feat(ui): console feedback v1 and the admin Nodes view (#1454)

* feat(ui): console feedback round: state tones, inline tags, filter bar and form fixes

Settled states go green and transitions yellow with a spinner, status text is
lowercase, tags are edited inline row by row, every list filters through one
filter bar, long cells truncate with a tooltip and times are relative.

EC2 launch takes a Name and offers ICMP echo, and leaves Placement Group out
when no group is available. RDS create is reordered with engine tiles and
window pickers. Route 53 records get bulk delete, a TTL select, value labels
that follow the type, and NS. Tooltips use the popover tokens, and the console
is sized over a 110% root.

* feat(ui): size RDS instance classes and give each record value its own input

An RDS class is a db.-prefixed EC2 type, so the class picker shows its vCPUs
and memory in every option and under the field, as the EC2 launch form does,
on create, modify and restore.

A Route 53 record's values were one textarea, which let a line break into a
value. Each value is now a single-line input with Add value; Enter starts the
next one, a pasted list splits into rows, and CNAME takes exactly one.

* fix(ui): open a DNS record for editing from the keyboard

* feat: admin node inventory, topology, live host metrics and network test

Each node collects its hardware facts as root at daemon start (dmidecode,
ethtool, networkctl LLDP where available) into /etc/spinifex/node-facts, and
the daemon serves them with its plane wiring over NATS.

New admin-only actions, refused for every account but the system admin
account regardless of policy:

- GetNodeFacts: hardware, NICs, LLDP neighbours and planes per node
- GetNodeMetrics: live CPU, memory and per-plane traffic for one node
- StartNetworkTest / DescribeNetworkTests: iperf2 between nodes over a
  chosen plane, both directions, one test cluster-wide at a time, recorded
  in KV and converged asynchronously

The iperf listener runs only for the duration of a run, without
capabilities, on TCP 5001, which the peers firewall rule now allows. A run
refuses any target outside the node's own plane subnet.

The console gains a node panel (hardware, network, metrics, network test
with a dial scaled to the port's line rate) and a topology view built with
@xyflow/react. setup.sh installs dmidecode and iperf.

* test: cover the node insight handlers and the facts file mode

* feat: report every CPU flag in node facts

* feat(ui): node table on the dashboard, every CPU flag and a readable topology

The dashboard's nodes section is the Nodes page table, open by default, and a
row opens that node. Ready reads green, capacity sorts by most available, and
the processor's features tip lists every flag. Topology draws one row per
port with switches in a muted card, highlights a node's links on hover, and
offers a left-to-right layout beside top-down.

* chore(ui): rebuild dist

* fix: align the CPU facts fields

* fix: bound the network test server start and read ARM CPU features and cores

* chore(ui): rebuild dist

* test(ui): pin the instances baseline clock and take the screenshots from CI's Playwright image

* fix: retry a network test claim whose holder released it mid-check

build/microvm/lambda-runtime/init.sh

@@ -16,8 +16,53 @@ load_mod() {
     done
     return 1
 }
-load_mod virtio_net || true
+# lambda-agent reads its identity from fw_cfg and unloads qemu_fw_cfg before
+# anything else runs. virtio_net needs net_failover and failover, and the
+# insmod fallback resolves no dependencies, so load the chain bottom-up.
+load_mod qemu_fw_cfg || echo "[init] qemu_fw_cfg did not load" >/dev/console
+load_mod failover || true
+load_mod net_failover || true
+load_mod virtio_net || echo "[init] virtio_net did not load" >/dev/console
 
 ip link set lo up
 
+# The guest's addresses come from the same netcfg entry as other system VMs.
+NETCFG=/sys/firmware/qemu_fw_cfg/by_name/opt/spinifex/netcfg/raw
+i=0
+while [ "$i" -lt 25 ] && [ ! -f "$NETCFG" ]; do
+    sleep 0.04
+    i=$((i + 1))
+done
+if [ -f "$NETCFG" ]; then
+    # shellcheck source=/dev/null
+    . "$NETCFG"
+    for n in 0 1 2 3 4 5; do
+        eval mac=\$NIC${n}_MAC
+        [ -z "$mac" ] && continue
+        iface=""
+        for _ in 1 2 3 4 5; do
+            iface=$(ip -o link | awk -v m="$mac" 'tolower($0) ~ tolower(m) {print $2}' | tr -d :)
+            [ -n "$iface" ] && break
+            sleep 0.02
+        done
+        if [ -z "$iface" ]; then
+            echo "[init] no interface for MAC $mac (NIC$n)" >/dev/console
+            continue
+        fi
+        cidr="" gw="" default="" rdst="" rvia=""
+        eval cidr=\$NIC${n}_CIDR
+        eval gw=\$NIC${n}_GW
+        eval default=\$NIC${n}_DEFAULT
+        eval rdst=\$NIC${n}_ROUTE_DST
+        eval rvia=\$NIC${n}_ROUTE_VIA
+        ip link set "$iface" up
+        [ -n "$cidr" ] && ip addr add "$cidr" dev "$iface"
+        [ "$default" = "1" ] && [ -n "$gw" ] && ip route add default via "$gw" dev "$iface"
+        [ -n "$rdst" ] && [ -n "$rvia" ] && ip route add "$rdst" via "$rvia" dev "$iface"
+    done
+else
+    # lambda-agent then fails to reach the host and the guest powers off.
+    echo "[init] fw_cfg netcfg not available" >/dev/console
+fi
+
 exec /sbin/init

build/systemd/spinifex-daemon.service

@@ -1,4 +1,4 @@
-# spinifex-unit-version: 5
+# spinifex-unit-version: 6
 [Unit]
 Description=Spinifex Daemon (VM Orchestration)
 PartOf=spinifex.target
@@ -15,6 +15,7 @@ Slice=spinifex-system.slice
 User=spinifex-daemon
 Group=spinifex
 ExecStartPre=/usr/local/bin/spx admin hostnet check
+ExecStartPre=-+/usr/local/bin/spx admin node-facts collect
 ExecStart=/usr/local/bin/spx service spinifex start
 Restart=on-failure
 RestartSec=5

cmd/lambda-agent/link_none.go

@@ -1,18 +0,0 @@
-//go:build !lambdatestlink
-
-package main
-
-import (
-	"errors"
-	"io"
-
-	"github.com/mulgadc/spinifex/spinifex/agents/lambda/hostlink"
-)
-
-// errNoHostTransport is returned until an authenticated host transport exists:
-// a normal build accepts no host work.
-var errNoHostTransport = errors.New("no authenticated host transport in this build")
-
-func openHostLink() (hostlink.Link, io.Closer, error) {
-	return nil, nil, errNoHostTransport
-}

cmd/lambda-agent/link_testlink.go

@@ -1,27 +0,0 @@
-//go:build lambdatestlink
-
-package main
-
-import (
-	"errors"
-	"flag"
-	"io"
-	"os"
-
-	"github.com/mulgadc/spinifex/spinifex/agents/lambda/hostlink"
-)
-
-// The test carrier is unauthenticated and exists only in lambdatestlink builds
-// used for local proofs; it is not the guest protocol.
-var linkPath = flag.String("link", os.Getenv("LAMBDA_AGENT_LINK"), "test carrier device path")
-
-func openHostLink() (hostlink.Link, io.Closer, error) {
-	if *linkPath == "" {
-		return nil, nil, errors.New("no test carrier configured")
-	}
-	dev, err := os.OpenFile(*linkPath, os.O_RDWR, 0)
-	if err != nil {
-		return nil, nil, err
-	}
-	return hostlink.NewTestStream(dev), dev, nil
-}

cmd/lambda-agent/main.go

@@ -1,87 +1,24 @@
-// lambda-agent runs inside a Lambda guest. It serves the Lambda Runtime API on
-// guest loopback, starts the function's bootstrap, and relays invocations
-// between the host link and that runtime.
+// lambda-agent runs inside a Lambda guest.
 //
-// A normal build has no host transport and refuses to start; the unauthenticated
-// test carrier exists only in lambdatestlink builds. The agent never listens for
-// the host.
+// A normal build reads its per-generation identity from fw_cfg, unloads
+// fw_cfg so nothing started later can read the guest key, and opens the
+// authenticated control connection to the host. It accepts no invocations and
+// never starts the function's bootstrap: the message protocol and grant
+// fencing do not exist yet. The agent never listens for the host.
+//
+// A lambdatestlink build instead relays invocations over an unauthenticated
+// test carrier for local proofs; it is not the guest protocol.
 package main
 
 import (
 	"context"
-	"errors"
 	"flag"
-	"fmt"
-	"log/slog"
-	"net"
-	"net/http"
 	"os"
-	"os/exec"
-	"syscall"
-	"time"
-
-	"github.com/mulgadc/spinifex/spinifex/agents/lambda/agent"
-	"github.com/mulgadc/spinifex/spinifex/agents/lambda/runtimeapi"
-)
-
-const (
-	runtimeAddr = "127.0.0.1:9001"
-	taskRoot    = "/var/task"
 )
 
 func main() { os.Exit(run()) }
 
 func run() int {
-	handler := flag.String("handler", os.Getenv("_HANDLER"), "function handler passed to the bootstrap")
 	flag.Parse()
-
-	link, closer, err := openHostLink()
-	if err != nil {
-		slog.Error("no host link; refusing to start", "err", err)
-		return 2
-	}
-	defer closer.Close()
-
-	srv := runtimeapi.New()
-	ln, err := net.Listen("tcp", runtimeAddr)
-	if err != nil {
-		slog.Error("listen runtime api", "err", err)
-		return 1
-	}
-	hs := &http.Server{Handler: srv.Handler(), ReadHeaderTimeout: 10 * time.Second}
-	go func() { _ = hs.Serve(ln) }()
-	defer hs.Close()
-
-	ctx, cancel := context.WithCancelCause(context.Background())
-	defer cancel(nil)
-
-	cmd := exec.CommandContext(ctx, taskRoot+"/bootstrap")
-	cmd.Env = []string{
-		"AWS_LAMBDA_RUNTIME_API=" + runtimeAddr,
-		"_HANDLER=" + *handler,
-		"LAMBDA_TASK_ROOT=" + taskRoot,
-		"PATH=/bin:/sbin:/usr/bin",
-	}
-	cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
-	cmd.Cancel = func() error { return cmd.Process.Signal(syscall.SIGTERM) }
-	cmd.WaitDelay = 5 * time.Second
-	if err := cmd.Start(); err != nil {
-		slog.Error("start bootstrap", "err", err)
-		return 1
-	}
-	exited := make(chan struct{})
-	go func() {
-		defer close(exited)
-		err := cmd.Wait()
-		cancel(fmt.Errorf("bootstrap exited: %w", err))
-	}()
-
-	err = agent.Run(ctx, link, srv)
-	cancel(errors.New("agent stopping"))
-	<-exited
-	if err != nil {
-		slog.Error("agent stopped", "err", err)
-		return 1
-	}
-	return 0
+	return start(context.Background())
 }

cmd/lambda-agent/start_tcp.go

@@ -0,0 +1,84 @@
+//go:build !lambdatestlink
+
+package main
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+
+	"github.com/mulgadc/spinifex/spinifex/agents/lambda/hostlink"
+)
+
+// Exit statuses: the guest refused to start, the control connection failed,
+// or the host closed it.
+const (
+	exitRefused = 2
+	exitLink    = 1
+	exitClosed  = 0
+)
+
+// errNoProtocol is returned when the host sends anything: this build defines no
+// message protocol, so it accepts no work.
+var errNoProtocol = errors.New("host sent data, but this build accepts no invocations")
+
+type startup struct {
+	fwCfgDir  string
+	fwCfgRoot string
+	unload    func() error
+}
+
+func start(ctx context.Context) int {
+	s := startup{fwCfgDir: hostlink.FwCfgDir, fwCfgRoot: hostlink.FwCfgRoot, unload: hostlink.UnloadFwCfg}
+	code, err := s.run(ctx)
+	if err != nil {
+		slog.Error("lambda-agent stopping", "exit", code, "err", err)
+	}
+	return code
+}
+
+// run loads the identity, seals fw_cfg whether or not the load succeeded,
+// then authenticates to the host and holds the connection until it closes.
+func (s startup) run(ctx context.Context) (int, error) {
+	id, loadErr := hostlink.LoadIdentity(s.fwCfgDir)
+	if err := hostlink.SealFwCfg(s.fwCfgRoot, s.unload); err != nil {
+		return exitRefused, errors.Join(loadErr, err)
+	}
+	if loadErr != nil {
+		return exitRefused, loadErr
+	}
+	conn, err := hostlink.Dial(ctx, id)
+	if err != nil {
+		if ctx.Err() != nil {
+			err = fmt.Errorf("%w: %w", err, context.Cause(ctx))
+		}
+		return exitLink, err
+	}
+	defer conn.Close()
+	slog.Info("control connection open; invocations are not enabled in this build", "host", id.HostAddr)
+	if err := awaitHostClose(ctx, conn); err != nil {
+		return exitLink, err
+	}
+	return exitClosed, nil
+}
+
+// awaitHostClose reads until the host closes the connection. Under TLS 1.3 a
+// host that rejects the guest certificate is only seen here, on first read.
+func awaitHostClose(ctx context.Context, conn *tls.Conn) error {
+	stop := context.AfterFunc(ctx, func() { _ = conn.Close() })
+	defer stop()
+	n, err := conn.Read(make([]byte, 1))
+	switch {
+	case n > 0:
+		return errNoProtocol
+	case errors.Is(err, io.EOF):
+		return nil
+	case ctx.Err() != nil:
+		return fmt.Errorf("control connection: %w", context.Cause(ctx))
+	default:
+		return fmt.Errorf("control connection: %w", err)
+	}
+}

cmd/lambda-agent/start_tcp_test.go

@@ -0,0 +1,256 @@
+//go:build !lambdatestlink
+
+package main
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	lambdav1 "github.com/mulgadc/spinifex/contracts/lambda/v1"
+	"github.com/mulgadc/spinifex/spinifex/runtime/compute/lambda/guestconn"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const scope lambdav1.Scope = "ap-southeast-2/000000000001/fn-1/env-1/gen-1"
+
+// guest is a fake fw_cfg tree; unload removes it as unloading the module would.
+type guest struct {
+	root     string
+	unloads  int
+	sealedAt chan struct{}
+}
+
+func newGuest(t *testing.T, entries map[string][]byte) *guest {
+	t.Helper()
+	g := &guest{root: filepath.Join(t.TempDir(), "qemu_fw_cfg"), sealedAt: make(chan struct{}, 1)}
+	for name, b := range entries {
+		dir := filepath.Join(g.root, "by_name", lambdav1.FwCfgPrefix, name)
+		require.NoError(t, os.MkdirAll(dir, 0o700))
+		require.NoError(t, os.WriteFile(filepath.Join(dir, "raw"), b, 0o600))
+	}
+	return g
+}
+
+func (g *guest) startup() startup {
+	return startup{
+		fwCfgDir:  filepath.Join(g.root, "by_name", lambdav1.FwCfgPrefix),
+		fwCfgRoot: g.root,
+		unload: func() error {
+			g.unloads++
+			g.sealedAt <- struct{}{}
+			return os.RemoveAll(g.root)
+		},
+	}
+}
+
+type host struct {
+	ln   *net.TCPListener
+	gen  *guestconn.Generation
+	conn chan accepted
+}
+
+func newHost(t *testing.T) *host {
+	t.Helper()
+	ln, err := net.ListenTCP("tcp", &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	require.NoError(t, err)
+	t.Cleanup(func() { ln.Close() })
+	gen, err := guestconn.NewGeneration(scope, time.Hour)
+	require.NoError(t, err)
+	return &host{ln: ln, gen: gen, conn: make(chan accepted, 1)}
+}
+
+func (h *host) entries() map[string][]byte { return h.gen.GuestEntries(h.ln.Addr().String()) }
+
+type accepted struct {
+	conn *tls.Conn
+	err  error
+}
+
+// accept runs the host end until ctx ends and reports what it accepted.
+func (h *host) accept(ctx context.Context) {
+	go func() {
+		c, err := h.gen.AcceptGuest(ctx, h.ln, 2*time.Second)
+		h.conn <- accepted{c, err}
+	}()
+}
+
+// guest waits for the host to authenticate the guest.
+func (h *host) guest(t *testing.T) *tls.Conn {
+	t.Helper()
+	a := wait(t, h.conn, "host to authenticate the guest")
+	require.NoError(t, a.err)
+	return a.conn
+}
+
+// wait bounds every test wait so a stalled host or startup fails promptly.
+func wait[T any](t *testing.T, ch <-chan T, what string) T {
+	t.Helper()
+	select {
+	case v := <-ch:
+		return v
+	case <-time.After(10 * time.Second):
+		t.Fatalf("timed out waiting for %s", what)
+		panic("unreachable")
+	}
+}
+
+type result struct {
+	code int
+	err  error
+}
+
+func runAsync(ctx context.Context, s startup) <-chan result {
+	out := make(chan result, 1)
+	go func() {
+		code, err := s.run(ctx)
+		out <- result{code, err}
+	}()
+	return out
+}
+
+func TestStartupAuthenticatesAfterSealingFwCfg(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	h := newHost(t)
+	h.accept(ctx)
+	g := newGuest(t, h.entries())
+	done := runAsync(ctx, g.startup())
+
+	conn := h.guest(t)
+	select {
+	case <-g.sealedAt:
+	default:
+		t.Fatal("guest dialled before fw_cfg was sealed")
+	}
+	_, err := os.Stat(g.root)
+	assert.ErrorIs(t, err, os.ErrNotExist, "fw_cfg still readable while connected")
+
+	require.NoError(t, conn.Close())
+	res := wait(t, done, "startup to return")
+	assert.Equal(t, exitClosed, res.code)
+	assert.NoError(t, res.err)
+	assert.Equal(t, 1, g.unloads)
+}
+
+func TestStartupRefusesHostData(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	h := newHost(t)
+	h.accept(ctx)
+	done := runAsync(ctx, newGuest(t, h.entries()).startup())
+
+	conn := h.guest(t)
+	defer conn.Close()
+	_, err := conn.Write([]byte{0})
+	require.NoError(t, err)
+	res := wait(t, done, "startup to return")
+	assert.Equal(t, exitLink, res.code)
+	assert.ErrorIs(t, res.err, errNoProtocol)
+}
+
+// The host pins another generation's guest; the guest learns of the refusal
+// on its first read and fails with a link error, never a clean close.
+func TestStartupFailsWhenHostRefusesGuest(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	h := newHost(t)
+	h.accept(ctx)
+	other, err := guestconn.NewGeneration(scope, time.Hour)
+	require.NoError(t, err)
+	entries := h.entries()
+	wrong := other.GuestEntries(h.ln.Addr().String())
+	entries[lambdav1.EntryGuestKey], entries[lambdav1.EntryGuestCert] = wrong[lambdav1.EntryGuestKey], wrong[lambdav1.EntryGuestCert]
+	g := newGuest(t, entries)
+
+	res := wait(t, runAsync(ctx, g.startup()), "startup to return")
+	assert.Equal(t, exitLink, res.code)
+	require.Error(t, res.err)
+	assert.Contains(t, res.err.Error(), "bad certificate")
+	assert.Equal(t, 1, g.unloads)
+	select {
+	case a := <-h.conn:
+		require.Error(t, a.err, "host accepted a guest it does not pin")
+	default:
+	}
+}
+
+func TestStartupRefusesWithoutDialling(t *testing.T) {
+	h := newHost(t)
+	cases := map[string]struct {
+		entries map[string][]byte
+		unload  func(g *guest) func() error
+		want    string
+	}{
+		"missing entry": {
+			entries: func() map[string][]byte { e := h.entries(); delete(e, lambdav1.EntryHostCert); return e }(),
+			want:    "read host-cert",
+		},
+		"fw_cfg stays readable": {
+			entries: h.entries(),
+			unload:  func(*guest) func() error { return func() error { return errors.New("module is built in") } },
+			want:    "fw_cfg still readable",
+		},
+		"unload claims success but tree remains": {
+			entries: h.entries(),
+			unload:  func(*guest) func() error { return func() error { return nil } },
+			want:    "unload reported success",
+		},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			g := newGuest(t, tc.entries)
+			s := g.startup()
+			if tc.unload != nil {
+				s.unload = tc.unload(g)
+			}
+			code, err := s.run(context.Background())
+			assert.Equal(t, exitRefused, code)
+			assert.ErrorContains(t, err, tc.want)
+		})
+	}
+
+	// Nothing dialled the host in any case above.
+	require.NoError(t, h.ln.SetDeadline(time.Now().Add(50*time.Millisecond)))
+	_, err := h.ln.Accept()
+	var ne net.Error
+	require.ErrorAs(t, err, &ne)
+	assert.True(t, ne.Timeout())
+}
+
+// A missing entry still seals fw_cfg: the key may be present even when
+// another entry is not.
+func TestStartupSealsEvenWhenIdentityIsIncomplete(t *testing.T) {
+	h := newHost(t)
+	e := h.entries()
+	delete(e, lambdav1.EntryHostAddr)
+	g := newGuest(t, e)
+	code, err := g.startup().run(context.Background())
+	assert.Equal(t, exitRefused, code)
+	assert.ErrorContains(t, err, "read host-addr")
+	assert.Equal(t, 1, g.unloads)
+	_, statErr := os.Stat(g.root)
+	assert.ErrorIs(t, statErr, os.ErrNotExist)
+}
+
+func TestStartupStopsWithContext(t *testing.T) {
+	ctx, cancel := context.WithCancelCause(context.Background())
+	defer cancel(nil)
+	h := newHost(t)
+	h.accept(ctx)
+	done := runAsync(ctx, newGuest(t, h.entries()).startup())
+	conn := h.guest(t)
+	defer conn.Close()
+
+	reason := errors.New("guest shutting down")
+	cancel(reason)
+	res := wait(t, done, "startup to return")
+	assert.Equal(t, exitLink, res.code)
+	assert.ErrorIs(t, res.err, reason)
+}

cmd/lambda-agent/start_testlink.go

@@ -0,0 +1,87 @@
+//go:build lambdatestlink
+
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"log/slog"
+	"net"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/mulgadc/spinifex/spinifex/agents/lambda/agent"
+	"github.com/mulgadc/spinifex/spinifex/agents/lambda/hostlink"
+	"github.com/mulgadc/spinifex/spinifex/agents/lambda/runtimeapi"
+)
+
+const (
+	runtimeAddr = "127.0.0.1:9001"
+	taskRoot    = "/var/task"
+)
+
+var (
+	linkPath = flag.String("link", os.Getenv("LAMBDA_AGENT_LINK"), "test carrier device path")
+	handler  = flag.String("handler", os.Getenv("_HANDLER"), "function handler passed to the bootstrap")
+)
+
+func start(parent context.Context) int {
+	if *linkPath == "" {
+		slog.Error("no test carrier configured; refusing to start")
+		return 2
+	}
+	// The bootstrap is tenant code; fw_cfg must be unreadable before it runs.
+	if err := hostlink.SealFwCfg(hostlink.FwCfgRoot, hostlink.UnloadFwCfg); err != nil {
+		slog.Error("seal fw_cfg; refusing to start", "err", err)
+		return 2
+	}
+	dev, err := os.OpenFile(*linkPath, os.O_RDWR, 0)
+	if err != nil {
+		slog.Error("open test carrier; refusing to start", "err", err)
+		return 2
+	}
+	defer dev.Close()
+	link := hostlink.NewTestStream(dev)
+
+	srv := runtimeapi.New()
+	ln, err := net.Listen("tcp", runtimeAddr)
+	if err != nil {
+		slog.Error("listen runtime api", "err", err)
+		return 1
+	}
+	hs := &http.Server{Handler: srv.Handler(), ReadHeaderTimeout: 10 * time.Second}
+	go func() { _ = hs.Serve(ln) }()
+	defer hs.Close()
+
+	ctx, cancel := context.WithCancelCause(parent)
+	defer cancel(nil)
+
+	cmd, err := agent.StartBootstrap(ctx, taskRoot+"/bootstrap", []string{
+		"AWS_LAMBDA_RUNTIME_API=" + runtimeAddr,
+		"_HANDLER=" + *handler,
+		"LAMBDA_TASK_ROOT=" + taskRoot,
+		"PATH=/bin:/sbin:/usr/bin",
+	}, os.Stdout, os.Stderr)
+	if err != nil {
+		slog.Error("start bootstrap", "err", err)
+		return 1
+	}
+	exited := make(chan struct{})
+	go func() {
+		defer close(exited)
+		err := cmd.Wait()
+		cancel(fmt.Errorf("bootstrap exited: %w", err))
+	}()
+
+	err = agent.Run(ctx, link, srv)
+	cancel(errors.New("agent stopping"))
+	<-exited
+	if err != nil {
+		slog.Error("agent stopped", "err", err)
+		return 1
+	}
+	return 0
+}

contracts/cluster/v1/facts.go

@@ -0,0 +1,211 @@
+package clusterv1
+
+import "regexp"
+
+const (
+	// NodeFactsSubject fans out a request for each daemon's hardware and
+	// cabling description. Its reply payload is NodeFacts.
+	NodeFactsSubject = "spinifex.node.facts"
+
+	nodeNetTestPrefix = "spinifex.node.nettest."
+)
+
+var nodeIDPattern = regexp.MustCompile(`^[A-Za-z0-9_-]{1,64}$`)
+
+// ValidNodeID reports whether a node name is safe to place in a subject: no
+// NATS token separator or wildcard can get through.
+func ValidNodeID(node string) bool {
+	return nodeIDPattern.MatchString(node)
+}
+
+// NetTestServeSubject asks one node to start a one-shot throughput server.
+func NetTestServeSubject(node string) string {
+	return nodeNetTestPrefix + node + ".serve"
+}
+
+// NetTestRunSubject asks one node to run the client side of a throughput test.
+func NetTestRunSubject(node string) string {
+	return nodeNetTestPrefix + node + ".run"
+}
+
+// Planes a node's NICs can carry, named as the installer names them.
+const (
+	PlaneWAN = "wan"
+	PlaneLAN = "lan"
+	PlaneVPC = "vpc"
+)
+
+// NetTestPort is the TCP port reserved for node-to-node throughput tests.
+const NetTestPort = 5001
+
+// NodeFacts describes one node's hardware, OS and cabling. Fields a host
+// cannot report are left empty, and Sources says why.
+type NodeFacts struct {
+	Node        string            `json:"node"`
+	CollectedAt string            `json:"collected_at,omitempty"`
+	FormFactor  string            `json:"form_factor"`
+	Virt        string            `json:"virt,omitempty"`
+	System      SystemFacts       `json:"system"`
+	OS          OSFacts           `json:"os"`
+	CPU         CPUFacts          `json:"cpu"`
+	Memory      MemoryFacts       `json:"memory"`
+	NICs        []NICFacts        `json:"nics"`
+	Planes      []PlaneFacts      `json:"planes"`
+	Sources     map[string]string `json:"sources"`
+}
+
+// SystemFacts is the machine's identity from DMI.
+type SystemFacts struct {
+	Vendor       string `json:"vendor,omitempty"`
+	Product      string `json:"product,omitempty"`
+	Family       string `json:"family,omitempty"`
+	Version      string `json:"version,omitempty"`
+	Serial       string `json:"serial,omitempty"`
+	UUID         string `json:"uuid,omitempty"`
+	ChassisType  string `json:"chassis_type,omitempty"`
+	ChassisAsset string `json:"chassis_asset,omitempty"`
+	BoardVendor  string `json:"board_vendor,omitempty"`
+	BoardProduct string `json:"board_product,omitempty"`
+	BoardSerial  string `json:"board_serial,omitempty"`
+	BIOSVendor   string `json:"bios_vendor,omitempty"`
+	BIOSVersion  string `json:"bios_version,omitempty"`
+	BIOSDate     string `json:"bios_date,omitempty"`
+	DeviceModel  string `json:"device_model,omitempty"`
+}
+
+// OSFacts names the running OS and Spinifex build.
+type OSFacts struct {
+	Name          string `json:"name,omitempty"`
+	Kernel        string `json:"kernel,omitempty"`
+	Arch          string `json:"arch,omitempty"`
+	Version       string `json:"spx_version,omitempty"`
+	Commit        string `json:"spx_commit,omitempty"`
+	UptimeSeconds int64  `json:"uptime_seconds,omitempty"`
+	Hostname      string `json:"hostname,omitempty"`
+}
+
+// CPUFacts summarises the sockets. Threads and Cores are totals. Features are
+// the flags worth naming; Flags is every flag the CPU reports.
+type CPUFacts struct {
+	Model          string   `json:"model,omitempty"`
+	Vendor         string   `json:"vendor,omitempty"`
+	Sockets        int      `json:"sockets"`
+	CoresPerSocket int      `json:"cores_per_socket,omitempty"`
+	Cores          int      `json:"cores"`
+	Threads        int      `json:"threads"`
+	MaxMHz         int      `json:"max_mhz,omitempty"`
+	CurrentMHz     int      `json:"current_mhz,omitempty"`
+	Virtualization string   `json:"virtualization,omitempty"`
+	Features       []string `json:"features,omitempty"`
+	Flags          []string `json:"flags,omitempty"`
+}
+
+// MemoryFacts groups identical DIMMs so a 32-slot board reads as one line.
+type MemoryFacts struct {
+	TotalBytes    uint64        `json:"total_bytes"`
+	SlotsUsed     int           `json:"slots_used"`
+	SlotsTotal    int           `json:"slots_total"`
+	MaxCapacity   string        `json:"max_capacity,omitempty"`
+	ECC           string        `json:"ecc,omitempty"`
+	Groups        []MemoryGroup `json:"groups"`
+	OSTotalBytes  uint64        `json:"os_total_bytes,omitempty"`
+	OSAvailBytes  uint64        `json:"os_available_bytes,omitempty"`
+	HugePageBytes uint64        `json:"huge_page_bytes,omitempty"`
+}
+
+// MemoryGroup is a set of DIMMs alike in every field shown. ConfiguredMTs
+// below SpeedMTs means the board runs them slower than rated.
+type MemoryGroup struct {
+	Count         int      `json:"count"`
+	SizeBytes     uint64   `json:"size_bytes"`
+	Type          string   `json:"type,omitempty"`
+	TypeDetail    string   `json:"type_detail,omitempty"`
+	FormFactor    string   `json:"form_factor,omitempty"`
+	SpeedMTs      int      `json:"speed_mts,omitempty"`
+	ConfiguredMTs int      `json:"configured_mts,omitempty"`
+	Manufacturer  string   `json:"manufacturer,omitempty"`
+	PartNumber    string   `json:"part_number,omitempty"`
+	Rank          string   `json:"rank,omitempty"`
+	Serials       []string `json:"serials,omitempty"`
+}
+
+// NICFacts is one physical network interface and, where LLDP reports it, the
+// switch port it is cabled to.
+type NICFacts struct {
+	Name      string        `json:"name"`
+	MAC       string        `json:"mac,omitempty"`
+	Driver    string        `json:"driver,omitempty"`
+	Firmware  string        `json:"firmware,omitempty"`
+	BusInfo   string        `json:"bus_info,omitempty"`
+	Model     string        `json:"model,omitempty"`
+	SpeedMbps int           `json:"speed_mbps,omitempty"`
+	MaxMbps   int           `json:"max_mbps,omitempty"`
+	Duplex    string        `json:"duplex,omitempty"`
+	Port      string        `json:"port,omitempty"`
+	MTU       int           `json:"mtu,omitempty"`
+	State     string        `json:"state"`
+	Master    string        `json:"master,omitempty"`
+	Planes    []string      `json:"planes,omitempty"`
+	Neighbor  *LLDPNeighbor `json:"neighbor,omitempty"`
+}
+
+// LLDPNeighbor is what the switch on the other end of a NIC advertises.
+type LLDPNeighbor struct {
+	ChassisID         string   `json:"chassis_id"`
+	SystemName        string   `json:"system_name,omitempty"`
+	SystemDescription string   `json:"system_description,omitempty"`
+	PortID            string   `json:"port_id,omitempty"`
+	PortDescription   string   `json:"port_description,omitempty"`
+	Capabilities      []string `json:"capabilities,omitempty"`
+}
+
+// PlaneFacts is the address a plane uses on this node and the NICs under it.
+type PlaneFacts struct {
+	Plane   string   `json:"plane"`
+	Bridge  string   `json:"bridge,omitempty"`
+	Address string   `json:"address,omitempty"`
+	Prefix  int      `json:"prefix,omitempty"`
+	NICs    []string `json:"nics,omitempty"`
+	MTU     int      `json:"mtu,omitempty"`
+}
+
+// NetTestServeRequest starts a server bound to the node's address on Plane.
+type NetTestServeRequest struct {
+	Plane           string `json:"plane"`
+	DurationSeconds int    `json:"duration_seconds"`
+}
+
+// NetTestServeResponse names the address the server listens on.
+type NetTestServeResponse struct {
+	Address string `json:"address,omitempty"`
+	Port    int    `json:"port,omitempty"`
+	Error   string `json:"error,omitempty"`
+}
+
+// NetTestRunRequest runs the client towards Address from the node's own
+// address on Plane.
+type NetTestRunRequest struct {
+	Plane           string `json:"plane"`
+	Address         string `json:"address"`
+	Port            int    `json:"port"`
+	DurationSeconds int    `json:"duration_seconds"`
+	Streams         int    `json:"streams"`
+}
+
+// NetTestRunResponse is one direction of a pair's measurement.
+type NetTestRunResponse struct {
+	SourceAddress string    `json:"source_address,omitempty"`
+	BitsPerSecond float64   `json:"bits_per_second"`
+	Bytes         int64     `json:"bytes"`
+	Seconds       float64   `json:"seconds"`
+	Streams       int       `json:"streams"`
+	StreamBPS     []float64 `json:"stream_bps,omitempty"`
+	RTTMinMillis  float64   `json:"rtt_min_ms,omitempty"`
+	RTTAvgMillis  float64   `json:"rtt_avg_ms,omitempty"`
+	RTTMaxMillis  float64   `json:"rtt_max_ms,omitempty"`
+	PacketLoss    float64   `json:"packet_loss_percent,omitempty"`
+	LinkMbps      int       `json:"link_mbps,omitempty"`
+	MTU           int       `json:"mtu,omitempty"`
+	Tool          string    `json:"tool,omitempty"`
+	Error         string    `json:"error,omitempty"`
+}

contracts/lambda/v1/README.md

@@ -34,6 +34,10 @@ Under TLS 1.3 the guest's handshake can complete before the host refuses its cer
 | `expect` | `<Region>/<account>/<function ID>/<environment ID>/<generation>` |
 | `host-addr` | Host listener as `host:port` |
 
+The guest's own interface settings come from `opt/spinifex/netcfg`, the entry other system VMs use.
+The agent unloads `qemu_fw_cfg` even when an entry is missing, and refuses to start if the fw_cfg tree is still readable afterwards.
+Until the message format exists, the agent authenticates and holds the connection but accepts no host message and starts no user code.
+
 **Authority:** one environment's attempt only.
 The user runtime never holds these keys, and sharing the guest with the agent gives user code no platform authority.
 

