factory-ai 1.0.0

package/bin/factory

@@ -0,0 +1,271 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CONFIG_FILE=${FACTORY_CONFIG_FILE:-$HOME/.config/factory-ai/config}
+LEGACY_CONFIG_FILE=$HOME/.config/agent-factory/config
+if [[ -f $CONFIG_FILE ]]; then source "$CONFIG_FILE"; elif [[ -f $LEGACY_CONFIG_FILE ]]; then source "$LEGACY_CONFIG_FILE"; fi
+RESOURCE_GROUP=${FACTORY_RESOURCE_GROUP:-factory-ai-rg}
+VM=${FACTORY_VM:-agent-factory-vm}
+NAMESPACE=${FACTORY_SERVICE_BUS:-}
+VAULT=${FACTORY_KEY_VAULT:-}
+
+remote() {
+  az vm run-command invoke --resource-group "$RESOURCE_GROUP" --name "$VM" \
+    --command-id RunShellScript --scripts "$1" --query 'value[0].message' --output tsv
+}
+
+usage() {
+  printf '%s\n' \
+    'Factory AI operator console' \
+    'Usage: factory <command>' \
+    '  setup' \
+    '  github status | connect ORG | transfer OWNER/REPO ORG' \
+    '  telegram status | configure | start | stop' \
+    '  submit <owner/repo> <objective>' \
+    '  issue <owner/repo> <number>' \
+    '  ui' \
+    '  init <local-project-path>' \
+    '  secret list | set NAME | copy NAME | delete NAME' \
+    '  dashboard | status | queue | report | logs | doctor' \
+    '  pause | resume'
+}
+
+command=${1:-help}
+shift || true
+case "$command" in
+  telegram)
+    action=${1:-status}
+    case "$action" in
+      status) remote 'systemctl status agent-factory-telegram.service --no-pager -n 20' ;;
+      start) remote 'systemctl restart agent-factory-telegram.service; systemctl is-active agent-factory-telegram.service' ;;
+      stop) remote 'systemctl stop agent-factory-telegram.service' ;;
+      configure)
+        read -r -s -p 'Telegram bot token from @BotFather: ' telegram_token; printf '\n'
+        read -r -p 'Allowed Telegram chat IDs (comma-separated): ' telegram_chat_ids
+        [[ $telegram_chat_ids =~ ^-?[0-9]+(,-?[0-9]+)*$ ]] || { printf 'Invalid Telegram chat ID allowlist\n' >&2; exit 2; }
+        ip=$(curl -fsS https://api.ipify.org)
+        cleanup_telegram_vault() { az keyvault network-rule remove --name "$VAULT" --ip-address "$ip/32" --output none >/dev/null 2>&1 || true; }
+        trap cleanup_telegram_vault EXIT
+        az keyvault network-rule add --name "$VAULT" --ip-address "$ip/32" --output none
+        sleep 5
+        az keyvault secret set --vault-name "$VAULT" --name telegram-bot-token --value "$telegram_token" --output none
+        az keyvault secret set --vault-name "$VAULT" --name telegram-allowed-chat-ids --value "$telegram_chat_ids" --output none
+        unset telegram_token
+        remote 'systemctl restart agent-factory-telegram.service; systemctl is-active agent-factory-telegram.service'
+        ;;
+      *) printf 'Unknown telegram action: %s\n' "$action" >&2; exit 2 ;;
+    esac
+    ;;
+  issue)
+    repo=${1:?repository owner/name required}
+    number=${2:?issue number required}
+    [[ $repo =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ && $number =~ ^[0-9]+$ ]] || { printf 'Invalid repository or issue number\n' >&2; exit 2; }
+    issue=$(gh issue view "$number" --repo "$repo" --json title,body,url)
+    title=$(jq -r .title <<<"$issue")
+    body=$(jq -r .body <<<"$issue")
+    url=$(jq -r .url <<<"$issue")
+    objective="/goal Resolve GitHub issue #$number: $title"
+    objective+=$'\n\n'
+    objective+="$body"
+    objective+=$'\n\nSource: '
+    objective+="$url"
+    exec "$0" submit "$repo" "$objective"
+    ;;
+  ui)
