@hivemagnus/magnus-server 1.1.13 → 2.1.0

package/.env.example

@@ -8,6 +8,7 @@
 #
 # Generate each secret with:  openssl rand -hex 32
 # Every secret must be distinct; there are no fallback values.
+HIVE_REHEARSAL=false
 
 # ═══════════════════════════════════════════════════════════════════════════
 # Required
@@ -35,6 +36,8 @@ LOG_INGEST_SIGNING_SECRET=
 CREDENTIAL_ROTATION_KEY=
 METRICS_TOKEN=
 WEBHOOK_ENCRYPTION_KEY=
+# Comma-separated exact HTTPS origins webhooks may target. Empty refuses every target.
+# WEBHOOK_ALLOWED_ORIGINS=https://hooks.example.com
 
 # HTTPS listener. TLS is required in production. Relative paths resolve
 # against the working directory; absolute paths are recommended.
@@ -99,6 +102,32 @@ CORS_ORIGIN=https://magnus.example.com:3000
 # IAM_TOKEN_ISSUER=https://iam.example.com
 # IAM_TOKEN_AUDIENCE=magnus
 
+# ── Oathweave: verify browser console resource tokens (audience "magnus") ──
+# Cannot be combined with IAM_CORE_URL. Local HS256 and service credentials keep working.
+# All four settings are required together. Endpoints must be HTTPS. A person needs an
+# exact issuer + subject link, never inferred by email; `role` is a ceiling on the
+# token's magnus:admin, magnus:operate and magnus:view permissions.
+# OATHWEAVE_ISSUER=https://identity.example.com
+# OATHWEAVE_JWKS_URL=https://identity.example.com/api/v1/oauth/jwks
+# OATHWEAVE_USERINFO_URL=https://identity.example.com/api/v1/oauth/userinfo
+# MAGNUS_OATHWEAVE_IDENTITIES_JSON=[{"issuer":"https://identity.example.com","subject":"example-subject","localUserId":"alice","role":"OPERATOR"}]
+# Reported to the browser console by GET /api/v1/console/session.
+# MAGNUS_HERMES_ENABLED=false
+
+# ── Fleet gateway: the separate service that carries the web terminal ──
+# This server never holds the SSH key. Both settings together offer the terminal to people with an
+# ADMIN link and the magnus:terminal permission. The digest is of the gateway's
+# FLEET_GATEWAY_API_TOKEN. The server must trust the gateway's certificate (NODE_EXTRA_CA_CERTS).
+# FLEET_GATEWAY_URL=https://fleet-gateway.example.com:4310
+# FLEET_GATEWAY_TOKEN_SHA256=
+# Who answers console drain challenges during resource enrollment. gateway (the default) needs
+# FLEET_GATEWAY_URL and RESOURCE_ENROLLMENT_DASHBOARD_SECRET. absent is for an installation with
+# neither a gateway nor a console that ever did SSH work: it succeeds only while the node has no
+# console work rows in any state, and otherwise fails closed.
+# RESOURCE_ENROLLMENT_DASHBOARD_PARTICIPANT=gateway
+# Path the console is served under, prefixed to links in notifications.
+# MAGNUS_CONSOLE_BASE_PATH=/fleet
+
 # ── Hive Router (or any OpenAI-compatible router) for managed Hermes Agents ──
 # HIVE_ROUTER_URL / HIVE_ROUTER_MODEL / HIVE_ROUTER_API_KEY are accepted as aliases.
 # MAGNUS_ROUTER_URL=https://router.example.com/v1
@@ -200,3 +229,11 @@ CORS_ORIGIN=https://magnus.example.com:3000
 # MAGNUS_AGENT_UPGRADE_MAX_FAILURES=2
 # The retired git-checkout self-update endpoints (source installs only).
 # MAGNUS_LEGACY_GIT_SELF_UPDATE=false
+
+# Optional Cindertrace response bridge. Configure a new dedicated secret.
+# CINDERTRACE_RESPONSE_SECRET=
+# CINDERTRACE_RESTART_ALLOWLIST=
+# CINDERTRACE_PROTECTED_TARGET_IDS=
+
+# Optional fixed HiveSkills reconciliation; protected target credentials stay on hosts.
+# MAGNUS_HIVESKILLS_DEPLOYMENTS_JSON={"fixture-registry":{"tokenSha256":"<sha256-of-dedicated-executor-token>","targets":{"fixture-target":{"nodeId":"<enrolled-node-id>","agentTarget":"fixture-native"}}}}

package/README.md

@@ -51,6 +51,9 @@ chmod 600 ~/.magnus/server.env
 production `TLS_CERT_PATH` / `TLS_KEY_PATH`. The server refuses to start while
 any is missing; there are no fallback secret values.
 
+Webhooks are refused until `WEBHOOK_ALLOWED_ORIGINS` lists the exact HTTPS origins
+they may target, as a comma-separated list.
+
 Local data (audit logs, credential rotation state, uploaded backups) lives
 under `MAGNUS_HOME`, default `~/.magnus`.
 