contracts/operator/v1/admin.go

@@ -74,3 +74,65 @@ type ListAccountsResponse struct {
 	Accounts []AccountSummary `json:"accounts"`
 	Count    int              `json:"count"`
 }
+
+// IAMQuiescence is the coordinator's recorded view of IAM quiescence for one
+// fence. Recording only: it admits nothing, and QuiescedScope stays empty until
+// a final inventory re-read exists to catch a late write.
+type IAMQuiescence struct {
+	OperationID   string            `json:"operationId"`
+	Fence         uint64            `json:"fence"`
+	Generation    uint64            `json:"generation"`
+	QuiescedScope []string          `json:"quiescedScope"`
+	Unresolved    []UnresolvedScope `json:"unresolved"`
+	Consumers     []ConsumerBasis   `json:"consumers"`
+	Writers       []AccountedWriter `json:"writers"`
+	Inventory     []InventoryStatus `json:"inventory"`
+	EvaluatedAt   string            `json:"evaluatedAt"`
+}
+
+// UnresolvedScope names a scope or writer that blocks quiescence, with a fixed
+// reason. It is never a timeout.
+type UnresolvedScope struct {
+	Scope  string `json:"scope"`
+	Class  string `json:"class"`
+	Reason string `json:"reason"`
+}
+
+// ConsumerBasis cites an enforcement consumer and the accepted contract that
+// lets it count as having applied the generation.
+type ConsumerBasis struct {
+	Consumer string `json:"consumer"`
+	Basis    string `json:"basis"`
+}
+
+// AccountedWriter is a writer that cannot be fenced and is covered by the
+// owner's inventory instead. Ref names the tracked work that closes the gap.
+type AccountedWriter struct {
+	Writer string `json:"writer"`
+	Basis  string `json:"basis"`
+	Ref    string `json:"ref"`
+}
+
+// InventoryStatus is the owner inventory's status for one kind at evaluation.
+type InventoryStatus struct {
+	Kind   string `json:"kind"`
+	Status string `json:"status"`
+}
+
+// Classes of an UnresolvedScope.
+const (
+	UnresolvedClassFence    = "fence"
+	UnresolvedClassConsumer = "consumer"
+	UnresolvedClassWriter   = "writer"
+)
+
+// Fixed reasons of an UnresolvedScope.
+const (
+	ReasonFenceMismatch                = "fence-mismatch"
+	ReasonIAMReadbackFailed            = "iam-readback-failed"
+	ReasonNoAcceptedEnforcement        = "no-accepted-enforcement-contract"
+	ReasonNoCompleteOwnerInventory     = "no-complete-owner-inventory"
+	ReasonParticipantNotDeclared       = "participant-not-declared"
+	ReasonOwnerInventoryIncomplete     = "owner-inventory-incomplete"
+	ReasonFinalInventoryRereadNotWired = "final-inventory-reread-not-wired"
+)

contracts/telemetry/v1/node_live.go

@@ -0,0 +1,53 @@
+package telemetryv1
+
+import "regexp"
+
+// Node live subjects mirror the instance ones, keyed by node name. Only the
+// super-admin account's gateway handler subscribes to them.
+const (
+	nodeLiveWatchSubjectPrefix  = "telemetry.watch.node."
+	nodeLiveSampleSubjectPrefix = "telemetry.live.node."
+)
+
+var liveNodePattern = regexp.MustCompile(`^[A-Za-z0-9_-]{1,64}$`)
+
+// ValidLiveNode reports whether a node name is safe to place in a subject.
+func ValidLiveNode(node string) bool {
+	return liveNodePattern.MatchString(node)
+}
+
+// NodeLiveWatchSubject is where a viewer asks a node to keep sampling itself.
+// A request on it is answered with a NodeLiveRing.
+func NodeLiveWatchSubject(node string) string {
+	return nodeLiveWatchSubjectPrefix + node
+}
+
+// NodeLiveSampleSubject carries one NodeLiveSample per period while watched.
+func NodeLiveSampleSubject(node string) string {
+	return nodeLiveSampleSubjectPrefix + node
+}
+
+// NodeLiveRing answers a watch with the samples newer than its SinceMillis.
+type NodeLiveRing struct {
+	Samples []NodeLiveSample `json:"samples"`
+}
+
+// NodeLiveSample is one host measurement. Rates are per second over the
+// interval ending at TimeMillis.
+type NodeLiveSample struct {
+	TimeMillis int64   `json:"t"`
+	CPUPercent float64 `json:"cpu"`
+	// MemoryUsedPercent is used memory less page cache, as free(1) reports it.
+	MemoryUsedPercent float64 `json:"mem"`
+	Load1             float64 `json:"load1"`
+	// Planes holds the traffic of each plane's physical NICs, keyed wan, lan, vpc.
+	Planes map[string]NodeLivePlane `json:"planes"`
+}
+
+// NodeLivePlane is one plane's traffic from the host's side.
+type NodeLivePlane struct {
+	NetworkIn  float64 `json:"netIn"`
+	NetworkOut float64 `json:"netOut"`
+	PacketsIn  float64 `json:"pktIn"`
+	PacketsOut float64 `json:"pktOut"`
+}

docs/security/network-connections/README.md

@@ -99,6 +99,7 @@ behavior in other words.
 | 4432 | Formation server | HTTPS | Cluster (bootstrap only) | Cluster join coordination; active only while a join token is valid. Binds the node's `--bind` (lan) address. See *Formation port lifecycle* below. | Short-lived bearer token + TLS¹ |
 | 4222 | spinifex-nats (client) | NATS + TLS | Cluster | Internal service bus for EC2/EBS/VPC/S3 handlers | Token + mutual TLS (cluster CA) |
 | 4248 | spinifex-nats (cluster) | NATS + TLS | Cluster | Inter-node NATS federation | Token + mutual TLS (cluster CA) |
+| 5001 | iperf2 (admin network test) | TCP | Cluster, any plane | Throughput test between two nodes, started only by the super-admin account. Listens on one plane address for the length of one test, then exits. Runs with no capabilities. | None — peer-scoped by firewall, and the client may only target its own plane subnet |
 | 5300 | northstar | DNS (UDP + TCP) | Cluster | Forward target for every node's per-instance DNS shim, dialled cross-node. Binds the wildcard by design. | None — restrict by firewall |
 | 6660 | predastore (blob node) | QUIC / UDP | Cluster | Erasure-coded object shard transport between hosts. Multi-node clusters only — see *Predastore ports* below. | TLS 1.3, server certificate verified against the cluster CA |
 | 7660 | predastore (meta node) | QUIC / UDP | Cluster | Raft consensus over global state — buckets and the object index — between hosts. Multi-node clusters only. | TLS 1.3, server certificate verified against the cluster CA |
@@ -221,7 +222,7 @@ table inet spinifex_filter {
 
     # Cluster, from peer nodes only. Replace with your nodes' lan-plane
     # addresses — a CIDR does not generalise to nodes on different subnets.
-    ip saddr { 10.0.1.1, 10.0.1.2, 10.0.1.3 } tcp dport { 4222, 4248, 4432, 5300, 6641, 6642, 6643, 6644, 8660 } accept
+    ip saddr { 10.0.1.1, 10.0.1.2, 10.0.1.3 } tcp dport { 4222, 4248, 4432, 5001, 5300, 6641, 6642, 6643, 6644, 8660 } accept
     ip saddr { 10.0.1.1, 10.0.1.2, 10.0.1.3 } udp dport { 5300, 6660, 7660 } accept
 
     # Encap, from peer chassis only. Replace with your nodes' vpc-plane

docs/ui/design-system.md

@@ -24,7 +24,7 @@ All colours are OKLCH and come from mulgadc.com, so product and site match.
 | Token | Use |
 |---|---|
 | `background` | The app page. Warm off-white in light, ink `#14181D` in dark. |
-| `card`, `popover` | Raised surfaces. White in light, about `#1B2027` in dark. |
+| `card`, `popover` | Raised surfaces. White in light, about `#1B2027` in dark. `popover` is every floating surface: tooltips, popovers, menus and pickers. |
 | `muted`, `secondary`, `accent` | Hover rows, secondary buttons, quiet fills. |
 | `border` | Every divider and card edge. `#DCD8CE` in light, `oklch(1 0 0 / 8%)` in dark. |
 | `brand` | Brand orange `#EE4B12`, for the logo and decoration only. It fails text contrast, so it never carries text. |
@@ -39,15 +39,22 @@ Each status has a solid token plus `-foreground` (text on a tinted background),
 
 | Status | Hue | AWS states |
 |---|---|---|
-| `success` | green | running, available, completed, healthy |
-| `warning` | brand yellow `#F5B500` | pending, stopping, creating, modifying, deleting, draining |
-| `danger` | cool red, hue 17 | stopped, error, failed, unhealthy, unavailable |
+| `success` | green | settled and good: running, available, active, associated, attached, in-use, healthy, ok, main |
+| `warning` | brand yellow `#F5B500` | changing state and will settle: pending, stopping, creating, modifying, deleting, draining |
+| `caution` | orange, hue 58 | works but needs attention: degraded, impaired, insufficient-data |
+| `danger` | cool red, hue 17 | stopped, error, failed, update-failed, unhealthy, unavailable, blackhole |
 | `info` | blue | informational notes |
-| `neutral` | grey `#9AA1A8` | terminated (muted text), and any unmapped state |
+| `neutral` | grey `#9AA1A8` | gone or absent (terminated, deleted, no) in muted text, and any unmapped state |
 
 `stopped` is danger because EC2 reads it that way, although RDS treats it as a resting state; splitting the map by service is its own change.
 
 `StateBadge` (`src/components/state-badge.tsx`) is the only mapping from an AWS state to a tone, and it exposes the result as `data-tone` for tests.
+Its tones are `success`, `progress` (the yellow `warning` token), `caution`, `danger`, `muted` and `neutral`.
+A `progress` state carries the submit button's spinning loader, so a launching instance reads as work under way; `StatusBadge` does not, because its yellow can mean waiting on the user, as a zone's `pending nameservers` does.
+It shows every state lowercase with hyphens, as EC2 writes them, so EKS's `ACTIVE` reads `active` and Bedrock's `IN_PROGRESS` reads `in-progress`; the API value, filters and CLI panels keep AWS's case.
+A good or settled state is always green, never grey, and a status that is not an API state, such as a cluster's health, uses `StatusBadge` with a tone rather than a `Badge`.
+The orange of `caution` is kept clear of the primary accent's hue, which marks actions and never a status.
+`Badge`'s default variant is the brand primary and is never used for a status; a label that is not a status, such as `default v3` or `Leader`, uses a `secondary` or `outline` `Badge`.
 Every status badge measures above 4.8:1 against its tinted background in both themes.
 
 **Danger is separated from the primary accent by hue alone in dark mode**: the two have the same lightness.
@@ -67,18 +74,21 @@ Colour is never the only key: label every series.
 | UI text, tables and forms | Geist (`font-sans`) |
 | IDs, ARNs, IPs, CIDRs, code and eyebrow labels | JetBrains Mono (`font-mono`), with `tabular-nums` for figures |
 
-| Step | Size | Use |
-|---|---|---|
-| `2xl` | 26px | page title (`PageHeading`) |
-| `xl` | 22px | section heading |
-| `lg` | 17px | |
-| `base` | 15px | |
-| `sm` | 14px | body and table default |
-| `xs` | 13px | badges, secondary text |
-| `2xs` | 12px | mono eyebrow labels |
+| Step | rem | At the default 16px browser font | Use |
+|---|---|---|---|
+| `2xl` | 1.625 | 28.6px | page title (`PageHeading`) |
+| `xl` | 1.375 | 24.2px | section heading |
+| `lg` | 1.0625 | 18.7px | |
+| `base` | 0.9375 | 16.5px | |
+| `sm` | 0.875 | 15.4px | body and table default |
+| `xs` | 0.8125 | 14.3px | badges, secondary text |
+| `2xs` | 0.75 | 13.2px | mono eyebrow labels |
 
-The scale sits a step above Tailwind's defaults, as consoles such as Vultr's do, because 13px body text read as cramped on a wide screen.
-Code blocks are set at 12px (`--text-code-block`) so a long command still fits.
+The root font size is 110% (`html` in `src/styles.css`), so one rem is 17.6px at the browser default.
+Everything is sized in rem, so text, spacing and breakpoints scale together, as they would at 110% browser zoom, and a user's own font-size setting still applies.
+The scale sits above Tailwind's defaults, as consoles such as Vultr's do, because the console read as small on a wide screen at 100%.
+Code blocks are set at 0.75rem (`--text-code-block`) so a long command still fits.
+Size new things in rem through the type and spacing scales, never in px, or they will not scale with the rest.
 
 ### Primary and contrast
 
@@ -169,6 +179,22 @@ Every other list is a `DataTable`, and the test also fails when an allowed file
 | S13 | a component outside `ui/` renders a raw `<input>`, `<select>` or `<textarea>` |
 | S15 | a route imports the `ui/alert` primitive instead of using `ErrorBanner` |
 
+Rules that ADR-0016 does not yet number are named by what they hold until their amendment is accepted:
+
+| Rule | Fails when |
+|---|---|
+| status pills come from StateBadge or StatusBadge | a component outside `ui/` renders `<Badge>` with the default variant |
+| status pills come from StateBadge or StatusBadge | a file outside `state-badge.tsx` builds a `rounded-full` pill on a status colour |
+| floating surfaces follow the theme | a file fills with `bg-foreground` or `text-background`, or a tooltip, popover, hover card, menu, select or combobox is not on `bg-popover` and `text-popover-foreground` |
+| expanding a panel keeps its tab | a `fullPage` link does not pass `search={{ tab }}` |
+| resource tags are edited in place | `PanelTags` or `TagsEditor` comes back |
+| lists filter through one FilterBar | a component other than `FilterBar` imports `ui/toggle-group` |
+| a component handed a form reads errors through `useFormState` | a file typed with `UseFormReturn` reads `form.formState` |
+
+The last one matters because the console builds with the React compiler and the unit tests run without it.
+With the compiler on, a child handed a react-hook-form object is cached on that object, whose identity never changes, so errors read from `form.formState` never draw and the submit looks dead.
+`useFormState({ control })` subscribes the child itself.
+
 An exception is named in that rule's allowlist with its reason, and the test fails when an allowed file stops needing it.
 S11, S14 and S16 are held by review, since none has a shape in the source a test can read without false alarms.
 
@@ -177,7 +203,7 @@ S11, S14 and S16 are held by review, since none has a shape in the source a test
 `src/lib/nav.ts` is the one description of the console's navigation.
 The sidebar, the command palette and the breadcrumbs all read it, and `nav.test.ts` checks every destination against the generated route tree, so a renamed route fails a test rather than leaving a dead link.
 
-- **Sidebar.** Groups take generic names rather than AWS's service marks: Compute, Databases, Authentication and Object Storage, not EC2, RDS, IAM and S3. Pages and the rest of the console keep the AWS names, and each group's `service` keeps its AWS name findable in the command palette, where typing it exactly ranks that group first. Each service group folds, and a folded group stays folded across reloads (`localStorage["spinifex-ui-nav-collapsed"]`). Navigating into a folded group unfolds it so the active item shows, and it can then be folded again, the current group included. On a phone the sidebar is a sheet, and any navigation closes it.
+- **Sidebar.** Groups take generic names rather than AWS's service marks: Compute, Databases, Authentication and Object Storage, not EC2, RDS, IAM and S3. Pages and the rest of the console keep the AWS names, and each group's `service` keeps its AWS name findable in the command palette, where typing it exactly ranks that group first. Each service group folds, and a folded group stays folded across reloads (`localStorage["spinifex-ui-nav-collapsed"]`). Navigating into a folded group unfolds it so the active item shows, and it can then be folded again, the current group included. Folding animates through the `nav` variant of `CollapsibleContent`, opening over 200ms and closing over 150ms, and switches at once under reduced motion. On a phone the sidebar is a sheet, and any navigation closes it.
 - **Command palette.** ⌘K or Ctrl K, or the Search button in the header. It lists every page the user can reach, every create flow (`create` on a nav item), and a theme toggle. It is navigation only, with no resource search yet.
 - **Breadcrumbs.** Service, then list page, then the resource or the create flow. A resource ID is set in mono. On a phone only the last crumb shows.
 - **Sign in.** The sign-in card sits over the shell on a light, barely blurred overlay rather than on a page of its own, so the console stays in view. The shell behind it is `inert`, which keeps pointer, keyboard and screen reader out of it until the user signs in.
@@ -202,8 +228,13 @@ So columns drop out when a side panel narrows the list as well as on a small scr
 List pages keep their filter, state and sort in the URL, so a filtered view can be bookmarked, shared and survives a reload.
 EC2 Instances is the reference page (`ec2/(instances)/-components/instances-page.tsx`):
 
-- The first column names the resource: the `Name` tag in the primary colour, with the ID in mono beneath it, opening its side panel.
+- The first column is the instance ID in mono, opening its side panel, and the second its `Name` tag.
+- A long value ends in an ellipsis and shows in full on hover (`TruncatedText`), so it never widens its column.
+- A time column shows a relative time, `33 min ago` or `8 months ago`, with the full timestamp on hover (`RelativeTime`).
+- A Tags column shows one tag key as a pill and `+N` for the rest, and hover lists every tag with its value (`TagPills`); it leaves out `Name`, which has its own column.
+- Below `md`, only the ID, Name and State columns remain.
 - Bulk actions appear above the table once a row is selected. Each action counts only the selected instances it applies to, so a mixed selection never sends a call that must fail, and Terminate asks first and lists every ID.
+- Search and state filters sit in one `FilterBar` (`src/components/filter-bar.tsx`) above the table: a search box, an optional set of choices with counts, and Clear filters while anything is filtered.
 - An empty account gets a call to action, and an empty filter result says the filters are why.
 
 VPCs and Internet gateways follow the same pattern.
@@ -219,6 +250,12 @@ Every list with a delete action has row checkboxes. Selecting a row shows `Selec
 - **The bulk delete and the panel's delete are the same function.** Where a single delete is several calls, such as removing dependants first, the sequence lives in one place and both use it.
 - The verb follows the AWS console: Release for an Elastic IP, Deregister for an image.
 
+### Lists inside a panel
+
+A list inside a panel tab, such as a hosted zone's records, is a `DataTable` with row checkboxes, and a click on a row opens it for editing in a `FormPanel`.
+Rows the user cannot change, such as a zone's own SOA and NS, are muted and cannot be selected (`isRowActionable`).
+A batch delete uses the service's batch call where it has one, so Route 53 removes the whole selection in one `ChangeResourceRecordSets`.
+
 ### Typed confirmation
 
 A delete that cannot be walked back asks the user to type a word first, as the AWS console does before deleting a volume.
@@ -264,13 +301,24 @@ Modelled on UniFi's console: a click on a row opens the resource in a panel besi
 - **URL.** The panel is search state on the list route: `selected=<id>`, `tab=overview|monitoring|settings`, and `create=true`. Defaults are stripped, so a closed panel leaves the plain list address. Opening or closing a panel pushes a history entry, so Back closes it; a tab or filter change replaces the entry.
 - **Layout.** From `lg` (1024px) the panel is fixed to the right edge, full height below the header, flush with no outer margin, and it slides in over the list. The list keeps its width and columns underneath, so nothing reflows when a panel opens, and a soft gradient on the panel's left edge reads as the panel lying on top. Below `lg` there is no room to share, so the panel replaces the list as a full page with a back arrow. `useWideLayout` decides, through `matchMedia`.
 - **`DetailPanel`.** A header with the resource's own page (left) and close (right), the title and its ID, a summary of state and quick actions, then icon tabs with tooltips. Escape closes it unless a dialog or menu is open over it. Closing slides the panel out over 150ms, or at once under reduced motion. Each tab, and a create form, sits in its own error boundary, so a failed query shows in the panel and the list keeps working.
-- **Contents.** `PanelSection` is a folding card, `PanelFields` and `PanelField` a label and value list, with `copy` for a one-click copy of IDs and addresses, and `PanelTags` the tag list. Create forms take an `onClose(id?)` prop: embedded, they hide their back link and heading, and a create selects the new resource.
+- **Contents.** `PanelSection` is a folding card, `PanelFields` and `PanelField` a label and value list, with `copy` for a one-click copy of IDs and addresses, and `InlineTags` the tag list. Create forms take an `onClose(id?)` prop: embedded, they hide their back link and heading, and a create selects the new resource.
 - **One component is both the panel and the page.** Each resource has a single details component (`InstanceDetails`, `VpcDetails`, `InternetGatewayDetails`) that takes `layout="auto" | "page"`. The list renders it as the panel; `/ec2/describe-instances/$id` and its kind render the same component as a page, as one centred column under a standard left-aligned heading, with state and actions on the right and text tabs. A feature added to the panel is on the page by construction, and the page ignores Escape and has a back arrow in place of close. Expanding the panel to its page keeps the tab, and query results such as fetched console output come along from the cache.
 - **A click on the list's background closes the panel**, as UniFi's does. A row selects another resource instead, and links, buttons and inputs keep their own behaviour. Selecting rows for a bulk action closes it too, so the bulk bar and the panel never compete.
 - **Actions.** State actions sit in the summary as a button group, and the rest go in an Actions menu, Unikraft style. Stop, Reboot and every destructive action confirm in a dialog.
 - **Loading.** A panel or page still loading shows `PanelSpinner`, a centred spinner on the background, not a grey skeleton block.
 - **`DetailCard`, `DetailRow` and `ListCard` are retired.** Every resource page uses the panel sections instead.
 
+### Tags
+
+`InlineTags` (`src/components/inline-tags.tsx`) shows a resource's tags in its panel and edits them in place.
+Each row has a pencil, which turns the key and value into inputs and becomes a tick to save, and a bin to remove the tag; `+ Add tag` appends a row being edited.
+Enter saves and Escape cancels the row without closing the panel.
+Every row saves on its own request through the service's own tagging call, and a failure shows beside its row.
+AWS has no rename, so changing a key puts the new key and then removes the old one, and a failure between the two leaves both rather than neither.
+Keys are 1 to 128 characters with no `aws:` prefix and no duplicates, and values up to 256.
+Without `onPut` and `onRemove` it is read-only, as for a system image or an AWS-managed policy.
+Panels use the per-service wrappers in `src/components/resource-tags.tsx` and the writers in `src/mutations/tags.ts` rather than wiring the calls themselves.
+
 ### Forms from a resource's panel
 
 A form that acts on an open resource, such as attaching a volume, scaling a node group or adding a listener, opens in `FormPanel` (`src/components/form-panel.tsx`), never in a dialog.
@@ -285,8 +333,16 @@ Every create flow opens in the side panel over its list, through `CreatePanel`,
 
 - **URL.** `create=true` opens it, plus a list-local field where the flow needs context (`volume` for a snapshot, `instance` for an RDS snapshot, `launch=service|task` on ECS clusters). The old `create-*` addresses redirect to the list with the panel open, so links and bookmarks keep working.
 - **Form.** The fields come in the order AWS asks for them. Settings that are on or off are `Switch`es, and a multi-select picker (subnets, security groups) is a `SwitchList`, a boxed list with one switch per row. Checkboxes only select table rows.
-- **CLI.** Every create form ends with a `CliCommandPanel` showing the AWS CLI commands that send the same request, built from the form's live values and only the flags the console actually sends.
-- **Submit.** `FormActions` turns the submit button into a spinner with its pending label in place, and `FormLock`, a native `<fieldset disabled>`, disables every control above it until the request settles. Nothing above the form appears or moves, and the panel does not scroll.
+- **CLI.** Every create form ends with a `CliCommandPanel` showing the AWS CLI commands that send the same request, built from the form's live values and only the flags the console actually sends. The commands wrap to the panel's width and never scroll sideways; Copy takes the unwrapped text.
+- **Sections.** Related fields are grouped in `PanelSection` boxes, as the instance launch form groups Image, Instance, Network and Root volume.
+- **Nothing to pick, no field.** An optional picker with nothing usable to choose, such as Launch Template or Placement Group with none available, is left out of the form rather than shown holding only `none`.
+- **Advanced settings.** Settings most users leave at their defaults sit in a collapsed Advanced settings section, which opens by itself when a field inside it fails validation.
+- **Choices with a mark.** A few named products, such as database engines or distributions, are `ChoiceTile`s with the product's own mark from `src/assets/`, not a select. One that cannot be used stays visible and disabled, saying why.
+- **Durations and windows.** A duration is a select of presets with the AWS default first and named (`Auto (5 min)` for a record's TTL), keeping a custom value the API returned. A time window, such as an RDS backup or maintenance window, is a day, start time and length picker that refuses an overlap before submitting.
+- **Labels by type.** Where one field means different things by type, its label follows the type, as a record's value reads `IPv4 address` for A and `Mail server` for MX.
+- **Long pickers.** A `SwitchList` that can run long, such as security groups, scrolls inside its box rather than pushing the form down.
+- **Help.** A field's longer explanation goes in an (i) beside its label, through the `info` prop of `TextField` and `SelectField`, rather than in text under the field. Text under a field is for what the user must know before submitting.
+- **Submit.** `FormActions` cross-fades the submit label into a spinner with its pending label over 150ms, at one width, so the button never changes size, and `FormLock`, a native `<fieldset disabled>`, disables every control above it until the request settles. Nothing above the form appears or moves, and the panel does not scroll.
 - **Failure.** A refused request shows beside the button through `FormActions`'s `error`, and the form unlocks. The handler wraps only the mutation call in `try`, with an empty `catch` that returns, because react-hook-form rethrows whatever the handler throws and the error is already on screen from the mutation's state.
 - **Success.** `onClose(id)` closes the panel and selects the new resource, where the list has a panel to select it in.
 - **Appliance images.** A create that needs an ECS, EKS or RDS appliance image shows the missing-image callout inside its panel, never on the list, and only the step that needs the image is blocked.
@@ -306,6 +362,7 @@ A gap of more than three sample periods breaks the line rather than drawing acro
 ## Dates
 
 `formatDateTime` writes the AWS console's form in the viewer's zone, `2026/06/04 02:00 GMT-5`, with a 24-hour clock and UTC as plain `GMT`.
+In a table the time is relative (`relativeTime` in `src/lib/relative-time.ts`), rounded down to the largest whole unit, and the full form shows on hover.
 
 ## Testing
 

scripts/setup.sh

@@ -732,7 +732,8 @@ table inet spinifex_filter {
         # inventory and running instances to anyone who asks. 8660 is
         # predastore's unauthenticated /healthz and /readyz, which name the
         # peers a gate cannot reach, so it belongs here for the same reason.
-        ip saddr $spinifex_peers tcp dport { 4222, 4248, 4432, 5300, 6641, 6642, 6643, 6644, 8660 } accept
+        # 5001 is the admin network test, listening only while one runs.
+        ip saddr $spinifex_peers tcp dport { 4222, 4248, 4432, 5001, 5300, 6641, 6642, 6643, 6644, 8660 } accept
         ip saddr $spinifex_peers udp dport { 5300, 6660, 7660 } accept
 
         # Encap plane, peer-scoped: Geneve, IKE, NAT-T and ESP. Geneve is a
@@ -1309,6 +1310,7 @@ qemu-utils gdisk ovmf qemu-efi-aarch64 less
 libvirt-daemon-system libvirt-clients
 pciutils
 jq curl iproute2 iputils-arping ethtool netcat-openbsd wget unzip xz-utils file
+dmidecode iperf
 ovn-central ovn-host openvswitch-switch openvswitch-ipsec strongswan-charon dhcpcd-base
 chrony nftables"
 
@@ -1318,7 +1320,7 @@ chrony nftables"
 OL_RUNTIME_PACKAGES="nbdkit nbdkit-basic-filters
 qemu-kvm qemu-img edk2-ovmf seabios-bin less
 pciutils
-jq curl iproute iputils ethtool nmap-ncat wget unzip xz file
+jq curl iproute iputils ethtool nmap-ncat wget unzip xz file dmidecode
 ovn25.03-central ovn25.03-host openvswitch3.5 openvswitch3.5-ipsec libreswan dhcpcd
 chrony nftables iptables-nft systemd-resolved"
 

spinifex/agents/lambda/agent/bootstrap.go

@@ -0,0 +1,54 @@
+//go:build linux
+
+package agent
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os/exec"
+	goruntime "runtime"
+	"syscall"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+// sandboxID is the uid and gid the function's bootstrap runs as.
+const sandboxID = 993
+
+// StartBootstrap starts the function's bootstrap at path as the sandbox uid and
+// gid with no supplementary groups, with no_new_privs, and with exactly env.
+// The caller waits on the returned command.
+func StartBootstrap(ctx context.Context, path string, env []string, stdout, stderr io.Writer) (*exec.Cmd, error) {
+	cred := &syscall.Credential{Uid: sandboxID, Gid: sandboxID, Groups: []uint32{}}
+	return startBootstrap(ctx, path, env, stdout, stderr, cred)
+}
+
+func startBootstrap(ctx context.Context, path string, env []string, stdout, stderr io.Writer, cred *syscall.Credential) (*exec.Cmd, error) {
+	cmd := exec.CommandContext(ctx, path)
+	// A nil Env inherits the agent's environment; the bootstrap gets only env.
+	cmd.Env = append([]string{}, env...)
+	cmd.Stdout, cmd.Stderr = stdout, stderr
+	if cred != nil {
+		cmd.SysProcAttr = &syscall.SysProcAttr{Credential: cred}
+	}
+	cmd.Cancel = func() error { return cmd.Process.Signal(syscall.SIGTERM) }
+	cmd.WaitDelay = 5 * time.Second
+
+	started := make(chan error, 1)
+	go func() {
+		// no_new_privs is per thread and the child inherits it from this one. The
+		// thread is never unlocked, so Go ends it when this goroutine returns.
+		goruntime.LockOSThread()
+		if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
+			started <- fmt.Errorf("set no_new_privs: %w", err)
+			return
+		}
+		started <- cmd.Start()
+	}()
+	if err := <-started; err != nil {
+		return nil, err
+	}
+	return cmd, nil
+}

spinifex/agents/lambda/agent/bootstrap_test.go

@@ -0,0 +1,171 @@
+//go:build linux
+
+package agent
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	goruntime "runtime"
+	"strings"
+	"syscall"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// statusProbe writes an executable that prints its own credential lines.
+func statusProbe(t *testing.T) string {
+	t.Helper()
+	// The sandbox uid must be able to reach the probe through the test's dirs.
+	dir := t.TempDir()
+	require.NoError(t, os.Chmod(filepath.Dir(dir), 0o755))
+	require.NoError(t, os.Chmod(dir, 0o755))
+	path := filepath.Join(dir, "bootstrap")
+	script := "#!/bin/sh\ngrep -E '^(Uid|Gid|Groups|NoNewPrivs):' /proc/self/status\n"
+	require.NoError(t, os.WriteFile(path, []byte(script), 0o755))
+	return path
+}
+
+func statusLines(t *testing.T, out []byte) map[string]string {
+	t.Helper()
+	lines := map[string]string{}
+	for l := range strings.SplitSeq(strings.TrimSpace(string(out)), "\n") {
+		k, v, ok := strings.Cut(l, ":")
+		require.True(t, ok, "status line %q", l)
+		lines[k] = strings.Join(strings.Fields(v), " ")
+	}
+	return lines
+}
+
+// run starts a bootstrap with the given credential and returns its stdout.
+func run(t *testing.T, path string, env []string, sandbox bool) []byte {
+	t.Helper()
+	var out bytes.Buffer
+	start := startBootstrap
+	if sandbox {
+		start = func(ctx context.Context, p string, e []string, o, s io.Writer, _ *syscall.Credential) (*exec.Cmd, error) {
+			return StartBootstrap(ctx, p, e, o, s)
+		}
+	}
+	cmd, err := start(context.Background(), path, env, &out, os.Stderr, nil)
+	require.NoError(t, err)
+	require.NoError(t, cmd.Wait())
+	return out.Bytes()
+}
+
+// threadNoNewPrivs reads no_new_privs for the calling OS thread.
+func threadNoNewPrivs(t *testing.T) string {
+	t.Helper()
+	b, err := os.ReadFile("/proc/thread-self/status")
+	require.NoError(t, err)
+	return statusLines(t, grepLines(b, "NoNewPrivs:"))["NoNewPrivs"]
+}
+
+func grepLines(b []byte, prefix string) []byte {
+	var keep []string
+	for l := range strings.SplitSeq(string(b), "\n") {
+		if strings.HasPrefix(l, prefix) {
+			keep = append(keep, l)
+		}
+	}
+	return []byte(strings.Join(keep, "\n"))
+}
+
+func TestStartBootstrapSetsNoNewPrivsWithoutChangingTheCaller(t *testing.T) {
+	goruntime.LockOSThread()
+	defer goruntime.UnlockOSThread()
+	if threadNoNewPrivs(t) != "0" {
+		t.Skip("test thread already has no_new_privs; the child would inherit it")
+	}
+
+	out := run(t, statusProbe(t), nil, false)
+	assert.Equal(t, "1", statusLines(t, out)["NoNewPrivs"])
+	assert.Equal(t, "0", threadNoNewPrivs(t), "the calling thread must keep no_new_privs unset")
+}
+
+func TestStartBootstrapDropsToSandboxIdentity(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("dropping to the sandbox uid needs root")
+	}
+	lines := statusLines(t, run(t, statusProbe(t), nil, true))
+	assert.Equal(t, "993 993 993 993", lines["Uid"])
+	assert.Equal(t, "993 993 993 993", lines["Gid"])
+	assert.Empty(t, lines["Groups"])
+	assert.Equal(t, "1", lines["NoNewPrivs"])
+}
+
+// A tenant LD_PRELOAD constructor runs before the bootstrap's main; it must
+// already see no_new_privs, so no loader runs before the flag is set.
+func TestStartBootstrapPreloadConstructorSeesNoNewPrivs(t *testing.T) {
+	goruntime.LockOSThread()
+	defer goruntime.UnlockOSThread()
+	if threadNoNewPrivs(t) != "0" {
+		t.Skip("test thread already has no_new_privs; the check would pass vacuously")
+	}
+	cc, err := exec.LookPath("cc")
+	if err != nil {
+		t.Skip("no C compiler for the preload library")
+	}
+	bootstrap, err := exec.LookPath("true")
+	require.NoError(t, err)
+	dir := t.TempDir()
+	src := filepath.Join(dir, "preload.c")
+	lib := filepath.Join(dir, "preload.so")
+	require.NoError(t, os.WriteFile(src, []byte(preloadSource), 0o644))
+	build := exec.Command(cc, "-shared", "-fPIC", "-o", lib, src)
+	build.Stderr = os.Stderr
+	require.NoError(t, build.Run())
+
+	out := run(t, bootstrap, []string{"LD_PRELOAD=" + lib}, false)
+	assert.Equal(t, "preload NoNewPrivs: 1", strings.Join(strings.Fields(string(out)), " "))
+}
+
+const preloadSource = `#include <stdio.h>
+#include <string.h>
+
+__attribute__((constructor)) static void report(void) {
+	char line[256];
+	FILE *f = fopen("/proc/self/status", "r");
+	if (!f)
+		return;
+	while (fgets(line, sizeof line, f))
+		if (strncmp(line, "NoNewPrivs:", 11) == 0)
+			printf("preload %s", line);
+	fclose(f);
+	fflush(stdout);
+}
+`
+
+func TestStartBootstrapDoesNotInheritAgentEnvironment(t *testing.T) {
+	t.Setenv("ZZ_AGENT_SECRET", "must-not-leak")
+	probe, err := exec.LookPath("env")
+	require.NoError(t, err)
+
+	for name, env := range map[string][]string{"nil": nil, "empty": {}, "given": {"ONLY=this"}} {
+		out := run(t, probe, env, false)
+		// Never print the captured environment: an inherited one may hold secrets.
+		if strings.TrimSuffix(string(out), "\n") != strings.Join(env, "\n") {
+			t.Errorf("%s: bootstrap environment is not exactly the one given", name)
+		}
+	}
+}
+
+// Without root the sandbox credential cannot be applied, so the exported entry
+// point must refuse rather than run the bootstrap as the caller.
+func TestStartBootstrapAsNonRootRefusesInsteadOfKeepingCallerIdentity(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root can apply the sandbox credential")
+	}
+	_, err := StartBootstrap(context.Background(), statusProbe(t), nil, nil, nil)
+	assert.ErrorIs(t, err, syscall.EPERM)
+}
+
+func TestStartBootstrapMissingExecutableFails(t *testing.T) {
+	_, err := startBootstrap(context.Background(), filepath.Join(t.TempDir(), "bootstrap"), nil, nil, nil, nil)
+	assert.Error(t, err)
+}

spinifex/agents/lambda/hostlink/seal.go

@@ -0,0 +1,42 @@
+package hostlink
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+// FwCfgRoot is the sysfs tree the qemu_fw_cfg module exposes; removing the
+// module removes every entry under it, including the guest key.
+const FwCfgRoot = "/sys/firmware/qemu_fw_cfg"
+
+// UnloadFwCfg removes the qemu_fw_cfg module from the running kernel.
+func UnloadFwCfg() error {
+	if err := unix.DeleteModule("qemu_fw_cfg", 0); err != nil {
+		return fmt.Errorf("hostlink: unload qemu_fw_cfg: %w", err)
+	}
+	return nil
+}
+
+// SealFwCfg makes fw_cfg unreadable for the rest of the boot. It succeeds only
+// once root is gone, so a built-in or busy module fails closed rather than
+// leaving the guest key readable by code started later.
+func SealFwCfg(root string, unload func() error) error {
+	if _, err := os.Stat(root); errors.Is(err, fs.ErrNotExist) {
+		return nil
+	} else if err != nil {
+		return fmt.Errorf("hostlink: fw_cfg: %w", err)
+	}
+	unloadErr := unload()
+	_, err := os.Stat(root)
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil
+	}
+	if unloadErr == nil {
+		unloadErr = errors.New("unload reported success")
+	}
+	return fmt.Errorf("hostlink: fw_cfg still readable at %s: %w", root, errors.Join(unloadErr, err))
+}

spinifex/agents/lambda/hostlink/seal_test.go

@@ -0,0 +1,43 @@
+package hostlink
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func fwCfgTree(t *testing.T) string {
+	t.Helper()
+	root := filepath.Join(t.TempDir(), "qemu_fw_cfg")
+	require.NoError(t, os.MkdirAll(filepath.Join(root, "by_name"), 0o700))
+	return root
+}
+
+func TestSealFwCfg(t *testing.T) {
+	t.Run("already absent needs no unload", func(t *testing.T) {
+		called := false
+		require.NoError(t, SealFwCfg(filepath.Join(t.TempDir(), "absent"), func() error { called = true; return nil }))
+		assert.False(t, called)
+	})
+	t.Run("unload removes the tree", func(t *testing.T) {
+		root := fwCfgTree(t)
+		require.NoError(t, SealFwCfg(root, func() error { return os.RemoveAll(root) }))
+	})
+	t.Run("unload fails and the tree remains", func(t *testing.T) {
+		builtIn := errors.New("module is built in")
+		err := SealFwCfg(fwCfgTree(t), func() error { return builtIn })
+		assert.ErrorIs(t, err, builtIn)
+		assert.ErrorContains(t, err, "still readable")
+	})
+	t.Run("unload succeeds but the tree remains", func(t *testing.T) {
+		assert.ErrorContains(t, SealFwCfg(fwCfgTree(t), func() error { return nil }), "unload reported success")
+	})
+	t.Run("unload errors after removing the tree", func(t *testing.T) {
+		root := fwCfgTree(t)
+		require.NoError(t, SealFwCfg(root, func() error { _ = os.RemoveAll(root); return errors.New("late") }))
+	})
+}

spinifex/agents/lambda/hostlink/tls.go

@@ -18,7 +18,7 @@ import (
 )
 