+    FACTORY_RESOURCE_GROUP="$RESOURCE_GROUP" FACTORY_VM="$VM" FACTORY_SERVICE_BUS="$NAMESPACE" FACTORY_KEY_VAULT="$VAULT" node "$(dirname "$0")/../src/tui.js"
+    ;;
+  setup)
+    for dependency in az gh jq curl ssh-keygen node; do command -v "$dependency" >/dev/null || { printf 'Missing dependency: %s\n' "$dependency" >&2; exit 1; }; done
+    choices=$(mktemp)
+    trap 'rm -f "$choices"' EXIT
+    node "$(dirname "$0")/../src/setup-menu.js" "$choices"
+    provider=$(jq -r .provider "$choices")
+    location=$(jq -r .location "$choices")
+    enterprise_org=$(jq -r .githubOrg "$choices")
+    aws_region=$(jq -r .awsRegion "$choices")
+    bedrock_builder=$(jq -r .bedrockBuilderModel "$choices")
+    deploy_now=$(jq -r .deployNow "$choices")
+    telegram=$(jq -r .telegram "$choices")
+    az account show --query '{subscription:name,state:state}' --output table
+    gh auth status
+    az group show --name "$RESOURCE_GROUP" --output none 2>/dev/null || az group create --name "$RESOURCE_GROUP" --location "$location" --output none
+    key=${FACTORY_SSH_KEY:-$HOME/.ssh/agent-factory-azure}
+    [[ -f $key ]] || ssh-keygen -t ed25519 -f "$key" -N "" -C agent-factory-azure
+    operator=$(az ad signed-in-user show --query id --output tsv)
+    deployment=$(az deployment group create --name agent-factory-setup --resource-group "$RESOURCE_GROUP" --template-file "$(dirname "$0")/../infra/main.bicep" --parameters adminSshKey="$(< "$key.pub")" operatorObjectId="$operator" --output json)
+    vault=$(jq -r '.properties.outputs.keyVaultName.value' <<<"$deployment")
+    namespace=$(jq -r '.properties.outputs.serviceBusNamespace.value' <<<"$deployment")
+    VAULT=$vault
+    NAMESPACE=$namespace
+    mkdir -p "$(dirname "$CONFIG_FILE")"
+    {
+      printf 'FACTORY_RESOURCE_GROUP=%q\n' "$RESOURCE_GROUP"
+      printf 'FACTORY_VM=%q\n' agent-factory-vm
+      printf 'FACTORY_SERVICE_BUS=%q\n' "$namespace"
+      printf 'FACTORY_KEY_VAULT=%q\n' "$vault"
+    } > "$CONFIG_FILE"
+    chmod 0600 "$CONFIG_FILE"
+    ip=$(curl -fsS https://api.ipify.org)
+    cleanup_setup_vault() { az keyvault network-rule remove --name "$vault" --ip-address "$ip/32" --output none >/dev/null 2>&1 || true; rm -f "$choices"; }
+    trap cleanup_setup_vault EXIT
+    az keyvault network-rule add --name "$vault" --ip-address "$ip/32" --output none
+    sleep 10
+    github_token=$(gh auth token)
+    az keyvault secret set --vault-name "$vault" --name github-token --value "$github_token" --output none
+    unset github_token
+    if [[ -n $enterprise_org ]]; then
+      gh api "orgs/$enterprise_org" --silent
+      az keyvault secret set --vault-name "$vault" --name github-enterprise-org --value "$enterprise_org" --output none
+    fi
+    if [[ $provider == azure || $provider == both ]]; then
+      read -r -p 'Azure OpenAI-compatible base URL: ' azure_base
+      read -r -s -p 'Azure API key: ' azure_key; printf '\n'
+      read -r -p 'Separate GPT-5.4 base URL (Enter to reuse): ' azure_small_base
+      [[ -n $azure_small_base ]] || azure_small_base=$azure_base
+      read -r -s -p 'Separate GPT-5.4 key (Enter to reuse): ' azure_small_key; printf '\n'
+      [[ -n $azure_small_key ]] || azure_small_key=$azure_key
+      az keyvault secret set --vault-name "$vault" --name azure-primary-base-url --value "$azure_base" --output none
+      az keyvault secret set --vault-name "$vault" --name azure-primary-api-key --value "$azure_key" --output none
+      az keyvault secret set --vault-name "$vault" --name azure-small-base-url --value "$azure_small_base" --output none