@@ -110,6 +113,7 @@ without any of them. `magnus-server check` prints which are on.
 | Integration | What it adds | Environment |
 | --- | --- | --- |
 | Hive IAM | RS256 access tokens issued by Hive IAM replace locally issued JWTs | `IAM_CORE_URL`, `IAM_TOKEN_ISSUER`, `IAM_TOKEN_AUDIENCE` |
+| Fleet gateway | The browser web terminal, through a [separate service](../fleet-gateway/README.md) that holds the SSH key; also answers console drain challenges | `FLEET_GATEWAY_URL`, `FLEET_GATEWAY_TOKEN_SHA256`, `RESOURCE_ENROLLMENT_DASHBOARD_PARTICIPANT` |
 | Hive Router | OpenAI-compatible model routing for managed Hermes Agents | `MAGNUS_ROUTER_URL` (alias `HIVE_ROUTER_URL`), `MAGNUS_ROUTER_MODEL`, `MAGNUS_ROUTER_API_KEY`, `HIVE_ROUTER_HEALTH_URL` |
 | HiveMem | Shared agent memory for Hermes Agents and operational lessons | `HIVEMEM_URL`, `HIVEMEM_TOKEN`, `MAGNUS_LESSONS_HIVEMEM_URL`, `MAGNUS_LESSONS_HIVEMEM_TOKEN` |
 | Security Fusion (local) | Security cases, evidence and signed receipts in this server | `SECURITY_FUSION_MODE=local`, `SECURITY_FUSION_RECEIPT_SIGNING_KEY`, optional `SECURITY_FUSION_EVIDENCE_DIR`, `SECURITY_FUSION_CONTAINMENT_COMMAND`, `SECURITY_FUSION_MATTERMOST_*` |
@@ -121,6 +125,15 @@ without any of them. `magnus-server check` prints which are on.
 | Agent discovery | Agents self-register | `ENABLE_AGENT_DISCOVERY=true`, `AGENT_DISCOVERY_SECRET` |
 | Resource leases | Durable node and shared-resource lease coordination | `MAGNUS_RESOURCE_LEASES_ENABLED=true` |
 
+For an isolated restore, set `HIVE_REHEARSAL=true` and
+`MAGNUS_AUTO_MIGRATE=false`. The API keeps read access but holds mutations,
+terminal WebSockets, queue activation, host contact, collectors, retention,
+reconciliation, updates and catalogue imports. Existing queued work remains
+dormant. Run explicitly reviewed migrations separately before starting the
+candidate. `magnus-server verify-migrations` verifies the exact packaged,
+completed migration checksums using read-only queries; pending, failed, missing,
+unknown or changed migrations fail. It does not initialize or repair the database.
+
 Credentials for services that call Magnus are stored only as SHA-256 digests.
 
 SSH helpers require `SSH_HOST_KEY_PINS_FILE` before they open a connection.
@@ -187,3 +200,26 @@ migrations are never edited.
 ## License
 
 Apache-2.0. See [LICENSE](LICENSE).
+
+## Cindertrace
+
+Embedded Security Fusion is retired. See [migration and response configuration](../../docs/CINDERTRACE_MIGRATION.md). CINDERTRACE_RESPONSE_SECRET, CINDERTRACE_RESTART_ALLOWLIST, and CINDERTRACE_PROTECTED_TARGET_IDS configure the optional managed response adapter.
+
+### HiveSkills execution bridge
+
+`MAGNUS_HIVESKILLS_DEPLOYMENTS_JSON` maps each registry to a dedicated token SHA-256
+and exact logical-target bindings (`nodeId`, `agentTarget`). This optional integration
+accepts only POST/GET `/api/v1/hiveskills/jobs/:id`, with exact publication digests
+and a durable registry-owned UUID. It cannot submit general commands. Nodes must
+already have completed managed resource enrollment. Repeated requests inspect the
+original signed receipt; they never dispatch an admitted job again. Unknown outcomes
+retain their node ownership for explicit reconciliation.
+
+Each node explicitly configures `MAGNUS_AGENT_HIVESKILLS_TARGETS_JSON`: registry ID,
+registry target, owner, home, Hermes profile directory, protected environment-file
+path, root-owned pinned sync script, Node executable and optional `caFile` trust bundle. The trust bundle is passed at Node startup; target bearer credentials remain in the protected environment file. The owner-scoped native
+handler runs that fixed product client as the configured owner, with sanitized
+environment and bounded output. No infrastructure or native target credential is
+sent by the browser or included in a job body. The client receives the frozen
+approved publication and independently checks archive origin, digest and local
+Hermes compatibility. A non-root agent may synchronize its own explicit profile. Changing owner or running as root requires privileged mode. No SSH or Docker socket is used by this path.

package/agent-version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.1.13"
+  "version": "2.1.0"
 }

package/dist/ai/TOOLS.md

@@ -65,7 +65,7 @@ Includes:
 #### `getFleetReadiness()`
 
 Returns stale-node, deploy-eligibility, destructive-action, agent-version, and
-credential-fingerprint posture from `/api/v1/ops/readiness`.
+credential state from `/api/v1/ops/readiness`, without secret fingerprints.
 