 // FwCfgDir is where the guest kernel exposes the executor's fw_cfg entries.
-const FwCfgDir = "/sys/firmware/qemu_fw_cfg/by_name/" + lambdav1.FwCfgPrefix
+const FwCfgDir = FwCfgRoot + "/by_name/" + lambdav1.FwCfgPrefix
 
 // Identity is the guest's material for one environment generation.
 type Identity struct {

spinifex/operator/accountlifecycle/engine.go

@@ -8,6 +8,8 @@ import (
 	"slices"
 	"sort"
 	"time"
+
+	operatorv1 "github.com/mulgadc/spinifex/contracts/operator/v1"
 )
 
 // AccountStatusTerminating mirrors iamdomain.AccountStatusTerminating.
@@ -29,6 +31,10 @@ type Engine struct {
 	// and this is the only view into it while it runs.
 	OnStage func(ctx context.Context, stage StageResult)
 
+	// OnQuiesced receives the recorded quiescence evaluation once the account is
+	// TERMINATING and before the first stage. It records evidence and gates nothing.
+	OnQuiesced func(ctx context.Context, quiescence operatorv1.IAMQuiescence)
+
 	// ec2Inventory is EC2's read-only platform inventory. Only DryRun consults
 	// it, and only to log a comparison; no teardown or Inventory call does.
 	ec2Inventory ec2PlatformInventory
@@ -118,9 +124,13 @@ func (e *Engine) Teardown(ctx context.Context, req Request) (*Result, error) {
 		return e.Inventory(ctx, req.AccountID)
 	}
 
-	if _, err := e.Accounts.QuiesceAccount(req.AccountID, req.OperationID, req.Fence); err != nil {
+	generation, err := e.Accounts.QuiesceAccount(req.AccountID, req.OperationID, req.Fence)
+	if err != nil {
 		return nil, fmt.Errorf("quiesce account: %w", err)
 	}
+	if e.OnQuiesced != nil {
+		e.OnQuiesced(ctx, e.evaluateQuiescence(ctx, req, generation))
+	}
 	e.logger().InfoContext(ctx, "Account teardown started",
 		"accountID", account.AccountID, "accountName", account.AccountName, "force", req.Force)
 
@@ -325,3 +335,23 @@ func containsResource(resources []Resource, want Resource) bool {
 func SortReapers(reapers []Reaper) {
 	sort.SliceStable(reapers, func(i, j int) bool { return reapers[i].Stage() < reapers[j].Stage() })
 }
+
+// evaluateQuiescence reads back what the quiesce wrote and, only if the fence
+// is confirmed, asks EC2 for its platform inventory within a short budget.
+func (e *Engine) evaluateQuiescence(ctx context.Context, req Request, generation uint64) operatorv1.IAMQuiescence {
+	ev := QuiesceEvidence{
+		OperationID: req.OperationID, Fence: req.Fence, Generation: generation, EvaluatedAt: time.Now(),
+	}
+	ev.Account, ev.ReadbackErr = e.Accounts.GetAccount(req.AccountID)
+	if _, confirmed := fenceReadback(ev); confirmed && e.ec2Inventory != nil {
+		budget := ec2PlatformShadowBudget
+		if e.ec2PlatformShadowBudget > 0 {
+			budget = e.ec2PlatformShadowBudget
+		}
+		inventoryCtx, cancel := context.WithTimeout(ctx, budget)
+		defer cancel()
+		reply := e.ec2Inventory.PlatformInventory(inventoryCtx, req.AccountID, req.OperationID)
+		ev.Inventory = &reply
+	}
+	return EvaluateQuiescence(ev)
+}

spinifex/operator/accountlifecycle/engine_test.go

@@ -61,6 +61,8 @@ func (f *fakeAccounts) QuiesceAccount(_, operationID string, fence uint64) (uint
 	f.statuses = append(f.statuses, AccountStatusTerminating)
 	f.quiesces = append(f.quiesces, quiesceCall{operationID, fence})
 	f.account.Status = AccountStatusTerminating
+	f.account.Generation = 1
+	f.account.TerminationOp = &TerminationOp{OperationID: operationID, Fence: fence}
 	return 1, nil
 }
 

spinifex/operator/accountlifecycle/quiescence.go

@@ -0,0 +1,164 @@
+package accountlifecycle
+
+import (
+	"time"
+
+	ec2v1 "github.com/mulgadc/spinifex/contracts/ec2/v1"
+	operatorv1 "github.com/mulgadc/spinifex/contracts/operator/v1"
+)
+
+// finalInventoryRereadWired says whether anything re-reads the owner inventory
+// before the account record goes. Until it does, a write landing after the
+// reaper stage is orphaned, so no kind may be recorded as quiesced.
+var finalInventoryRereadWired = false
+
+// QuiesceEvidence is what the engine read after QuiesceAccount returned.
+type QuiesceEvidence struct {
+	OperationID string
+	Fence       uint64
+	Generation  uint64
+
+	// Account is the IAM record read back after the quiesce.
+	Account     *Account
+	ReadbackErr error
+	Inventory   *ec2v1.PlatformInventoryReply
+	EvaluatedAt time.Time
+}
+
+// enforcementConsumers are the consumers with an accepted contract for the
+// account admission fact. Predastore is deliberately absent: it has none.
+var enforcementConsumers = []operatorv1.ConsumerBasis{
+	{Consumer: "awsgw-admission", Basis: "ADR-0005:S7"},
+	{Consumer: "ecr-registry", Basis: "ADR-0005:S7"},
+	{Consumer: "sts-mint-gate", Basis: "ADR-0008:S9 (IAM-owned)"},
+}
+
+// accountedWriters cannot be fenced and are covered by the owner inventory.
+var accountedWriters = []operatorv1.AccountedWriter{
+	{Writer: "daemon-nats-handlers", Basis: "owner-inventory", Ref: "mulga-tpoz4"},
+}
+
+// ec2PlatformKinds are the kinds the first scope covers. The inventory's own
+// tag-index kind belongs to a different register row and is not part of it.
+var ec2PlatformKinds = []string{
+	ec2v1.PlatformKindKeyPair,
+	ec2v1.PlatformKindPlacementGroup,
+	ec2v1.PlatformKindLaunchTemplate,
+}
+
+type unresolvedEntry struct {
+	scope, class, reason string
+}
+
+// otherScopes lists every scope the first exercise does not cover, by name.
+// A register row family missing from here would read as quiesced by omission.
+var otherScopes = []unresolvedEntry{
+	{"ec2-instances", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"ec2-spot-requests", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"ebs-volumes", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"ec2-snapshots-images", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"ec2-vpc", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"host-network", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"ec2-account-settings", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"ec2-tag-index", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"iam", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"elbv2", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"acm", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"eks", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"ecs", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"rds", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"dns", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"ochre", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"quota", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"idempotency", operatorv1.UnresolvedClassWriter, operatorv1.ReasonNoCompleteOwnerInventory},
+	{"s3", operatorv1.UnresolvedClassConsumer, operatorv1.ReasonNoAcceptedEnforcement},
+	{"ecr", operatorv1.UnresolvedClassConsumer, operatorv1.ReasonNoAcceptedEnforcement},
+	{"lambda", operatorv1.UnresolvedClassWriter, operatorv1.ReasonParticipantNotDeclared},
+	{"sqs", operatorv1.UnresolvedClassWriter, operatorv1.ReasonParticipantNotDeclared},
+}
+
+// EvaluateQuiescence applies ADR-0008:S9's three conditions to the evidence and
+// records what holds. A fence the read-back does not confirm stops everything
+// else; otherwise every scope is listed, and none is reported quiesced yet.
+func EvaluateQuiescence(ev QuiesceEvidence) operatorv1.IAMQuiescence {
+	out := operatorv1.IAMQuiescence{
+		OperationID:   ev.OperationID,
+		Fence:         ev.Fence,
+		Generation:    ev.Generation,
+		QuiescedScope: []string{},
+		Unresolved:    []operatorv1.UnresolvedScope{},
+		Consumers:     []operatorv1.ConsumerBasis{},
+		Writers:       []operatorv1.AccountedWriter{},
+		Inventory:     []operatorv1.InventoryStatus{},
+		EvaluatedAt:   ev.EvaluatedAt.UTC().Format(time.RFC3339),
+	}
+
+	if reason, ok := fenceReadback(ev); !ok {
+		out.Unresolved = append(out.Unresolved, operatorv1.UnresolvedScope{
+			Scope: "all", Class: operatorv1.UnresolvedClassFence, Reason: reason,
+		})
+		return out
+	}
+
+	out.Consumers = append(out.Consumers, enforcementConsumers...)
+	out.Writers = append(out.Writers, accountedWriters...)
+
+	for _, kind := range ec2PlatformKinds {
+		status, complete := kindInventory(ev.Inventory, kind)
+		out.Inventory = append(out.Inventory, operatorv1.InventoryStatus{Kind: kind, Status: status})
+		switch {
+		case !complete:
+			out.Unresolved = append(out.Unresolved, writerEntry("ec2-"+kind, operatorv1.ReasonOwnerInventoryIncomplete))
+		case !finalInventoryRereadWired:
+			out.Unresolved = append(out.Unresolved, writerEntry("ec2-"+kind, operatorv1.ReasonFinalInventoryRereadNotWired))
+		default:
+			out.QuiescedScope = append(out.QuiescedScope, kind)
+		}
+	}
+	for _, entry := range otherScopes {
+		out.Unresolved = append(out.Unresolved, operatorv1.UnresolvedScope{
+			Scope: entry.scope, Class: entry.class, Reason: entry.reason,
+		})
+	}
+	return out
+}
+
+func writerEntry(scope, reason string) operatorv1.UnresolvedScope {
+	return operatorv1.UnresolvedScope{Scope: scope, Class: operatorv1.UnresolvedClassWriter, Reason: reason}
+}
+
+// fenceReadback is condition 1: the operation record and the IAM account record
+// hold the same operation, fence and generation.
+func fenceReadback(ev QuiesceEvidence) (reason string, ok bool) {
+	if ev.ReadbackErr != nil || ev.Account == nil {
+		return operatorv1.ReasonIAMReadbackFailed, false
+	}
+	op := ev.Account.TerminationOp
+	if ev.Account.Status != AccountStatusTerminating || op == nil ||
+		op.OperationID != ev.OperationID || op.Fence != ev.Fence || ev.Account.Generation != ev.Generation {
+		return operatorv1.ReasonFenceMismatch, false
+	}
+	return "", true
+}
+
+// kindInventory reports one kind's status and whether the owner scan was
+// complete. A missing or repeated kind, or no reply at all, is incomplete.
+func kindInventory(reply *ec2v1.PlatformInventoryReply, kind string) (status string, complete bool) {
+	if reply == nil {
+		return ec2v1.PlatformStatusScanIncomplete, false
+	}
+	var found *ec2v1.PlatformKindReport
+	for i := range reply.Kinds {
+		if reply.Kinds[i].Kind != kind {
+			continue
+		}
+		if found != nil {
+			return ec2v1.PlatformStatusScanIncomplete, false
+		}
+		found = &reply.Kinds[i]
+	}
+	if found == nil || found.Status == ec2v1.PlatformStatusScanIncomplete {
+		return ec2v1.PlatformStatusScanIncomplete, false
+	}
+	return found.Status, true
+}

spinifex/operator/accountlifecycle/quiescence_test.go

@@ -0,0 +1,281 @@
+package accountlifecycle
+
+//test:in-package — the evaluator, its scope table and the engine hook are
+// unexported, and the table is what keeps a scope from reading as quiesced by omission.
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"testing"
+	"time"
+
+	ec2v1 "github.com/mulgadc/spinifex/contracts/ec2/v1"
+	operatorv1 "github.com/mulgadc/spinifex/contracts/operator/v1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func confirmedEvidence() QuiesceEvidence {
+	return QuiesceEvidence{
+		OperationID: "op-1", Fence: 2, Generation: 5,
+		Account: &Account{
+			AccountID: testAccountID, Status: AccountStatusTerminating, Generation: 5,
+			TerminationOp: &TerminationOp{OperationID: "op-1", Fence: 2},
+		},
+		Inventory:   completeInventory(),
+		EvaluatedAt: time.Date(2026, 11, 2, 0, 0, 0, 0, time.UTC),
+	}
+}
+
+func completeInventory() *ec2v1.PlatformInventoryReply {
+	reply := &ec2v1.PlatformInventoryReply{AccountID: testAccountID}
+	for _, kind := range ec2v1.PlatformKinds() {
+		reply.Kinds = append(reply.Kinds, ec2v1.PlatformKindReport{Kind: kind, Status: ec2v1.PlatformStatusObservedClean})
+	}
+	return reply
+}
+
+func unresolvedFor(q operatorv1.IAMQuiescence, scope string) []operatorv1.UnresolvedScope {
+	var out []operatorv1.UnresolvedScope
+	for _, entry := range q.Unresolved {
+		if entry.Scope == scope {
+			out = append(out, entry)
+		}
+	}
+	return out
+}
+
+// With the fence confirmed and every L09 kind scanned complete, the evidence is
+// recorded but no kind is quiesced: nothing re-reads the inventory before the
+// account record goes, so a late write would be orphaned (ADR-0008:S9 condition 3).
+func TestEvaluateQuiescenceRecordsEvidenceButQuiescesNothingWithoutAFinalReread(t *testing.T) {
+	q := EvaluateQuiescence(confirmedEvidence())
+
+	assert.Equal(t, "op-1", q.OperationID)
+	assert.Equal(t, uint64(2), q.Fence)
+	assert.Equal(t, uint64(5), q.Generation)
+	assert.Empty(t, q.QuiescedScope)
+	assert.NotNil(t, q.QuiescedScope, "evaluated-and-empty must serialise as [] not null")
+	for _, kind := range ec2PlatformKinds {
+		assert.Equal(t, []operatorv1.UnresolvedScope{{
+			Scope: "ec2-" + kind, Class: operatorv1.UnresolvedClassWriter,
+			Reason: operatorv1.ReasonFinalInventoryRereadNotWired,
+		}}, unresolvedFor(q, "ec2-"+kind))
+	}
+	assert.ElementsMatch(t, []operatorv1.InventoryStatus{
+		{Kind: ec2v1.PlatformKindKeyPair, Status: ec2v1.PlatformStatusObservedClean},
+		{Kind: ec2v1.PlatformKindPlacementGroup, Status: ec2v1.PlatformStatusObservedClean},
+		{Kind: ec2v1.PlatformKindLaunchTemplate, Status: ec2v1.PlatformStatusObservedClean},
+	}, q.Inventory)
+	assert.Equal(t, []operatorv1.AccountedWriter{{Writer: "daemon-nats-handlers", Basis: "owner-inventory", Ref: "mulga-tpoz4"}}, q.Writers)
+	assert.Equal(t, "2026-11-02T00:00:00Z", q.EvaluatedAt)
+}
+
+// The wiring step flips this switch; the complete kinds are then, and only then, named.
+func TestEvaluateQuiescenceNamesCompleteKindsOnceTheRereadIsWired(t *testing.T) {
+	finalInventoryRereadWired = true
+	t.Cleanup(func() { finalInventoryRereadWired = false })
+
+	ev := confirmedEvidence()
+	ev.Inventory.Kinds[1].Status = ec2v1.PlatformStatusScanIncomplete
+	q := EvaluateQuiescence(ev)
+
+	assert.Equal(t, []string{ec2v1.PlatformKindKeyPair, ec2v1.PlatformKindLaunchTemplate}, q.QuiescedScope)
+	assert.Equal(t, operatorv1.ReasonOwnerInventoryIncomplete, unresolvedFor(q, "ec2-placement-group")[0].Reason)
+}
+
+func TestEvaluateQuiescenceRecordsAnIncompleteInventoryPerKind(t *testing.T) {
+	cases := map[string]func(*QuiesceEvidence){
+		"one kind scan-incomplete": func(ev *QuiesceEvidence) { ev.Inventory.Kinds[0].Status = ec2v1.PlatformStatusScanIncomplete },
+		"kind missing":             func(ev *QuiesceEvidence) { ev.Inventory.Kinds = ev.Inventory.Kinds[1:] },
+		"kind repeated": func(ev *QuiesceEvidence) {
+			ev.Inventory.Kinds = append(ev.Inventory.Kinds, ev.Inventory.Kinds[0])
+		},
+	}
+	for name, mutate := range cases {
+		t.Run(name, func(t *testing.T) {
+			ev := confirmedEvidence()
+			mutate(&ev)
+			q := EvaluateQuiescence(ev)
+
+			got := unresolvedFor(q, "ec2-key-pair")
+			require.Len(t, got, 1)
+			assert.Equal(t, operatorv1.ReasonOwnerInventoryIncomplete, got[0].Reason)
+			assert.Equal(t, operatorv1.ReasonFinalInventoryRereadNotWired, unresolvedFor(q, "ec2-launch-template")[0].Reason,
+				"the other kinds keep their own result")
+		})
+	}
+
+	t.Run("no reply at all", func(t *testing.T) {
+		ev := confirmedEvidence()
+		ev.Inventory = nil
+		q := EvaluateQuiescence(ev)
+		for _, kind := range ec2PlatformKinds {
+			assert.Equal(t, operatorv1.ReasonOwnerInventoryIncomplete, unresolvedFor(q, "ec2-"+kind)[0].Reason)
+		}
+	})
+}
+
+// Condition 1: a read-back that does not confirm the operation, fence and
+// generation records nothing as quiesced and evaluates nothing else.
+func TestEvaluateQuiescenceRecordsNothingWhenTheFenceIsNotConfirmed(t *testing.T) {
+	cases := map[string]struct {
+		mutate func(*QuiesceEvidence)
+		reason string
+	}{
+		"not terminating":     {func(ev *QuiesceEvidence) { ev.Account.Status = "ACTIVE" }, operatorv1.ReasonFenceMismatch},
+		"no operation":        {func(ev *QuiesceEvidence) { ev.Account.TerminationOp = nil }, operatorv1.ReasonFenceMismatch},
+		"other operation":     {func(ev *QuiesceEvidence) { ev.Account.TerminationOp.OperationID = "op-2" }, operatorv1.ReasonFenceMismatch},
+		"higher fence in IAM": {func(ev *QuiesceEvidence) { ev.Account.TerminationOp.Fence = 3 }, operatorv1.ReasonFenceMismatch},
+		"other generation":    {func(ev *QuiesceEvidence) { ev.Account.Generation = 6 }, operatorv1.ReasonFenceMismatch},
+		"read-back failed":    {func(ev *QuiesceEvidence) { ev.Account, ev.ReadbackErr = nil, errors.New("kv down") }, operatorv1.ReasonIAMReadbackFailed},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			finalInventoryRereadWired = true
+			t.Cleanup(func() { finalInventoryRereadWired = false })
+			ev := confirmedEvidence()
+			tc.mutate(&ev)
+			q := EvaluateQuiescence(ev)
+
+			assert.Empty(t, q.QuiescedScope)
+			assert.Equal(t, []operatorv1.UnresolvedScope{{Scope: "all", Class: operatorv1.UnresolvedClassFence, Reason: tc.reason}}, q.Unresolved)
+			assert.Empty(t, q.Consumers)
+			assert.Empty(t, q.Writers)
+			assert.Empty(t, q.Inventory)
+		})
+	}
+}
+
+// Every scope outside the first exercise is named. The expected list is the
+// lifecycle register's rows other than L01, L02 and L09, so a new row has to be
+// added here and in the table rather than reading as quiesced by omission.
+func TestEveryOtherScopeIsRecordedUnresolvedByName(t *testing.T) {
+	want := []string{
+		"ec2-instances", "ec2-spot-requests", "ebs-volumes", "ec2-snapshots-images", "ec2-vpc",
+		"host-network", "ec2-account-settings", "ec2-tag-index", "iam", "elbv2", "acm", "eks", "ecs",
+		"rds", "dns", "ochre", "quota", "idempotency", "s3", "ecr", "lambda", "sqs",
+	}
+	q := EvaluateQuiescence(confirmedEvidence())
+
+	for _, scope := range want {
+		got := unresolvedFor(q, scope)
+		require.Len(t, got, 1, scope)
+		assert.NotEmpty(t, got[0].Reason, scope)
+	}
+	assert.Len(t, q.Unresolved, len(want)+len(ec2PlatformKinds), "no scope beyond the register and the three kinds")
+	for _, entry := range otherScopes {
+		assert.False(t, slices.Contains(ec2PlatformKinds, entry.scope), entry.scope)
+	}
+}
+
+// Predastore has no accepted enforcement contract, so the scopes it admits writes
+// for stay unresolved and it is never cited as a consumer, even once the
+// re-read is wired and every L09 kind is complete.
+func TestPredastoreIsNeverCitedAndItsScopesNeverQuiesce(t *testing.T) {
+	finalInventoryRereadWired = true
+	t.Cleanup(func() { finalInventoryRereadWired = false })
+	q := EvaluateQuiescence(confirmedEvidence())
+
+	for _, scope := range []string{"s3", "ecr"} {
+		got := unresolvedFor(q, scope)
+		require.Len(t, got, 1)
+		assert.Equal(t, operatorv1.UnresolvedClassConsumer, got[0].Class)
+		assert.Equal(t, operatorv1.ReasonNoAcceptedEnforcement, got[0].Reason)
+		assert.NotContains(t, q.QuiescedScope, scope)
+	}
+	for _, consumer := range q.Consumers {
+		assert.NotContains(t, consumer.Consumer, "predastore")
+		want := "ADR-0005:S7"
+		if consumer.Consumer == "sts-mint-gate" {
+			want = "ADR-0008:S9 (IAM-owned)"
+		}
+		assert.Equal(t, want, consumer.Basis)
+	}
+	assert.Equal(t, []string{"awsgw-admission", "ecr-registry", "sts-mint-gate"},
+		[]string{q.Consumers[0].Consumer, q.Consumers[1].Consumer, q.Consumers[2].Consumer})
+}
+
+type stubInventory struct {
+	reply ec2v1.PlatformInventoryReply
+	calls int
+}
+
+func (s *stubInventory) PlatformInventory(context.Context, string, string) ec2v1.PlatformInventoryReply {
+	s.calls++
+	return s.reply
+}
+
+// The hook fires once, after the quiesce and before the first stage, carrying the
+// operation, fence and generation the quiesce returned.
+func TestTeardownReportsQuiescenceAfterTheQuiesceAndBeforeTheFirstStage(t *testing.T) {
+	accounts := newFakeAccounts()
+	var events []string
+	reaper := &fakeReaper{kind: "volume", stage: StageStorage, resources: []Resource{{Kind: "volume", ID: "vol-1"}}}
+	engine := quietEngine(accounts, reaper)
+	inventory := &stubInventory{reply: *completeInventory()}
+	engine.ec2Inventory = inventory
+	var got operatorv1.IAMQuiescence
+	engine.OnQuiesced = func(_ context.Context, q operatorv1.IAMQuiescence) {
+		events = append(events, "quiesced")
+		assert.Equal(t, 0, reaper.deletesAttempted, "no stage may have run yet")
+		assert.Equal(t, AccountStatusTerminating, accounts.account.Status)
+		got = q
+	}
+	engine.OnStage = func(context.Context, StageResult) {
+		if len(events) == 0 || events[len(events)-1] != "stage" {
+			events = append(events, "stage")
+		}
+	}
+
+	req := request()
+	req.OperationID, req.Fence = "op-7", 3
+	_, err := engine.Teardown(context.Background(), req)
+
+	require.NoError(t, err)
+	assert.Equal(t, []string{"quiesced", "stage"}, events)
+	assert.Equal(t, "op-7", got.OperationID)
+	assert.Equal(t, uint64(3), got.Fence)
+	assert.Equal(t, uint64(1), got.Generation)
+	assert.Equal(t, 1, inventory.calls)
+	assert.True(t, accounts.deleted, "recording must not change the legacy teardown")
+}
+
+// A fence the read-back does not confirm must not spend an inventory call, and a
+// failed read-back must not stop the teardown: this step records and gates nothing.
+func TestTeardownRecordsAFailedReadbackAndStillRunsEveryStage(t *testing.T) {
+	accounts := newFakeAccounts()
+	engine := quietEngine(accounts)
+	inventory := &stubInventory{reply: *completeInventory()}
+	engine.ec2Inventory = inventory
+	var got operatorv1.IAMQuiescence
+	engine.OnQuiesced = func(_ context.Context, q operatorv1.IAMQuiescence) { got = q }
+	accounts.getErr = nil
+
+	engine.Accounts = &readbackFails{fakeAccounts: accounts}
+	req := request()
+	req.OperationID, req.Fence = "op-1", 1
+	_, err := engine.Teardown(context.Background(), req)
+
+	require.NoError(t, err)
+	require.Len(t, got.Unresolved, 1)
+	assert.Equal(t, operatorv1.ReasonIAMReadbackFailed, got.Unresolved[0].Reason)
+	assert.Zero(t, inventory.calls)
+	assert.True(t, accounts.deleted)
+}
+
+// readbackFails serves the pre-quiesce read and fails the one after it.
+type readbackFails struct {
+	*fakeAccounts
+
+	reads int
+}
+
+func (r *readbackFails) GetAccount(id string) (*Account, error) {
+	r.reads++
+	if r.reads > 1 {
+		return nil, errors.New("kv down")
+	}
+	return r.fakeAccounts.GetAccount(id)
+}

spinifex/operator/accountlifecycle/reapers_account.go

@@ -106,9 +106,14 @@ func (a *IAMAccounts) GetAccount(accountID string) (*Account, error) {
 	if err != nil {
 		return nil, err
 	}
-	return &Account{
+	out := &Account{
 		AccountID: account.AccountID, AccountName: account.AccountName, Status: account.Status,
-	}, nil
+		Generation: account.Generation,
+	}
+	if op := account.TerminationOp; op != nil {
+		out.TerminationOp = &TerminationOp{OperationID: op.OperationID, Fence: op.Fence}
+	}
+	return out, nil
 }
 
 func (a *IAMAccounts) QuiesceAccount(accountID, operationID string, fence uint64) (uint64, error) {

spinifex/operator/accountlifecycle/types.go

@@ -136,6 +136,16 @@ type Account struct {
 	AccountID   string
 	AccountName string
 	Status      string
+
+	// Generation and TerminationOp are what a quiesce read-back compares.
+	Generation    uint64
+	TerminationOp *TerminationOp
+}
+
+// TerminationOp mirrors the operation and fence IAM holds on a terminating account.
+type TerminationOp struct {
+	OperationID string
+	Fence       uint64
 }
 
 // Request is one teardown.

spinifex/operator/admin/account_delete.go

@@ -85,6 +85,9 @@ type accountDeletionJob struct {
 	Holder     string             `json:"holder,omitempty"`
 	LeaseUntil string             `json:"leaseUntil,omitempty"`
 	Takeovers  []deletionTakeover `json:"takeovers,omitempty"`
+	// IAM is the quiescence evaluation made under the current fence. A takeover
+	// starts without one and the new holder records its own.
+	IAM *operatorv1.IAMQuiescence `json:"iam,omitempty"`
 }
 
 // deletionTakeover records one change of holder.
@@ -258,6 +261,7 @@ func (d Deps) runAccountDeletion(
 	ctx, cancel := context.WithTimeout(context.Background(), accountDeletionTimeout)
 	tracker := &deletionTracker{jobs: jobs, job: job, revision: revision, cancel: cancel}
 	engine.OnStage = tracker.stageFinished
+	engine.OnQuiesced = tracker.quiesced
 
 	go func() {
 		defer cancel()
@@ -297,6 +301,13 @@ func (t *deletionTracker) stageFinished(ctx context.Context, stage accountteardo
 	t.persist(ctx)
 }
 
+func (t *deletionTracker) quiesced(ctx context.Context, quiescence operatorv1.IAMQuiescence) {
+	t.mu.Lock()
+	t.job.IAM = &quiescence
+	t.mu.Unlock()
+	t.persist(ctx)
+}
+
 func (t *deletionTracker) finished(ctx context.Context, result *accountteardown.Result, err error) {
 	t.mu.Lock()
 	if result != nil {

spinifex/operator/admin/account_delete_iam_test.go

@@ -0,0 +1,141 @@
+package admin
+
+//test:in-package — the job record, the tracker and the takeover that clears the
+// evaluation are unexported.
+
+import (
+	"encoding/json"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	operatorv1 "github.com/mulgadc/spinifex/contracts/operator/v1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func sampleQuiescence(fence uint64) operatorv1.IAMQuiescence {
+	return operatorv1.IAMQuiescence{
+		OperationID: "op-1", Fence: fence, Generation: 4,
+		QuiescedScope: []string{},
+		Unresolved: []operatorv1.UnresolvedScope{{
+			Scope: "ec2-key-pair", Class: operatorv1.UnresolvedClassWriter,
+			Reason: operatorv1.ReasonFinalInventoryRereadNotWired,
+		}},
+		Consumers:   []operatorv1.ConsumerBasis{{Consumer: "awsgw-admission", Basis: "ADR-0005:S7"}},
+		Writers:     []operatorv1.AccountedWriter{{Writer: "daemon-nats-handlers", Basis: "owner-inventory", Ref: "mulga-tpoz4"}},
+		Inventory:   []operatorv1.InventoryStatus{{Kind: "key-pair", Status: "observed-clean-at-scan-time"}},
+		EvaluatedAt: "2026-11-02T00:00:00Z",
+	}
+}
+
+// A normal deletion leaves the evaluation on the record, read back from the real
+// IAM account record, and DescribeAccountDeletion returns it.
+func TestDeletionRecordCarriesTheIAMQuiescence(t *testing.T) {
+	gw := newDeleteAccountGateway(t)
+	account := newTenantAccount(t, gw, "tenant@example.com")
+
+	_, err := gw.deleteAccount(t.Context(),
+		deleteAccountBody(t, account.AccountID, "tenant@example.com", deleteClientToken))
+	require.NoError(t, err)
+	require.Eventually(t, func() bool {
+		return describeDeletion(t, gw, account.AccountID).State == operatorv1.DeletionStateCompleted
+	}, 30*time.Second, 100*time.Millisecond)
+
+	stored := describeDeletion(t, gw, account.AccountID)
+	require.NotNil(t, stored.IAM)
+	assert.Equal(t, stored.OperationID, stored.IAM.OperationID)
+	assert.Equal(t, uint64(1), stored.IAM.Fence)
+	assert.Positive(t, stored.IAM.Generation)
+	assert.Empty(t, stored.IAM.QuiescedScope)
+	assert.NotEmpty(t, stored.IAM.Unresolved)
+	assert.Len(t, stored.IAM.Consumers, 3)
+	// The stubbed cluster answers the inventory subject with an empty body, which
+	// is an incomplete inventory, and recording that must not fail the teardown.
+	for _, kind := range []string{"ec2-key-pair", "ec2-placement-group", "ec2-launch-template"} {
+		var reasons []string
+		for _, entry := range stored.IAM.Unresolved {
+			if entry.Scope == kind {
+				reasons = append(reasons, entry.Reason)
+			}
+		}
+		assert.Equal(t, []string{operatorv1.ReasonOwnerInventoryIncomplete}, reasons, kind)
+	}
+}
+
+// The evaluation belongs to a fence: a holder that has been taken over cannot
+// write it into the new holder's record.
+func TestSupersededHolderCannotWriteTheQuiescence(t *testing.T) {
+	gw := newDeleteAccountGateway(t)
+	jobs, err := gw.accountDeletionStore(t.Context())
+	require.NoError(t, err)
+	const accountID = "000000000042"
+
+	holderA, revisionA, err := claimAs(t, jobs, accountID, strings.Repeat("a", 32), "node-a")
+	require.NoError(t, err)
+	var cancelled atomic.Bool
+	trackerA := &deletionTracker{jobs: jobs, job: holderA, revision: revisionA, cancel: func() { cancelled.Store(true) }}
+
+	expireLease(t, jobs, accountID)
+	_, _, err = claimAs(t, jobs, accountID, strings.Repeat("b", 32), "node-b")
+	require.NoError(t, err)
+
+	trackerA.quiesced(t.Context(), sampleQuiescence(1))
+
+	assert.True(t, cancelled.Load())
+	stored := describeDeletion(t, gw, accountID)
+	assert.Equal(t, uint64(2), stored.Fence)
+	assert.Nil(t, stored.IAM, "the old holder's evaluation must not land under the new fence")
+}
+
+// A takeover starts without the previous fence's evaluation, and the new holder
+// records its own under the new fence.
+func TestTakeoverClearsTheQuiescenceAndTheNewHolderRecordsItsOwn(t *testing.T) {
+	gw := newDeleteAccountGateway(t)
+	jobs, err := gw.accountDeletionStore(t.Context())
+	require.NoError(t, err)
+	const accountID = "000000000042"
+
+	holderA, revisionA, err := claimAs(t, jobs, accountID, strings.Repeat("a", 32), "node-a")
+	require.NoError(t, err)
+	trackerA := &deletionTracker{jobs: jobs, job: holderA, revision: revisionA}
+	trackerA.quiesced(t.Context(), sampleQuiescence(1))
+	require.NotNil(t, describeDeletion(t, gw, accountID).IAM)
+
+	expireLease(t, jobs, accountID)
+	holderB, revisionB, err := claimAs(t, jobs, accountID, strings.Repeat("b", 32), "node-b")
+	require.NoError(t, err)
+	assert.Nil(t, holderB.IAM)
+	assert.Nil(t, describeDeletion(t, gw, accountID).IAM, "the record shows no evaluation until the new holder makes one")
+
+	trackerB := &deletionTracker{jobs: jobs, job: holderB, revision: revisionB}
+	trackerB.quiesced(t.Context(), sampleQuiescence(2))
+	stored := describeDeletion(t, gw, accountID)
+	require.NotNil(t, stored.IAM)
+	assert.Equal(t, uint64(2), stored.IAM.Fence)
+}
+
+// The field is optional on the wire: a record from before it decodes without it
+// and prints without it, and one with it keeps the lists as arrays.
+func TestAdminWire_DeletionJobIAMIsOptional(t *testing.T) {
+	var old accountDeletionJob
+	require.NoError(t, json.Unmarshal([]byte(`{"deletionId":"d","accountId":"000000000042","state":"RUNNING"}`), &old))
+	assert.Nil(t, old.IAM)
+	encoded, err := json.Marshal(old)
+	require.NoError(t, err)
+	assert.NotContains(t, string(encoded), `"iam"`)
+
+	quiescence := sampleQuiescence(1)
+	data, err := json.Marshal(accountDeletionJob{DeletionID: "d", AccountID: "000000000042", State: "RUNNING", IAM: &quiescence})
+	require.NoError(t, err)
+	var raw map[string]json.RawMessage
+	require.NoError(t, json.Unmarshal(data, &raw))
+	goldenJSON(t, raw["iam"], `{
+		"operationId":"op-1","fence":1,"generation":4,"quiescedScope":[],
+		"unresolved":[{"scope":"ec2-key-pair","class":"writer","reason":"final-inventory-reread-not-wired"}],
+		"consumers":[{"consumer":"awsgw-admission","basis":"ADR-0005:S7"}],
+		"writers":[{"writer":"daemon-nats-handlers","basis":"owner-inventory","ref":"mulga-tpoz4"}],
+		"inventory":[{"kind":"key-pair","status":"observed-clean-at-scan-time"}],
+		"evaluatedAt":"2026-11-02T00:00:00Z"}`)
+}

spinifex/operator/admin/instance_metrics.go

@@ -106,10 +106,33 @@ func flushSupported(w http.ResponseWriter) bool {
 }
 
 func streamInstanceMetrics(w http.ResponseWriter, r *http.Request, nc *nats.Conn, accountID, instanceID string, since int64) error {
+	return streamLive(w, r, nc, liveSubjects{
+		action: GetInstanceMetricsAction,
+		sample: telemetryv1.LiveSampleSubject(accountID, instanceID),
+		watch:  telemetryv1.LiveWatchSubject(accountID, instanceID),
+		absent: awserrors.ErrorInvalidInstanceIDNotFound,
+	}, since, func(data []byte) ([]telemetryv1.LiveSample, error) {
+		var ring telemetryv1.LiveRing
+		err := json.Unmarshal(data, &ring)
+		return ring.Samples, err
+	}, func(s telemetryv1.LiveSample) int64 { return s.TimeMillis })
+}
+
+// liveSubjects names one live source: where its samples are published, where
+// to ask for its ring, and the error for a source nobody answers for.
+type liveSubjects struct {
+	action string
+	sample string
+	watch  string
+	absent string
+}
+
+func streamLive[S any](w http.ResponseWriter, r *http.Request, nc *nats.Conn, src liveSubjects, since int64,
+	decodeRing func([]byte) ([]S, error), stamp func(S) int64) error {
 	samples := make(chan *nats.Msg, 64)
-	sub, err := nc.ChanSubscribe(telemetryv1.LiveSampleSubject(accountID, instanceID), samples)
+	sub, err := nc.ChanSubscribe(src.sample, samples)
 	if err != nil {
-		slog.ErrorContext(r.Context(), "GetInstanceMetrics: subscribe", "err", err)
+		slog.ErrorContext(r.Context(), src.action+": subscribe", "err", err)
 		return errors.New(awserrors.ErrorServerInternal)
 	}
 	defer func() { _ = sub.Unsubscribe() }()
@@ -118,22 +141,21 @@ func streamInstanceMetrics(w http.ResponseWriter, r *http.Request, nc *nats.Conn
 	if err != nil {
 		return errors.New(awserrors.ErrorInternalError)
 	}
-	watchSubject := telemetryv1.LiveWatchSubject(accountID, instanceID)
 