+      az keyvault secret set --vault-name "$vault" --name azure-small-api-key --value "$azure_small_key" --output none
+      unset azure_key azure_small_key
+    fi
+    if [[ $provider == bedrock || $provider == both ]]; then
+      read -r -p 'AWS access key ID: ' aws_access_key
+      read -r -s -p 'AWS secret access key: ' aws_secret_key; printf '\n'
+      read -r -s -p 'AWS session token (optional): ' aws_session_token; printf '\n'
+      az keyvault secret set --vault-name "$vault" --name aws-access-key-id --value "$aws_access_key" --output none
+      az keyvault secret set --vault-name "$vault" --name aws-secret-access-key --value "$aws_secret_key" --output none
+      [[ -n $aws_session_token ]] && az keyvault secret set --vault-name "$vault" --name aws-session-token --value "$aws_session_token" --output none
+      unset aws_access_key aws_secret_key aws_session_token
+    fi
+    if [[ $telegram == true ]]; then
+      read -r -s -p 'Telegram bot token from @BotFather: ' telegram_token; printf '\n'
+      read -r -p 'Allowed Telegram chat IDs (comma-separated): ' telegram_chat_ids
+      [[ $telegram_chat_ids =~ ^-?[0-9]+(,-?[0-9]+)*$ ]] || { printf 'Invalid Telegram chat ID allowlist\n' >&2; exit 2; }
+      az keyvault secret set --vault-name "$vault" --name telegram-bot-token --value "$telegram_token" --output none
+      az keyvault secret set --vault-name "$vault" --name telegram-allowed-chat-ids --value "$telegram_chat_ids" --output none
+      unset telegram_token
+    fi
+    printf 'Azure foundation and credential vault ready. Config: %s\n' "$CONFIG_FILE"
+    if [[ $deploy_now == true ]]; then
+      source_ref=$(gh api repos/itsvedantkumar/factory-ai/commits/main --jq .sha)
+      parameters=(KEY_VAULT_NAME "$vault" SERVICE_BUS_NAMESPACE "$namespace" SERVICE_BUS_QUEUE code-tasks SOURCE_REPOSITORY itsvedantkumar/factory-ai SOURCE_REF "$source_ref")
+      if [[ $provider == bedrock ]]; then
+        parameters+=(AWS_REGION "$aws_region")
+        for role in SCOUT PLANNER BUILDER TESTER DEBUGGER REVIEWER SECURITY RELEASE; do parameters+=("FACTORY_MODEL_$role" "bedrock/$bedrock_builder"); done
+      elif [[ $provider == both ]]; then
+        parameters+=(AWS_REGION "$aws_region" FACTORY_MODEL_BUILDER "bedrock/$bedrock_builder")
+      fi
+      az vm run-command invoke --resource-group "$RESOURCE_GROUP" --name agent-factory-vm --command-id RunShellScript \
+        --scripts @"$(dirname "$0")/../bootstrap/deploy-runtime.sh" --parameters "${parameters[@]}" --output none
+      printf 'Runtime deployed. Run: factory doctor && factory dashboard\n'
+    fi
+    ;;
+  github)
+    action=${1:-status}
+    case "$action" in
+      status)
+        gh auth status
+        printf 'Organizations:\n'
+        gh api user/orgs --jq '.[].login'
+        ;;
+      connect)
+        org=${2:?Enterprise organization required}
+        gh api "orgs/$org" --jq '{login,plan:.plan.name}'
+        token=$(gh auth token)
+        ip=$(curl -fsS https://api.ipify.org)
+        cleanup_github_vault() { az keyvault network-rule remove --name "$VAULT" --ip-address "$ip/32" --output none >/dev/null 2>&1 || true; }
+        trap cleanup_github_vault EXIT
+        az keyvault network-rule add --name "$VAULT" --ip-address "$ip/32" --output none
+        sleep 5
+        az keyvault secret set --vault-name "$VAULT" --name github-token --value "$token" --output none
+        az keyvault secret set --vault-name "$VAULT" --name github-enterprise-org --value "$org" --output none