 #### `getCodexFleetStatus()`
 

package/dist/cli/args.js

@@ -6,6 +6,8 @@ Commands:
   start         Start the API server (default)
   check         Validate configuration and reach PostgreSQL and Redis; list enabled integrations
   migrate       Apply pending migrations (prisma migrate deploy) and base data
+  verify-migrations Verify exact completed migration checksums without applying changes
+  verify-initialization Verify migrations and committed base initialization without changes
   migrations    Show applied and pending migrations with their impact notes
   backup        Dump PostgreSQL (pg_dump -Fc) into MAGNUS_BACKUP_DIR and print the restore command
   restore FILE  Replace the database with a dump (stop the server first; asks unless --yes)
@@ -25,7 +27,7 @@ Options:
   -h, --help          Show this help
   -v, --version       Print the version
 `;
-const COMMANDS = new Set(['start', 'check', 'migrate', 'migrations', 'backup', 'restore', 'upgrade', 'rollback', 'agents', 'env-schema', 'help', 'version']);
+const COMMANDS = new Set(['start', 'check', 'migrate', 'migrations', 'verify-migrations', 'verify-initialization', 'backup', 'restore', 'upgrade', 'rollback', 'agents', 'env-schema', 'help', 'version']);
 /** Commands whose remaining arguments belong to another tool. */
 const PASSTHROUGH = new Set(['upgrade', 'rollback', 'agents']);
 export function parseArgs(argv) {