 	// Subscribed first, then asked for the ring, so nothing falls between them.
-	// No responder is an instance that is not running in this account, which
+	// No responder is a source that is not running in this account, which
 	// reads the same as one that does not exist.
-	reply, err := nc.Request(watchSubject, watch, liveWatchTimeout)
+	reply, err := nc.Request(src.watch, watch, liveWatchTimeout)
 	if err != nil {
 		if errors.Is(err, nats.ErrNoResponders) || errors.Is(err, nats.ErrTimeout) {
-			return errors.New(awserrors.ErrorInvalidInstanceIDNotFound)
+			return errors.New(src.absent)
 		}
-		slog.ErrorContext(r.Context(), "GetInstanceMetrics: watch request", "err", err)
+		slog.ErrorContext(r.Context(), src.action+": watch request", "err", err)
 		return errors.New(awserrors.ErrorServerInternal)
 	}
-	var ring telemetryv1.LiveRing
-	if err := json.Unmarshal(reply.Data, &ring); err != nil {
-		slog.ErrorContext(r.Context(), "GetInstanceMetrics: malformed ring", "err", err)
+	ring, err := decodeRing(reply.Data)
+	if err != nil {
+		slog.ErrorContext(r.Context(), src.action+": malformed ring", "err", err)
 		return errors.New(awserrors.ErrorServerInternal)
 	}
 
@@ -146,22 +168,23 @@ func streamInstanceMetrics(w http.ResponseWriter, r *http.Request, nc *nats.Conn
 	// From here the status is committed, so failures end the stream quietly and
 	// the client reconnects.
 	last := since
-	send := func(s telemetryv1.LiveSample) bool {
-		if s.TimeMillis <= last {
+	send := func(s S) bool {
+		t := stamp(s)
+		if t <= last {
 			return true
 		}
 		data, err := json.Marshal(s)
 		if err != nil {
 			return true
 		}
-		last = s.TimeMillis
-		if _, err := fmt.Fprintf(w, "id: %d\nevent: sample\ndata: %s\n\n", s.TimeMillis, data); err != nil {
+		last = t
+		if _, err := fmt.Fprintf(w, "id: %d\nevent: sample\ndata: %s\n\n", t, data); err != nil {
 			return false
 		}
 		return ctrl.Flush() == nil
 	}
 
-	for _, s := range ring.Samples {
+	for _, s := range ring {
 		if !send(s) {
 			return nil
 		}
@@ -184,17 +207,17 @@ func streamInstanceMetrics(w http.ResponseWriter, r *http.Request, nc *nats.Conn
 		case <-end.C:
 			return nil
 		case <-renew.C:
-			if err := nc.Publish(watchSubject, watch); err != nil {
-				slog.DebugContext(r.Context(), "GetInstanceMetrics: renew watch", "err", err)
+			if err := nc.Publish(src.watch, watch); err != nil {
+				slog.DebugContext(r.Context(), src.action+": renew watch", "err", err)
 			}
 		case <-keepAlive.C:
 			if _, err := fmt.Fprint(w, ": keep-alive\n\n"); err != nil || ctrl.Flush() != nil {
 				return nil
 			}
 		case msg := <-samples:
-			var s telemetryv1.LiveSample
+			var s S
 			if err := json.Unmarshal(msg.Data, &s); err != nil {
-				slog.DebugContext(r.Context(), "GetInstanceMetrics: malformed sample", "err", err)
+				slog.DebugContext(r.Context(), src.action+": malformed sample", "err", err)
 				continue
 			}
 			if !send(s) {

spinifex/operator/admin/node_insight.go

@@ -0,0 +1,441 @@
+package admin
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"slices"
+	"strconv"
+	"time"
+
+	clusterv1 "github.com/mulgadc/spinifex/contracts/cluster/v1"
+	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
+	natsmsg "github.com/mulgadc/spinifex/spinifex/foundation/messaging/nats"
+	"github.com/mulgadc/spinifex/spinifex/foundation/state/kvstore"
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// GetNodeFactsOutput is the response for GetNodeFacts.
+type GetNodeFactsOutput struct {
+	Nodes []clusterv1.NodeFacts `json:"nodes"`
+}
+
+// nodeFactsTimeout allows for a node rebuilding its facts, which reads every NIC.
+const nodeFactsTimeout = 7 * time.Second
+
+// GetNodeFacts gathers every node's hardware and network facts.
+func GetNodeFacts(ctx context.Context, nc *nats.Conn, expectedNodes int) (*GetNodeFactsOutput, error) {
+	frames, _, err := natsmsg.Gather(ctx, nc, clusterv1.NodeFactsSubject, []byte("{}"),
+		natsmsg.GatherOpts{Timeout: nodeFactsTimeout, ExpectedNodes: expectedNodes})
+	if err != nil {
+		return nil, err
+	}
+	out := &GetNodeFactsOutput{Nodes: make([]clusterv1.NodeFacts, 0, len(frames))}
+	for _, frame := range frames {
+		var f clusterv1.NodeFacts
+		if json.Unmarshal(frame.Data, &f) == nil && f.Node != "" {
+			out.Nodes = append(out.Nodes, f)
+		}
+	}
+	slices.SortFunc(out.Nodes, func(a, b clusterv1.NodeFacts) int {
+		switch {
+		case a.Node < b.Node:
+			return -1
+		case a.Node > b.Node:
+			return 1
+		}
+		return 0
+	})
+	return out, nil
+}
+
+// Network test states.
+const (
+	NetworkTestRunning  = "running"
+	NetworkTestComplete = "complete"
+	NetworkTestFailed   = "failed"
+	NetworkTestPending  = "pending"
+)
+
+// Bounds on one network test, so an admin cannot tie the cluster's links up.
+const (
+	defaultNetworkTestSeconds = 10
+	defaultNetworkTestStreams = 4
+	maxNetworkTestRuns        = 24
+	maxNetworkTestListed      = 20
+	networkTestRunSlack       = 20 * time.Second
+	networkTestServeTimeout   = 5 * time.Second
+)
+
+// NetworkTest is one admin-requested test: every ordered pair of nodes on a
+// plane, run one after another so no two share a link.
+type NetworkTest struct {
+	TestID          string              `json:"testId"`
+	Plane           string              `json:"plane"`
+	Status          string              `json:"status"`
+	DurationSeconds int                 `json:"durationSeconds"`
+	Streams         int                 `json:"streams"`
+	StartedAt       time.Time           `json:"startedAt"`
+	CompletedAt     *time.Time          `json:"completedAt,omitempty"`
+	Error           string              `json:"error,omitempty"`
+	Runs            []NetworkTestResult `json:"runs"`
+}
+
+// NetworkTestResult is one direction between two nodes.
+type NetworkTestResult struct {
+	clusterv1.NetTestRunResponse
+
+	From   string `json:"from"`
+	To     string `json:"to"`
+	Status string `json:"status"`
+}
+
+// NetworkTestStore holds tests and the one cluster-wide claim on running one.
+type NetworkTestStore interface {
+	// Claim takes the cluster-wide slot for testID until the given time, and
+	// reports ErrNetworkTestBusy while another unexpired claim holds it.
+	Claim(ctx context.Context, testID string, until time.Time) error
+	Release(ctx context.Context, testID string) error
+	Put(ctx context.Context, t *NetworkTest) error
+	Get(ctx context.Context, testID string) (*NetworkTest, error)
+	List(ctx context.Context) ([]NetworkTest, error)
+}
+
+// ErrNetworkTestBusy is a claim refused because another test is running.
+var ErrNetworkTestBusy = errors.New("a network test is already running")
+
+const (
+	networkTestBucket   = "spinifex-network-tests"
+	networkTestTTL      = 7 * 24 * time.Hour
+	networkTestClaimKey = "active"
+	networkTestPrefix   = "test."
+)
+
+type networkTestClaim struct {
+	TestID string    `json:"testId"`
+	Until  time.Time `json:"until"`
+}
+
+// KVNetworkTests is the NetworkTestStore over a JetStream KV bucket, shared
+// by every gateway so a test started through one is visible through all.
+type KVNetworkTests struct {
+	tests  *kvstore.Store[NetworkTest]
+	claims *kvstore.Store[networkTestClaim]
+}
+
+var _ NetworkTestStore = (*KVNetworkTests)(nil)
+
+// NewKVNetworkTests constructs the store over the cluster's JetStream client.
+func NewKVNetworkTests(js jetstream.JetStream) *KVNetworkTests {
+	b := kvstore.NewBucket(js, kvstore.Config{
+		Name:    networkTestBucket,
+		History: 1,
+		TTL:     networkTestTTL,
+		Missing: "network tests: no JetStream client configured",
+	})
+	return &KVNetworkTests{tests: kvstore.On[NetworkTest](b), claims: kvstore.On[networkTestClaim](b)}
+}
+
+// Claim is a create-only write; an expired claim, left by a gateway that died
+// mid-test, is replaced under its revision so two takers cannot both win.
+func (s *KVNetworkTests) Claim(ctx context.Context, testID string, until time.Time) error {
+	claim := &networkTestClaim{TestID: testID, Until: until}
+	var held *networkTestClaim
+	var rev uint64
+	// A holder releasing between the create and the read leaves nothing to
+	// read, so the create is tried again rather than failing the request.
+	for attempt := 0; ; attempt++ {
+		_, err := s.claims.Create(ctx, networkTestClaimKey, claim)
+		if !errors.Is(err, kvstore.ErrExists) {
+			return err
+		}
+		held, rev, err = s.claims.Get(ctx, networkTestClaimKey)
+		if err == nil {
+			break
+		}
+		if !errors.Is(err, kvstore.ErrNotFound) || attempt == 2 {
+			return err
+		}
+	}
+	if time.Now().Before(held.Until) {
+		return ErrNetworkTestBusy
+	}
+	if _, err := s.claims.CompareAndSet(ctx, networkTestClaimKey, claim, rev); err != nil {
+		if errors.Is(err, kvstore.ErrConflict) {
+			return ErrNetworkTestBusy
+		}
+		return err
+	}
+	return nil
+}
+
+// Release drops the claim only if testID still holds it.
+func (s *KVNetworkTests) Release(ctx context.Context, testID string) error {
+	held, rev, err := s.claims.Get(ctx, networkTestClaimKey)
+	if errors.Is(err, kvstore.ErrNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if held.TestID != testID {
+		return nil
+	}
+	return s.claims.CompareAndDelete(ctx, networkTestClaimKey, rev)
+}
+
+func (s *KVNetworkTests) Put(ctx context.Context, t *NetworkTest) error {
+	return s.tests.Set(ctx, networkTestPrefix+t.TestID, t)
+}
+
+func (s *KVNetworkTests) Get(ctx context.Context, testID string) (*NetworkTest, error) {
+	t, _, err := s.tests.Get(ctx, networkTestPrefix+testID)
+	return t, err
+}
+
+func (s *KVNetworkTests) List(ctx context.Context) ([]NetworkTest, error) {
+	return s.tests.List(ctx, networkTestPrefix)
+}
+
+// StartNetworkTest validates the request, claims the cluster-wide slot,
+// records the test and returns at once; the runs converge in the background.
+func (d Deps) StartNetworkTest(ctx context.Context, args map[string]string) (*NetworkTest, error) {
+	if d.NetworkTests == nil || d.NATS == nil {
+		return nil, errors.New(awserrors.ErrorServerInternal)
+	}
+	plane := args["Plane"]
+	if plane != clusterv1.PlaneWAN && plane != clusterv1.PlaneLAN && plane != clusterv1.PlaneVPC {
+		return nil, awserrors.Errorf(awserrors.ErrorInvalidParameterValue, "Plane must be wan, lan or vpc")
+	}
+	duration, err := intArg(args, "DurationSeconds", defaultNetworkTestSeconds, minNetTestSeconds, maxNetTestSeconds)
+	if err != nil {
+		return nil, err
+	}
+	streams, err := intArg(args, "Streams", defaultNetworkTestStreams, 1, maxNetTestStreams)
+	if err != nil {
+		return nil, err
+	}
+	runs, err := networkTestPairs(d.NodeIDs, args["Source"], args["Target"])
+	if err != nil {
+		return nil, err
+	}
+
+	test := &NetworkTest{
+		TestID: newNetworkTestID(), Plane: plane, Status: NetworkTestRunning,
+		DurationSeconds: duration, Streams: streams, StartedAt: time.Now().UTC(), Runs: runs,
+	}
+	perRun := time.Duration(duration)*time.Second + networkTestRunSlack + networkTestServeTimeout
+	until := time.Now().Add(time.Duration(len(runs))*perRun + time.Minute)
+	switch err := d.NetworkTests.Claim(ctx, test.TestID, until); {
+	case errors.Is(err, ErrNetworkTestBusy):
+		return nil, awserrors.Errorf(awserrors.ErrorIncorrectState, "%s", err.Error())
+	case err != nil:
+		slog.ErrorContext(ctx, "StartNetworkTest: claim", "err", err)
+		return nil, errors.New(awserrors.ErrorServerInternal)
+	}
+	if err := d.NetworkTests.Put(ctx, test); err != nil {
+		_ = d.NetworkTests.Release(ctx, test.TestID)
+		slog.ErrorContext(ctx, "StartNetworkTest: record", "err", err)
+		return nil, errors.New(awserrors.ErrorServerInternal)
+	}
+	slog.InfoContext(ctx, "network test started", "test_id", test.TestID, "plane", plane, "runs", len(runs))
+
+	started := *test
+	started.Runs = slices.Clone(test.Runs)
+	go d.runNetworkTest(context.WithoutCancel(ctx), test, perRun)
+	return &started, nil
+}
+
+// These mirror the daemon's limits, which refuse anything outside them.
+const (
+	minNetTestSeconds = 5
+	maxNetTestSeconds = 30
+	maxNetTestStreams = 16
+)
+
+func intArg(args map[string]string, name string, def, lo, hi int) (int, error) {
+	raw := args[name]
+	if raw == "" {
+		return def, nil
+	}
+	v, err := strconv.Atoi(raw)
+	if err != nil || v < lo || v > hi {
+		return 0, awserrors.Errorf(awserrors.ErrorInvalidParameterValue, "%s must be between %d and %d", name, lo, hi)
+	}
+	return v, nil
+}
+
+// networkTestPairs is both directions between source and target, or with no
+// target every ordered pair of nodes, the source's first.
+func networkTestPairs(nodes []string, source, target string) ([]NetworkTestResult, error) {
+	known := func(n string) bool { return slices.Contains(nodes, n) }
+	if source != "" && !known(source) {
+		return nil, awserrors.Errorf(awserrors.ErrorInvalidParameterValue, "unknown Source node")
+	}
+	if target != "" && !known(target) {
+		return nil, awserrors.Errorf(awserrors.ErrorInvalidParameterValue, "unknown Target node")
+	}
+	var runs []NetworkTestResult
+	add := func(from, to string) {
+		runs = append(runs, NetworkTestResult{From: from, To: to, Status: NetworkTestPending})
+	}
+	switch {
+	case source != "" && target != "":
+		if source == target {
+			return nil, awserrors.Errorf(awserrors.ErrorInvalidParameterCombination, "Source and Target must differ")
+		}
+		add(source, target)
+		add(target, source)
+	case target != "":
+		return nil, awserrors.Errorf(awserrors.ErrorMissingParameter, "Target needs a Source")
+	default:
+		order := slices.Clone(nodes)
+		slices.Sort(order)
+		if source != "" {
+			order = append([]string{source}, slices.DeleteFunc(order, func(n string) bool { return n == source })...)
+		}
+		for _, from := range order {
+			for _, to := range order {
+				if from != to {
+					add(from, to)
+				}
+			}
+		}
+	}
+	if len(runs) == 0 {
+		return nil, awserrors.Errorf(awserrors.ErrorInvalidParameterValue, "a network test needs at least two nodes")
+	}
+	if len(runs) > maxNetworkTestRuns {
+		return nil, awserrors.Errorf(awserrors.ErrorInvalidParameterValue, "too many nodes for a full mesh; name a Source and Target")
+	}
+	return runs, nil
+}
+
+func newNetworkTestID() string {
+	b := make([]byte, 8)
+	_, _ = rand.Read(b)
+	return "nt-" + hex.EncodeToString(b)
+}
+
+// runNetworkTest drives each run in turn and writes the record after each,
+// so a poller sees results as they land.
+func (d Deps) runNetworkTest(parent context.Context, test *NetworkTest, perRun time.Duration) {
+	ctx, cancel := context.WithTimeout(parent, time.Duration(len(test.Runs))*perRun+time.Minute)
+	defer cancel()
+	defer func() {
+		if err := d.NetworkTests.Release(parent, test.TestID); err != nil {
+			slog.Warn("network test: release claim", "test_id", test.TestID, "err", err)
+		}
+	}()
+
+	failed := 0
+	for i := range test.Runs {
+		run := &test.Runs[i]
+		run.Status = NetworkTestRunning
+		d.saveNetworkTest(ctx, test)
+		res, err := d.runNetworkTestPair(ctx, test, run.From, run.To, perRun)
+		run.NetTestRunResponse = res
+		if err != nil {
+			run.Status, run.Error = NetworkTestFailed, err.Error()
+			failed++
+		} else {
+			run.Status = NetworkTestComplete
+		}
+	}
+	now := time.Now().UTC()
+	test.CompletedAt = &now
+	test.Status = NetworkTestComplete
+	if failed == len(test.Runs) {
+		test.Status, test.Error = NetworkTestFailed, "every run failed"
+	}
+	// The run deadline may have passed, and the final status must still land.
+	d.saveNetworkTest(parent, test)
+	slog.Info("network test finished", "test_id", test.TestID, "status", test.Status, "failed_runs", failed)
+}
+
+func (d Deps) saveNetworkTest(ctx context.Context, test *NetworkTest) {
+	if err := d.NetworkTests.Put(ctx, test); err != nil {
+		slog.Warn("network test: write record", "test_id", test.TestID, "err", err)
+	}
+}
+
+func (d Deps) runNetworkTestPair(ctx context.Context, test *NetworkTest, from, to string, perRun time.Duration) (clusterv1.NetTestRunResponse, error) {
+	var res clusterv1.NetTestRunResponse
+	serveReq, err := json.Marshal(clusterv1.NetTestServeRequest{Plane: test.Plane, DurationSeconds: test.DurationSeconds})
+	if err != nil {
+		return res, fmt.Errorf("encode serve request: %w", err)
+	}
+	sctx, scancel := context.WithTimeout(ctx, networkTestServeTimeout)
+	defer scancel()
+	msg, err := d.NATS.RequestWithContext(sctx, clusterv1.NetTestServeSubject(to), serveReq)
+	if err != nil {
+		return res, fmt.Errorf("%s did not start its server: %w", to, err)
+	}
+	var served clusterv1.NetTestServeResponse
+	if err := json.Unmarshal(msg.Data, &served); err != nil {
+		return res, fmt.Errorf("%s: malformed serve reply", to)
+	}
+	if served.Error != "" {
+		return res, fmt.Errorf("%s: %s", to, served.Error)
+	}
+
+	runReq, err := json.Marshal(clusterv1.NetTestRunRequest{
+		Plane: test.Plane, Address: served.Address, Port: served.Port,
+		DurationSeconds: test.DurationSeconds, Streams: test.Streams,
+	})
+	if err != nil {
+		return res, fmt.Errorf("encode run request: %w", err)
+	}
+	rctx, cancel := context.WithTimeout(ctx, perRun)
+	defer cancel()
+	msg, err = d.NATS.RequestWithContext(rctx, clusterv1.NetTestRunSubject(from), runReq)
+	if err != nil {
+		return res, fmt.Errorf("%s did not report a result: %w", from, err)
+	}
+	if err := json.Unmarshal(msg.Data, &res); err != nil {
+		return res, fmt.Errorf("%s: malformed result", from)
+	}
+	if res.Error != "" {
+		return res, errors.New(res.Error)
+	}
+	return res, nil
+}
+
+// DescribeNetworkTestsOutput is the response for DescribeNetworkTests.
+type DescribeNetworkTestsOutput struct {
+	Tests []NetworkTest `json:"tests"`
+}
+
+// DescribeNetworkTests returns one test by ID, or the most recent ones.
+func (d Deps) DescribeNetworkTests(ctx context.Context, args map[string]string) (*DescribeNetworkTestsOutput, error) {
+	if d.NetworkTests == nil {
+		return nil, errors.New(awserrors.ErrorServerInternal)
+	}
+	if id := args["TestId"]; id != "" {
+		t, err := d.NetworkTests.Get(ctx, id)
+		if errors.Is(err, kvstore.ErrNotFound) {
+			return nil, awserrors.Errorf(awserrors.ErrorResourceNotFound, "no network test %s", id)
+		}
+		if err != nil {
+			return nil, err
+		}
+		return &DescribeNetworkTestsOutput{Tests: []NetworkTest{*t}}, nil
+	}
+	tests, err := d.NetworkTests.List(ctx)
+	if err != nil {
+		return nil, err
+	}
+	slices.SortFunc(tests, func(a, b NetworkTest) int { return b.StartedAt.Compare(a.StartedAt) })
+	if len(tests) > maxNetworkTestListed {
+		tests = tests[:maxNetworkTestListed]
+	}
+	if tests == nil {
+		tests = []NetworkTest{}
+	}
+	return &DescribeNetworkTestsOutput{Tests: tests}, nil
+}

spinifex/operator/admin/node_insight_test.go

@@ -0,0 +1,225 @@
+package admin
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/mulgadc/bluebottle/pkg/iampolicy"
+	clusterv1 "github.com/mulgadc/spinifex/contracts/cluster/v1"
+	"github.com/mulgadc/spinifex/internal/testkit"
+	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
+	awsidentifiers "github.com/mulgadc/spinifex/spinifex/foundation/aws/identifiers"
+	"github.com/nats-io/nats.go"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetNodeMetricsAsksThePolicyBeforeAnythingElse(t *testing.T) {
+	var asked []string
+	deny := func(_, act string, _ []string, _ iampolicy.ConditionKeys) error {
+		asked = append(asked, act)
+		return errors.New(awserrors.ErrorAccessDenied)
+	}
+	_, err := serve(t, Deps{}, awsidentifiers.DefaultAccountID(), action(GetNodeMetricsAction, "NodeId", "node1"), deny)
+	requireCode(t, err, awserrors.ErrorAccessDenied)
+	assert.Equal(t, []string{GetNodeMetricsAction}, asked)
+}
+
+func TestGetNodeMetricsRefusesANodeOutsideTheCluster(t *testing.T) {
+	d := Deps{NodeIDs: []string{"node1", "node2"}}
+	for _, node := range []string{"node9", "node1.>", "*"} {
+		_, err := serve(t, d, awsidentifiers.DefaultAccountID(), action(GetNodeMetricsAction, "NodeId", node), nil)
+		code, _ := awserrors.ResolveErrorCode(err)
+		assert.Equal(t, awserrors.ErrorInvalidParameterValue, code, node)
+	}
+}
+
+func TestNetworkTestPairs(t *testing.T) {
+	nodes := []string{"c", "a", "b"}
+
+	pair, err := networkTestPairs(nodes, "a", "b")
+	require.NoError(t, err)
+	assert.Equal(t, [][2]string{{"a", "b"}, {"b", "a"}}, directions(pair))
+
+	mesh, err := networkTestPairs(nodes, "b", "")
+	require.NoError(t, err)
+	assert.Equal(t, [][2]string{{"b", "a"}, {"b", "c"}, {"a", "b"}, {"a", "c"}, {"c", "b"}, {"c", "a"}}, directions(mesh))
+
+	for _, c := range []struct{ source, target, code string }{
+		{"a", "a", awserrors.ErrorInvalidParameterCombination},
+		{"", "b", awserrors.ErrorMissingParameter},
+		{"z", "", awserrors.ErrorInvalidParameterValue},
+		{"a", "z", awserrors.ErrorInvalidParameterValue},
+	} {
+		_, err := networkTestPairs(nodes, c.source, c.target)
+		code, _ := awserrors.ResolveErrorCode(err)
+		assert.Equal(t, c.code, code, "%s -> %s", c.source, c.target)
+	}
+
+	_, err = networkTestPairs([]string{"solo"}, "", "")
+	assert.Error(t, err, "one node has nobody to test against")
+}
+
+func directions(runs []NetworkTestResult) [][2]string {
+	out := make([][2]string, len(runs))
+	for i, r := range runs {
+		out[i] = [2]string{r.From, r.To}
+	}
+	return out
+}
+
+func TestStartNetworkTestValidatesBeforeClaiming(t *testing.T) {
+	_, nc, js := testutil.StartTestJetStream(t)
+	d := Deps{NATS: nc, NetworkTests: NewKVNetworkTests(js), NodeIDs: []string{"a", "b"}}
+	for _, args := range []map[string]string{
+		{"Plane": "mgmt"},
+		{"Plane": "lan", "DurationSeconds": "600"},
+		{"Plane": "lan", "Streams": "0"},
+		{"Plane": "lan", "Source": "a", "Target": "a"},
+	} {
+		_, err := d.StartNetworkTest(context.Background(), args)
+		assert.Error(t, err, "%v", args)
+	}
+	tests, err := d.NetworkTests.List(context.Background())
+	require.NoError(t, err)
+	assert.Empty(t, tests, "a refused request records nothing")
+}
+
+func TestNetworkTestClaimIsClusterWide(t *testing.T) {
+	_, _, js := testutil.StartTestJetStream(t)
+	ctx := context.Background()
+	first, second := NewKVNetworkTests(js), NewKVNetworkTests(js)
+
+	require.NoError(t, first.Claim(ctx, "nt-1", time.Now().Add(time.Minute)))
+	assert.ErrorIs(t, second.Claim(ctx, "nt-2", time.Now().Add(time.Minute)), ErrNetworkTestBusy)
+
+	require.NoError(t, second.Release(ctx, "nt-2"), "releasing a claim it does not hold is a no-op")
+	assert.ErrorIs(t, second.Claim(ctx, "nt-2", time.Now().Add(time.Minute)), ErrNetworkTestBusy)
+
+	require.NoError(t, first.Release(ctx, "nt-1"))
+	require.NoError(t, second.Claim(ctx, "nt-2", time.Now().Add(-time.Second)))
+	require.NoError(t, first.Claim(ctx, "nt-3", time.Now().Add(time.Minute)), "an expired claim is taken over")
+}
+
+// fakeNode answers the serve and run halves as a daemon would, reporting a
+// fixed throughput, or failing the serve when broken. A run waits for gate.
+func fakeNode(t *testing.T, nc *nats.Conn, node, addr string, bps float64, broken bool, gate <-chan struct{}) {
+	t.Helper()
+	serveSub, err := nc.Subscribe(clusterv1.NetTestServeSubject(node), func(m *nats.Msg) {
+		resp := clusterv1.NetTestServeResponse{Address: addr, Port: clusterv1.NetTestPort}
+		if broken {
+			resp = clusterv1.NetTestServeResponse{Error: "iperf (version 2) is not installed on this node"}
+		}
+		data, _ := json.Marshal(resp)
+		_ = m.Respond(data)
+	})
+	require.NoError(t, err)
+	runSub, err := nc.Subscribe(clusterv1.NetTestRunSubject(node), func(m *nats.Msg) {
+		if gate != nil {
+			<-gate
+		}
+		var req clusterv1.NetTestRunRequest
+		_ = json.Unmarshal(m.Data, &req)
+		data, _ := json.Marshal(clusterv1.NetTestRunResponse{
+			SourceAddress: addr, BitsPerSecond: bps, Streams: req.Streams, LinkMbps: 25000, Tool: "iperf2",
+		})
+		_ = m.Respond(data)
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = serveSub.Unsubscribe(); _ = runSub.Unsubscribe() })
+}
+
+func TestNetworkTestRunsEveryDirectionAndRecordsEachResult(t *testing.T) {
+	_, nc, js := testutil.StartTestJetStream(t)
+	ctx := context.Background()
+	d := Deps{NATS: nc, NetworkTests: NewKVNetworkTests(js), NodeIDs: []string{"a", "b", "c"}}
+	gate := make(chan struct{})
+	fakeNode(t, nc, "a", "10.10.8.4", 23e9, false, gate)
+	fakeNode(t, nc, "b", "10.10.8.5", 22e9, false, gate)
+	fakeNode(t, nc, "c", "10.10.8.6", 0, true, gate)
+
+	started, err := d.StartNetworkTest(ctx, map[string]string{"Plane": "lan", "DurationSeconds": "5", "Streams": "2"})
+	require.NoError(t, err)
+	assert.Equal(t, NetworkTestRunning, started.Status)
+	assert.Len(t, started.Runs, 6)
+
+	_, err = d.StartNetworkTest(ctx, map[string]string{"Plane": "lan"})
+	code, _ := awserrors.ResolveErrorCode(err)
+	assert.Equal(t, awserrors.ErrorIncorrectState, code, "one test at a time across the cluster")
+	close(gate)
+
+	var done NetworkTest
+	require.Eventually(t, func() bool {
+		out, err := d.DescribeNetworkTests(ctx, map[string]string{"TestId": started.TestID})
+		if err != nil || len(out.Tests) != 1 {
+			return false
+		}
+		done = out.Tests[0]
+		return done.Status != NetworkTestRunning
+	}, 10*time.Second, 20*time.Millisecond)
+
+	assert.Equal(t, NetworkTestComplete, done.Status, "some runs succeeded")
+	byDirection := map[[2]string]NetworkTestResult{}
+	for _, r := range done.Runs {
+		byDirection[[2]string{r.From, r.To}] = r
+	}
+	ab := byDirection[[2]string{"a", "b"}]
+	assert.Equal(t, NetworkTestComplete, ab.Status)
+	assert.InDelta(t, 23e9, ab.BitsPerSecond, 1)
+	assert.Equal(t, 2, ab.Streams)
+	assert.Equal(t, NetworkTestFailed, byDirection[[2]string{"a", "c"}].Status)
+	assert.Contains(t, byDirection[[2]string{"a", "c"}].Error, "not installed")
+	assert.Equal(t, NetworkTestComplete, byDirection[[2]string{"c", "a"}].Status, "c can still send")
+
+	again, err := d.StartNetworkTest(ctx, map[string]string{"Plane": "lan", "Source": "a", "Target": "b", "DurationSeconds": "5"})
+	require.NoError(t, err, "the claim is released when the test ends")
+
+	list, err := d.DescribeNetworkTests(ctx, map[string]string{})
+	require.NoError(t, err)
+	require.Len(t, list.Tests, 2)
+	assert.Equal(t, again.TestID, list.Tests[0].TestID, "newest first")
+
+	require.Eventually(t, func() bool {
+		out, err := d.DescribeNetworkTests(ctx, map[string]string{"TestId": again.TestID})
+		return err == nil && out.Tests[0].Status != NetworkTestRunning
+	}, 10*time.Second, 20*time.Millisecond)
+}
+
+func TestNetworkTestFailsARunWhoseServerNeverAnswers(t *testing.T) {
+	_, nc, js := testutil.StartTestJetStream(t)
+	ctx := context.Background()
+	d := Deps{NATS: nc, NetworkTests: NewKVNetworkTests(js), NodeIDs: []string{"a", "b"}}
+	fakeNode(t, nc, "a", "10.10.8.4", 23e9, false, nil)
+	silent, err := nc.Subscribe(clusterv1.NetTestServeSubject("b"), func(*nats.Msg) {})
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = silent.Unsubscribe() })
+
+	started, err := d.StartNetworkTest(ctx, map[string]string{"Plane": "lan", "Source": "a", "Target": "b", "DurationSeconds": "5"})
+	require.NoError(t, err)
+
+	var done NetworkTest
+	require.Eventually(t, func() bool {
+		out, err := d.DescribeNetworkTests(ctx, map[string]string{"TestId": started.TestID})
+		if err != nil || len(out.Tests) != 1 {
+			return false
+		}
+		done = out.Tests[0]
+		return done.Status != NetworkTestRunning
+	}, networkTestServeTimeout+3*time.Second, 50*time.Millisecond, "the serve request has its own deadline")
+
+	assert.Equal(t, NetworkTestFailed, done.Status)
+	require.NotEmpty(t, done.Runs)
+	assert.Equal(t, [2]string{"a", "b"}, [2]string{done.Runs[0].From, done.Runs[0].To})
+	assert.Contains(t, done.Runs[0].Error, "b did not start its server")
+}
+
+func TestDescribeNetworkTestsUnknownID(t *testing.T) {
+	_, _, js := testutil.StartTestJetStream(t)
+	d := Deps{NetworkTests: NewKVNetworkTests(js)}
+	_, err := d.DescribeNetworkTests(context.Background(), map[string]string{"TestId": "nt-missing"})
+	code, _ := awserrors.ResolveErrorCode(err)
+	assert.Equal(t, awserrors.ErrorResourceNotFound, code)
+}

spinifex/operator/admin/node_metrics.go

@@ -0,0 +1,63 @@
+package admin
+
+import (
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"net/http"
+	"slices"
+	"strconv"
+
+	telemetryv1 "github.com/mulgadc/spinifex/contracts/telemetry/v1"
+	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
+	otelsetup "github.com/mulgadc/spinifex/spinifex/foundation/telemetry"
+	"github.com/mulgadc/spinifex/spinifex/ingress/aws/dispatch"
+)
+
+// GetNodeMetricsAction streams one node's host load. The dispatcher has
+// already passed the policy and super-admin gates before it runs.
+const GetNodeMetricsAction = "GetNodeMetrics"
+
+func (d Deps) getNodeMetrics(w http.ResponseWriter, inv dispatch.Invocation, queryArgs map[string]string) error {
+	r := inv.Request
+	node := queryArgs["NodeId"]
+	if node == "" {
+		return errors.New(awserrors.ErrorMissingParameter)
+	}
+	if !telemetryv1.ValidLiveNode(node) || (len(d.NodeIDs) > 0 && !slices.Contains(d.NodeIDs, node)) {
+		return awserrors.Errorf(awserrors.ErrorInvalidParameterValue, "unknown NodeId")
+	}
+	var since int64
+	if raw := queryArgs["Since"]; raw != "" {
+		parsed, err := strconv.ParseInt(raw, 10, 64)
+		if err != nil || parsed < 0 {
+			return errors.New(awserrors.ErrorInvalidParameterValue)
+		}
+		since = parsed
+	}
+	if d.NATS == nil {
+		return errors.New(awserrors.ErrorServerInternal)
+	}
+	if !flushSupported(w) {
+		slog.ErrorContext(r.Context(), "GetNodeMetrics: response writer cannot flush")
+		return errors.New(awserrors.ErrorInternalError)
+	}
+
+	release, ok, _ := liveStreams.acquire(inv.AccountID)
+	if !ok {
+		otelsetup.RecordLiveStream(r.Context(), otelsetup.LiveStreamRefusedTotal)
+		return errors.New(awserrors.ErrorRequestLimitExceeded)
+	}
+	defer release()
+
+	return streamLive(w, r, d.NATS, liveSubjects{
+		action: GetNodeMetricsAction,
+		sample: telemetryv1.NodeLiveSampleSubject(node),
+		watch:  telemetryv1.NodeLiveWatchSubject(node),
+		absent: awserrors.ErrorInvalidParameterValue,
+	}, since, func(data []byte) ([]telemetryv1.NodeLiveSample, error) {
+		var ring telemetryv1.NodeLiveRing
+		err := json.Unmarshal(data, &ring)
+		return ring.Samples, err
+	}, func(s telemetryv1.NodeLiveSample) int64 { return s.TimeMillis })
+}

spinifex/operator/admin/registration.go

@@ -69,22 +69,28 @@ type Deps struct {
 	Region                 string
 	SQSWorkerPolling       func() bool
 	SQSTenantAPIRegistered func() bool
+
+	// NetworkTests holds node-to-node throughput tests; nil refuses them.
+	NetworkTests NetworkTestStore
 }
 