+        unset token
+        printf 'Connected organization %s. Restart release/worker services after credential changes.\n' "$org"
+        ;;
+      transfer)
+        repo=${2:?OWNER/REPO required}
+        org=${3:?Enterprise organization required}
+        gh api --method POST "repos/$repo/transfer" -f new_owner="$org" --silent
+        printf 'Transfer requested: %s -> %s. Update submit paths after GitHub completes it.\n' "$repo" "$org"
+        ;;
+      *) printf 'Unknown github action: %s\n' "$action" >&2; exit 2 ;;
+    esac
+    ;;
+  secret)
+    action=${1:-list}
+    name=${2:-}
+    ip=$(curl -fsS https://api.ipify.org)
+    cleanup_vault_rule() { az keyvault network-rule remove --name "$VAULT" --ip-address "$ip/32" --output none >/dev/null 2>&1 || true; }
+    trap cleanup_vault_rule EXIT
+    az keyvault network-rule add --name "$VAULT" --ip-address "$ip/32" --output none
+    sleep 5
+    case "$action" in
+      list) az keyvault secret list --vault-name "$VAULT" --query '[].{name:name,updated:attributes.updated}' --output table ;;
+      set)
+        [[ $name =~ ^[A-Za-z0-9-]+$ ]] || { printf 'Valid secret name required\n' >&2; exit 2; }
+        read -r -s -p "Value for $name: " value
+        printf '\n'
+        az keyvault secret set --vault-name "$VAULT" --name "$name" --value "$value" --output none
+        unset value
+        printf 'Stored %s in Azure Key Vault.\n' "$name"
+        ;;
+      copy)
+        [[ $name =~ ^[A-Za-z0-9-]+$ ]] || { printf 'Valid secret name required\n' >&2; exit 2; }
+        az keyvault secret show --vault-name "$VAULT" --name "$name" --query value --output tsv | pbcopy
+        printf 'Copied %s to clipboard without printing it.\n' "$name"
+        ;;
+      delete)
+        [[ $name =~ ^[A-Za-z0-9-]+$ ]] || { printf 'Valid secret name required\n' >&2; exit 2; }
+        az keyvault secret delete --vault-name "$VAULT" --name "$name" --output none
+        printf 'Soft-deleted %s.\n' "$name"
+        ;;
+      *) printf 'Unknown secret action: %s\n' "$action" >&2; exit 2 ;;
+    esac
+    ;;
+  init)
+    target=${1:?local project path required}
+    [[ -d $target ]] || { printf 'Project directory does not exist: %s\n' "$target" >&2; exit 2; }
+    context="$target/.agent-factory"
+    mkdir -p "$context"
+    for template in "$(dirname "$0")/../templates/project/"*.md; do
+      destination="$context/$(basename "$template")"
+      [[ -e $destination ]] || cp "$template" "$destination"
+    done
+    printf 'Initialized %s\nShared runtime memory remains on Azure; repo context lives in .agent-factory/.\n' "$context"
+    ;;
+  submit)
+    repo=${1:?repository owner/name required}
+    shift
+    objective=${*:?objective required}
+    [[ $repo =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]] || { printf 'Invalid repository\n' >&2; exit 2; }
+    repo64=$(printf '%s' "$repo" | base64)
+    objective64=$(printf '%s' "$objective" | base64)
+    remote "repo=\$(printf '%s' '$repo64' | base64 -d); objective=\$(printf '%s' '$objective64' | base64 -d); sudo -u factory env \$(xargs < /etc/agent-factory-control.env) node /opt/agent-factory/app/src/ceo.js --repo \"https://github.com/\$repo.git\" --base main \"\$objective\""
+    ;;
+  dashboard|status)
+    remote 'sudo -u factory env $(xargs < /etc/agent-factory-control.env) node /opt/agent-factory/app/src/dashboard.js'
+    ;;
+  queue)
+    az servicebus queue list --resource-group "$RESOURCE_GROUP" --namespace-name "$NAMESPACE" \