package/dist/cli/env-catalog.js

@@ -1,10 +1,12 @@
 const secret32 = (name, description) => ({ name, group: 'secrets', required: true, secret: true, description: `${description} At least 32 characters; must differ from every other secret.` });
 export const ENV_CATALOG = [
     // ── Core ──
+    { name: 'HIVE_REHEARSAL', group: 'core', default: 'false', description: 'Isolated restore mode: no workers, timers, queue activation, mutations, host execution or terminal WebSockets. Explicit true/false only.' },
     { name: 'NODE_ENV', group: 'core', default: 'development', description: 'development, production or test. Production enforces TLS, DATABASE_URL and strict CORS.' },
     { name: 'LOG_LEVEL', group: 'core', default: 'info', description: 'debug, info, warn, error or fatal.' },
     { name: 'MAGNUS_ROUTE_ALIASES_JSON', group: 'core', description: 'Optional JSON object mapping legacy /api/v1 path prefixes to current ones, for clients built against older route names. Requests are rewritten before routing, so auth and audit see the current path. Unset means no aliases.' },
     { name: 'MAGNUS_WEBHOOK_TYPE_ALIASES', group: 'core', description: 'Optional comma-separated legacy=format pairs (format: generic, slack, discord or mattermost) so webhook endpoints stored or submitted under an older type name keep their delivery format.' },
+    { name: 'WEBHOOK_ALLOWED_ORIGINS', group: 'core', description: 'Comma-separated exact HTTPS origins that webhooks may target. Empty refuses every webhook target.' },
     { name: 'MAGNUS_HOME', group: 'paths', default: '~/.magnus', description: 'Base directory for server-owned data (audit logs, credential rotation state, backups).' },
     { name: 'MAGNUS_ENV_FILE', group: 'paths', description: 'Env file loaded at startup (set by `--env-file`). Variables already in the environment win.' },
     { name: 'AUDIT_LOG_DIR', group: 'paths', default: '$MAGNUS_HOME/audit-logs', description: 'Directory for the append-only audit log files.' },
@@ -24,6 +26,7 @@ export const ENV_CATALOG = [
     { name: 'ALLOW_INSECURE_HTTP', group: 'listener', default: 'false', description: 'Development only: serve cleartext HTTP on loopback when no certificate is configured.' },
     { name: 'CORS_ORIGIN', group: 'listener', default: 'https://localhost:3000', description: 'Comma-separated browser origins allowed to call the API (the dashboard).' },
     { name: 'DASHBOARD_PUBLIC_ORIGIN', group: 'listener', description: 'Public HTTPS origin of the dashboard, used for links in notifications.' },
+    { name: 'MAGNUS_CONSOLE_BASE_PATH', group: 'listener', description: 'Path the console is served under on DASHBOARD_PUBLIC_ORIGIN (for example /fleet), prefixed to links in notifications. Unset means the origin root.' },
     // ── Required secrets ──
     secret32('API_SECRET', 'Dashboard-to-server shared secret (x-api-secret).'),
     { ...secret32('JWT_SECRET', 'HS256 key for locally issued user tokens.'), required: false, requiredWhen: 'IAM_CORE_URL unset' },
@@ -49,6 +52,15 @@ export const ENV_CATALOG = [
     { name: 'IAM_CORE_URL', group: 'iam', description: 'Hive IAM base URL. When set, RS256 tokens from Hive IAM replace local JWTs.' },
     { name: 'IAM_TOKEN_ISSUER', group: 'iam', requiredWhen: 'IAM_CORE_URL set', description: 'Exact `iss` claim required on IAM access tokens.' },
     { name: 'IAM_TOKEN_AUDIENCE', group: 'iam', requiredWhen: 'IAM_CORE_URL set', description: 'Exact `aud` claim required on IAM access tokens.' },
+    // ── Oathweave browser console tokens ──
+    { name: 'OATHWEAVE_ISSUER', group: 'iam', description: 'Exact `iss` claim of Oathweave resource tokens (audience `magnus`). Cannot be combined with IAM_CORE_URL.' },
+    { name: 'OATHWEAVE_JWKS_URL', group: 'iam', requiredWhen: 'OATHWEAVE_ISSUER set', description: 'HTTPS JWKS URL that verifies Oathweave token signatures.' },
+    { name: 'OATHWEAVE_USERINFO_URL', group: 'iam', requiredWhen: 'OATHWEAVE_ISSUER set', description: 'HTTPS userinfo URL used for online session revocation (logout takes effect within 15 seconds, including on open streams).' },
+    { name: 'MAGNUS_OATHWEAVE_IDENTITIES_JSON', group: 'iam', requiredWhen: 'OATHWEAVE_ISSUER set', description: 'JSON array of {issuer,subject,localUserId,role}. Exact issuer and subject match, never by email; a missing or duplicate link is refused. `role` caps what the token permissions magnus:admin, magnus:operate and magnus:view can grant.' },
+    // ── Fleet gateway (web terminal) ──
+    { name: 'FLEET_GATEWAY_URL', group: 'iam', description: 'HTTPS origin of the fleet gateway, the separate service holding the restricted SSH key. Enables the console terminal capability with FLEET_GATEWAY_TOKEN_SHA256, and receives console drain challenges.' },
+    { name: 'FLEET_GATEWAY_TOKEN_SHA256', group: 'iam', requiredWhen: 'FLEET_GATEWAY_URL set', description: 'SHA-256 digest of the credential the fleet gateway presents to resolve nodes and record terminal audit events.' },
+    { name: 'RESOURCE_ENROLLMENT_DASHBOARD_PARTICIPANT', group: 'iam', description: '`gateway` (default) sends console drain challenges to FLEET_GATEWAY_URL. `absent` declares no console participant exists: drain evidence is accepted only while the node has no console work rows, in any state.' },
     // ── Hive Router ──
     { name: 'MAGNUS_ROUTER_URL', group: 'router', description: 'OpenAI-compatible model router (for example Hive Router) for managed Hermes Agents. HIVE_ROUTER_URL is accepted as an alias.' },
     { name: 'MAGNUS_ROUTER_MODEL', group: 'router', description: 'Default model served by the router. HIVE_ROUTER_MODEL is accepted as an alias.' },
@@ -60,6 +72,9 @@ export const ENV_CATALOG = [
     { name: 'MAGNUS_LESSONS_HIVEMEM_URL', group: 'hivemem', description: 'Optional HiveMem URL for operational lessons.' },
     { name: 'MAGNUS_LESSONS_HIVEMEM_TOKEN', group: 'hivemem', secret: true, description: 'Token for MAGNUS_LESSONS_HIVEMEM_URL.' },
     // ── Security Fusion / external security console ──
+    { name: 'CINDERTRACE_RESPONSE_SECRET', group: 'security', description: 'Dedicated HMAC credential for the optional Cindertrace managed response bridge.' },
+    { name: 'CINDERTRACE_RESTART_ALLOWLIST', group: 'security', description: 'Comma-separated allowlisted response service names; empty by default.' },
+    { name: 'CINDERTRACE_PROTECTED_TARGET_IDS', group: 'security', description: 'Comma-separated node IDs that Cindertrace must never isolate.' },
     { name: 'SECURITY_FUSION_MODE', group: 'security', default: 'off', description: 'off (feature disabled), local (cases and evidence in this server) or remote (export to an external security console).' },
     { name: 'SECURITY_FUSION_RECEIPT_SIGNING_KEY', group: 'security', secret: true, requiredWhen: 'SECURITY_FUSION_MODE=local', description: 'Dedicated key that signs Security Fusion deletion receipts (min 32 chars).' },
     { name: 'SECURITY_FUSION_EVIDENCE_DIR', group: 'security', description: 'Private evidence directory (local mode).' },
@@ -77,6 +92,7 @@ export const ENV_CATALOG = [
     { name: 'SECURITY_FUSION_MATTERMOST_CHANNEL_ID', group: 'security', description: 'Mattermost channel ID.' },
     // ── Hermes Agent plugin API ──
     { name: 'MAGNUS_PLUGIN_API_ENABLED', group: 'plugins', default: 'false', description: 'Accept Hermes Agent plugin credentials on the plugin-scoped routes.' },
+    { name: 'MAGNUS_HIVESKILLS_DEPLOYMENTS_JSON', group: 'plugins', description: 'Optional endpoint-scoped HiveSkills executor grants: registry ID -> tokenSha256 and exact target -> nodeId/agentTarget mapping; no administrator credentials.' },
     { name: 'MAGNUS_PLUGIN_READ_TOKEN_DIGESTS_JSON', group: 'plugins', requiredWhen: 'MAGNUS_PLUGIN_API_ENABLED=true', description: 'JSON object {consumerId: sha256(token)} of 1-16 read-only plugin credentials.' },
     { name: 'MAGNUS_PLUGIN_OPERATOR_TOKEN_SHA256', group: 'plugins', requiredWhen: 'MAGNUS_PLUGIN_API_ENABLED=true', description: 'SHA-256 digest of the server-local plugin operator credential.' },
     { name: 'MAGNUS_APPROVAL_BRIDGE_CONSUMER', group: 'plugins', description: 'Plugin read consumer allowed to list approval plans and relay signed decisions.' },