 // adminActions are the actions only the super-admin account may call.
 var adminActions = map[string]bool{
-	"GetVersion":        true,
-	"GetNodes":          true,
-	"GetVMs":            true,
-	"GetStorageStatus":  true,
-	"PromoteImage":      true,
-	"GrantModelAccess":  true,
-	"RevokeModelAccess": true,
-	"ListModelAccess":   true,
-	"ListOchreCatalog":  true,
-	"EnsureSQSWorker":   true,
-	"EnableSQS":         true,
-	"DescribeSQS":       true,
+	"GetVersion":           true,
+	"GetNodes":             true,
+	"GetNodeFacts":         true,
+	"StartNetworkTest":     true,
+	"DescribeNetworkTests": true,
+	"GetVMs":               true,
+	"GetStorageStatus":     true,
+	"PromoteImage":         true,
+	"GrantModelAccess":     true,
+	"RevokeModelAccess":    true,
+	"ListModelAccess":      true,
+	"ListOchreCatalog":     true,
+	"EnsureSQSWorker":      true,
+	"EnableSQS":            true,
+	"DescribeSQS":          true,
 }
 
 // AdminActionNames lists the actions only the super-admin account may call, sorted.
@@ -94,7 +100,7 @@ func AdminActionNames() []string {
 
 // ActionNames lists every action the registration dispatches, sorted.
 func ActionNames() []string {
-	names := append(AdminActionNames(), GetInstanceMetricsAction, GetInstanceTypeCapacityAction)
+	names := append(AdminActionNames(), GetInstanceMetricsAction, GetInstanceTypeCapacityAction, GetNodeMetricsAction)
 	slices.Sort(names)
 	return names
 }
@@ -173,11 +179,16 @@ func (d Deps) dispatch(w http.ResponseWriter, inv dispatch.Invocation) error {
 		return errors.New(awserrors.ErrorServerInternal)
 	}
 
-	if adminActions[action] && accountID != awsidentifiers.DefaultAccountID() {
+	if (adminActions[action] || action == GetNodeMetricsAction) && accountID != awsidentifiers.DefaultAccountID() {
 		slog.InfoContext(r.Context(), "Spinifex dispatch: non-admin access denied", "action", action, "accountID", accountID)
 		return errors.New(awserrors.ErrorAccessDenied)
 	}
 
+	// Streams rather than returning one document, and only after both gates.
+	if action == GetNodeMetricsAction {
+		return d.getNodeMetrics(w, inv, args)
+	}
+
 	output, err := d.run(r.Context(), action, args, accountID)
 	if err != nil {
 		return err
@@ -207,6 +218,15 @@ func (d Deps) run(ctx context.Context, action string, args map[string]string, ac
 			return nil, errors.New(awserrors.ErrorServerInternal)
 		}
 		return GetNodes(ctx, d.NATS, d.activeNodes(ctx))
+	case "GetNodeFacts":
+		if d.NATS == nil {
+			return nil, errors.New(awserrors.ErrorServerInternal)
+		}
+		return GetNodeFacts(ctx, d.NATS, d.activeNodes(ctx))
+	case "StartNetworkTest":
+		return d.StartNetworkTest(ctx, args)
+	case "DescribeNetworkTests":
+		return d.DescribeNetworkTests(ctx, args)
 	case GetInstanceTypeCapacityAction:
 		if d.NATS == nil {
 			return nil, errors.New(awserrors.ErrorServerInternal)

spinifex/operator/admin/registration_test.go

@@ -64,7 +64,7 @@ func TestRegistration_GetVersion_Admin(t *testing.T) {
 }
 
 func TestRegistration_EveryActionDeniesNonAdminAccount(t *testing.T) {
-	for _, name := range AdminActionNames() {
+	for _, name := range append(AdminActionNames(), GetNodeMetricsAction) {
 		t.Run(name, func(t *testing.T) {
 			_, err := serve(t, Deps{}, "000000000002", action(name), nil)
 			requireCode(t, err, awserrors.ErrorAccessDenied)
@@ -243,7 +243,7 @@ func TestNewRegistration_DeclaresTheAdminActionsAsItsInventory(t *testing.T) {
 	assert.Equal(t, ServiceName, reg.Service)
 	assert.Equal(t, dispatch.ErrorEnvelopeXML, reg.Errors)
 	assert.ElementsMatch(t, []string{
-		"GetVersion", "GetNodes", "GetVMs", "GetStorageStatus", "PromoteImage",
+		"GetVersion", "GetNodes", "GetNodeFacts", "GetNodeMetrics", "StartNetworkTest", "DescribeNetworkTests", "GetVMs", "GetStorageStatus", "PromoteImage",
 		"GrantModelAccess", "RevokeModelAccess", "ListModelAccess", "ListOchreCatalog",
 		"EnableSQS", "DescribeSQS",
 		"EnsureSQSWorker",

spinifex/operator/cli/admin_node_facts.go

@@ -0,0 +1,30 @@
+package cli
+
+import (
+	"github.com/mulgadc/spinifex/spinifex/runtime/host/nodefacts"
+	"github.com/spf13/cobra"
+)
+
+var adminNodeFactsCmd = &cobra.Command{
+	Use:   "node-facts",
+	Short: "Record this node's hardware and cabling for the operator console",
+}
+
+var adminNodeFactsCollectCmd = &cobra.Command{
+	Use:   "collect",
+	Short: "Run the root-only hardware probes (run by spinifex-daemon.service as root)",
+	Long: `Runs dmidecode, ethtool, udevadm, networkctl lldp and systemd-detect-virt, and
+writes their raw output to /etc/spinifex/node-facts/ readable by the spinifex group.
+The daemon parses the files on request. A probe that fails leaves no file, and the
+console shows that source as unavailable.`,
+	Args:         cobra.NoArgs,
+	SilenceUsage: true,
+	RunE: func(cmd *cobra.Command, _ []string) error {
+		return nodefacts.Collect(cmd.Context(), nodefacts.DefaultDir, "/sys")
+	},
+}
+
+func init() {
+	adminCmd.AddCommand(adminNodeFactsCmd)
+	adminNodeFactsCmd.AddCommand(adminNodeFactsCollectCmd)
+}

spinifex/operator/cli/service.go

@@ -15,6 +15,7 @@ import (
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/instance/state"
 	"github.com/mulgadc/spinifex/spinifex/domains/network/external"
 	"github.com/mulgadc/spinifex/spinifex/providers/ebs/viperblock"
+	"github.com/mulgadc/spinifex/spinifex/runtime/daemon"
 	"github.com/mulgadc/spinifex/spinifex/runtime/roles/awsgw"
 	"github.com/mulgadc/spinifex/spinifex/runtime/roles/nats"
 	"github.com/mulgadc/spinifex/spinifex/runtime/roles/northstar"
@@ -535,6 +536,7 @@ var spinifexStartCmd = &cobra.Command{
 
 		defer initTelemetry("spinifex-daemon", false)()
 
+		daemon.SetBuildInfo(Version, Commit)
 		svc, err := service.New("spinifex", clusterConfig)
 
 		if err != nil {

spinifex/operator/host/systemd/units_gen.go

@@ -8,7 +8,7 @@ package systemd
 var Units = map[string]string{
 	"regenerate-ssh-host-keys.service": "# spinifex-unit-version: 1\n[Unit]\nDescription=Regenerate SSH host keys\nConditionPathExists=!/etc/ssh/ssh_host_ed25519_key\nBefore=ssh.service\n\n[Service]\nType=oneshot\nExecStart=/usr/bin/ssh-keygen -A\nRemainAfterExit=yes\n# No ExecStop: the keygen process has already exited by the time this unit\n# is stopped, so there is nothing to signal.\nTimeoutStopSec=5\n\n[Install]\nWantedBy=multi-user.target\n",
 	"spinifex-awsgw.service":           "# spinifex-unit-version: 1\n[Unit]\nDescription=Spinifex AWS Gateway\nPartOf=spinifex.target\nAfter=spinifex-nats.service spinifex-daemon.service\nWants=spinifex-nats.service\n\n[Service]\nEnvironmentFile=-/etc/spinifex/telemetry.env\nType=simple\nSlice=spinifex-system.slice\nUser=spinifex-gw\nGroup=spinifex\nExecStartPre=/var/lib/spinifex/wait-for-nats.sh\nExecStart=/usr/local/bin/spx service awsgw start\nRestart=on-failure\nRestartSec=5\n# No SIGTERM handler in this process: it exits immediately on signal, so this\n# only bounds an unexpectedly wedged process before SIGKILL.\nTimeoutStopSec=10\n\nOOMScoreAdjust=-500\n# Per-service ceiling bounds a leak in this service alone rather than\n# tripping the slice-wide cap, which would pick an arbitrary victim.\nMemoryHigh=10%\nMemoryMax=20%\nEnvironment=SPINIFEX_CONFIG_PATH=/etc/spinifex/spinifex.toml\nEnvironment=SPINIFEX_BASE_DIR=/var/lib/spinifex/awsgw/\nEnvironment=SPINIFEX_AWSGW_TLS_CERT=/etc/spinifex/server.pem\nEnvironment=SPINIFEX_AWSGW_TLS_KEY=/etc/spinifex/server.key\n\n# Filesystem access\nNoNewPrivileges=yes\nProtectSystem=strict\nPrivateDevices=yes\nReadOnlyPaths=/etc/spinifex/spinifex.toml /etc/spinifex/master.key /etc/spinifex/server.pem /etc/spinifex/server.key /etc/spinifex/ca.pem\nReadWritePaths=/var/lib/spinifex/awsgw /var/log/spinifex\n\n# Hardening\nProtectHome=yes\nPrivateTmp=yes\nRestrictSUIDSGID=yes\nLockPersonality=yes\nRestrictRealtime=yes\nRestrictNamespaces=yes\nProtectClock=yes\nProtectKernelTunables=yes\nProtectKernelModules=yes\nProtectKernelLogs=yes\nProtectControlGroups=yes\nProtectProc=invisible\nSystemCallArchitectures=native\nMemoryDenyWriteExecute=yes\nRestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK\nCapabilityBoundingSet=\nProtectHostname=yes\nKeyringMode=private\nRemoveIPC=yes\nLimitCORE=0\nLimitNOFILE=65536\nLimitNPROC=4096\n\n[Install]\nWantedBy=spinifex.target\n",
-	"spinifex-daemon.service":          "# spinifex-unit-version: 5\n[Unit]\nDescription=Spinifex Daemon (VM Orchestration)\nPartOf=spinifex.target\nAfter=spinifex-nats.service spinifex-viperblock.service ovsdb-server.service ovs-vswitchd.service ovn-controller.service openvswitch-ipsec.service spinifex-hostnet.service\n# Wants (not Requires): boot without openvswitch-ipsec, survive OVS restarts via hostnet\nWants=openvswitch-ipsec.service spinifex-hostnet.service\n\n[Service]\nEnvironmentFile=-/etc/spinifex/telemetry.env\n# ZFS root: installer raises SPINIFEX_RESERVED_MEM_GB by the ARC ceiling the admission gate cannot see\nEnvironmentFile=-/etc/spinifex/host.env\nType=simple\nSlice=spinifex-system.slice\nUser=spinifex-daemon\nGroup=spinifex\nExecStartPre=/usr/local/bin/spx admin hostnet check\nExecStart=/usr/local/bin/spx service spinifex start\nRestart=on-failure\nRestartSec=5\n# KillMode=process: guest QEMU survives daemon restart; the new daemon reattaches (DDIL)\nKillMode=process\nTimeoutStopSec=15\n# RG-4: infra tier — reaped only after every guest\nOOMScoreAdjust=-500\n# Guest QEMU shares this cgroup: the ceiling tracks the slice budget, not daemon overhead\nMemoryHigh=75%\nMemoryMax=85%\nEnvironment=SPINIFEX_CONFIG_PATH=/etc/spinifex/spinifex.toml\nEnvironment=SPINIFEX_BASE_DIR=/var/lib/spinifex/spinifex/\nEnvironment=SPINIFEX_WAL_DIR=/var/lib/spinifex/spinifex/\n# Pin to host tmpfs: QEMU pidfiles/QMP sockets must survive PrivateTmp namespace churn (DDIL)\nEnvironment=XDG_RUNTIME_DIR=/run/spinifex\n\n# RG-9: daemon tier — privileged by necessity (GPU vfio). No CAP_NET_ADMIN here,\n# so unlike vpcd it still escalates ip/sysctl and NoNewPrivileges stays omitted.\nAmbientCapabilities=CAP_SYS_ADMIN CAP_DAC_OVERRIDE\nProtectSystem=full\nPrivateDevices=no\nDevicePolicy=closed\nDeviceAllow=/dev/kvm rw\nDeviceAllow=/dev/net/tun rw\nDeviceAllow=/dev/vhost-net rw\nDeviceAllow=char-vfio rw\nDeviceAllow=/dev/vfio/vfio rw\nReadOnlyPaths=/etc/spinifex/spinifex.toml /etc/spinifex/server.pem /etc/spinifex/server.key /etc/spinifex/ca.pem\n# /proc/sys/net/ipv4/conf: ProtectKernelTunables would keep the per-tap IMDS\n# rp_filter/accept_local read-only; /etc/spinifex/firewall: the root helper writes peers.nft.\nReadWritePaths=/var/lib/spinifex/spinifex /var/log/spinifex /run/spinifex /run/spinifex/nbd /proc/sys/net/ipv4/conf -/etc/spinifex/firewall\n\n# RG-9: hardening baseline\nProtectHome=yes\nPrivateTmp=yes\nRestrictSUIDSGID=yes\nLockPersonality=yes\nRestrictRealtime=yes\nRestrictNamespaces=yes\nProtectClock=yes\nProtectKernelTunables=yes\nProtectKernelModules=yes\nProtectKernelLogs=yes\nProtectControlGroups=yes\nProtectProc=invisible\nSystemCallArchitectures=native\nMemoryDenyWriteExecute=yes\nRestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK\nProtectHostname=yes\nKeyringMode=private\nRemoveIPC=yes\nLimitCORE=0\nLimitNOFILE=65536\nLimitNPROC=4096\n# LimitMEMLOCK=infinity: VFIO pins all guest RAM\nLimitMEMLOCK=infinity\n\n[Install]\nWantedBy=spinifex.target\n",
+	"spinifex-daemon.service":          "# spinifex-unit-version: 6\n[Unit]\nDescription=Spinifex Daemon (VM Orchestration)\nPartOf=spinifex.target\nAfter=spinifex-nats.service spinifex-viperblock.service ovsdb-server.service ovs-vswitchd.service ovn-controller.service openvswitch-ipsec.service spinifex-hostnet.service\n# Wants (not Requires): boot without openvswitch-ipsec, survive OVS restarts via hostnet\nWants=openvswitch-ipsec.service spinifex-hostnet.service\n\n[Service]\nEnvironmentFile=-/etc/spinifex/telemetry.env\n# ZFS root: installer raises SPINIFEX_RESERVED_MEM_GB by the ARC ceiling the admission gate cannot see\nEnvironmentFile=-/etc/spinifex/host.env\nType=simple\nSlice=spinifex-system.slice\nUser=spinifex-daemon\nGroup=spinifex\nExecStartPre=/usr/local/bin/spx admin hostnet check\nExecStartPre=-+/usr/local/bin/spx admin node-facts collect\nExecStart=/usr/local/bin/spx service spinifex start\nRestart=on-failure\nRestartSec=5\n# KillMode=process: guest QEMU survives daemon restart; the new daemon reattaches (DDIL)\nKillMode=process\nTimeoutStopSec=15\n# RG-4: infra tier — reaped only after every guest\nOOMScoreAdjust=-500\n# Guest QEMU shares this cgroup: the ceiling tracks the slice budget, not daemon overhead\nMemoryHigh=75%\nMemoryMax=85%\nEnvironment=SPINIFEX_CONFIG_PATH=/etc/spinifex/spinifex.toml\nEnvironment=SPINIFEX_BASE_DIR=/var/lib/spinifex/spinifex/\nEnvironment=SPINIFEX_WAL_DIR=/var/lib/spinifex/spinifex/\n# Pin to host tmpfs: QEMU pidfiles/QMP sockets must survive PrivateTmp namespace churn (DDIL)\nEnvironment=XDG_RUNTIME_DIR=/run/spinifex\n\n# RG-9: daemon tier — privileged by necessity (GPU vfio). No CAP_NET_ADMIN here,\n# so unlike vpcd it still escalates ip/sysctl and NoNewPrivileges stays omitted.\nAmbientCapabilities=CAP_SYS_ADMIN CAP_DAC_OVERRIDE\nProtectSystem=full\nPrivateDevices=no\nDevicePolicy=closed\nDeviceAllow=/dev/kvm rw\nDeviceAllow=/dev/net/tun rw\nDeviceAllow=/dev/vhost-net rw\nDeviceAllow=char-vfio rw\nDeviceAllow=/dev/vfio/vfio rw\nReadOnlyPaths=/etc/spinifex/spinifex.toml /etc/spinifex/server.pem /etc/spinifex/server.key /etc/spinifex/ca.pem\n# /proc/sys/net/ipv4/conf: ProtectKernelTunables would keep the per-tap IMDS\n# rp_filter/accept_local read-only; /etc/spinifex/firewall: the root helper writes peers.nft.\nReadWritePaths=/var/lib/spinifex/spinifex /var/log/spinifex /run/spinifex /run/spinifex/nbd /proc/sys/net/ipv4/conf -/etc/spinifex/firewall\n\n# RG-9: hardening baseline\nProtectHome=yes\nPrivateTmp=yes\nRestrictSUIDSGID=yes\nLockPersonality=yes\nRestrictRealtime=yes\nRestrictNamespaces=yes\nProtectClock=yes\nProtectKernelTunables=yes\nProtectKernelModules=yes\nProtectKernelLogs=yes\nProtectControlGroups=yes\nProtectProc=invisible\nSystemCallArchitectures=native\nMemoryDenyWriteExecute=yes\nRestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK\nProtectHostname=yes\nKeyringMode=private\nRemoveIPC=yes\nLimitCORE=0\nLimitNOFILE=65536\nLimitNPROC=4096\n# LimitMEMLOCK=infinity: VFIO pins all guest RAM\nLimitMEMLOCK=infinity\n\n[Install]\nWantedBy=spinifex.target\n",
 	"spinifex-firewall.service":        "# spinifex-unit-version: 2\n[Unit]\nDescription=Spinifex host firewall (nftables input policy)\nDocumentation=file:/etc/spinifex/firewall/spinifex.nft\nWants=network-pre.target\nBefore=network-pre.target shutdown.target\nDefaultDependencies=no\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nStandardInput=null\nProtectSystem=full\nProtectHome=true\n# Unconditional: connection tracking loads on every node, so a flow that opens\n# while the policy is not armed survives the arm. The policy itself still loads\n# only where the daemon has written a peer file.\nExecStart=/usr/local/lib/spinifex/spinifex-firewall-apply boot\nExecReload=/usr/local/lib/spinifex/spinifex-firewall-apply boot\nTimeoutStopSec=10s\n\n# No ExecStop: flushing on stop would take vpcd's MASQUERADE and per-EIP FORWARD\n# rules with it. Remove the policy deliberately with\n# `nft delete table inet spinifex_filter`.\n\n[Install]\nWantedBy=sysinit.target\n",
 	"spinifex-guests.slice":            "# spinifex-unit-version: 1\n[Unit]\nDescription=Spinifex guest VM tier\nBefore=slices.target\n\n[Slice]\n# RG-3: child of spinifex.slice (spinifex-guests -> spinifex), sibling of\n# spinifex-system. Parent for the per-instance spinifex-instance-<id>.slice\n# leaves (0002 RG-7). Inherits the spinifex.slice ceiling; no extra limit here.\n",
 	"spinifex-hostnet.service":         "# spinifex-unit-version: 2\n[Unit]\nDescription=Spinifex host network wiring (veth pairs, mgmt address, encap route)\n# PartOf/WantedBy ovs-vswitchd: re-applied whenever OVS starts; daemon and vpcd only Want it\nRequires=ovs-vswitchd.service\nAfter=ovs-vswitchd.service NetworkManager-wait-online.service\nPartOf=ovs-vswitchd.service\n# Stopping OVS stops ovn-controller through its Requires= chain and starting OVS\n# does not bring it back, so the start that re-applies hostnet restarts it too\nWants=ovn-controller.service\nBefore=spinifex.target\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/local/bin/spx admin hostnet apply\n# Covers the 120s wait behind setup-ovn.sh plus the 60s wait for links\nTimeoutStartSec=240\nTimeoutStopSec=10\nProtectSystem=full\nProtectHome=yes\nPrivateTmp=yes\n\n[Install]\nWantedBy=spinifex.target ovs-vswitchd.service\n",

spinifex/operator/host/systemd/units_invariants_test.go

@@ -425,6 +425,7 @@ var unitBodyHashes = map[string]map[int]string{
 		3: "8059fe13a678b8cb2a383ae75c069560cf39adece9a9394e17781998c711cd57",
 		4: "f66e1240cc5655f6a13f3b56ca282c73e2fe289f2e51d0ce624d14b90f12f838",
 		5: "d3d25d7eb0051ccf97f70838ddff763bade38bef934b8f85733e048151ac9319",
+		6: "4db31f63c0b9b297a3ec33c34df99c2ec1424374d39f1752f1fd1dc4ec887316",
 	},
 	"spinifex-firewall.service": {
 		1: "01d0a7a79f47eedca02aaab3ff97a0b6462d61b7834e16c7336a7b96034dc392",

spinifex/runtime/daemon/daemon.go

@@ -40,6 +40,7 @@ import (
 	clusterv1 "github.com/mulgadc/spinifex/contracts/cluster/v1"
 	"github.com/mulgadc/spinifex/contracts/ec2/v1"
 	operatorv1 "github.com/mulgadc/spinifex/contracts/operator/v1"
+	telemetryv1 "github.com/mulgadc/spinifex/contracts/telemetry/v1"
 	viperblocklegacyv1 "github.com/mulgadc/spinifex/contracts/viperblockd/legacy/v1"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/preflight"
@@ -170,6 +171,7 @@ type Daemon struct {
 	spotInstanceService   *ec2spotinstance.SpotInstanceServiceImpl
 	vpcService            *ec2vpc.VPCServiceImpl
 	sqsWorker             *sqsWorkerEnsurer
+	insight               *nodeInsight
 	eipService            ec2eip.EIPService
 	elbv2Service          *elbv2domain.ELBv2ServiceImpl
 	eksService            *ekscluster.EKSServiceImpl
@@ -907,6 +909,10 @@ func (d *Daemon) subscribeAll() error {
 	if d.sqsWorker == nil {
 		d.sqsWorker = newSQSWorkerEnsurer(d.buildSQSWorkerLauncher)
 	}
+	if d.insight == nil {
+		d.insight = newNodeInsight(d.node)
+		d.insight.live = &nodeLiveSampler{insight: d.insight, nc: d.natsConn, subject: telemetryv1.NodeLiveSampleSubject(d.node)}
+	}
 	subs := []natsSub{
 		// ec2.RunInstances is handled by dynamic per-instance-type subscriptions
 		// managed by ResourceManager.initSubscriptions()
@@ -1046,6 +1052,7 @@ func (d *Daemon) subscribeAll() error {
 		{clusterv1.NodeHealthSubject(d.node), d.handleHealthCheck, ""},
 		{clusterv1.NodesDiscoverSubject, d.handleNodeDiscover, ""},
 		{clusterv1.NodeStatusSubject, d.handleNodeStatus, ""},
+		{clusterv1.NodeFactsSubject, d.handleNodeFacts, ""},
 		{clusterv1.NodeVMsSubject, d.handleNodeVMs, ""},
 		{operatorv1.StorageConfigSubject, d.handleStorageConfig, ""},
 		{"spinifex.image.promote", d.handleSpinifexPromoteImage, "spinifex-workers"},
@@ -1059,6 +1066,13 @@ func (d *Daemon) subscribeAll() error {
 		{"spinifex.cluster.shutdown.persist", d.handleShutdownPersist, ""},
 		{"spinifex.cluster.shutdown.infra", d.handleShutdownInfra, ""},
 	}
+	if clusterv1.ValidNodeID(d.node) {
+		subs = append(subs,
+			natsSub{clusterv1.NetTestServeSubject(d.node), d.handleNetTestServe, ""},
+			natsSub{clusterv1.NetTestRunSubject(d.node), d.handleNetTestRun, ""},
+			natsSub{telemetryv1.NodeLiveWatchSubject(d.node), d.handleNodeLiveWatch, ""},
+		)
+	}
 
 	// ELBv2 operations require a resolved gateway URL.
 	// Without a subscriber the gateway returns nats.ErrNoResponders → ServiceUnavailable.

spinifex/runtime/daemon/node_insight.go

@@ -0,0 +1,397 @@
+package daemon
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net"
+	"os"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	clusterv1 "github.com/mulgadc/spinifex/contracts/cluster/v1"
+	telemetryv1 "github.com/mulgadc/spinifex/contracts/telemetry/v1"
+	"github.com/mulgadc/spinifex/spinifex/runtime/host/nettest"
+	"github.com/mulgadc/spinifex/spinifex/runtime/host/nodefacts"
+	"github.com/nats-io/nats.go"
+)
+
+// Build-time version and commit, set by the cmd package before the daemon starts.
+var (
+	buildVersion = "dev"
+	buildCommit  = "unknown"
+)
+
+// SetBuildInfo records the build-time version and commit the node reports.
+func SetBuildInfo(version, commit string) {
+	buildVersion, buildCommit = version, commit
+}
+
+// nodeFactsTTL bounds how often a request rebuilds the facts; a re-cabled
+// port shows within it.
+const nodeFactsTTL = 15 * time.Second
+
+// nodeInsight serves the operator's view of this host: its facts, a live
+// sampler of its own load, and the two halves of a throughput test.
+type nodeInsight struct {
+	node string
+	env  nodefacts.Env
+
+	mu      sync.Mutex
+	facts   clusterv1.NodeFacts
+	factsAt time.Time
+
+	live   *nodeLiveSampler
+	server nettest.Server
+	// testing serialises the client side, so two tests never share a link.
+	testing sync.Mutex
+}
+
+func newNodeInsight(node string) *nodeInsight {
+	return &nodeInsight{node: node, env: nodefacts.DefaultEnv(node, buildVersion, buildCommit)}
+}
+
+func (n *nodeInsight) currentFacts(ctx context.Context) clusterv1.NodeFacts {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	if time.Since(n.factsAt) < nodeFactsTTL {
+		return n.facts
+	}
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	n.facts = nodefacts.Build(ctx, n.env)
+	n.factsAt = time.Now()
+	return n.facts
+}
+
+func (n *nodeInsight) planeAddress(ctx context.Context, plane string) string {
+	addr, _ := n.planeSubnet(ctx, plane)
+	return addr
+}
+
+// planeSubnet is the node's address on plane and the subnet it sits in. A
+// client may only be pointed inside that subnet, never at an arbitrary host.
+func (n *nodeInsight) planeSubnet(ctx context.Context, plane string) (string, *net.IPNet) {
+	for _, p := range n.currentFacts(ctx).Planes {
+		if p.Plane != plane || p.Address == "" {
+			continue
+		}
+		_, subnet, err := net.ParseCIDR(p.Address + "/" + strconv.Itoa(p.Prefix))
+		if err != nil {
+			return p.Address, nil
+		}
+		return p.Address, subnet
+	}
+	return "", nil
+}
+
+func (n *nodeInsight) planeLink(ctx context.Context, plane string) (speed, mtu int) {
+	f := n.currentFacts(ctx)
+	for _, p := range f.Planes {
+		if p.Plane != plane {
+			continue
+		}
+		mtu = p.MTU
+		for _, nic := range f.NICs {
+			if slices.Contains(p.NICs, nic.Name) {
+				speed = max(speed, nic.SpeedMbps)
+			}
+		}
+	}
+	return speed, mtu
+}
+
+func (d *Daemon) handleNodeFacts(msg *nats.Msg) string {
+	respondWithJSON(d.node, msg, d.insight.currentFacts(context.Background()))
+	return outcomeSuccess
+}
+
+func validPlane(plane string) bool {
+	return plane == clusterv1.PlaneWAN || plane == clusterv1.PlaneLAN || plane == clusterv1.PlaneVPC
+}
+
+func (d *Daemon) handleNetTestServe(msg *nats.Msg) string {
+	var req clusterv1.NetTestServeRequest
+	if err := json.Unmarshal(msg.Data, &req); err != nil || !validPlane(req.Plane) ||
+		req.DurationSeconds < nettest.MinDuration || req.DurationSeconds > nettest.MaxDuration {
+		respondWithJSON(d.node, msg, clusterv1.NetTestServeResponse{Error: "invalid request"})
+		return outcomeError
+	}
+	addr := d.insight.planeAddress(context.Background(), req.Plane)
+	if addr == "" {
+		respondWithJSON(d.node, msg, clusterv1.NetTestServeResponse{Error: "this node has no address on the " + req.Plane + " plane"})
+		return outcomeError
+	}
+	if err := d.insight.server.Serve(addr, req.DurationSeconds); err != nil {
+		respondWithJSON(d.node, msg, clusterv1.NetTestServeResponse{Error: err.Error()})
+		return outcomeError
+	}
+	respondWithJSON(d.node, msg, clusterv1.NetTestServeResponse{Address: addr, Port: clusterv1.NetTestPort})
+	return outcomeSuccess
+}
+
+// handleNetTestRun runs the client in its own goroutine: it takes the test's
+// duration, and the subscription must keep serving other requests meanwhile.
+func (d *Daemon) handleNetTestRun(msg *nats.Msg) string {
+	var req clusterv1.NetTestRunRequest
+	if err := json.Unmarshal(msg.Data, &req); err != nil || !validPlane(req.Plane) ||
+		req.DurationSeconds < nettest.MinDuration || req.DurationSeconds > nettest.MaxDuration ||
+		req.Streams < 1 || req.Streams > nettest.MaxStreams || req.Port != clusterv1.NetTestPort {
+		respondWithJSON(d.node, msg, clusterv1.NetTestRunResponse{Error: "invalid request"})
+		return outcomeError
+	}
+	go func() {
+		ctx := context.Background()
+		addr, subnet := d.insight.planeSubnet(ctx, req.Plane)
+		if addr == "" {
+			respondWithJSON(d.node, msg, clusterv1.NetTestRunResponse{Error: "this node has no address on the " + req.Plane + " plane"})
+			return
+		}
+		if target := net.ParseIP(req.Address); subnet == nil || target == nil || !subnet.Contains(target) {
+			respondWithJSON(d.node, msg, clusterv1.NetTestRunResponse{Error: "target is outside this node's " + req.Plane + " subnet"})
+			return
+		}
+		if !d.insight.testing.TryLock() {
+			respondWithJSON(d.node, msg, clusterv1.NetTestRunResponse{Error: "a test is already running from this node"})
+			return
+		}
+		defer d.insight.testing.Unlock()
+
+		res, err := nettest.Run(ctx, req, addr)
+		res.LinkMbps, res.MTU = d.insight.planeLink(ctx, req.Plane)
+		if err != nil {
+			res.Error = err.Error()
+			slog.Info("node network test failed", "plane", req.Plane, "target", req.Address, "err", err)
+		}
+		respondWithJSON(d.node, msg, res)
+	}()
+	return outcomeSuccess
+}
+
+// nodeLiveSampler samples this host every period while somebody watches, as
+// the instance sampler does, and drops its ring when the lease lapses.
+type nodeLiveSampler struct {
+	insight *nodeInsight
+	nc      *nats.Conn
+	subject string
+
+	mu      sync.Mutex
+	until   time.Time
+	running bool
+	ring    []telemetryv1.NodeLiveSample
+}
+
+func (d *Daemon) handleNodeLiveWatch(msg *nats.Msg) string {
+	var watch telemetryv1.LiveWatch
+	if len(msg.Data) > 0 {
+		if err := json.Unmarshal(msg.Data, &watch); err != nil {
+			return outcomeError
+		}
+	}
+	samples := d.insight.live.watch(watch.SinceMillis)
+	if msg.Reply != "" {
+		data, err := json.Marshal(telemetryv1.NodeLiveRing{Samples: samples})
+		if err == nil {
+			_ = msg.Respond(data)
+		}
+	}
+	return outcomeSuccess
+}
+
+func (l *nodeLiveSampler) watch(sinceMillis int64) []telemetryv1.NodeLiveSample {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.until = time.Now().Add(telemetryv1.LiveWatchLeaseMillis * time.Millisecond)
+	if !l.running {
+		l.running = true
+		go l.run()
+	}
+	out := make([]telemetryv1.NodeLiveSample, 0, len(l.ring))
+	for _, s := range l.ring {
+		if s.TimeMillis > sinceMillis {
+			out = append(out, s)
+		}
+	}
+	return out
+}
+
+func (l *nodeLiveSampler) lapsed() bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if time.Now().Before(l.until) {
+		return false
+	}
+	l.running = false
+	l.ring = nil
+	return true
+}
+
+func (l *nodeLiveSampler) record(s telemetryv1.NodeLiveSample) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if len(l.ring) == telemetryv1.LiveRingSamples {
+		l.ring = append(l.ring[:0], l.ring[1:]...)
+	}
+	l.ring = append(l.ring, s)
+}
+
+func (l *nodeLiveSampler) run() {
+	ticker := time.NewTicker(telemetryv1.LiveSamplePeriodMillis * time.Millisecond)
+	defer ticker.Stop()
+	var prev *hostCounters
+	for range ticker.C {
+		if l.lapsed() {
+			return
+		}
+		cur := readHostCounters(l.insight.env.ProcRoot, l.insight.env.SysRoot, planeNICs(l.insight.currentFacts(context.Background())))
+		if prev != nil {
+			if s, ok := hostRates(prev, cur); ok {
+				l.record(s)
+				if data, err := json.Marshal(s); err == nil {
+					_ = l.nc.Publish(l.subject, data)
+				}
+			}
+		}
+		prev = cur
+	}
+}
+
+// planeNICs keys each set of NICs by the planes it carries, so a NIC that
+// carries lan and vpc is counted once, as "lan+vpc".
+func planeNICs(f clusterv1.NodeFacts) map[string][]string {
+	byNICs := map[string][]string{}
+	nics := map[string][]string{}
+	for _, p := range f.Planes {
+		key := strings.Join(p.NICs, ",")
+		if key == "" {
+			key = "bridge:" + p.Bridge
+		}
+		byNICs[key] = append(byNICs[key], p.Plane)
+		if _, ok := nics[key]; !ok {
+			if len(p.NICs) == 0 {
+				nics[key] = []string{p.Bridge}
+			} else {
+				nics[key] = p.NICs
+			}
+		}
+	}
+	out := map[string][]string{}
+	for key, planes := range byNICs {
+		out[strings.Join(planes, "+")] = nics[key]
+	}
+	return out
+}
+
+type nicCounters struct{ rxBytes, txBytes, rxPackets, txPackets uint64 }
+
+type hostCounters struct {
+	at         time.Time
+	busy, idle uint64
+	memPercent float64
+	load1      float64
+	planes     map[string]nicCounters
+}
+
+func readHostCounters(procRoot, sysRoot string, planes map[string][]string) *hostCounters {
+	c := &hostCounters{at: time.Now(), planes: map[string]nicCounters{}}
+	if data, err := os.ReadFile(filepath.Join(procRoot, "stat")); err == nil {
+		line, _, _ := strings.Cut(string(data), "\n")
+		fields := strings.Fields(line)
+		for i, f := range fields[1:] {
+			v, _ := strconv.ParseUint(f, 10, 64)
+			// user nice system idle iowait irq softirq steal; guest time is
+			// already counted in user.
+			switch {
+			case i == 3 || i == 4:
+				c.idle += v
+			case i < 8:
+				c.busy += v
+			}
+		}
+	}
+	if data, err := os.ReadFile(filepath.Join(procRoot, "meminfo")); err == nil {
+		var total, avail float64
+		for line := range strings.SplitSeq(string(data), "\n") {
+			key, value, _ := strings.Cut(line, ":")
+			fields := strings.Fields(value)
+			if len(fields) == 0 {
+				continue
+			}
+			v, _ := strconv.ParseFloat(fields[0], 64)
+			switch key {
+			case "MemTotal":
+				total = v
+			case "MemAvailable":
+				avail = v
+			}
+		}
+		if total > 0 {
+			c.memPercent = (total - avail) / total * 100
+		}
+	}
+	if data, err := os.ReadFile(filepath.Join(procRoot, "loadavg")); err == nil {
+		if fields := strings.Fields(string(data)); len(fields) > 0 {
+			c.load1, _ = strconv.ParseFloat(fields[0], 64)
+		}
+	}
+	for plane, nics := range planes {
+		var sum nicCounters
+		for _, nic := range nics {
+			read := func(name string) uint64 {
+				data, err := os.ReadFile(filepath.Join(sysRoot, "class", "net", nic, "statistics", name))
+				if err != nil {
+					return 0
+				}
+				v, _ := strconv.ParseUint(strings.TrimSpace(string(data)), 10, 64)
+				return v
+			}
+			sum.rxBytes += read("rx_bytes")
+			sum.txBytes += read("tx_bytes")
+			sum.rxPackets += read("rx_packets")
+			sum.txPackets += read("tx_packets")
+		}
+		c.planes[plane] = sum
+	}
+	return c
+}
+
+func hostRates(prev, cur *hostCounters) (telemetryv1.NodeLiveSample, bool) {
+	elapsed := cur.at.Sub(prev.at).Seconds()
+	if elapsed <= 0 || cur.busy < prev.busy || cur.idle < prev.idle {
+		return telemetryv1.NodeLiveSample{}, false
+	}
+	s := telemetryv1.NodeLiveSample{
+		TimeMillis:        cur.at.UnixMilli(),
+		MemoryUsedPercent: round2(cur.memPercent),
+		Load1:             cur.load1,
+		Planes:            map[string]telemetryv1.NodeLivePlane{},
+	}
+	if total := float64((cur.busy - prev.busy) + (cur.idle - prev.idle)); total > 0 {
+		s.CPUPercent = round2(float64(cur.busy-prev.busy) / total * 100)
+	}
+	rate := func(a, b uint64) float64 {
+		if b < a {
+			return 0
+		}
+		return round2(float64(b-a) / elapsed)
+	}
+	for plane, c := range cur.planes {
+		p, ok := prev.planes[plane]
+		if !ok {
+			continue
+		}
+		s.Planes[plane] = telemetryv1.NodeLivePlane{
+			NetworkIn: rate(p.rxBytes, c.rxBytes), NetworkOut: rate(p.txBytes, c.txBytes),
+			PacketsIn: rate(p.rxPackets, c.rxPackets), PacketsOut: rate(p.txPackets, c.txPackets),
+		}
+	}
+	return s, true
+}
+
+func round2(v float64) float64 {
+	return float64(int64(v*100+0.5)) / 100
+}