+      --query '[].{queue:name,active:countDetails.activeMessageCount,deadLetter:countDetails.deadLetterMessageCount}' --output table
+    ;;
+  report)
+    remote 'node -e '\''const fs=require("fs"),p="/opt/agent-factory/state/reports";const f=fs.readdirSync(p).filter(x=>x.endsWith(".md")).sort().at(-1);process.stdout.write(fs.readFileSync(`${p}/${f}`,"utf8"))'\'''
+    ;;
+  logs)
+    remote 'journalctl -u agent-factory-control -u agent-factory-worker -u agent-factory-release --since "1 hour ago" --no-pager -n 250'
+    ;;
+  doctor)
+    remote 'systemctl is-active agent-factory-control agent-factory-worker agent-factory-release; systemctl is-enabled agent-factory-reporter.timer; docker ps --format "{{.Names}} {{.Status}}"; findmnt /opt/agent-factory/state; df -h /opt/agent-factory/state; free -h'
+    ;;
+  pause)
+    remote 'systemctl stop agent-factory-worker agent-factory-release'
+    ;;
+  resume)
+    remote 'systemctl start agent-factory-worker agent-factory-release; systemctl is-active agent-factory-worker agent-factory-release'
+    ;;
+  help|-h|--help) usage ;;
+  *) usage >&2; exit 2 ;;
+esac

package/bootstrap/agent-factory-control.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=Factory AI capability-free control plane
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=300
+StartLimitBurst=10
+
+[Service]
+Type=simple
+User=factory
+Group=factory
+WorkingDirectory=/opt/agent-factory/app
+EnvironmentFile=/etc/agent-factory-control.env
+ExecStart=/usr/bin/node /opt/agent-factory/app/src/control-service.js
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=45
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+ReadWritePaths=/opt/agent-factory/state
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

package/bootstrap/agent-factory-release.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=Factory AI trusted release bot
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=factory
+Group=factory
+WorkingDirectory=/opt/agent-factory/app
+EnvironmentFile=/etc/agent-factory.env
+Environment=HOME=/opt/agent-factory/state/home
+ExecStart=/usr/bin/node /opt/agent-factory/app/src/release-service.js
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=45
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/agent-factory/state /opt/agent-factory/logs
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

package/bootstrap/agent-factory-reporter.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Factory AI hourly progress report
+After=agent-factory-worker.service
+
+[Service]
+Type=oneshot
+User=factory
+Group=factory
+WorkingDirectory=/opt/agent-factory/app
+EnvironmentFile=/etc/agent-factory.env
+ExecStart=/usr/bin/node /opt/agent-factory/app/src/reporter.js
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/agent-factory/state
+UMask=0027

package/bootstrap/agent-factory-reporter.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Generate Factory AI progress report hourly
+
+[Timer]
+OnCalendar=hourly
+Persistent=true
+RandomizedDelaySec=60
+
+[Install]
+WantedBy=timers.target

package/bootstrap/agent-factory-telegram.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=Factory AI Telegram remote objective intake
+After=network-online.target agent-factory-control.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=factory
+Group=factory
+WorkingDirectory=/opt/agent-factory/app
+EnvironmentFile=/etc/agent-factory.env
+Environment=HOME=/opt/agent-factory/state/home
+ExecStart=/usr/bin/node /opt/agent-factory/app/src/telegram-service.js