package/dist/cli/migrations.js

@@ -3,6 +3,7 @@
  * `magnus-server migrate`, `check` and startup auto-migrate.
  */
 import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { basename, dirname, join } from 'node:path';
@@ -16,6 +17,27 @@ export function packagedMigrations(migrationsDir) {
         .map(entry => entry.name)
         .sort();
 }
+/** Strict initialization receipt verification. SELECT only; never repairs history. */
+export async function verifyCurrentMigrations(client, migrationsDir) {
+    const packaged = packagedMigrations(migrationsDir);
+    if (!packaged.length)
+        throw new Error('Packaged migrations are unavailable; select the owned migration artifact');
+    const table = await client.query(`SELECT to_regclass('public._prisma_migrations') IS NOT NULL AS exists`);
+    if (!table.rows[0]?.exists)
+        throw new Error('Migration history is absent; initialization has not completed');
+    const rows = (await client.query('SELECT migration_name, checksum, finished_at, rolled_back_at FROM _prisma_migrations ORDER BY migration_name')).rows;
+    const active = rows.filter(row => !row.rolled_back_at);
+    if (active.some(row => !row.finished_at))
+        throw new Error('An unfinished migration requires explicit recovery');
+    if (active.length !== packaged.length || active.some(row => !packaged.includes(row.migration_name)))
+        throw new Error('Database migration history differs from this exact release');
+    for (const name of packaged) {
+        const matching = active.filter(row => row.migration_name === name);
+        const expected = createHash('sha256').update(readFileSync(join(migrationsDir, name, 'migration.sql'))).digest('hex');
+        if (matching.length !== 1 || matching[0].checksum !== expected)
+            throw new Error('A completed migration checksum differs from its immutable packaged source');
+    }
+}
 /**
  * Each migration may carry `magnus-impact.json` (`{"impact":"slow","note":"…"}`).
  * A migration without one is treated as fast and reversible by rollback.

package/dist/cli/verify-initialization.js

@@ -0,0 +1,12 @@
+/** No DDL, seeding or repairs: reconcile only an already committed owner receipt. */
+export async function verifyInitialization(client) {
+    const result = await client.query(`SELECT
+    EXISTS (SELECT 1 FROM product_initializations WHERE id = 'base-data-v1') AS completed,
+    EXISTS (SELECT 1 FROM users WHERE (id = 'system' OR email = 'system@magnus.local') AND active = true AND role = 'ADMIN') AS actor,
+    (SELECT count(*) = 2 FROM nodes WHERE id IN ('__control-api__', '__dashboard__') AND os = 'internal' AND arch = 'internal') AS sentinels`);
+    const row = result.rows[0];
+    if (!row?.completed || !row.actor || !row.sentinels) {
+        throw Error('Base initialization is incomplete or its required system records changed; activation remains held. Use the product recovery procedure; no seeding or migration was replayed.');
+    }
+}
+//# sourceMappingURL=verify-initialization.js.map

package/dist/cli.js

@@ -134,6 +134,25 @@ async function commandCheck(format) {
     return failures === 0 ? 0 : 1;
 }
 /** Applied and pending migrations, with impact notes (`--format json` for tooling). */
+async function commandVerifyMigrations(initialization = false) {
+    const { resolveDatabaseUrl } = await import('./db/client.js');
+    const { verifyCurrentMigrations } = await import('./cli/migrations.js');
+    const pg = (await import('pg')).default;
+    const client = new pg.Client({ connectionString: process.env['MAGNUS_MIGRATE_DATABASE_URL']?.trim() || resolveDatabaseUrl(), connectionTimeoutMillis: 10_000 });
+    await client.connect();
+    try {
+        await verifyCurrentMigrations(client, MIGRATIONS_DIR);
+        if (initialization) {
+            const { verifyInitialization } = await import('./cli/verify-initialization.js');
+            await verifyInitialization(client);
+        }
+        console.log(JSON.stringify({ ok: true, migrations: 'current', ...(initialization ? { initialization: 'complete' } : {}) }));
+        return 0;
+    }
+    finally {
+        await client.end().catch(() => undefined);
+    }
+}
 async function commandMigrations(format) {
     const { resolveDatabaseUrl } = await import('./db/client.js');
     const { readMigrationState } = await import('./cli/migrations.js');
@@ -284,6 +303,9 @@ async function commandStart(options) {
         process.loadEnvFile(packageEnv);
         dropEmptyValues();
     }
+    const { rehearsalEnabled } = await import('./config/rehearsal.js');
+    if (rehearsalEnabled() && (options.migrate || process.env['MAGNUS_AUTO_MIGRATE'] === 'true'))
+        fatal('Isolated rehearsal requires explicit migrations before startup; automatic migration must be disabled.');
     if (options.migrate)
         await migrate();
     else
@@ -309,6 +331,12 @@ async function run(argv) {
         case 'check':
             loadEnvFiles(options.envFiles);
             return commandCheck(options.formatGiven ? options.format : 'table');
+        case 'verify-migrations':
+            loadEnvFiles(options.envFiles);
+            return commandVerifyMigrations();
+        case 'verify-initialization':
+            loadEnvFiles(options.envFiles);
+            return commandVerifyMigrations(true);
         case 'migrations':
             loadEnvFiles(options.envFiles);
             return commandMigrations(options.formatGiven ? options.format : 'table');