spinifex/runtime/daemon/node_insight_test.go

@@ -0,0 +1,229 @@
+//test:in-package — the handlers, the plane lookups and the live sampler are
+//unexported, and the fixture seeds the cached facts directly so no test reads
+//this host's hardware.
+
+package daemon
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	clusterv1 "github.com/mulgadc/spinifex/contracts/cluster/v1"
+	telemetryv1 "github.com/mulgadc/spinifex/contracts/telemetry/v1"
+	testutil "github.com/mulgadc/spinifex/internal/testkit"
+	"github.com/nats-io/nats.go"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func insightFacts() clusterv1.NodeFacts {
+	return clusterv1.NodeFacts{
+		NICs: []clusterv1.NICFacts{
+			{Name: "eth0", SpeedMbps: 25000},
+			{Name: "eth1", SpeedMbps: 10000},
+			{Name: "eth2", SpeedMbps: 1000},
+		},
+		Planes: []clusterv1.PlaneFacts{
+			{Plane: clusterv1.PlaneLAN, Bridge: "br-lan", Address: "10.10.8.1", Prefix: 24, NICs: []string{"eth0", "eth1"}, MTU: 9000},
+			{Plane: clusterv1.PlaneVPC, Bridge: "br-lan", Address: "10.10.8.1", Prefix: 24, NICs: []string{"eth0", "eth1"}, MTU: 9000},
+			{Plane: clusterv1.PlaneWAN, Bridge: "br-wan", NICs: []string{"eth2"}},
+		},
+	}
+}
+
+func insightDaemon(t *testing.T, facts clusterv1.NodeFacts) (*Daemon, *nats.Conn) {
+	t.Helper()
+	_, nc, _ := testutil.StartTestJetStream(t)
+	insight := newNodeInsight("node1")
+	insight.facts, insight.factsAt = facts, time.Now()
+	return &Daemon{node: "node1", natsConn: nc, insight: insight}, nc
+}
+
+func callHandler[T any](t *testing.T, nc *nats.Conn, handler func(*nats.Msg) string, req any) T {
+	t.Helper()
+	subject := nats.NewInbox()
+	sub, err := nc.Subscribe(subject, func(msg *nats.Msg) { handler(msg) })
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = sub.Unsubscribe() })
+
+	data, err := json.Marshal(req)
+	require.NoError(t, err)
+	reply, err := nc.Request(subject, data, 5*time.Second)
+	require.NoError(t, err)
+
+	var out T
+	require.NoError(t, json.Unmarshal(reply.Data, &out))
+	return out
+}
+
+func validRun() clusterv1.NetTestRunRequest {
+	return clusterv1.NetTestRunRequest{
+		Plane: clusterv1.PlaneLAN, Address: "10.10.8.2", Port: clusterv1.NetTestPort,
+		DurationSeconds: 5, Streams: 4,
+	}
+}
+
+func TestHandleNetTestRun_RefusesTargetOutsidePlaneSubnet(t *testing.T) {
+	d, nc := insightDaemon(t, insightFacts())
+
+	for _, target := range []string{"10.10.9.2", "8.8.8.8", "127.0.0.1", "not-an-ip", ""} {
+		req := validRun()
+		req.Address = target
+		res := callHandler[clusterv1.NetTestRunResponse](t, nc, d.handleNetTestRun, req)
+		assert.Contains(t, res.Error, "outside this node's lan subnet", "target %q", target)
+	}
+}
+
+func TestHandleNetTestRun_RefusesInvalidRequests(t *testing.T) {
+	d, nc := insightDaemon(t, insightFacts())
+
+	mutations := map[string]func(*clusterv1.NetTestRunRequest){
+		"unknown plane":  func(r *clusterv1.NetTestRunRequest) { r.Plane = "storage" },
+		"short duration": func(r *clusterv1.NetTestRunRequest) { r.DurationSeconds = 1 },
+		"long duration":  func(r *clusterv1.NetTestRunRequest) { r.DurationSeconds = 600 },
+		"no streams":     func(r *clusterv1.NetTestRunRequest) { r.Streams = 0 },
+		"many streams":   func(r *clusterv1.NetTestRunRequest) { r.Streams = 99 },
+		"other port":     func(r *clusterv1.NetTestRunRequest) { r.Port = 22 },
+	}
+	for name, mutate := range mutations {
+		req := validRun()
+		mutate(&req)
+		res := callHandler[clusterv1.NetTestRunResponse](t, nc, d.handleNetTestRun, req)
+		assert.Equal(t, "invalid request", res.Error, name)
+	}
+}
+
+func TestHandleNetTestRun_RefusesPlaneWithoutAddress(t *testing.T) {
+	d, nc := insightDaemon(t, insightFacts())
+
+	req := validRun()
+	req.Plane = clusterv1.PlaneWAN
+	res := callHandler[clusterv1.NetTestRunResponse](t, nc, d.handleNetTestRun, req)
+	assert.Equal(t, "this node has no address on the wan plane", res.Error)
+}
+
+func TestHandleNetTestRun_OneTestPerNode(t *testing.T) {
+	d, nc := insightDaemon(t, insightFacts())
+	d.insight.testing.Lock()
+	defer d.insight.testing.Unlock()
+
+	res := callHandler[clusterv1.NetTestRunResponse](t, nc, d.handleNetTestRun, validRun())
+	assert.Equal(t, "a test is already running from this node", res.Error)
+}
+
+func TestHandleNetTestServe_RefusesBadRequests(t *testing.T) {
+	d, nc := insightDaemon(t, insightFacts())
+
+	res := callHandler[clusterv1.NetTestServeResponse](t, nc, d.handleNetTestServe,
+		clusterv1.NetTestServeRequest{Plane: clusterv1.PlaneLAN, DurationSeconds: 600})
+	assert.Equal(t, "invalid request", res.Error)
+
+	res = callHandler[clusterv1.NetTestServeResponse](t, nc, d.handleNetTestServe,
+		clusterv1.NetTestServeRequest{Plane: clusterv1.PlaneWAN, DurationSeconds: 5})
+	assert.Equal(t, "this node has no address on the wan plane", res.Error)
+	assert.Zero(t, res.Port)
+}
+
+func TestHandleNodeFacts_ServesCachedFacts(t *testing.T) {
+	d, nc := insightDaemon(t, insightFacts())
+
+	got := callHandler[clusterv1.NodeFacts](t, nc, d.handleNodeFacts, struct{}{})
+	assert.Equal(t, insightFacts().Planes, got.Planes)
+}
+
+func TestPlaneLink_FastestNICAndMTU(t *testing.T) {
+	d, _ := insightDaemon(t, insightFacts())
+
+	speed, mtu := d.insight.planeLink(t.Context(), clusterv1.PlaneLAN)
+	assert.Equal(t, 25000, speed)
+	assert.Equal(t, 9000, mtu)
+
+	speed, mtu = d.insight.planeLink(t.Context(), "storage")
+	assert.Zero(t, speed)
+	assert.Zero(t, mtu)
+}
+
+func TestPlaneNICs_SharedNICsCountedOnce(t *testing.T) {
+	got := planeNICs(insightFacts())
+	assert.Equal(t, map[string][]string{
+		"lan+vpc": {"eth0", "eth1"},
+		"wan":     {"eth2"},
+	}, got)
+
+	got = planeNICs(clusterv1.NodeFacts{Planes: []clusterv1.PlaneFacts{{Plane: clusterv1.PlaneWAN, Bridge: "br-wan"}}})
+	assert.Equal(t, map[string][]string{"wan": {"br-wan"}}, got)
+}
+
+func writeHostTree(t *testing.T, root string, stat, rx string) {
+	t.Helper()
+	proc := filepath.Join(root, "proc")
+	stats := filepath.Join(root, "sys", "class", "net", "eth0", "statistics")
+	require.NoError(t, os.MkdirAll(proc, 0o755))
+	require.NoError(t, os.MkdirAll(stats, 0o755))
+	files := map[string]string{
+		filepath.Join(proc, "stat"):        stat,
+		filepath.Join(proc, "meminfo"):     "MemTotal: 1000 kB\nMemFree: 100 kB\nMemAvailable: 250 kB\n",
+		filepath.Join(proc, "loadavg"):     "1.50 1.00 0.50 1/100 1\n",
+		filepath.Join(stats, "rx_bytes"):   rx,
+		filepath.Join(stats, "tx_bytes"):   "0\n",
+		filepath.Join(stats, "rx_packets"): "0\n",
+		filepath.Join(stats, "tx_packets"): "0\n",
+	}
+	for path, body := range files {
+		require.NoError(t, os.WriteFile(path, []byte(body), 0o600))
+	}
+}
+
+func TestHostRates_FromProcAndSysCounters(t *testing.T) {
+	root := t.TempDir()
+	planes := map[string][]string{"lan": {"eth0", "missing0"}}
+
+	writeHostTree(t, root, "cpu 100 0 100 700 100 0 0 0 0 0\ncpu0 1 1 1 1\n", "1000\n")
+	prev := readHostCounters(filepath.Join(root, "proc"), filepath.Join(root, "sys"), planes)
+	writeHostTree(t, root, "cpu 200 0 200 1300 200 0 0 0 0 0\n", "3000\n")
+	cur := readHostCounters(filepath.Join(root, "proc"), filepath.Join(root, "sys"), planes)
+	cur.at = prev.at.Add(2 * time.Second)
+
+	s, ok := hostRates(prev, cur)
+	require.True(t, ok)
+	assert.InDelta(t, 22.22, s.CPUPercent, 0.01)
+	assert.InDelta(t, 75.0, s.MemoryUsedPercent, 0.01)
+	assert.InDelta(t, 1.5, s.Load1, 0.001)
+	assert.InDelta(t, 1000.0, s.Planes["lan"].NetworkIn, 0.01)
+
+	_, ok = hostRates(cur, prev)
+	assert.False(t, ok, "counters going backwards are a reset, not a rate")
+}
+
+func TestNodeLiveSampler_RingAndLease(t *testing.T) {
+	l := &nodeLiveSampler{running: true}
+	for i := range telemetryv1.LiveRingSamples + 5 {
+		l.record(telemetryv1.NodeLiveSample{TimeMillis: int64(i)})
+	}
+	require.Len(t, l.ring, telemetryv1.LiveRingSamples)
+	assert.Equal(t, int64(5), l.ring[0].TimeMillis)
+
+	l.until = time.Now().Add(time.Minute)
+	got := l.watch(int64(telemetryv1.LiveRingSamples + 2))
+	assert.Len(t, got, 2)
+	assert.False(t, l.lapsed())
+
+	l.until = time.Now().Add(-time.Second)
+	assert.True(t, l.lapsed())
+	assert.Empty(t, l.ring)
+	assert.False(t, l.running)
+}
+
+func TestHandleNodeLiveWatch_ReturnsRing(t *testing.T) {
+	d, nc := insightDaemon(t, insightFacts())
+	d.insight.live = &nodeLiveSampler{insight: d.insight, nc: nc, subject: nats.NewInbox(), running: true}
+	d.insight.live.record(telemetryv1.NodeLiveSample{TimeMillis: 10})
+	d.insight.live.record(telemetryv1.NodeLiveSample{TimeMillis: 20})
+
+	ring := callHandler[telemetryv1.NodeLiveRing](t, nc, d.handleNodeLiveWatch, telemetryv1.LiveWatch{SinceMillis: 10})
+	require.Len(t, ring.Samples, 1)
+	assert.Equal(t, int64(20), ring.Samples[0].TimeMillis)
+}

spinifex/runtime/host/nettest/nettest.go

@@ -0,0 +1,236 @@
+// Package nettest runs one direction of a node-to-node throughput test with
+// iperf2, bound to one plane's address on each end.
+package nettest
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	clusterv1 "github.com/mulgadc/spinifex/contracts/cluster/v1"
+)
+
+// Limits on one direction of a test. A request outside them is refused.
+const (
+	MinDuration = 5
+	MaxDuration = 30
+	MaxStreams  = 16
+)
+
+const (
+	serverGrace  = 15 * time.Second
+	readyTimeout = 3 * time.Second
+	pingCount    = 10
+)
+
+var (
+	iperfPaths   = []string{"/usr/bin/iperf", "/usr/local/bin/iperf"}
+	setprivPaths = []string{"/usr/bin/setpriv", "/bin/setpriv"}
+	pingPaths    = []string{"/usr/bin/ping", "/bin/ping"}
+)
+
+func findTool(paths []string) string {
+	for _, p := range paths {
+		if _, err := os.Stat(p); err == nil {
+			return p
+		}
+	}
+	return ""
+}
+
+// ErrNoIperf is returned on a node without iperf2 installed.
+var ErrNoIperf = errors.New("iperf (version 2) is not installed on this node")
+
+// unprivileged wraps a command so it runs with no capabilities. The daemon's
+// ambient capabilities would otherwise pass to a network-facing listener.
+func unprivileged(ctx context.Context, name string, args ...string) (*exec.Cmd, error) {
+	setpriv := findTool(setprivPaths)
+	if setpriv == "" {
+		return nil, errors.New("setpriv is not installed, refusing to run a listener with the daemon's capabilities")
+	}
+	full := append([]string{"--inh-caps=-all", "--ambient-caps=-all", "--no-new-privs", name}, args...)
+	cmd := exec.CommandContext(ctx, setpriv, full...)
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	cmd.Cancel = func() error { return syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL) }
+	return cmd, nil
+}
+
+// Server is one listener; only one runs on a node at a time.
+type Server struct {
+	mu   sync.Mutex
+	stop context.CancelFunc
+}
+
+// Serve starts a one-shot iperf server on bindIP that exits after the test
+// window, and returns once it accepts connections.
+func (s *Server) Serve(bindIP string, durationSeconds int) error {
+	iperf := findTool(iperfPaths)
+	if iperf == "" {
+		return ErrNoIperf
+	}
+	if net.ParseIP(bindIP) == nil {
+		return fmt.Errorf("invalid bind address %q", bindIP)
+	}
+	window := time.Duration(durationSeconds)*time.Second + serverGrace
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.stop != nil {
+		s.stop()
+		s.stop = nil
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), window)
+	cmd, err := unprivileged(ctx, iperf, "-s", "-B", bindIP, "-p", strconv.Itoa(clusterv1.NetTestPort),
+		"-t", strconv.Itoa(int(window.Seconds())))
+	if err != nil {
+		cancel()
+		return err
+	}
+	if err := cmd.Start(); err != nil {
+		cancel()
+		return fmt.Errorf("start iperf server: %w", err)
+	}
+	s.stop = cancel
+	go func() {
+		_ = cmd.Wait()
+		cancel()
+	}()
+
+	addr := net.JoinHostPort(bindIP, strconv.Itoa(clusterv1.NetTestPort))
+	deadline := time.Now().Add(readyTimeout)
+	for time.Now().Before(deadline) {
+		conn, err := net.DialTimeout("tcp", addr, 200*time.Millisecond)
+		if err == nil {
+			_ = conn.Close()
+			return nil
+		}
+		select {
+		case <-ctx.Done():
+			return errors.New("iperf server exited before it was ready")
+		case <-time.After(100 * time.Millisecond):
+		}
+	}
+	return errors.New("iperf server did not start listening")
+}
+
+// Stop ends a running listener, if any.
+func (s *Server) Stop() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.stop != nil {
+		s.stop()
+		s.stop = nil
+	}
+}
+
+// Run is the client side: it sends to address from bindIP for the duration
+// and measures the round trip with ping beforehand, so the two never overlap.
+func Run(ctx context.Context, req clusterv1.NetTestRunRequest, bindIP string) (clusterv1.NetTestRunResponse, error) {
+	out := clusterv1.NetTestRunResponse{SourceAddress: bindIP, Streams: req.Streams, Tool: "iperf2"}
+	iperf := findTool(iperfPaths)
+	if iperf == "" {
+		return out, ErrNoIperf
+	}
+	if net.ParseIP(req.Address) == nil || net.ParseIP(bindIP) == nil {
+		return out, errors.New("invalid address")
+	}
+
+	if ping := findTool(pingPaths); ping != "" {
+		pctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+		cmd, err := unprivileged(pctx, ping, "-n", "-q", "-c", strconv.Itoa(pingCount), "-i", "0.2", "-W", "1", "-I", bindIP, req.Address)
+		if err == nil {
+			if data, err := cmd.Output(); err == nil || len(data) > 0 {
+				out.RTTMinMillis, out.RTTAvgMillis, out.RTTMaxMillis, out.PacketLoss = parsePing(string(data))
+			}
+		}
+		cancel()
+	}
+
+	cctx, cancel := context.WithTimeout(ctx, time.Duration(req.DurationSeconds)*time.Second+serverGrace)
+	defer cancel()
+	cmd, err := unprivileged(cctx, iperf, "-c", req.Address, "-B", bindIP, "-p", strconv.Itoa(req.Port),
+		"-t", strconv.Itoa(req.DurationSeconds), "-P", strconv.Itoa(req.Streams), "-y", "C")
+	if err != nil {
+		return out, err
+	}
+	data, err := cmd.Output()
+	if err != nil && len(data) == 0 {
+		var exit *exec.ExitError
+		if errors.As(err, &exit) && len(exit.Stderr) > 0 {
+			return out, fmt.Errorf("iperf: %s", strings.TrimSpace(string(exit.Stderr)))
+		}
+		return out, fmt.Errorf("iperf: %w", err)
+	}
+	if err := parseIperfCSV(string(data), &out); err != nil {
+		return out, err
+	}
+	return out, nil
+}
+
+// parseIperfCSV reads iperf2's `-y C` report. With more than one stream the
+// line whose ID is -1 is the sum; with one, the only line is.
+func parseIperfCSV(text string, out *clusterv1.NetTestRunResponse) error {
+	var sum, single []string
+	streams := 0
+	for line := range strings.SplitSeq(strings.TrimSpace(text), "\n") {
+		f := strings.Split(strings.TrimSpace(line), ",")
+		if len(f) < 9 {
+			continue
+		}
+		if f[5] == "-1" {
+			sum = f
+			continue
+		}
+		streams++
+		single = f
+		if bps, err := strconv.ParseFloat(f[8], 64); err == nil {
+			out.StreamBPS = append(out.StreamBPS, bps)
+		}
+	}
+	row := sum
+	if row == nil {
+		row = single
+	}
+	if row == nil {
+		return errors.New("iperf printed no report")
+	}
+	out.Streams = streams
+	out.Bytes, _ = strconv.ParseInt(row[7], 10, 64)
+	out.BitsPerSecond, _ = strconv.ParseFloat(row[8], 64)
+	if start, end, ok := strings.Cut(row[6], "-"); ok {
+		s, _ := strconv.ParseFloat(start, 64)
+		e, _ := strconv.ParseFloat(end, 64)
+		out.Seconds = e - s
+	}
+	return nil
+}
+
+// parsePing reads "x% packet loss" and "rtt min/avg/max/mdev = a/b/c/d ms".
+func parsePing(text string) (minMs, avgMs, maxMs, loss float64) {
+	for line := range strings.SplitSeq(text, "\n") {
+		if i := strings.Index(line, "% packet loss"); i > 0 {
+			fields := strings.Fields(line[:i])
+			if len(fields) > 0 {
+				loss, _ = strconv.ParseFloat(fields[len(fields)-1], 64)
+			}
+		}
+		if _, values, ok := strings.Cut(line, "= "); ok && strings.Contains(line, "min/avg/max") {
+			parts := strings.Split(strings.Fields(values)[0], "/")
+			if len(parts) >= 3 {
+				minMs, _ = strconv.ParseFloat(parts[0], 64)
+				avgMs, _ = strconv.ParseFloat(parts[1], 64)
+				maxMs, _ = strconv.ParseFloat(parts[2], 64)
+			}
+		}
+	}
+	return minMs, avgMs, maxMs, loss
+}

spinifex/runtime/host/nettest/nettest_test.go

@@ -0,0 +1,51 @@
+package nettest
+
+import (
+	"testing"
+
+	clusterv1 "github.com/mulgadc/spinifex/contracts/cluster/v1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Captured from iperf 2.2.1 with -P 3 -y C.
+const threeStreams = `20261102023725,127.0.0.1,36493,127.0.0.1,5099,1,0.0-2.0,1544421440,6124843671
+20261102023725,127.0.0.1,40019,127.0.0.1,5099,3,0.0-2.0,1603665984,6361182295
+20261102023725,127.0.0.1,35431,127.0.0.1,5099,2,0.0-2.0,1424490560,5647792895
+20261102023725,127.0.0.1,0,127.0.0.1,5099,-1,0.0-2.0,4572577984,18116331744
+`
+
+func TestIperfCSVTakesTheSumLine(t *testing.T) {
+	var out clusterv1.NetTestRunResponse
+	require.NoError(t, parseIperfCSV(threeStreams, &out))
+
+	assert.InDelta(t, 18116331744, out.BitsPerSecond, 1)
+	assert.Equal(t, int64(4572577984), out.Bytes)
+	assert.InDelta(t, 2.0, out.Seconds, 0.001)
+	assert.Equal(t, 3, out.Streams)
+	assert.Len(t, out.StreamBPS, 3)
+}
+
+func TestIperfCSVWithOneStreamHasNoSumLine(t *testing.T) {
+	var out clusterv1.NetTestRunResponse
+	require.NoError(t, parseIperfCSV("20261102023725,10.0.0.1,36493,10.0.0.2,5001,3,0.0-10.0,1180000000,943718400\n", &out))
+
+	assert.InDelta(t, 943718400, out.BitsPerSecond, 1)
+	assert.Equal(t, 1, out.Streams)
+}
+
+func TestIperfCSVRefusesAnEmptyReport(t *testing.T) {
+	var out clusterv1.NetTestRunResponse
+	assert.Error(t, parseIperfCSV("connect failed: Connection refused\n", &out))
+}
+
+func TestPingSummary(t *testing.T) {
+	minMs, avgMs, maxMs, loss := parsePing(`--- 10.2.0.3 ping statistics ---
+10 packets transmitted, 9 received, 10% packet loss, time 1803ms
+rtt min/avg/max/mdev = 0.041/0.063/0.120/0.021 ms
+`)
+	assert.InDelta(t, 0.041, minMs, 1e-9)
+	assert.InDelta(t, 0.063, avgMs, 1e-9)
+	assert.InDelta(t, 0.120, maxMs, 1e-9)
+	assert.InDelta(t, 10, loss, 1e-9)
+}

spinifex/runtime/host/nodefacts/build.go

@@ -0,0 +1,401 @@
+package nodefacts
+
+import (
+	"bufio"
+	"bytes"
+	"cmp"
+	"context"
+	"net"
+	"os"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strconv"
+	"strings"
+
+	clusterv1 "github.com/mulgadc/spinifex/contracts/cluster/v1"
+)
+
+// Env is where Build reads from. Tests point the roots at fixtures.
+type Env struct {
+	Dir      string
+	SysRoot  string
+	ProcRoot string
+	EtcRoot  string
+	Node     string
+	Version  string
+	Commit   string
+	// LiveLLDP reads neighbours now, so a re-cabled port shows without a
+	// restart. Nil or an error falls back to what Collect saved.
+	LiveLLDP func(context.Context) ([]byte, error)
+	// Addrs returns an interface's IPv4 addresses with their prefix lengths.
+	Addrs func(iface string) []net.IPNet
+}
+
+// DefaultEnv reads the live host.
+func DefaultEnv(node, version, commit string) Env {
+	return Env{
+		Dir: DefaultDir, SysRoot: "/sys", ProcRoot: "/proc", EtcRoot: "/etc",
+		Node: node, Version: version, Commit: commit,
+		LiveLLDP: liveLLDP, Addrs: interfaceAddrs,
+	}
+}
+
+func liveLLDP(ctx context.Context) ([]byte, error) {
+	ctl := findTool(networkctlPaths)
+	if ctl == "" {
+		return nil, errNoFile
+	}
+	return run(ctx, ctl, "lldp", "--json=short")
+}
+
+func interfaceAddrs(name string) []net.IPNet {
+	iface, err := net.InterfaceByName(name)
+	if err != nil {
+		return nil
+	}
+	addrs, err := iface.Addrs()
+	if err != nil {
+		return nil
+	}
+	var out []net.IPNet
+	for _, a := range addrs {
+		if ipn, ok := a.(*net.IPNet); ok && ipn.IP.To4() != nil {
+			out = append(out, *ipn)
+		}
+	}
+	return out
+}
+
+// Source states reported in NodeFacts.Sources.
+const (
+	sourceOK          = "ok"
+	sourceUnavailable = "unavailable"
+)
+
+// Build assembles the facts from the collected probes and live sysfs.
+func Build(ctx context.Context, env Env) clusterv1.NodeFacts {
+	f := clusterv1.NodeFacts{Node: env.Node, Sources: map[string]string{}}
+	if data, err := readFacts(env.Dir, fileCollected); err == nil {
+		f.CollectedAt = strings.TrimSpace(string(data))
+	}
+
+	if data, err := readFacts(env.Dir, fileIdentity); err == nil {
+		f.System = parseIdentity(string(data))
+		f.Sources["dmi"] = sourceOK
+	} else {
+		f.Sources["dmi"] = sourceUnavailable
+	}
+	if data, err := os.ReadFile(filepath.Join(env.ProcRoot, "device-tree", "model")); err == nil {
+		f.System.DeviceModel = strings.TrimRight(string(data), "\x00\n ")
+	}
+	if data, err := readFacts(env.Dir, fileVirt); err == nil {
+		f.Virt = strings.TrimSpace(string(data))
+	}
+	f.FormFactor = formFactor(f.Virt, f.System)
+
+	if data, err := readFacts(env.Dir, fileProcessor); err == nil {
+		f.CPU = parseProcessors(string(data))
+	}
+	addCPUInfo(&f.CPU, env.ProcRoot)
+
+	if data, err := readFacts(env.Dir, fileMemory); err == nil {
+		f.Memory = parseMemory(string(data))
+	}
+	addMeminfo(&f.Memory, env.ProcRoot)
+
+	f.OS = osFacts(env)
+
+	neighbours, lldpState := lldpNeighbours(ctx, env)
+	f.Sources["lldp"] = lldpState
+	f.NICs = nicFacts(env, neighbours)
+	f.Planes = planeFacts(env, f.NICs)
+	for i := range f.NICs {
+		for _, p := range f.Planes {
+			if slices.Contains(p.NICs, f.NICs[i].Name) {
+				f.NICs[i].Planes = append(f.NICs[i].Planes, p.Plane)
+			}
+		}
+	}
+	return f
+}
+
+// formFactor decides the picture the console draws. A hypervisor wins over
+// whatever chassis the virtual firmware claims.
+func formFactor(virt string, s clusterv1.SystemFacts) string {
+	model := strings.ToLower(s.DeviceModel)
+	switch {
+	case virt != "" && virt != "none":
+		return "virtual-machine"
+	case strings.Contains(model, "raspberry pi"):
+		return "sbc"
+	case strings.Contains(model, "jetson"):
+		return "jetson"
+	}
+	switch strings.ToLower(s.ChassisType) {
+	case "rack mount chassis", "blade", "blade enclosure", "multi-system", "main server chassis":
+		return "rack-server"
+	case "tower", "mini tower", "desktop", "low profile desktop", "space-saving", "all in one":
+		return "tower"
+	case "mini pc", "compact pci", "embedded pc", "sub chassis", "stick pc":
+		return "sbc"
+	}
+	if model != "" {
+		return "sbc"
+	}
+	return "unknown"
+}
+
+// addCPUInfo fills what DMI cannot tell a VM, and the features worth naming.
+func addCPUInfo(c *clusterv1.CPUFacts, procRoot string) {
+	data, err := os.ReadFile(filepath.Join(procRoot, "cpuinfo"))
+	if err != nil {
+		return
+	}
+	var (
+		model   string
+		flags   []string
+		threads int
+		socket  string
+		sockets = map[string]bool{}
+		cores   = map[string]bool{}
+	)
+	sc := bufio.NewScanner(bytes.NewReader(data))
+	sc.Buffer(make([]byte, 64*1024), 1024*1024)
+	for sc.Scan() {
+		key, value, ok := strings.Cut(sc.Text(), ":")
+		if !ok {
+			continue
+		}
+		key, value = strings.TrimSpace(key), strings.TrimSpace(value)
+		switch key {
+		case "processor":
+			threads++
+		case "model name":
+			model = value
+		case "physical id":
+			socket = value
+			sockets[value] = true
+		case "core id":
+			cores[socket+"/"+value] = true
+		case "flags", "Features": // ARM names the same list Features
+			if flags == nil {
+				flags = strings.Fields(value)
+			}
+		}
+	}
+	if model != "" {
+		c.Model = strings.Join(strings.Fields(model), " ")
+	}
+	if c.Threads == 0 {
+		c.Threads = threads
+	}
+	if c.Sockets == 0 {
+		c.Sockets = max(len(sockets), 1)
+	}
+	if c.Cores == 0 {
+		c.Cores = cmp.Or(len(cores), threads)
+	}
+	switch {
+	case slices.Contains(flags, "svm"):
+		c.Virtualization = "AMD-V"
+	case slices.Contains(flags, "vmx"):
+		c.Virtualization = "VT-x"
+	}
+	c.Flags = flags
+	for _, want := range []string{"avx512f", "avx2", "aes", "sev", "sme"} {
+		if slices.Contains(flags, want) {
+			c.Features = append(c.Features, want)
+		}
+	}
+	if runtime.GOARCH == "arm64" && c.Model == "" {
+		c.Model = "ARM64"
+	}
+}
+
+func addMeminfo(m *clusterv1.MemoryFacts, procRoot string) {
+	data, err := os.ReadFile(filepath.Join(procRoot, "meminfo"))
+	if err != nil {
+		return
+	}
+	for line := range strings.SplitSeq(string(data), "\n") {
+		key, value, ok := strings.Cut(line, ":")
+		if !ok {
+			continue
+		}
+		kb, err := strconv.ParseUint(strings.Fields(value + " 0")[0], 10, 64)
+		if err != nil {
+			continue
+		}
+		switch key {
+		case "MemTotal":
+			m.OSTotalBytes = kb << 10
+		case "MemAvailable":
+			m.OSAvailBytes = kb << 10
+		case "Hugetlb":
+			m.HugePageBytes = kb << 10
+		}
+	}
+}
+
+func osFacts(env Env) clusterv1.OSFacts {
+	o := clusterv1.OSFacts{Arch: runtime.GOARCH, Version: env.Version, Commit: env.Commit}
+	if data, err := os.ReadFile(filepath.Join(env.EtcRoot, "os-release")); err == nil {
+		for line := range strings.SplitSeq(string(data), "\n") {
+			if v, ok := strings.CutPrefix(line, "PRETTY_NAME="); ok {
+				o.Name = strings.Trim(v, `"`)
+			}
+		}
+	}
+	if data, err := os.ReadFile(filepath.Join(env.ProcRoot, "sys", "kernel", "osrelease")); err == nil {
+		o.Kernel = strings.TrimSpace(string(data))
+	}
+	if data, err := os.ReadFile(filepath.Join(env.ProcRoot, "uptime")); err == nil {
+		if fields := strings.Fields(string(data)); len(fields) > 0 {
+			secs, _ := strconv.ParseFloat(fields[0], 64)
+			o.UptimeSeconds = int64(secs)
+		}
+	}
+	if data, err := os.ReadFile(filepath.Join(env.ProcRoot, "sys", "kernel", "hostname")); err == nil {
+		o.Hostname = strings.TrimSpace(string(data))
+	}
+	return o
+}
+
+// lldpNeighbours prefers a live read and falls back to the start-up probe.
+func lldpNeighbours(ctx context.Context, env Env) (map[string]clusterv1.LLDPNeighbor, string) {
+	if env.LiveLLDP != nil {
+		if data, err := env.LiveLLDP(ctx); err == nil {
+			if n, err := parseLLDP(data); err == nil {
+				return n, sourceOK
+			}
+		}
+	}
+	data, err := readFacts(env.Dir, fileLLDP)
+	if err != nil {
+		return nil, sourceUnavailable
+	}
+	n, err := parseLLDP(data)
+	if err != nil {
+		return nil, sourceUnavailable
+	}
+	return n, sourceOK
+}
+
+func readSys(sysRoot, nic, name string) string {
+	data, err := os.ReadFile(filepath.Join(sysRoot, "class", "net", nic, name))
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(data))
+}
+
+func nicFacts(env Env, neighbours map[string]clusterv1.LLDPNeighbor) []clusterv1.NICFacts {
+	var out []clusterv1.NICFacts
+	for _, name := range physicalNICs(env.SysRoot) {
+		n := clusterv1.NICFacts{
+			Name:  name,
+			MAC:   readSys(env.SysRoot, name, "address"),
+			State: readSys(env.SysRoot, name, "operstate"),
+		}
+		n.MTU, _ = strconv.Atoi(readSys(env.SysRoot, name, "mtu"))
+		if speed, err := strconv.Atoi(readSys(env.SysRoot, name, "speed")); err == nil && speed > 0 {
+			n.SpeedMbps = speed
+		}
+		if target, err := os.Readlink(filepath.Join(env.SysRoot, "class", "net", name, "master")); err == nil {
+			n.Master = filepath.Base(target)
+		}
+		if data, err := readFacts(env.Dir, nicPrefix+name+".txt"); err == nil {
+			e := parseEthtool(string(data))
+			n.Driver, n.Firmware, n.BusInfo, n.Duplex, n.Port = e.driver, e.firmware, e.busInfo, e.duplex, e.port
+			n.MaxMbps = e.maxMbps
+			if n.SpeedMbps == 0 {
+				n.SpeedMbps = e.speedMbps
+			}
+			n.Model = parseUdevModel(string(data))
+			if br := ovsBridge(string(data)); br != "" && (n.Master == "" || n.Master == "ovs-system") {
+				n.Master = br
+			}
+		}
+		if n.Driver == "" {
+			if target, err := os.Readlink(filepath.Join(env.SysRoot, "class", "net", name, "device", "driver")); err == nil {
+				n.Driver = filepath.Base(target)
+			}
+		}
+		if nb, ok := neighbours[name]; ok {
+			n.Neighbor = &nb
+		}
+		out = append(out, n)
+	}
+	return out
+}
+
+func ovsBridge(text string) string {
+	for line := range strings.SplitSeq(text, "\n") {
+		if v, ok := strings.CutPrefix(strings.TrimSpace(line), "OVS_BRIDGE="); ok {
+			return v
+		}
+	}
+	return ""
+}
+
+// planeFacts finds each plane's bridge and address. A host without br-vpc
+// carries the overlay on whichever bridge holds the encap address.
+func planeFacts(env Env, nics []clusterv1.NICFacts) []clusterv1.PlaneFacts {
+	addrs := env.Addrs
+	if addrs == nil {
+		addrs = func(string) []net.IPNet { return nil }
+	}
+	var encap string
+	if data, err := readFacts(env.Dir, fileEncapIP); err == nil {
+		encap = strings.TrimSpace(string(data))
+	}
+
+	bridges := map[string]string{
+		clusterv1.PlaneWAN: "br-wan",
+		clusterv1.PlaneLAN: "br-lan",
+		clusterv1.PlaneVPC: "br-vpc",
+	}
+	if encap != "" {
+		if br := bridgeHolding(encap, addrs); br != "" {
+			bridges[clusterv1.PlaneVPC] = br
+		}
+	}
+
+	var out []clusterv1.PlaneFacts
+	for _, plane := range []string{clusterv1.PlaneWAN, clusterv1.PlaneLAN, clusterv1.PlaneVPC} {
+		br := bridges[plane]
+		if _, err := os.Stat(filepath.Join(env.SysRoot, "class", "net", br)); err != nil {
+			continue
+		}
+		p := clusterv1.PlaneFacts{Plane: plane, Bridge: br}
+		p.MTU, _ = strconv.Atoi(readSys(env.SysRoot, br, "mtu"))
+		list := addrs(br)
+		for _, a := range list {
+			if plane == clusterv1.PlaneVPC && encap != "" && a.IP.String() != encap {
+				continue
+			}
+			ones, _ := a.Mask.Size()
+			p.Address, p.Prefix = a.IP.String(), ones
+			break
+		}
+		for _, n := range nics {
+			if n.Master == br {
+				p.NICs = append(p.NICs, n.Name)
+			}
+		}
+		out = append(out, p)
+	}
+	return out
+}
+
+func bridgeHolding(ip string, addrs func(string) []net.IPNet) string {
+	for _, br := range []string{"br-vpc", "br-lan", "br-wan"} {
+		for _, a := range addrs(br) {
+			if a.IP.String() == ip {
+				return br
+			}
+		}
+	}
+	return ""
+}