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=40
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+ReadWritePaths=/opt/agent-factory/state/telegram
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

package/bootstrap/agent-factory-worker.service

@@ -0,0 +1,39 @@
+[Unit]
+Description=Factory AI durable worker
+After=network-online.target docker.service
+Wants=network-online.target
+Requires=docker.service
+StartLimitIntervalSec=300
+StartLimitBurst=10
+
+[Service]
+Type=simple
+User=factory
+Group=factory
+WorkingDirectory=/opt/agent-factory/app
+EnvironmentFile=/etc/agent-factory.env
+Environment=HOME=/opt/agent-factory/state/home
+Environment=XDG_CACHE_HOME=/opt/agent-factory/state/home/.cache
+Environment=XDG_CONFIG_HOME=/opt/agent-factory/state/home/.config
+ExecStart=/usr/bin/node /opt/agent-factory/app/src/worker.js
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=45
+KillSignal=SIGTERM
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SupplementaryGroups=docker
+ReadWritePaths=/opt/agent-factory/state /opt/agent-factory/workspaces /opt/agent-factory/logs
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target

package/bootstrap/cloud-init.yaml

@@ -0,0 +1,78 @@
+#cloud-config
+package_update: true
+package_upgrade: true
+packages:
+  - ca-certificates
+  - curl
+  - docker-compose-v2
+  - docker.io
+  - fail2ban
+  - git
+  - jq
+  - postgresql-client
+  - ripgrep
+  - sqlite3
+  - unattended-upgrades
+
+write_files:
+  - path: /etc/docker/daemon.json
+    permissions: '0644'
+    content: |
+      {
+        "log-driver": "json-file",
+        "log-opts": {
+          "max-size": "20m",
+          "max-file": "5"
+        },
+        "live-restore": true
+      }
+  - path: /etc/sysctl.d/99-agent-factory.conf
+    permissions: '0644'
+    content: |
+      fs.inotify.max_user_instances=1024
+      fs.inotify.max_user_watches=1048576
+      fs.file-max=2097152
+  - path: /etc/systemd/system/agent-factory-health.service
+    permissions: '0644'
+    content: |
+      [Unit]
+      Description=Agent factory host health check
+      After=network-online.target docker.service
+      Wants=network-online.target
+
+      [Service]
+      Type=oneshot
+      ExecStart=/usr/local/bin/agent-factory-health
+  - path: /etc/systemd/system/agent-factory-health.timer
+    permissions: '0644'
+    content: |
+      [Unit]
+      Description=Run agent factory host health check
+
+      [Timer]
+      OnBootSec=5min
+      OnUnitActiveSec=5min
+      Persistent=true
+
+      [Install]
+      WantedBy=timers.target
+  - path: /usr/local/bin/agent-factory-health
+    permissions: '0755'
+    content: |
+      #!/usr/bin/env bash
+      set -euo pipefail
+      test "$(systemctl is-active docker)" = active
+      test "$(df --output=pcent / | tail -1 | tr -dc '0-9')" -lt 90
+      test "$(awk '/MemAvailable/ {print $2}' /proc/meminfo)" -gt 1048576
+
+runcmd:
+  - [mkdir, -p, /opt/agent-factory/workspaces, /opt/agent-factory/state, /opt/agent-factory/logs]
+  - [chmod, '0750', /opt/agent-factory]
+  - [systemctl, enable, --now, docker]
+  - [systemctl, enable, --now, fail2ban]
+  - [systemctl, enable, --now, unattended-upgrades]
+  - [systemctl, daemon-reload]
+  - [systemctl, enable, --now, agent-factory-health.timer]
+  - [sysctl, --system]
+
+final_message: Agent factory base host ready after $UPTIME seconds

package/bootstrap/deploy-runtime.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -euo pipefail
+set +x