package/dist/config/console-path.js

@@ -0,0 +1,17 @@
+/** One or more plain path segments with a leading slash and no trailing slash. */
+const CONSOLE_BASE_PATH = /^(?:\/(?!\.{1,2}(?:\/|$))[A-Za-z0-9._~-]+)+$/;
+export function isConsoleBasePath(value) {
+    return CONSOLE_BASE_PATH.test(value);
+}
+/**
+ * Absolute path of a console page, honouring MAGNUS_CONSOLE_BASE_PATH.
+ * Null when the configured base is invalid, so callers omit the link rather
+ * than emit one they cannot vouch for. Startup validation rejects that value.
+ */
+export function consolePagePath(page, env = process.env) {
+    const base = env['MAGNUS_CONSOLE_BASE_PATH'];
+    if (!base)
+        return page;
+    return isConsoleBasePath(base) ? `${base}${page}` : null;
+}
+//# sourceMappingURL=console-path.js.map

package/dist/config/env.js

@@ -4,6 +4,8 @@ import { parseRouteAliases } from './route-aliases.js';
 import { webhookTypeAliases } from '../services/webhook-types.js';
 // ─── Shared environment schema — validated with Zod ───
 const portSchema = z.coerce.number().int().min(1).max(65535);
+import { isConsoleBasePath } from './console-path.js';
+import { oathweaveConfigurationIssues } from './oathweave.js';
 const booleanEnvSchema = z.enum(['true', 'false']).default('false').transform((value) => value === 'true');
 function configuredDigestValues(raw) {
     if (!raw)
@@ -21,6 +23,7 @@ function configuredDigestValues(raw) {
 /** Default skills directory — `<package root>/skills`. */
 const DEFAULT_SKILLS_DIR = path.resolve(import.meta.dirname, '../../skills');
 export const envSchema = z.object({
+    HIVE_REHEARSAL: booleanEnvSchema,
     NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
     LOG_LEVEL: z.enum(['debug', 'info', 'warn', 'error', 'fatal']).default('info'),
     // PostgreSQL
@@ -43,6 +46,9 @@ export const envSchema = z.object({
     MAGNUS_COLLECTOR_TOKEN_SHA256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
     MAGNUS_RESOURCE_LEASES_ENABLED: booleanEnvSchema,
     RESOURCE_ENROLLMENT_DASHBOARD_SECRET: z.string().min(32).optional(),
+    RESOURCE_ENROLLMENT_DASHBOARD_PARTICIPANT: z.enum(['gateway', 'absent']).optional(),
+    FLEET_GATEWAY_URL: z.string().url().optional(),
+    FLEET_GATEWAY_TOKEN_SHA256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
     // Optional signed team-approval relay (Ed25519 public key + actor bindings).
     APPROVAL_SIGNER_PUBLIC_KEY_PEM: z.string().optional(),
     APPROVAL_SIGNER_PUBLIC_KEY_B64: z.string().min(32).optional(),
@@ -55,7 +61,10 @@ export const envSchema = z.object({
         .regex(/^\s*[a-z0-9](?:[a-z0-9.-]{0,98}[a-z0-9])?\s*(?:,\s*[a-z0-9](?:[a-z0-9.-]{0,98}[a-z0-9])?\s*)*$/, 'must list domain prefixes made of a-z, 0-9, "." and "-", separated by commas')
         .optional(),
     // Security Fusion: off (default) | local (in-process) | remote (external security console).
-    SECURITY_FUSION_MODE: z.enum(['off', 'local', 'remote']).default('off'),
+    SECURITY_FUSION_MODE: z.enum(['off', 'remote'], { error: 'Embedded Security Fusion local mode is retired; export and import state into Cindertrace before selecting remote mode (docs/CINDERTRACE_MIGRATION.md)' }).default('off'),
+    CINDERTRACE_RESPONSE_SECRET: z.string().min(32).optional(),
+    CINDERTRACE_RESTART_ALLOWLIST: z.string().optional(),
+    CINDERTRACE_PROTECTED_TARGET_IDS: z.string().optional(),
     SECURITY_FUSION_API_URL: z.string().url().optional(),
     MAGNUS_SECURITY_CONSOLE_URL: z.string().url().optional(),
     SECURITY_APPROVAL_BRIDGE_TOKEN: z.string().min(32).optional(),
@@ -65,6 +74,10 @@ export const envSchema = z.object({
     SHARED_RESOURCE_MISSION_TRUST_JSON: z.string().optional(),
     SHARED_RESOURCE_RESULT_TRUST_JSON: z.string().optional(),
     DASHBOARD_PUBLIC_ORIGIN: z.string().url().optional(),
+    MAGNUS_CONSOLE_BASE_PATH: z.string()
+        .refine(isConsoleBasePath, 'must be an absolute path such as /fleet, without a trailing slash or dot segments')
+        .optional(),
+    MAGNUS_HERMES_ENABLED: booleanEnvSchema,
     MAGNUS_APPLICATION_PROBES_FILE: z.string().optional(),
     MAGNUS_OPERATIONS_CATALOG_FILE: z.string().optional(),