spinifex/runtime/host/nodefacts/collect.go

@@ -0,0 +1,208 @@
+// Package nodefacts describes a node's hardware, OS and cabling for the
+// operator console. The root-only probes run once at daemon start through
+// Collect; Build reads their output and adds what sysfs reports live.
+package nodefacts
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// DefaultDir is where Collect writes and Build reads.
+const DefaultDir = "/etc/spinifex/node-facts"
+
+const probeTimeout = 10 * time.Second
+
+// Raw probe files under the facts directory.
+const (
+	fileIdentity  = "dmi-identity.txt"
+	fileProcessor = "dmi-processor.txt"
+	fileMemory    = "dmi-memory.txt"
+	fileVirt      = "virt.txt"
+	fileLLDP      = "lldp.json"
+	fileEncapIP   = "ovn-encap-ip.txt"
+	fileCollected = "collected-at.txt"
+	nicPrefix     = "nic-"
+)
+
+// Tools are looked up by absolute path: /usr/sbin is not on a service's PATH.
+var (
+	dmidecodePaths  = []string{"/usr/sbin/dmidecode", "/sbin/dmidecode"}
+	ethtoolPaths    = []string{"/usr/sbin/ethtool", "/sbin/ethtool"}
+	networkctlPaths = []string{"/usr/bin/networkctl", "/bin/networkctl"}
+	ovsVsctlPaths   = []string{"/usr/bin/ovs-vsctl", "/usr/sbin/ovs-vsctl"}
+	udevadmPaths    = []string{"/usr/bin/udevadm", "/bin/udevadm"}
+	detectVirtPaths = []string{"/usr/bin/systemd-detect-virt", "/bin/systemd-detect-virt"}
+)
+
+func findTool(paths []string) string {
+	for _, p := range paths {
+		if info, err := os.Stat(p); err == nil && info.Mode().IsRegular() {
+			return p
+		}
+	}
+	return ""
+}
+
+// Collect runs the probes that need root and writes their raw output under
+// dir, readable by the spinifex group. A probe that fails leaves no file, so
+// Build reports that source as unavailable rather than stopping the daemon.
+func Collect(ctx context.Context, dir, sysRoot string) error {
+	if err := os.MkdirAll(dir, 0o750); err != nil {
+		return fmt.Errorf("create %s: %w", dir, err)
+	}
+	gid := spinifexGID()
+	if gid >= 0 {
+		_ = os.Chown(dir, 0, gid)
+	}
+	write := func(name string, data []byte) {
+		if err := writeFile(dir, name, data, gid); err != nil {
+			slog.Warn("node-facts: write failed", "file", name, "err", err)
+		}
+	}
+
+	if dmi := findTool(dmidecodePaths); dmi != "" {
+		for name, args := range map[string][]string{
+			fileIdentity:  {"-t", "bios", "-t", "system", "-t", "chassis", "-t", "baseboard"},
+			fileProcessor: {"-t", "processor"},
+			fileMemory:    {"-t", "memory"},
+		} {
+			if out, err := run(ctx, dmi, args...); err == nil {
+				write(name, out)
+			} else {
+				slog.Info("node-facts: dmidecode unavailable", "type", name, "err", err)
+			}
+		}
+	}
+
+	if virt := findTool(detectVirtPaths); virt != "" {
+		// Exits 1 on bare metal while printing "none", so the output counts.
+		out, _ := run(ctx, virt)
+		write(fileVirt, out)
+	}
+
+	if ctl := findTool(networkctlPaths); ctl != "" {
+		if out, err := run(ctx, ctl, "lldp", "--json=short"); err == nil {
+			write(fileLLDP, out)
+		}
+	}
+
+	if vsctl := findTool(ovsVsctlPaths); vsctl != "" {
+		if out, err := run(ctx, vsctl, "get", "Open_vSwitch", ".", "external_ids:ovn-encap-ip"); err == nil {
+			write(fileEncapIP, []byte(strings.Trim(strings.TrimSpace(string(out)), `"`)))
+		}
+	}
+
+	ethtool, udevadm, vsctl := findTool(ethtoolPaths), findTool(udevadmPaths), findTool(ovsVsctlPaths)
+	for _, nic := range physicalNICs(sysRoot) {
+		var b strings.Builder
+		if ethtool != "" {
+			out, _ := run(ctx, ethtool, nic)
+			b.Write(out)
+			out, _ = run(ctx, ethtool, "-i", nic)
+			b.Write(out)
+		}
+		if udevadm != "" {
+			out, _ := run(ctx, udevadm, "info", "--query=property", "--path=/sys/class/net/"+nic)
+			b.Write(out)
+		}
+		if vsctl != "" {
+			if out, err := run(ctx, vsctl, "iface-to-br", nic); err == nil {
+				fmt.Fprintf(&b, "OVS_BRIDGE=%s\n", strings.TrimSpace(string(out)))
+			}
+		}
+		write(nicPrefix+nic+".txt", []byte(b.String()))
+	}
+
+	write(fileCollected, []byte(time.Now().UTC().Format(time.RFC3339)))
+	return nil
+}
+
+func run(ctx context.Context, name string, args ...string) ([]byte, error) {
+	ctx, cancel := context.WithTimeout(ctx, probeTimeout)
+	defer cancel()
+	out, err := exec.CommandContext(ctx, name, args...).Output()
+	if err != nil && len(out) == 0 {
+		return nil, err
+	}
+	return out, nil
+}
+
+// writeFile replaces dir/name atomically. The files carry serial numbers, so
+// they are root-owned and readable only by the spinifex group.
+func writeFile(dir, name string, data []byte, gid int) error {
+	tmp, err := os.CreateTemp(dir, "."+name+".*")
+	if err != nil {
+		return err
+	}
+	defer func() { _ = os.Remove(tmp.Name()) }()
+	if _, err := tmp.Write(data); err != nil {
+		_ = tmp.Close()
+		return err
+	}
+	if err := tmp.Chmod(0o640); err != nil {
+		_ = tmp.Close()
+		return err
+	}
+	if gid >= 0 {
+		_ = tmp.Chown(0, gid)
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmp.Name(), filepath.Join(dir, name))
+}
+
+func spinifexGID() int {
+	g, err := user.LookupGroup("spinifex")
+	if err != nil {
+		return -1
+	}
+	gid, err := strconv.Atoi(g.Gid)
+	if err != nil {
+		return -1
+	}
+	return gid
+}
+
+// physicalNICs lists interfaces backed by a device, which leaves out bridges,
+// taps, veths and VLANs.
+func physicalNICs(sysRoot string) []string {
+	entries, err := os.ReadDir(filepath.Join(sysRoot, "class", "net"))
+	if err != nil {
+		return nil
+	}
+	var out []string
+	for _, e := range entries {
+		base := filepath.Join(sysRoot, "class", "net", e.Name())
+		if _, err := os.Stat(filepath.Join(base, "device")); err != nil {
+			continue
+		}
+		// A VF or an SR-IOV representor still has a device; its phys_port_name
+		// marks it, and it is not cabled to anything.
+		if name, err := os.ReadFile(filepath.Join(base, "phys_port_name")); err == nil && strings.HasPrefix(strings.TrimSpace(string(name)), "pf") {
+			continue
+		}
+		out = append(out, e.Name())
+	}
+	return out
+}
+
+var errNoFile = errors.New("not collected")
+
+func readFacts(dir, name string) ([]byte, error) {
+	data, err := os.ReadFile(filepath.Join(dir, name))
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, errNoFile
+	}
+	return data, err
+}

spinifex/runtime/host/nodefacts/dmi.go

@@ -0,0 +1,233 @@
+package nodefacts
+
+import (
+	"slices"
+	"strconv"
+	"strings"
+
+	clusterv1 "github.com/mulgadc/spinifex/contracts/cluster/v1"
+)
+
+// dmiBlock is one structure from dmidecode's text output: its title line and
+// its "Key: value" fields. Indented list items are folded under their key.
+type dmiBlock struct {
+	title  string
+	fields map[string]string
+	lists  map[string][]string
+}
+
+func (b dmiBlock) get(key string) string {
+	return cleanDMI(b.fields[key])
+}
+
+// parseDMI splits dmidecode output into its structures, in order.
+func parseDMI(text string) []dmiBlock {
+	var (
+		blocks  []dmiBlock
+		cur     *dmiBlock
+		listKey string
+	)
+	flush := func() {
+		if cur != nil {
+			blocks = append(blocks, *cur)
+			cur = nil
+		}
+	}
+	for line := range strings.SplitSeq(text, "\n") {
+		line = strings.TrimRight(line, " \r")
+		switch {
+		case line == "" || strings.HasPrefix(line, "Handle ") || strings.HasPrefix(line, "#"):
+			flush()
+			listKey = ""
+		case !strings.HasPrefix(line, "\t"):
+			if strings.HasPrefix(line, "SMBIOS ") || strings.HasPrefix(line, "Getting SMBIOS") {
+				continue
+			}
+			flush()
+			cur = &dmiBlock{title: line, fields: map[string]string{}, lists: map[string][]string{}}
+			listKey = ""
+		case cur == nil:
+		case strings.HasPrefix(line, "\t\t"):
+			if listKey != "" {
+				cur.lists[listKey] = append(cur.lists[listKey], strings.TrimSpace(line))
+			}
+		default:
+			key, value, _ := strings.Cut(strings.TrimSpace(line), ":")
+			key, value = strings.TrimSpace(key), strings.TrimSpace(value)
+			cur.fields[key] = value
+			listKey = ""
+			if value == "" {
+				listKey = key
+			}
+		}
+	}
+	flush()
+	return blocks
+}
+
+func blocksTitled(blocks []dmiBlock, title string) []dmiBlock {
+	var out []dmiBlock
+	for _, b := range blocks {
+		if b.title == title {
+			out = append(out, b)
+		}
+	}
+	return out
+}
+
+// placeholders are the values firmware writes when a field was never filled.
+var placeholders = map[string]bool{
+	"": true, "unknown": true, "not specified": true, "not present": true, "none": true,
+	"to be filled by o.e.m.": true, "default string": true, "system serial number": true,
+	"system product name": true, "system manufacturer": true, "o.e.m.": true, "oem": true,
+	"0123456789": true, "123456789": true, "no asset tag": true, "chassis serial number": true,
+	"base board serial number": true, "not settable": true, "unknown unknown": true,
+	"03000200-0400-0500-0006-000700080009": true,
+}
+
+// cleanDMI trims a DMI value and drops the placeholders firmware ships with.
+func cleanDMI(v string) string {
+	v = strings.TrimSpace(v)
+	lower := strings.ToLower(v)
+	if placeholders[lower] || strings.HasSuffix(lower, "_assettag") || strings.Trim(lower, "0") == "" {
+		return ""
+	}
+	return v
+}
+
+// parseIdentity reads the bios, system, chassis and baseboard structures.
+func parseIdentity(text string) clusterv1.SystemFacts {
+	blocks := parseDMI(text)
+	var s clusterv1.SystemFacts
+	if b := blocksTitled(blocks, "BIOS Information"); len(b) > 0 {
+		s.BIOSVendor, s.BIOSVersion, s.BIOSDate = b[0].get("Vendor"), b[0].get("Version"), b[0].get("Release Date")
+	}
+	if b := blocksTitled(blocks, "System Information"); len(b) > 0 {
+		s.Vendor, s.Product, s.Family = b[0].get("Manufacturer"), b[0].get("Product Name"), b[0].get("Family")
+		s.Version, s.Serial, s.UUID = b[0].get("Version"), b[0].get("Serial Number"), b[0].get("UUID")
+	}
+	if b := blocksTitled(blocks, "Chassis Information"); len(b) > 0 {
+		s.ChassisType, s.ChassisAsset = b[0].get("Type"), b[0].get("Asset Tag")
+	}
+	if b := blocksTitled(blocks, "Base Board Information"); len(b) > 0 {
+		s.BoardVendor, s.BoardProduct, s.BoardSerial = b[0].get("Manufacturer"), b[0].get("Product Name"), b[0].get("Serial Number")
+	}
+	return s
+}
+
+// parseProcessors summarises the populated sockets.
+func parseProcessors(text string) clusterv1.CPUFacts {
+	var c clusterv1.CPUFacts
+	for _, b := range blocksTitled(parseDMI(text), "Processor Information") {
+		if !strings.HasPrefix(b.fields["Status"], "Populated") {
+			continue
+		}
+		c.Sockets++
+		if c.Model == "" {
+			c.Model = strings.Join(strings.Fields(b.get("Version")), " ")
+			c.Vendor = b.get("Manufacturer")
+		}
+		cores, _ := strconv.Atoi(b.fields["Core Count"])
+		threads, _ := strconv.Atoi(b.fields["Thread Count"])
+		c.Cores += cores
+		c.Threads += threads
+		c.CoresPerSocket = max(c.CoresPerSocket, cores)
+		c.MaxMHz = max(c.MaxMHz, atoiPrefix(b.fields["Max Speed"]))
+		c.CurrentMHz = max(c.CurrentMHz, atoiPrefix(b.fields["Current Speed"]))
+	}
+	return c
+}
+
+// memoryKey is everything a DIMM is grouped by.
+type memoryKey struct {
+	size                                 uint64
+	typ, detail, form, maker, part, rank string
+	speed, configured                    int
+}
+
+// parseMemory groups the populated DIMMs and counts the slots of every array.
+func parseMemory(text string) clusterv1.MemoryFacts {
+	var m clusterv1.MemoryFacts
+	blocks := parseDMI(text)
+	for _, b := range blocksTitled(blocks, "Physical Memory Array") {
+		if b.fields["Use"] != "System Memory" {
+			continue
+		}
+		if m.MaxCapacity == "" {
+			m.MaxCapacity = b.get("Maximum Capacity")
+		}
+		if m.ECC == "" {
+			m.ECC = b.get("Error Correction Type")
+		}
+	}
+
+	groups := map[memoryKey]*clusterv1.MemoryGroup{}
+	var order []memoryKey
+	for _, b := range blocksTitled(blocks, "Memory Device") {
+		m.SlotsTotal++
+		size := parseSize(b.fields["Size"])
+		if size == 0 {
+			continue
+		}
+		m.SlotsUsed++
+		m.TotalBytes += size
+		k := memoryKey{
+			size: size, typ: b.get("Type"), detail: b.get("Type Detail"), form: b.get("Form Factor"),
+			maker: b.get("Manufacturer"), part: b.get("Part Number"), rank: b.get("Rank"),
+			speed: atoiPrefix(b.fields["Speed"]), configured: atoiPrefix(b.fields["Configured Memory Speed"]),
+		}
+		g, ok := groups[k]
+		if !ok {
+			g = &clusterv1.MemoryGroup{
+				SizeBytes: size, Type: k.typ, TypeDetail: k.detail, FormFactor: k.form,
+				SpeedMTs: k.speed, ConfiguredMTs: k.configured, Manufacturer: k.maker,
+				PartNumber: k.part, Rank: k.rank,
+			}
+			groups[k] = g
+			order = append(order, k)
+		}
+		g.Count++
+		if serial := b.get("Serial Number"); serial != "" {
+			g.Serials = append(g.Serials, serial)
+		}
+	}
+	for _, k := range order {
+		m.Groups = append(m.Groups, *groups[k])
+	}
+	slices.SortStableFunc(m.Groups, func(a, b clusterv1.MemoryGroup) int { return b.Count - a.Count })
+	return m
+}
+
+// parseSize reads a DMI size such as "16 GB" or "4096 MB"; anything else,
+// including "No Module Installed", is zero.
+func parseSize(v string) uint64 {
+	fields := strings.Fields(v)
+	if len(fields) != 2 {
+		return 0
+	}
+	n, err := strconv.ParseUint(fields[0], 10, 64)
+	if err != nil {
+		return 0
+	}
+	switch fields[1] {
+	case "kB", "KB":
+		return n << 10
+	case "MB":
+		return n << 20
+	case "GB":
+		return n << 30
+	case "TB":
+		return n << 40
+	}
+	return 0
+}
+
+// atoiPrefix reads the leading integer of a value such as "3675 MHz".
+func atoiPrefix(v string) int {
+	fields := strings.Fields(v)
+	if len(fields) == 0 {
+		return 0
+	}
+	n, _ := strconv.Atoi(fields[0])
+	return n
+}

spinifex/runtime/host/nodefacts/network.go

@@ -0,0 +1,132 @@
+package nodefacts
+
+import (
+	"encoding/json"
+	"regexp"
+	"strconv"
+	"strings"
+
+	clusterv1 "github.com/mulgadc/spinifex/contracts/cluster/v1"
+)
+
+// ethtoolFacts is what `ethtool <if>` and `ethtool -i <if>` add to sysfs.
+type ethtoolFacts struct {
+	speedMbps int
+	maxMbps   int
+	duplex    string
+	port      string
+	driver    string
+	firmware  string
+	busInfo   string
+}
+
+var linkModeSpeed = regexp.MustCompile(`\b(\d+)base`)
+
+// parseEthtool reads both outputs, concatenated in either order.
+func parseEthtool(text string) ethtoolFacts {
+	var e ethtoolFacts
+	inSupported := false
+	for line := range strings.SplitSeq(text, "\n") {
+		trimmed := strings.TrimSpace(line)
+		key, value, hasColon := strings.Cut(trimmed, ":")
+		value = strings.TrimSpace(value)
+		if hasColon && !strings.Contains(key, "base") {
+			inSupported = key == "Supported link modes"
+		}
+		if inSupported {
+			for _, m := range linkModeSpeed.FindAllStringSubmatch(trimmed, -1) {
+				if n, err := strconv.Atoi(m[1]); err == nil {
+					e.maxMbps = max(e.maxMbps, n)
+				}
+			}
+		}
+		if !hasColon {
+			continue
+		}
+		switch key {
+		case "Speed":
+			e.speedMbps = atoiPrefix(strings.TrimSuffix(value, "Mb/s"))
+		case "Duplex":
+			if value != "Unknown! (255)" {
+				e.duplex = value
+			}
+		case "Port":
+			if value != "Other" {
+				e.port = value
+			}
+		case "driver":
+			e.driver = value
+		case "firmware-version":
+			e.firmware = value
+		case "bus-info":
+			e.busInfo = value
+		}
+	}
+	return e
+}
+
+// parseUdevModel reads the hwdb vendor and model from `udevadm info` output.
+func parseUdevModel(text string) string {
+	var vendor, model string
+	for line := range strings.SplitSeq(text, "\n") {
+		key, value, _ := strings.Cut(strings.TrimSpace(line), "=")
+		switch key {
+		case "ID_VENDOR_FROM_DATABASE":
+			vendor = value
+		case "ID_MODEL_FROM_DATABASE":
+			model = value
+		}
+	}
+	vendor = strings.TrimSuffix(strings.TrimSuffix(vendor, " Corporation"), " Technologies")
+	switch {
+	case model == "":
+		return vendor
+	case vendor == "":
+		return model
+	}
+	return vendor + " " + model
+}
+
+// lldpCapabilityNames are the IEEE 802.1AB system capability bits.
+var lldpCapabilityNames = []string{"other", "repeater", "bridge", "wlan-ap", "router", "telephone", "docsis", "station"}
+
+type networkctlLLDP struct {
+	Neighbors []struct {
+		InterfaceName string `json:"InterfaceName"`
+		Neighbors     []struct {
+			ChassisID           string `json:"ChassisID"`
+			PortID              string `json:"PortID"`
+			PortDescription     string `json:"PortDescription"`
+			SystemName          string `json:"SystemName"`
+			SystemDescription   string `json:"SystemDescription"`
+			EnabledCapabilities int    `json:"EnabledCapabilities"`
+		} `json:"Neighbors"`
+	} `json:"Neighbors"`
+}
+
+// parseLLDP reads `networkctl lldp --json=short` into the first neighbour of
+// each interface. A NIC sees one switch port, so a second is a hub or a loop.
+func parseLLDP(data []byte) (map[string]clusterv1.LLDPNeighbor, error) {
+	var doc networkctlLLDP
+	if err := json.Unmarshal(data, &doc); err != nil {
+		return nil, err
+	}
+	out := map[string]clusterv1.LLDPNeighbor{}
+	for _, iface := range doc.Neighbors {
+		if len(iface.Neighbors) == 0 {
+			continue
+		}
+		n := iface.Neighbors[0]
+		var caps []string
+		for i, name := range lldpCapabilityNames {
+			if n.EnabledCapabilities&(1<<i) != 0 {
+				caps = append(caps, name)
+			}
+		}
+		out[iface.InterfaceName] = clusterv1.LLDPNeighbor{
+			ChassisID: n.ChassisID, SystemName: n.SystemName, SystemDescription: n.SystemDescription,
+			PortID: n.PortID, PortDescription: n.PortDescription, Capabilities: caps,
+		}
+	}
+	return out, nil
+}

spinifex/runtime/host/nodefacts/nodefacts_test.go

@@ -0,0 +1,280 @@
+package nodefacts
+
+import (
+	"context"
+	"errors"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+
+	clusterv1 "github.com/mulgadc/spinifex/contracts/cluster/v1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The fixtures are dmidecode, ethtool and networkctl output captured from
+// prod node1, dev-prod bottlebrush and a QEMU dev box, serials replaced.
+func fixture(t *testing.T, host, name string) string {
+	t.Helper()
+	data, err := os.ReadFile(filepath.Join("testdata", host, name))
+	require.NoError(t, err)
+	return string(data)
+}
+
+func TestMemoryGroupsIdenticalDIMMsAndCountsEmptySlots(t *testing.T) {
+	m := parseMemory(fixture(t, "bottlebrush", "dmi-memory.txt"))
+
+	assert.Equal(t, 32, m.SlotsTotal)
+	assert.Equal(t, 16, m.SlotsUsed)
+	assert.Equal(t, uint64(256)<<30, m.TotalBytes)
+	assert.Equal(t, "8 TB", m.MaxCapacity)
+	assert.Equal(t, "Multi-bit ECC", m.ECC)
+	require.Len(t, m.Groups, 1)
+	g := m.Groups[0]
+	assert.Equal(t, 16, g.Count)
+	assert.Equal(t, uint64(16)<<30, g.SizeBytes)
+	assert.Equal(t, "DDR4", g.Type)
+	assert.Equal(t, 2400, g.SpeedMTs)
+	assert.Equal(t, 2400, g.ConfiguredMTs)
+	assert.Equal(t, "SK Hynix", g.Manufacturer)
+	assert.Equal(t, "HMA82GR7AFR8N-UH", g.PartNumber)
+	assert.Len(t, g.Serials, 16)
+}
+
+func TestMemorySplitsDIMMsThatDifferInAnyShownField(t *testing.T) {
+	dimm := func(size, speed, part string) string {
+		return "Memory Device\n\tSize: " + size + "\n\tType: DDR5\n\tSpeed: " + speed +
+			"\n\tManufacturer: Samsung\n\tPart Number: " + part + "\n\tConfigured Memory Speed: 4800 MT/s\n\n"
+	}
+	m := parseMemory(dimm("32 GB", "5600 MT/s", "A") + dimm("32 GB", "5600 MT/s", "A") +
+		dimm("64 GB", "5600 MT/s", "B") + "Memory Device\n\tSize: No Module Installed\n\n")
+
+	assert.Equal(t, 4, m.SlotsTotal)
+	assert.Equal(t, 3, m.SlotsUsed)
+	require.Len(t, m.Groups, 2)
+	assert.Equal(t, 2, m.Groups[0].Count, "largest group first")
+	assert.Equal(t, 5600, m.Groups[0].SpeedMTs)
+	assert.Equal(t, 4800, m.Groups[0].ConfiguredMTs, "running below rated speed stays visible")
+	assert.Equal(t, uint64(64)<<30, m.Groups[1].SizeBytes)
+}
+
+func TestProcessorsSummariseEverySocket(t *testing.T) {
+	c := parseProcessors(fixture(t, "node1", "dmi-processor.txt"))
+
+	assert.Equal(t, "AMD EPYC 7513 32-Core Processor", c.Model)
+	assert.Equal(t, 2, c.Sockets)
+	assert.Equal(t, 32, c.CoresPerSocket)
+	assert.Equal(t, 64, c.Cores)
+	assert.Equal(t, 128, c.Threads)
+	assert.Equal(t, 3675, c.MaxMHz)
+}
+
+func TestCPUInfoKeepsEveryFlagAndNamesTheNotableOnes(t *testing.T) {
+	proc := t.TempDir()
+	cpuinfo := "processor\t: 0\nmodel name\t: AMD EPYC 7713\nphysical id\t: 0\ncore id\t\t: 0\nflags\t\t: fpu sse2 svm avx2 aes sev\n\n" +
+		"processor\t: 1\nphysical id\t: 0\ncore id\t\t: 0\nflags\t\t: fpu sse2 svm avx2 aes sev\n"
+	require.NoError(t, os.WriteFile(filepath.Join(proc, "cpuinfo"), []byte(cpuinfo), 0o644))
+
+	var c clusterv1.CPUFacts
+	addCPUInfo(&c, proc)
+
+	assert.Equal(t, []string{"fpu", "sse2", "svm", "avx2", "aes", "sev"}, c.Flags)
+	assert.Equal(t, []string{"avx2", "aes", "sev"}, c.Features)
+	assert.Equal(t, "AMD-V", c.Virtualization)
+	assert.Equal(t, 2, c.Threads)
+	assert.Equal(t, 1, c.Cores, "two threads of one core")
+}
+
+func TestCPUInfoReadsARMFeaturesAndCountsCoresWithoutCoreIDs(t *testing.T) {
+	proc := t.TempDir()
+	cpuinfo := "processor\t: 0\nFeatures\t: fp asimd aes pmull sha2\n\n" +
+		"processor\t: 1\nFeatures\t: fp asimd aes pmull sha2\n"
+	require.NoError(t, os.WriteFile(filepath.Join(proc, "cpuinfo"), []byte(cpuinfo), 0o644))
+
+	var c clusterv1.CPUFacts
+	addCPUInfo(&c, proc)
+
+	assert.Equal(t, []string{"fp", "asimd", "aes", "pmull", "sha2"}, c.Flags)
+	assert.Equal(t, []string{"aes"}, c.Features)
+	assert.Equal(t, 2, c.Cores, "with no core ids every thread is a core")
+}
+
+func TestIdentityDropsFirmwarePlaceholders(t *testing.T) {
+	s := parseIdentity(fixture(t, "node1", "dmi-identity.txt"))
+	assert.Equal(t, "GIGABYTE", s.Vendor)
+	assert.Equal(t, "H262-Z62-ZB", s.Product)
+	assert.Equal(t, "Rack Mount Chassis", s.ChassisType)
+	assert.Equal(t, "M30", s.BIOSVersion)
+	assert.Equal(t, "06/23/2026", s.BIOSDate)
+
+	vm := parseIdentity(fixture(t, "devbox", "dmi-identity.txt"))
+	assert.Equal(t, "SeaBIOS", vm.BIOSVendor)
+	assert.Equal(t, "QEMU", vm.Vendor)
+	assert.Empty(t, vm.Serial, "QEMU leaves the serial unset")
+
+	assert.Empty(t, cleanDMI("To Be Filled By O.E.M."))
+	assert.Empty(t, cleanDMI("DIMM_P0_A0_AssetTag"))
+	assert.Empty(t, cleanDMI("00000000"))
+}
+
+func TestFormFactor(t *testing.T) {
+	cases := []struct {
+		name string
+		virt string
+		sys  clusterv1.SystemFacts
+		want string
+	}{
+		{"hypervisor wins over the chassis it fakes", "kvm", clusterv1.SystemFacts{ChassisType: "Rack Mount Chassis"}, "virtual-machine"},
+		{"rack server", "none", clusterv1.SystemFacts{ChassisType: "Rack Mount Chassis"}, "rack-server"},
+		{"tower", "none", clusterv1.SystemFacts{ChassisType: "Tower"}, "tower"},
+		{"raspberry pi from the device tree", "none", clusterv1.SystemFacts{DeviceModel: "Raspberry Pi 5 Model B Rev 1.0"}, "sbc"},
+		{"jetson from the device tree", "none", clusterv1.SystemFacts{DeviceModel: "NVIDIA Jetson AGX Orin Developer Kit"}, "jetson"},
+		{"nothing to go on", "", clusterv1.SystemFacts{}, "unknown"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			assert.Equal(t, c.want, formFactor(c.virt, c.sys))
+		})
+	}
+}
+
+func TestEthtoolReadsLinkAndDriver(t *testing.T) {
+	text := fixture(t, "bottlebrush", "nic-enp193s0f1np1.txt")
+	e := parseEthtool(text)
+
+	assert.Equal(t, 25000, e.speedMbps)
+	assert.Equal(t, 25000, e.maxMbps)
+	assert.Equal(t, "Full", e.duplex)
+	assert.Equal(t, "Direct Attach Copper", e.port)
+	assert.Equal(t, "mlx5_core", e.driver)
+	assert.Equal(t, "0000:c1:00.1", e.busInfo)
+	assert.Contains(t, parseUdevModel(text), "BlueField-2")
+
+	copper := parseEthtool(fixture(t, "bottlebrush", "nic-eno1.txt"))
+	assert.Equal(t, 1000, copper.maxMbps)
+	assert.Equal(t, "Twisted Pair", copper.port)
+	assert.Equal(t, "igb", copper.driver)
+}
+
+func TestLLDPNamesTheSwitchPortPerNIC(t *testing.T) {
+	n, err := parseLLDP([]byte(fixture(t, "node1", "lldp.json")))
+	require.NoError(t, err)
+
+	require.Contains(t, n, "eno1")
+	assert.Equal(t, "MikroTik 1gbe", n["eno1"].SystemName)
+	assert.Equal(t, "ether18", n["eno1"].PortID)
+	assert.Equal(t, []string{"bridge", "router"}, n["eno1"].Capabilities)
+	assert.Equal(t, n["enp33s0f0np0"].ChassisID, n["enp33s0f1np1"].ChassisID, "both 100G ports land on one switch")
+	assert.Equal(t, "qsfp28-7-1", n["enp33s0f0np0"].PortID)
+}
+
+// fakeHost lays out a sysfs tree with two NICs under bridges, as dev-prod has:
+// no br-vpc, so the overlay rides br-lan.
+func fakeHost(t *testing.T) Env {
+	t.Helper()
+	root := t.TempDir()
+	sys := filepath.Join(root, "sys")
+	nic := func(name, master, speed string) {
+		dir := filepath.Join(sys, "class", "net", name)
+		require.NoError(t, os.MkdirAll(filepath.Join(dir, "device"), 0o755))
+		for file, value := range map[string]string{"speed": speed, "operstate": "up", "mtu": "9000", "address": "02:00:00:00:00:01"} {
+			require.NoError(t, os.WriteFile(filepath.Join(dir, file), []byte(value+"\n"), 0o644))
+		}
+		require.NoError(t, os.Symlink("../"+master, filepath.Join(dir, "master")))
+	}
+	bridge := func(name string) {
+		dir := filepath.Join(sys, "class", "net", name)
+		require.NoError(t, os.MkdirAll(dir, 0o755))
+		require.NoError(t, os.WriteFile(filepath.Join(dir, "mtu"), []byte("9000\n"), 0o644))
+	}
+	bridge("br-wan")
+	bridge("br-lan")
+	nic("eno1", "br-wan", "1000")
+	nic("enp193s0f1np1", "br-lan", "25000")
+
+	dir := filepath.Join(root, "facts")
+	require.NoError(t, os.MkdirAll(dir, 0o755))
+	for name, src := range map[string]string{
+		fileIdentity: "dmi-identity.txt", fileMemory: "dmi-memory.txt", fileProcessor: "dmi-processor.txt",
+		"nic-enp193s0f1np1.txt": "nic-enp193s0f1np1.txt", "nic-eno1.txt": "nic-eno1.txt",
+	} {
+		require.NoError(t, os.WriteFile(filepath.Join(dir, name), []byte(fixture(t, "bottlebrush", src)), 0o644))
+	}
+	require.NoError(t, os.WriteFile(filepath.Join(dir, fileVirt), []byte("none\n"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, fileEncapIP), []byte("10.10.8.4"), 0o644))
+
+	addrs := map[string][]net.IPNet{
+		"br-wan": {{IP: net.IPv4(192, 168, 1, 14), Mask: net.CIDRMask(23, 32)}},
+		"br-lan": {{IP: net.IPv4(10, 10, 8, 4), Mask: net.CIDRMask(24, 32)}},
+	}
+	return Env{
+		Dir: dir, SysRoot: sys, ProcRoot: filepath.Join(root, "proc"), EtcRoot: filepath.Join(root, "etc"),
+		Node: "bottlebrush",
+		LiveLLDP: func(context.Context) ([]byte, error) {
+			return nil, errors.New("systemd-networkd is not running")
+		},
+		Addrs: func(name string) []net.IPNet { return addrs[name] },
+	}
+}
+
+func TestBuildMapsPlanesToNICsWhenTheOverlayRidesTheLANBridge(t *testing.T) {
+	f := Build(context.Background(), fakeHost(t))
+
+	assert.Equal(t, "rack-server", f.FormFactor)
+	assert.Equal(t, "R182-Z92-00", f.System.Product)
+	assert.Equal(t, sourceUnavailable, f.Sources["lldp"], "no networkd and nothing collected")
+
+	planes := map[string]clusterv1.PlaneFacts{}
+	for _, p := range f.Planes {
+		planes[p.Plane] = p
+	}
+	assert.Equal(t, "192.168.1.14", planes["wan"].Address)
+	assert.Equal(t, []string{"eno1"}, planes["wan"].NICs)
+	assert.Equal(t, "br-lan", planes["vpc"].Bridge, "encap address is on br-lan")
+	assert.Equal(t, "10.10.8.4", planes["vpc"].Address)
+	assert.Equal(t, []string{"enp193s0f1np1"}, planes["lan"].NICs)
+
+	nics := map[string]clusterv1.NICFacts{}
+	for _, n := range f.NICs {
+		nics[n.Name] = n
+	}
+	assert.Equal(t, []string{"lan", "vpc"}, nics["enp193s0f1np1"].Planes)
+	assert.Equal(t, 25000, nics["enp193s0f1np1"].SpeedMbps)
+	assert.Equal(t, "mlx5_core", nics["enp193s0f1np1"].Driver)
+	assert.Nil(t, nics["eno1"].Neighbor)
+}
+
+func TestBuildFallsBackToTheCollectedLLDP(t *testing.T) {
+	env := fakeHost(t)
+	require.NoError(t, os.WriteFile(filepath.Join(env.Dir, fileLLDP),
+		[]byte(`{"Neighbors":[{"InterfaceName":"eno1","Neighbors":[{"ChassisID":"aa:bb","PortID":"ether3","SystemName":"core","EnabledCapabilities":4}]}]}`), 0o644))
+
+	f := Build(context.Background(), env)
+
+	assert.Equal(t, sourceOK, f.Sources["lldp"])
+	for _, n := range f.NICs {
+		if n.Name == "eno1" {
+			require.NotNil(t, n.Neighbor)
+			assert.Equal(t, "ether3", n.Neighbor.PortID)
+		}
+	}
+}
+
+func TestWriteFile_ReplacesAtomicallyGroupReadOnly(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, writeFile(dir, fileIdentity, []byte("first"), -1))
+	require.NoError(t, writeFile(dir, fileIdentity, []byte("second"), -1))
+
+	data, err := readFacts(dir, fileIdentity)
+	require.NoError(t, err)
+	assert.Equal(t, "second", string(data))
+
+	info, err := os.Stat(filepath.Join(dir, fileIdentity))
+	require.NoError(t, err)
+	assert.Equal(t, os.FileMode(0o640), info.Mode().Perm(), "the facts carry serial numbers")
+
+	entries, err := os.ReadDir(dir)
+	require.NoError(t, err)
+	assert.Len(t, entries, 1, "no temporary file is left behind")
+}

