typeof value.attestation.tcbFloor !== "object" || Array.isArray(value.attestation.tcbFloor) || Object.keys(value.attestation.tcbFloor).some((key) => !["bootLoader", "tee", "snp", "microcode"].includes(key)) || Object.values(value.attestation.tcbFloor).some((component) => !Number.isSafeInteger(component) || component < 0 || component > 255)))
+    throw new Error("initial platform attestation evidence is invalid");
   const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
     if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
       "name",
@@ -773,6 +775,9 @@ function validatePlatformInitialInventory(value) {
       databaseAgency: compute.databaseAgency,
       confidential: true
     })),
+    ...value.attestation ? {
+      attestation: { measurement: value.attestation.measurement, tcbFloor: { ...value.attestation.tcbFloor } }
+    } : {},
     ...value.deployment ? { deployment: { ...value.deployment } } : {}
   };
 }

package/dist/platform-fleet-verification.js

@@ -2908,7 +2908,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.96";
+var VERSION3 = "0.1.98";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -4142,7 +4142,7 @@ var httpsOrigin = (name, raw) => {
 };
 var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "attestation", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
@@ -4150,6 +4150,8 @@ function validatePlatformInitialInventory(value) {
     safeAtom("initialInventory.region.city", value.region.city);
   if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
     throw new Error("initial platform deployment evidence is invalid");
+  if (value.attestation !== undefined && (!value.attestation || typeof value.attestation !== "object" || Array.isArray(value.attestation) || Object.keys(value.attestation).some((key) => !["measurement", "tcbFloor"].includes(key)) || !/^[a-f0-9]{96}$/.test(value.attestation.measurement) || !value.attestation.tcbFloor || typeof value.attestation.tcbFloor !== "object" || Array.isArray(value.attestation.tcbFloor) || Object.keys(value.attestation.tcbFloor).some((key) => !["bootLoader", "tee", "snp", "microcode"].includes(key)) || Object.values(value.attestation.tcbFloor).some((component) => !Number.isSafeInteger(component) || component < 0 || component > 255)))
+    throw new Error("initial platform attestation evidence is invalid");
   const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
     if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
       "name",
@@ -4185,6 +4187,9 @@ function validatePlatformInitialInventory(value) {
       databaseAgency: compute.databaseAgency,
       confidential: true
     })),
+    ...value.attestation ? {
+      attestation: { measurement: value.attestation.measurement, tcbFloor: { ...value.attestation.tcbFloor } }
+    } : {},
     ...value.deployment ? { deployment: { ...value.deployment } } : {}
   };
 }

package/dist/platform-genesis-config.d.ts

@@ -15,4 +15,4 @@ export declare function platformGenesisBootstrapConfigs(template: PlatformBootst
     branch: 'dev' | 'main';
     revision: string;
     bundleSha256: string;
-}): readonly PlatformBootstrapConfig[];
+}, attestation?: import('./platform-bootstrap-runtime').PlatformInitialInventory['attestation']): readonly PlatformBootstrapConfig[];

package/dist/platform-launch-profile.d.ts

@@ -20,6 +20,16 @@ export interface ForgeZeroLaunchProfile {
     agentOtlpEndpoint: string;
     seedSyncEpoch: string;
     privateCidrs: readonly string[];
+    /** Owner-observed, AMD-verified evidence for this exact reviewed launch image. */
+    attestation?: {
+        measurement: string;
+        tcbFloor: {
+            bootLoader: number;
+            tee: number;
+            snp: number;
+            microcode: number;
+        };
+    };
     nodeHostname(nodeIndex: number): string;
 }
 export interface ForgeZeroLaunchOwnerInput {

package/dist/provision.js

@@ -2908,7 +2908,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.96";
+var VERSION3 = "0.1.98";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.96";
+export declare const VERSION = "0.1.98";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.96",
+  "version": "0.1.98",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",