     MAGNUS_ENGINEERING_EVIDENCE_FILE: z.string().optional(),
@@ -101,6 +114,7 @@ export const envSchema = z.object({
     MAGNUS_PLUGIN_READ_TOKEN_DIGESTS_JSON: z.string().optional(),
     MAGNUS_PLUGIN_OPERATOR_TOKEN_SHA256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
     MAGNUS_SHARED_RESOURCE_TOKEN_SHA256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+    MAGNUS_HIVESKILLS_DEPLOYMENTS_JSON: z.string().optional(),
     MAGNUS_SHARED_RESOURCE_TOKEN_DIGESTS_JSON: z.string().optional(),
     MAGNUS_FLEET_CHECK_TOKEN_SHA256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
     SECURITY_FUSION_RECEIPT_SIGNING_KEY: z.string().min(32).optional(),
@@ -111,6 +125,10 @@ export const envSchema = z.object({
     IAM_CORE_URL: z.string().url().optional(),
     IAM_TOKEN_ISSUER: z.string().min(1).optional(),
     IAM_TOKEN_AUDIENCE: z.string().min(1).optional(),
+    OATHWEAVE_ISSUER: z.string().url().optional(),
+    OATHWEAVE_JWKS_URL: z.string().url().optional(),
+    OATHWEAVE_USERINFO_URL: z.string().url().optional(),
+    MAGNUS_OATHWEAVE_IDENTITIES_JSON: z.string().optional(),
     // Skills
     SKILLS_DIR: z.string().default(DEFAULT_SKILLS_DIR),
     // Log retention
@@ -164,6 +182,15 @@ export const envSchema = z.object({
         .regex(/^\s*(?:[a-z][a-z0-9_-]{0,31}\s*=\s*(?:generic|slack|discord|mattermost)\s*(?:,\s*|$))*$/, 'must list legacy=format pairs, where format is generic, slack, discord or mattermost')
         .optional(),
 }).superRefine((env, ctx) => {
+    if (env.FLEET_GATEWAY_URL) {
+        const url = new URL(env.FLEET_GATEWAY_URL);
+        if (url.protocol !== 'https:' || url.username || url.password || url.pathname !== '/' || url.search || url.hash)
+            ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['FLEET_GATEWAY_URL'], message: 'FLEET_GATEWAY_URL must be a bare HTTPS origin' });
+        if (env.RESOURCE_ENROLLMENT_DASHBOARD_PARTICIPANT === 'absent')
+            ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['RESOURCE_ENROLLMENT_DASHBOARD_PARTICIPANT'], message: 'A deployed fleet gateway cannot be declared absent; unset FLEET_GATEWAY_URL or RESOURCE_ENROLLMENT_DASHBOARD_PARTICIPANT' });
+    }
+    if (Boolean(env.FLEET_GATEWAY_URL) !== Boolean(env.FLEET_GATEWAY_TOKEN_SHA256))
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['FLEET_GATEWAY_TOKEN_SHA256'], message: 'FLEET_GATEWAY_URL and FLEET_GATEWAY_TOKEN_SHA256 must be configured together' });
     try {
         webhookTypeAliases(env.MAGNUS_WEBHOOK_TYPE_ALIASES);
     }
@@ -192,6 +219,9 @@ export const envSchema = z.object({
             message: 'NOTIFICATION_READ_RETENTION_DAYS cannot exceed NOTIFICATION_MAX_RETENTION_DAYS',
         });
     }
+    for (const issue of oathweaveConfigurationIssues(env)) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: [issue.path], message: issue.message });
+    }
     if (env.IAM_CORE_URL) {
         for (const field of ['IAM_TOKEN_ISSUER', 'IAM_TOKEN_AUDIENCE']) {
             if (env[field])
@@ -246,10 +276,6 @@ export const envSchema = z.object({
             message: 'AGENT_DISCOVERY_SECRET is required when ENABLE_AGENT_DISCOVERY=true',
         });
     }
-    if (env.SECURITY_FUSION_MODE === 'local' && !env.SECURITY_FUSION_RECEIPT_SIGNING_KEY) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['SECURITY_FUSION_RECEIPT_SIGNING_KEY'],
-            message: 'SECURITY_FUSION_RECEIPT_SIGNING_KEY is required when SECURITY_FUSION_MODE=local' });
-    }
     if (env.MAGNUS_PLUGIN_API_ENABLED) {
         if (!env.MAGNUS_PLUGIN_READ_TOKEN_DIGESTS_JSON)
             ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['MAGNUS_PLUGIN_READ_TOKEN_DIGESTS_JSON'],
@@ -336,6 +362,7 @@ export const envSchema = z.object({
         env.MAGNUS_PLUGIN_OPERATOR_TOKEN_SHA256,
         env.MAGNUS_FLEET_CHECK_TOKEN_SHA256,
         env.MAGNUS_COLLECTOR_TOKEN_SHA256,
+        env.FLEET_GATEWAY_TOKEN_SHA256,
         ...configuredDigestValues(env.MAGNUS_PLUGIN_READ_TOKEN_DIGESTS_JSON),
     ].filter((value) => Boolean(value)));
     if (env.MAGNUS_SHARED_RESOURCE_TOKEN_SHA256 && otherScopedDigests.has(env.MAGNUS_SHARED_RESOURCE_TOKEN_SHA256)) {