+
+if [[ ${EUID} -ne 0 ]]; then
+  echo "deploy-runtime.sh must run as root" >&2
+  exit 1
+fi
+
+while (($# > 0)); do
+  if [[ $1 == *=* ]]; then
+    name=${1%%=*}
+    value=${1#*=}
+    shift
+  else
+    name=$1
+    shift
+    (($# > 0)) || { echo "Missing value for $name" >&2; exit 1; }
+    value=$1
+    shift
+  fi
+  case "$name" in
+    KEY_VAULT_NAME|SERVICE_BUS_NAMESPACE|SERVICE_BUS_QUEUE|SOURCE_REPOSITORY|SOURCE_REF|AWS_REGION|FACTORY_MODEL_SCOUT|FACTORY_MODEL_PLANNER|FACTORY_MODEL_BUILDER|FACTORY_MODEL_TESTER|FACTORY_MODEL_DEBUGGER|FACTORY_MODEL_REVIEWER|FACTORY_MODEL_SECURITY|FACTORY_MODEL_RELEASE) printf -v "$name" '%s' "$value" ;;
+    *) echo "Unknown deployment parameter: $name" >&2; exit 1 ;;
+  esac
+done
+
+: "${KEY_VAULT_NAME:?KEY_VAULT_NAME is required}"
+: "${SERVICE_BUS_NAMESPACE:?SERVICE_BUS_NAMESPACE is required}"
+: "${SOURCE_REPOSITORY:?SOURCE_REPOSITORY as OWNER/REPOSITORY is required}"
+: "${SOURCE_REF:?SOURCE_REF must be a full commit SHA}"
+SERVICE_BUS_QUEUE=${SERVICE_BUS_QUEUE:-code-tasks}
+[[ $SOURCE_REPOSITORY =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]] || { echo "Invalid SOURCE_REPOSITORY" >&2; exit 1; }
+[[ $SOURCE_REF =~ ^[0-9a-f]{40}$ ]] || { echo "SOURCE_REF must be a full lowercase commit SHA" >&2; exit 1; }
+
+export DEBIAN_FRONTEND=noninteractive
+apt-get update
+apt-get install -y ca-certificates curl git gpg rsync
+install -d -m 0755 /etc/apt/keyrings
+curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /etc/apt/keyrings/githubcli-archive-keyring.gpg
+chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
+printf '%s\n' "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list
+curl -fsSL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor --yes -o /etc/apt/keyrings/microsoft.gpg
+printf '%s\n' "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/azure-cli/ $(. /etc/os-release && printf '%s' "$VERSION_CODENAME") main" > /etc/apt/sources.list.d/azure-cli.list
+apt-get update
+apt-get install -y azure-cli gh
+
+az login --identity --allow-no-subscriptions --output none
+github_token=$(az keyvault secret show --vault-name "$KEY_VAULT_NAME" --name "${GITHUB_TOKEN_SECRET:-github-token}" --query value --output tsv)
+[[ -n $github_token && $github_token != *$'\n'* && $github_token != *$'\r'* ]] || { echo "GitHub secret is empty or invalid" >&2; exit 1; }
+
+temporary=$(mktemp -d /opt/agent-factory-source.XXXXXX)
+trap 'rm -rf "$temporary"' EXIT
+GH_TOKEN="$github_token" gh repo clone "$SOURCE_REPOSITORY" "$temporary/source" -- --no-checkout
+unset github_token
+git -C "$temporary/source" checkout --detach "$SOURCE_REF"
+test "$(git -C "$temporary/source" rev-parse HEAD)" = "$SOURCE_REF"
+install -d -m 0755 /opt/agent-factory/app
+rsync -a --delete --exclude .git "$temporary/source/" /opt/agent-factory/app/
+
+KEY_VAULT_NAME="$KEY_VAULT_NAME" \
+SERVICE_BUS_NAMESPACE="$SERVICE_BUS_NAMESPACE" \
+SERVICE_BUS_QUEUE="$SERVICE_BUS_QUEUE" \
+FACTORY_WORKER_IMAGE="agent-factory-worker:$SOURCE_REF" \
+AWS_REGION="${AWS_REGION:-}" \
+FACTORY_MODEL_SCOUT="${FACTORY_MODEL_SCOUT:-}" \
+FACTORY_MODEL_PLANNER="${FACTORY_MODEL_PLANNER:-}" \
+FACTORY_MODEL_BUILDER="${FACTORY_MODEL_BUILDER:-}" \
+FACTORY_MODEL_TESTER="${FACTORY_MODEL_TESTER:-}" \
+FACTORY_MODEL_DEBUGGER="${FACTORY_MODEL_DEBUGGER:-}" \
+FACTORY_MODEL_REVIEWER="${FACTORY_MODEL_REVIEWER:-}" \
+FACTORY_MODEL_SECURITY="${FACTORY_MODEL_SECURITY:-}" \
+FACTORY_MODEL_RELEASE="${FACTORY_MODEL_RELEASE:-}" \
+bash /opt/agent-factory/app/bootstrap/setup.sh