package/dist/config/features.js

@@ -3,14 +3,17 @@ export function featureFlags(env = process.env) {
     const mode = env['SECURITY_FUSION_MODE'];
     return {
         iam: Boolean(env['IAM_CORE_URL']),
+        oathweave: Boolean(env['OATHWEAVE_ISSUER']),
+        hermes: truthy(env['MAGNUS_HERMES_ENABLED']),
         router: Boolean(env['MAGNUS_ROUTER_URL'] || env['HIVE_ROUTER_URL']),
         hivemem: Boolean(env['HIVEMEM_URL']),
-        securityFusion: mode === 'local' || mode === 'remote' ? mode : 'off',
+        securityFusion: mode === 'remote' ? mode : 'off',
         securityConsoleUrl: env['MAGNUS_SECURITY_CONSOLE_URL'] || null,
         pluginApi: truthy(env['MAGNUS_PLUGIN_API_ENABLED']),
         hermesRegistry: truthy(env['MAGNUS_HERMES_REGISTRY_ENABLED']),
         resourceLeases: truthy(env['MAGNUS_RESOURCE_LEASES_ENABLED']),
         agentDiscovery: truthy(env['ENABLE_AGENT_DISCOVERY']),
+        fleetGateway: Boolean(env['FLEET_GATEWAY_URL'] && env['FLEET_GATEWAY_TOKEN_SHA256']),
     };
 }
 /** Boolean switch with an explicit default: only `true`/`false` (any case) override it. */

package/dist/config/oathweave.js

@@ -0,0 +1,42 @@
+import { z } from 'zod';
+import { isOathweaveEndpoint, parseOathweaveLinks } from '@hivemagnus/magnus-oathweave';
+export { isOathweaveEndpoint, OATHWEAVE_AUDIENCE, parseOathweaveLinks, } from '@hivemagnus/magnus-oathweave';
+/** Every startup problem with the Oathweave settings, keyed by variable name. */
+export function oathweaveConfigurationIssues(env) {
+    const issues = [];
+    const fields = ['OATHWEAVE_ISSUER', 'OATHWEAVE_JWKS_URL', 'OATHWEAVE_USERINFO_URL'];
+    if (!fields.some((field) => env[field]) && !env.MAGNUS_OATHWEAVE_IDENTITIES_JSON)
+        return issues;
+    if (env.IAM_CORE_URL && env.OATHWEAVE_ISSUER) {
+        issues.push({ path: 'OATHWEAVE_ISSUER', message: 'IAM_CORE_URL and OATHWEAVE_ISSUER cannot both be configured; choose one RS256 token verifier' });
+    }
+    for (const field of fields) {
+        const value = env[field];
+        if (!value)
+            issues.push({ path: field, message: `${field} is required when Oathweave authentication is configured` });
+        else if (!isOathweaveEndpoint(value))
+            issues.push({ path: field, message: `${field} must be an HTTPS URL without credentials or a fragment` });
+    }
+    if (!env.MAGNUS_OATHWEAVE_IDENTITIES_JSON) {
+        issues.push({ path: 'MAGNUS_OATHWEAVE_IDENTITIES_JSON', message: 'MAGNUS_OATHWEAVE_IDENTITIES_JSON is required when Oathweave authentication is configured' });
+        return issues;
+    }
+    try {
+        const links = parseOathweaveLinks(env.MAGNUS_OATHWEAVE_IDENTITIES_JSON);
+        const seen = new Set();
+        for (const link of links) {
+            if (env.OATHWEAVE_ISSUER && link.issuer !== env.OATHWEAVE_ISSUER)
+                throw new Error('every identity link issuer must exactly equal OATHWEAVE_ISSUER');
+            const key = JSON.stringify([link.issuer, link.subject]);
+            if (seen.has(key))
+                throw new Error('identity links must be unique per issuer and subject');
+            seen.add(key);
+        }
+    }
+    catch (error) {
+        issues.push({ path: 'MAGNUS_OATHWEAVE_IDENTITIES_JSON', message: error instanceof Error && !(error instanceof z.ZodError) && !(error instanceof SyntaxError)
+                ? error.message : 'MAGNUS_OATHWEAVE_IDENTITIES_JSON must be a JSON array of {issuer,subject,localUserId,role}' });
+    }
+    return issues;
+}
+//# sourceMappingURL=oathweave.js.map

package/dist/config/rehearsal.js

@@ -0,0 +1,22 @@
+import { z } from 'zod';
+import { HttpError } from '../middleware/error-handler.js';
+export function rehearsalEnabled(env = process.env) {
+    return z.enum(['true', 'false']).default('false').parse(env['HIVE_REHEARSAL']) === 'true';
+}
+/** Isolated candidates must not claim restored queues, run timers or import catalogs. */
+export function startLiveBackgroundServices(start, env = process.env) {
+    if (rehearsalEnabled(env))
+        return false;
+    start();
+    return true;
+}
+export function assertLiveExecution(env = process.env) {
+    if (rehearsalEnabled(env))
+        throw new HttpError(503, 'REHEARSAL_READ_ONLY', 'Isolated rehearsal disables host execution and queue activation');
+}
+export const rehearsalReadOnly = async (context, next) => {
+    if (rehearsalEnabled() && !['GET', 'HEAD', 'OPTIONS'].includes(context.req.method))
+        return context.json({ success: false, error: { code: 'REHEARSAL_READ_ONLY', message: 'Isolated rehearsal disables mutations and dispatch' } }, 503);
+    return next();
+};
+//# sourceMappingURL=rehearsal.js.map