spinifex/runtime/host/nodefacts/testdata/bottlebrush/dmi-identity.txt

@@ -0,0 +1,186 @@
+# dmidecode 3.6
+Getting SMBIOS data from sysfs.
+SMBIOS 3.2.0 present.
+
+Handle 0x0000, DMI type 0, 26 bytes
+BIOS Information
+	Vendor: GIGABYTE
+	Version: R23
+	Release Date: 07/10/2021
+	Address: 0xF0000
+	Runtime Size: 64 kB
+	ROM Size: 16 MB
+	Characteristics:
+		PCI is supported
+		BIOS is upgradeable
+		BIOS shadowing is allowed
+		Boot from CD is supported
+		Selectable boot is supported
+		BIOS ROM is socketed
+		EDD is supported
+		5.25"/1.2 MB floppy services are supported (int 13h)
+		3.5"/720 kB floppy services are supported (int 13h)
+		3.5"/2.88 MB floppy services are supported (int 13h)
+		Print screen service is supported (int 5h)
+		Serial services are supported (int 14h)
+		Printer services are supported (int 17h)
+		ACPI is supported
+		USB legacy is supported
+		BIOS boot specification is supported
+		Targeted content distribution is supported
+		UEFI is supported
+	BIOS Revision: 5.14
+
+Handle 0x0001, DMI type 1, 27 bytes
+System Information
+	Manufacturer: GIGABYTE
+	Product Name: R182-Z92-00
+	Version: 0100
+	Serial Number: TEST-0001
+	UUID: TEST-0002
+	Wake-up Type: Power Switch
+	SKU Number: 01234567890123456789AB
+	Family: Server
+
+Handle 0x0002, DMI type 2, 15 bytes
+Base Board Information
+	Manufacturer: GIGABYTE
+	Product Name: MZ92-FS0-00
+	Version: 01010101
+	Serial Number: TEST-0003
+	Asset Tag: TEST-0004
+	Features:
+		Board is a hosting board
+		Board is removable
+		Board is replaceable
+	Location In Chassis: 01234567890123456789AB
+	Chassis Handle: 0x0003
+	Type: Motherboard
+	Contained Object Handles: 0
+
+Handle 0x0003, DMI type 3, 22 bytes
+Chassis Information
+	Manufacturer: GIGABYTE
+	Type: Rack Mount Chassis
+	Lock: Not Present
+	Version: 01234567
+	Serial Number: TEST-0005
+	Asset Tag: TEST-0006
+	Boot-up State: Safe
+	Power Supply State: Safe
+	Thermal State: Safe
+	Security Status: None
+	OEM Information: 0x00000000
+	Height: Unspecified
+	Number Of Power Cords: 1
+	Contained Elements: 0
+	SKU Number: 01234567890123456789AB
+
+Handle 0x0030, DMI type 10, 10 bytes
+On Board Device 1 Information
+	Type: Video
+	Status: Enabled
+	Description: AST2500
+On Board Device 2 Information
+	Type: Ethernet
+	Status: Enabled
+	Description: Intel i350 Lan1
+On Board Device 3 Information
+	Type: Ethernet
+	Status: Enabled
+	Description: Intel i350 Lan2
+
+Handle 0x0031, DMI type 41, 11 bytes
+Onboard Device
+	Reference Designation:  Onboard VGA
+	Type: Video
+	Status: Enabled
+	Type Instance: 1
+	Bus Address: 0000:66:00.0
+
+Handle 0x0032, DMI type 41, 11 bytes
+Onboard Device
+	Reference Designation:  Onboard LAN1
+	Type: Ethernet
+	Status: Enabled
+	Type Instance: 1
+	Bus Address: 0000:64:00.0
+
+Handle 0x0033, DMI type 41, 11 bytes
+Onboard Device
+	Reference Designation:  Onboard LAN2
+	Type: Ethernet
+	Status: Enabled
+	Type Instance: 2
+	Bus Address: 0000:64:00.1
+
+Handle 0x0043, DMI type 15, 73 bytes
+System Event Log
+	Area Length: 0 bytes
+	Header Start Offset: 0x0000
+	Header Length: 16 bytes
+	Data Start Offset: 0x0010
+	Access Method: Memory-mapped physical 32-bit address
+	Access Address: 0xFF4FB000
+	Status: Valid, Not Full
+	Change Token: 0x00000053
+	Header Format: Type 1
+	Supported Log Type Descriptors: 25
+	Descriptor 1: Single-bit ECC memory error
+	Data Format 1: Multiple-event handle
+	Descriptor 2: Multi-bit ECC memory error
+	Data Format 2: Multiple-event handle
+	Descriptor 3: Parity memory error
+	Data Format 3: None
+	Descriptor 4: Bus timeout
+	Data Format 4: None
+	Descriptor 5: I/O channel block
+	Data Format 5: None
+	Descriptor 6: Software NMI
+	Data Format 6: None
+	Descriptor 7: POST memory resize
+	Data Format 7: None
+	Descriptor 8: POST error
+	Data Format 8: POST results bitmap
+	Descriptor 9: PCI parity error
+	Data Format 9: Multiple-event handle
+	Descriptor 10: PCI system error
+	Data Format 10: Multiple-event handle
+	Descriptor 11: CPU failure
+	Data Format 11: None
+	Descriptor 12: EISA failsafe timer timeout
+	Data Format 12: None
+	Descriptor 13: Correctable memory log disabled
+	Data Format 13: None
+	Descriptor 14: Logging disabled
+	Data Format 14: None
+	Descriptor 15: System limit exceeded
+	Data Format 15: None
+	Descriptor 16: Asynchronous hardware timer expired
+	Data Format 16: None
+	Descriptor 17: System configuration information
+	Data Format 17: None
+	Descriptor 18: Hard disk information
+	Data Format 18: None
+	Descriptor 19: System reconfigured
+	Data Format 19: None
+	Descriptor 20: Uncorrectable CPU-complex error
+	Data Format 20: None
+	Descriptor 21: Log area reset/cleared
+	Data Format 21: None
+	Descriptor 22: System boot
+	Data Format 22: None
+	Descriptor 23: End of log
+	Data Format 23: None
+	Descriptor 24: OEM-specific
+	Data Format 24: OEM-specific
+	Descriptor 25: OEM-specific
+	Data Format 25: OEM-specific
+
+Handle 0x00B5, DMI type 13, 22 bytes
+BIOS Language Information
+	Language Description Format: Long
+	Installable Languages: 1
+		en|US|iso8859-1
+	Currently Installed Language: en|US|iso8859-1
+

spinifex/runtime/host/nodefacts/testdata/bottlebrush/dmi-memory.txt

@@ -0,0 +1,797 @@
+# dmidecode 3.6
+Getting SMBIOS data from sysfs.
+SMBIOS 3.2.0 present.
+
+Handle 0x0045, DMI type 16, 23 bytes
+Physical Memory Array
+	Location: System Board Or Motherboard
+	Use: System Memory
+	Error Correction Type: Multi-bit ECC
+	Maximum Capacity: 8 TB
+	Error Information Handle: 0x0044
+	Number Of Devices: 32
+
+Handle 0x004D, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x004C
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P0_A0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x004F, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x004E
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_A1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0001
+	Asset Tag: TEST-0002
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0052, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0051
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P0_B0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x0054, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0053
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_B1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0003
+	Asset Tag: TEST-0004
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0057, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0056
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P0_C0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x0059, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0058
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_C1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0005
+	Asset Tag: TEST-0006
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x005C, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x005B
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P0_D0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x005E, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x005D
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_D1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0007
+	Asset Tag: TEST-0008
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0061, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0060
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P0_E0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x0063, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0062
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_E1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0009
+	Asset Tag: TEST-0010
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0066, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0065
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P0_F0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x0068, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0067
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_F1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0011
+	Asset Tag: TEST-0012
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x006B, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x006A
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P0_G0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x006D, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x006C
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_G1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0013
+	Asset Tag: TEST-0014
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0070, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x006F
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P0_H0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x0072, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0071
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_H1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0015
+	Asset Tag: TEST-0016
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0079, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0078
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P1_I0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x007B, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x007A
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_I1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0017
+	Asset Tag: TEST-0018
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x007E, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x007D
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P1_J0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x0080, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x007F
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_J1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0019
+	Asset Tag: TEST-0020
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0083, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0082
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P1_K0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x0085, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0084
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_K1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0021
+	Asset Tag: TEST-0022
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0088, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0087
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P1_L0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x008A, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0089
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_L1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0023
+	Asset Tag: TEST-0024
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x008D, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x008C
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P1_M0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x008F, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x008E
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_M1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0025
+	Asset Tag: TEST-0026
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0092, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0091
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P1_N0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x0094, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0093
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_N1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0027
+	Asset Tag: TEST-0028
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0097, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0096
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P1_O0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x0099, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x0098
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_O1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0029
+	Asset Tag: TEST-0030
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x009C, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x009B
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P1_P0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x009E, DMI type 17, 84 bytes
+Memory Device
+	Array Handle: 0x0045
+	Error Information Handle: 0x009D
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_P1
+	Bank Locator: BANK 1
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2400 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0031
+	Asset Tag: TEST-0032
+	Part Number: HMA82GR7AFR8N-UH    
+	Rank: 2
+	Configured Memory Speed: 2400 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+

spinifex/runtime/host/nodefacts/testdata/bottlebrush/dmi-processor.txt

@@ -0,0 +1,116 @@
+# dmidecode 3.6
+Getting SMBIOS data from sysfs.
+SMBIOS 3.2.0 present.
+
+Handle 0x004B, DMI type 4, 48 bytes
+Processor Information
+	Socket Designation: P0
+	Type: Central Processor
+	Family: Zen
+	Manufacturer: Advanced Micro Devices, Inc.
+	ID: TEST-0001
+	Signature: Family 23, Model 49, Stepping 0
+	Flags:
+		FPU (Floating-point unit on-chip)
+		VME (Virtual mode extension)
+		DE (Debugging extension)
+		PSE (Page size extension)
+		TSC (Time stamp counter)
+		MSR (Model specific registers)
+		PAE (Physical address extension)
+		MCE (Machine check exception)
+		CX8 (CMPXCHG8 instruction supported)
+		APIC (On-chip APIC hardware supported)
+		SEP (Fast system call)
+		MTRR (Memory type range registers)
+		PGE (Page global enable)
+		MCA (Machine check architecture)
+		CMOV (Conditional move instruction supported)
+		PAT (Page attribute table)
+		PSE-36 (36-bit page size extension)
+		CLFSH (CLFLUSH instruction supported)
+		MMX (MMX technology supported)
+		FXSR (FXSAVE and FXSTOR instructions supported)
+		SSE (Streaming SIMD extensions)
+		SSE2 (Streaming SIMD extensions 2)
+		HTT (Multi-threading)
+	Version: AMD EPYC 7662 64-Core Processor
+	Voltage: 1.1 V
+	External Clock: 100 MHz
+	Max Speed: 3300 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Socket SP3
+	L1 Cache Handle: 0x0048
+	L2 Cache Handle: 0x0049
+	L3 Cache Handle: 0x004A
+	Serial Number: Unknown
+	Asset Tag: Unknown
+	Part Number: Unknown
+	Core Count: 64
+	Core Enabled: 64
+	Thread Count: 128
+	Characteristics:
+		64-bit capable
+		Multi-Core
+		Hardware Thread
+		Execute Protection
+		Enhanced Virtualization
+		Power/Performance Control
+
+Handle 0x0077, DMI type 4, 48 bytes
+Processor Information
+	Socket Designation: P1
+	Type: Central Processor
+	Family: Zen
+	Manufacturer: Advanced Micro Devices, Inc.
+	ID: TEST-0004
+	Signature: Family 23, Model 49, Stepping 0
+	Flags:
+		FPU (Floating-point unit on-chip)
+		VME (Virtual mode extension)
+		DE (Debugging extension)
+		PSE (Page size extension)
+		TSC (Time stamp counter)
+		MSR (Model specific registers)
+		PAE (Physical address extension)
+		MCE (Machine check exception)
+		CX8 (CMPXCHG8 instruction supported)
+		APIC (On-chip APIC hardware supported)
+		SEP (Fast system call)
+		MTRR (Memory type range registers)
+		PGE (Page global enable)
+		MCA (Machine check architecture)
+		CMOV (Conditional move instruction supported)
+		PAT (Page attribute table)
+		PSE-36 (36-bit page size extension)
+		CLFSH (CLFLUSH instruction supported)
+		MMX (MMX technology supported)
+		FXSR (FXSAVE and FXSTOR instructions supported)
+		SSE (Streaming SIMD extensions)
+		SSE2 (Streaming SIMD extensions 2)
+		HTT (Multi-threading)
+	Version: AMD EPYC 7662 64-Core Processor
+	Voltage: 1.1 V
+	External Clock: 100 MHz
+	Max Speed: 3300 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Socket SP3
+	L1 Cache Handle: 0x0074
+	L2 Cache Handle: 0x0075
+	L3 Cache Handle: 0x0076
+	Serial Number: Unknown
+	Asset Tag: Unknown
+	Part Number: Unknown
+	Core Count: 64
+	Core Enabled: 64
+	Thread Count: 128
+	Characteristics:
+		64-bit capable
+		Multi-Core
+		Hardware Thread
+		Execute Protection
+		Enhanced Virtualization
+		Power/Performance Control
+

spinifex/runtime/host/nodefacts/testdata/bottlebrush/nic-eno1.txt

@@ -0,0 +1,43 @@
+Settings for eno1:
+	Supported ports: [ TP ]
+	Supported link modes:   10baseT/Half 10baseT/Full
+	                        100baseT/Half 100baseT/Full
+	                        1000baseT/Full
+	Supported pause frame use: Symmetric
+	Supports auto-negotiation: Yes
+	Supported FEC modes: Not reported
+	Advertised link modes:  10baseT/Half 10baseT/Full
+	                        100baseT/Half 100baseT/Full
+	                        1000baseT/Full
+	Advertised pause frame use: Symmetric
+	Advertised auto-negotiation: Yes
+	Advertised FEC modes: Not reported
+	Speed: 1000Mb/s
+	Duplex: Full
+	Auto-negotiation: on
+	Port: Twisted Pair
+	PHYAD: 1
+	Transceiver: internal
+	MDI-X: on (auto)
+        Current message level: 0x00000007 (7)
+                               drv probe link
+	Link detected: yes
+netlink error: Operation not permitted
+===
+driver: igb
+version: 6.12.73+deb13-amd64
+firmware-version: 1.63, 0x800009fa
+expansion-rom-version: 
+bus-info: 0000:64:00.0
+supports-statistics: yes
+supports-test: yes
+supports-eeprom-access: yes
+supports-register-dump: yes
+supports-priv-flags: yes
+===
+ID_VENDOR_FROM_DATABASE=Intel Corporation
+ID_MODEL_FROM_DATABASE=I350 Gigabit Network Connection
+ID_NET_NAME_MAC=enx000000000001
+ID_NET_NAME_ONBOARD=eno1
+ID_NET_NAME_PATH=enp100s0f0
+ID_NET_NAME=eno1

spinifex/runtime/host/nodefacts/testdata/bottlebrush/nic-enp193s0f1np1.txt

@@ -0,0 +1,59 @@
+Settings for enp193s0f1np1:
+	Supported ports: [ Backplane ]
+	Supported link modes:   1000baseT/Full
+	                        10000baseT/Full
+	                        1000baseKX/Full
+	                        10000baseKR/Full
+	                        10000baseR_FEC
+	                        25000baseCR/Full
+	                        25000baseKR/Full
+	                        25000baseSR/Full
+	                        1000baseX/Full
+	                        10000baseCR/Full
+	                        10000baseSR/Full
+	                        10000baseLR/Full
+	                        10000baseER/Full
+	Supported pause frame use: Symmetric
+	Supports auto-negotiation: Yes
+	Supported FEC modes: None	 RS	 BASER
+	Advertised link modes:  1000baseT/Full
+	                        10000baseT/Full
+	                        1000baseKX/Full
+	                        10000baseKR/Full
+	                        10000baseR_FEC
+	                        25000baseCR/Full
+	                        25000baseKR/Full
+	                        25000baseSR/Full
+	                        1000baseX/Full
+	                        10000baseCR/Full
+	                        10000baseSR/Full
+	                        10000baseLR/Full
+	                        10000baseER/Full
+	Advertised pause frame use: Symmetric
+	Advertised auto-negotiation: Yes
+	Advertised FEC modes: None
+	Speed: 25000Mb/s
+	Duplex: Full
+	Auto-negotiation: on
+	Port: Direct Attach Copper
+	PHYAD: 0
+	Transceiver: internal
+	Link detected: yes
+netlink error: Operation not permitted
+===
+driver: mlx5_core
+version: 6.12.73+deb13-amd64
+firmware-version: 24.47.1088 (MT_0000000541)
+expansion-rom-version: 
+bus-info: 0000:c1:00.1
+supports-statistics: yes
+supports-test: yes
+supports-eeprom-access: no
+supports-register-dump: no
+supports-priv-flags: yes
+===
+ID_VENDOR_FROM_DATABASE=Mellanox Technologies
+ID_MODEL_FROM_DATABASE=MT42822 BlueField-2 integrated ConnectX-6 Dx network controller
+ID_NET_NAME_MAC=enx000000000002
+ID_NET_NAME_PATH=enp193s0f1np1
+ID_NET_NAME=enp193s0f1np1

spinifex/runtime/host/nodefacts/testdata/devbox/dmi-identity.txt

@@ -0,0 +1,50 @@
+# dmidecode 3.6
+Getting SMBIOS data from sysfs.
+SMBIOS 2.8 present.
+
+Handle 0x0000, DMI type 0, 24 bytes
+BIOS Information
+	Vendor: SeaBIOS
+	Version: 1.16.3-debian-1.16.3-2
+	Release Date: 04/01/2014
+	Address: 0xE8000
+	Runtime Size: 96 kB
+	ROM Size: 64 kB
+	Characteristics:
+		BIOS characteristics not supported
+		Targeted content distribution is supported
+	BIOS Revision: 0.0
+
+Handle 0x0100, DMI type 1, 27 bytes
+System Information
+	Manufacturer: QEMU
+	Product Name: Standard PC (i440FX + PIIX, 1996)
+	Version: pc-i440fx-10.0
+	Serial Number: Not Specified
+	UUID: TEST-0002
+	Wake-up Type: Power Switch
+	SKU Number: Not Specified
+	Family: Not Specified
+
+Handle 0x0300, DMI type 3, 22 bytes
+Chassis Information
+	Manufacturer: QEMU
+	Type: Other
+	Lock: Not Present
+	Version: pc-i440fx-10.0
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Boot-up State: Safe
+	Power Supply State: Safe
+	Thermal State: Safe
+	Security Status: Unknown
+	OEM Information: 0x00000000
+	Height: Unspecified
+	Number Of Power Cords: Unspecified
+	Contained Elements: 0
+	SKU Number: Not Specified
+
+Handle 0x2000, DMI type 32, 11 bytes
+System Boot Information
+	Status: No errors detected
+

spinifex/runtime/host/nodefacts/testdata/devbox/dmi-memory.txt

@@ -0,0 +1,37 @@
+# dmidecode 3.6
+Getting SMBIOS data from sysfs.
+SMBIOS 2.8 present.
+
+Handle 0x1000, DMI type 16, 23 bytes
+Physical Memory Array
+	Location: Other
+	Use: System Memory
+	Error Correction Type: Multi-bit ECC
+	Maximum Capacity: 32 GB
+	Error Information Handle: Not Provided
+	Number Of Devices: 1
+
+Handle 0x1100, DMI type 17, 40 bytes
+Memory Device
+	Array Handle: 0x1000
+	Error Information Handle: Not Provided
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: 32 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM 0
+	Bank Locator: Not Specified
+	Type: RAM
+	Type Detail: Other
+	Speed: Unknown
+	Manufacturer: QEMU
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Rank: Unknown
+	Configured Memory Speed: Unknown
+	Minimum Voltage: Unknown
+	Maximum Voltage: Unknown
+	Configured Voltage: Unknown
+

spinifex/runtime/host/nodefacts/testdata/devbox/dmi-processor.txt

@@ -0,0 +1,404 @@
+# dmidecode 3.6
+Getting SMBIOS data from sysfs.
+SMBIOS 2.8 present.
+
+Handle 0x0400, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU 0
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0001
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x0401, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU 1
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0004
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x0402, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU 2
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0007
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x0403, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU 3
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0010
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x0404, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU 4
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0013
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x0405, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU 5
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0016
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x0406, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU 6
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0019
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x0407, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU 7
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0022
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x0408, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU 8
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0025
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x0409, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU 9
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0028
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x040A, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU a
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0031
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x040B, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU b
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0034
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x040C, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU c
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0037
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x040D, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU d
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0040
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x040E, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU e
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0043
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+
+Handle 0x040F, DMI type 4, 42 bytes
+Processor Information
+	Socket Designation: CPU f
+	Type: Central Processor
+	Family: Other
+	Manufacturer: QEMU
+	ID: TEST-0046
+	Version: pc-i440fx-10.0
+	Voltage: Unknown
+	External Clock: Unknown
+	Max Speed: 2000 MHz
+	Current Speed: 2000 MHz
+	Status: Populated, Enabled
+	Upgrade: Other
+	L1 Cache Handle: Not Provided
+	L2 Cache Handle: Not Provided
+	L3 Cache Handle: Not Provided
+	Serial Number: Not Specified
+	Asset Tag: Not Specified
+	Part Number: Not Specified
+	Core Count: 1
+	Core Enabled: 1
+	Thread Count: 1
+	Characteristics: None
+

spinifex/runtime/host/nodefacts/testdata/node1/dmi-identity.txt

@@ -0,0 +1,189 @@
+# dmidecode 3.6
+Getting SMBIOS data from sysfs.
+SMBIOS 3.3.0 present.
+
+Handle 0x0000, DMI type 0, 26 bytes
+BIOS Information
+	Vendor: GIGABYTE
+	Version: M30
+	Release Date: 06/23/2026
+	Address: 0xF0000
+	Runtime Size: 64 kB
+	ROM Size: 16 MB
+	Characteristics:
+		PCI is supported
+		BIOS is upgradeable
+		BIOS shadowing is allowed
+		Boot from CD is supported
+		Selectable boot is supported
+		BIOS ROM is socketed
+		EDD is supported
+		Japanese floppy for NEC 9800 1.2 MB is supported (int 13h)
+		Japanese floppy for Toshiba 1.2 MB is supported (int 13h)
+		5.25"/360 kB floppy services are supported (int 13h)
+		5.25"/1.2 MB floppy services are supported (int 13h)
+		3.5"/720 kB floppy services are supported (int 13h)
+		3.5"/2.88 MB floppy services are supported (int 13h)
+		Print screen service is supported (int 5h)
+		Serial services are supported (int 14h)
+		Printer services are supported (int 17h)
+		CGA/mono video services are supported (int 10h)
+		USB legacy is supported
+		BIOS boot specification is supported
+		Targeted content distribution is supported
+		UEFI is supported
+	BIOS Revision: 5.22
+
+Handle 0x0001, DMI type 1, 27 bytes
+System Information
+	Manufacturer: GIGABYTE
+	Product Name: H262-Z62-ZB
+	Version: 0100
+	Serial Number: TEST-0001
+	UUID: TEST-0002
+	Wake-up Type: Power Switch
+	SKU Number: 01234567890123456789AB
+	Family: Server
+
+Handle 0x0002, DMI type 2, 15 bytes
+Base Board Information
+	Manufacturer: GIGABYTE
+	Product Name: MZ62-HD0-ZB
+	Version: 02000200
+	Serial Number: TEST-0003
+	Asset Tag: TEST-0004
+	Features:
+		Board is a hosting board
+		Board is removable
+		Board is replaceable
+	Location In Chassis: 01234567890123456789AB
+	Chassis Handle: 0x0003
+	Type: Motherboard
+	Contained Object Handles: 0
+
+Handle 0x0003, DMI type 3, 22 bytes
+Chassis Information
+	Manufacturer: GIGABYTE
+	Type: Rack Mount Chassis
+	Lock: Not Present
+	Version: 01234567
+	Serial Number: TEST-0005
+	Asset Tag: TEST-0006
+	Boot-up State: Safe
+	Power Supply State: Safe
+	Thermal State: Safe
+	Security Status: None
+	OEM Information: 0x00000000
+	Height: Unspecified
+	Number Of Power Cords: 1
+	Contained Elements: 0
+	SKU Number: 01234567890123456789AB
+
+Handle 0x0023, DMI type 10, 10 bytes
+On Board Device 1 Information
+	Type: Video
+	Status: Enabled
+	Description: AST2500
+On Board Device 2 Information
+	Type: Ethernet
+	Status: Enabled
+	Description: Intel i350 Lan1
+On Board Device 3 Information
+	Type: Ethernet
+	Status: Enabled
+	Description: Intel i350 Lan2
+
+Handle 0x0024, DMI type 41, 11 bytes
+Onboard Device
+	Reference Designation:  Onboard VGA
+	Type: Video
+	Status: Enabled
+	Type Instance: 1
+	Bus Address: 0000:63:00.0
+
+Handle 0x0025, DMI type 41, 11 bytes
+Onboard Device
+	Reference Designation:  Onboard LAN1
+	Type: Ethernet
+	Status: Enabled
+	Type Instance: 1
+	Bus Address: 0000:61:00.0
+
+Handle 0x0026, DMI type 41, 11 bytes
+Onboard Device
+	Reference Designation:  Onboard LAN2
+	Type: Ethernet
+	Status: Enabled
+	Type Instance: 2
+	Bus Address: 0000:61:00.1
+
+Handle 0x0037, DMI type 15, 73 bytes
+System Event Log
+	Area Length: 0 bytes
+	Header Start Offset: 0x0000
+	Header Length: 16 bytes
+	Data Start Offset: 0x0010
+	Access Method: Memory-mapped physical 32-bit address
+	Access Address: 0xFF536000
+	Status: Valid, Not Full
+	Change Token: 0x00000015
+	Header Format: Type 1
+	Supported Log Type Descriptors: 25
+	Descriptor 1: Single-bit ECC memory error
+	Data Format 1: Multiple-event handle
+	Descriptor 2: Multi-bit ECC memory error
+	Data Format 2: Multiple-event handle
+	Descriptor 3: Parity memory error
+	Data Format 3: None
+	Descriptor 4: Bus timeout
+	Data Format 4: None
+	Descriptor 5: I/O channel block
+	Data Format 5: None
+	Descriptor 6: Software NMI
+	Data Format 6: None
+	Descriptor 7: POST memory resize
+	Data Format 7: None
+	Descriptor 8: POST error
+	Data Format 8: POST results bitmap
+	Descriptor 9: PCI parity error
+	Data Format 9: Multiple-event handle
+	Descriptor 10: PCI system error
+	Data Format 10: Multiple-event handle
+	Descriptor 11: CPU failure
+	Data Format 11: None
+	Descriptor 12: EISA failsafe timer timeout
+	Data Format 12: None
+	Descriptor 13: Correctable memory log disabled
+	Data Format 13: None
+	Descriptor 14: Logging disabled
+	Data Format 14: None
+	Descriptor 15: System limit exceeded
+	Data Format 15: None
+	Descriptor 16: Asynchronous hardware timer expired
+	Data Format 16: None
+	Descriptor 17: System configuration information
+	Data Format 17: None
+	Descriptor 18: Hard disk information
+	Data Format 18: None
+	Descriptor 19: System reconfigured
+	Data Format 19: None
+	Descriptor 20: Uncorrectable CPU-complex error
+	Data Format 20: None
+	Descriptor 21: Log area reset/cleared
+	Data Format 21: None
+	Descriptor 22: System boot
+	Data Format 22: None
+	Descriptor 23: End of log
+	Data Format 23: None
+	Descriptor 24: OEM-specific
+	Data Format 24: OEM-specific
+	Descriptor 25: OEM-specific
+	Data Format 25: OEM-specific
+
+Handle 0x0085, DMI type 13, 22 bytes
+BIOS Language Information
+	Language Description Format: Long
+	Installable Languages: 1
+		en|US|iso8859-1
+	Currently Installed Language: en|US|iso8859-1
+

spinifex/runtime/host/nodefacts/testdata/node1/dmi-memory.txt

@@ -0,0 +1,531 @@
+# dmidecode 3.6
+Getting SMBIOS data from sysfs.
+SMBIOS 3.3.0 present.
+
+Handle 0x0039, DMI type 16, 23 bytes
+Physical Memory Array
+	Location: System Board Or Motherboard
+	Use: System Memory
+	Error Correction Type: Multi-bit ECC
+	Maximum Capacity: 4 TB
+	Error Information Handle: 0x0038
+	Number Of Devices: 16
+
+Handle 0x0041, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x0040
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_A0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0001
+	Asset Tag: TEST-0002
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0044, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x0043
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_B0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0003
+	Asset Tag: TEST-0004
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0047, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x0046
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_C0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0005
+	Asset Tag: TEST-0006
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x004A, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x0049
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_D0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0007
+	Asset Tag: TEST-0008
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x004D, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x004C
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_E0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0009
+	Asset Tag: TEST-0010
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0050, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x004F
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_F0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0011
+	Asset Tag: TEST-0012
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0053, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x0052
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P0_G0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0013
+	Asset Tag: TEST-0014
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0056, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x0055
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P0_H0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x005C, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x005B
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_I0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0015
+	Asset Tag: TEST-0016
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x005F, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x005E
+	Total Width: Unknown
+	Data Width: Unknown
+	Size: No Module Installed
+	Form Factor: Unknown
+	Set: None
+	Locator: DIMM_P1_J0
+	Bank Locator: BANK 0
+	Type: Unknown
+	Type Detail: Unknown
+
+Handle 0x0061, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x0060
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_K0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0017
+	Asset Tag: TEST-0018
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0064, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x0063
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_L0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0019
+	Asset Tag: TEST-0020
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0067, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x0066
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_M0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0021
+	Asset Tag: TEST-0022
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x006A, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x0069
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_N0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0023
+	Asset Tag: TEST-0024
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x006D, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x006C
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_O0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0025
+	Asset Tag: TEST-0026
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+
+Handle 0x0070, DMI type 17, 92 bytes
+Memory Device
+	Array Handle: 0x0039
+	Error Information Handle: 0x006F
+	Total Width: 72 bits
+	Data Width: 64 bits
+	Size: 16 GB
+	Form Factor: DIMM
+	Set: None
+	Locator: DIMM_P1_P0
+	Bank Locator: BANK 0
+	Type: DDR4
+	Type Detail: Synchronous Registered (Buffered)
+	Speed: 2933 MT/s
+	Manufacturer: SK Hynix
+	Serial Number: TEST-0027
+	Asset Tag: TEST-0028
+	Part Number: HMA82GR7JJR8N-WM    
+	Rank: 2
+	Configured Memory Speed: 2933 MT/s
+	Minimum Voltage: 1.2 V
+	Maximum Voltage: 1.2 V
+	Configured Voltage: 1.2 V
+	Memory Technology: DRAM
+	Memory Operating Mode Capability: Volatile memory
+	Firmware Version: Unknown
+	Module Manufacturer ID: Bank 1, Hex 0xAD
+	Module Product ID: Unknown
+	Memory Subsystem Controller Manufacturer ID: Unknown
+	Memory Subsystem Controller Product ID: Unknown
+	Non-Volatile Size: None
+	Volatile Size: 16 GB
+	Cache Size: None
+	Logical Size: None
+

spinifex/runtime/host/nodefacts/testdata/node1/dmi-processor.txt

@@ -0,0 +1,116 @@
+# dmidecode 3.6
+Getting SMBIOS data from sysfs.
+SMBIOS 3.3.0 present.
+
+Handle 0x003F, DMI type 4, 48 bytes
+Processor Information
+	Socket Designation: P0
+	Type: Central Processor
+	Family: Zen
+	Manufacturer: Advanced Micro Devices, Inc.
+	ID: TEST-0001
+	Signature: Family 25, Model 1, Stepping 1
+	Flags:
+		FPU (Floating-point unit on-chip)
+		VME (Virtual mode extension)
+		DE (Debugging extension)
+		PSE (Page size extension)
+		TSC (Time stamp counter)
+		MSR (Model specific registers)
+		PAE (Physical address extension)
+		MCE (Machine check exception)
+		CX8 (CMPXCHG8 instruction supported)
+		APIC (On-chip APIC hardware supported)
+		SEP (Fast system call)
+		MTRR (Memory type range registers)
+		PGE (Page global enable)
+		MCA (Machine check architecture)
+		CMOV (Conditional move instruction supported)
+		PAT (Page attribute table)
+		PSE-36 (36-bit page size extension)
+		CLFSH (CLFLUSH instruction supported)
+		MMX (MMX technology supported)
+		FXSR (FXSAVE and FXSTOR instructions supported)
+		SSE (Streaming SIMD extensions)
+		SSE2 (Streaming SIMD extensions 2)
+		HTT (Multi-threading)
+	Version: AMD EPYC 7513 32-Core Processor
+	Voltage: 1.1 V
+	External Clock: 100 MHz
+	Max Speed: 3675 MHz
+	Current Speed: 2600 MHz
+	Status: Populated, Enabled
+	Upgrade: Socket SP3
+	L1 Cache Handle: 0x003C
+	L2 Cache Handle: 0x003D
+	L3 Cache Handle: 0x003E
+	Serial Number: Unknown
+	Asset Tag: Unknown
+	Part Number: Unknown
+	Core Count: 32
+	Core Enabled: 32
+	Thread Count: 64
+	Characteristics:
+		64-bit capable
+		Multi-Core
+		Hardware Thread
+		Execute Protection
+		Enhanced Virtualization
+		Power/Performance Control
+
+Handle 0x005A, DMI type 4, 48 bytes
+Processor Information
+	Socket Designation: P1
+	Type: Central Processor
+	Family: Zen
+	Manufacturer: Advanced Micro Devices, Inc.
+	ID: TEST-0004
+	Signature: Family 25, Model 1, Stepping 1
+	Flags:
+		FPU (Floating-point unit on-chip)
+		VME (Virtual mode extension)
+		DE (Debugging extension)
+		PSE (Page size extension)
+		TSC (Time stamp counter)
+		MSR (Model specific registers)
+		PAE (Physical address extension)
+		MCE (Machine check exception)
+		CX8 (CMPXCHG8 instruction supported)
+		APIC (On-chip APIC hardware supported)
+		SEP (Fast system call)
+		MTRR (Memory type range registers)
+		PGE (Page global enable)
+		MCA (Machine check architecture)
+		CMOV (Conditional move instruction supported)
+		PAT (Page attribute table)
+		PSE-36 (36-bit page size extension)
+		CLFSH (CLFLUSH instruction supported)
+		MMX (MMX technology supported)
+		FXSR (FXSAVE and FXSTOR instructions supported)
+		SSE (Streaming SIMD extensions)
+		SSE2 (Streaming SIMD extensions 2)
+		HTT (Multi-threading)
+	Version: AMD EPYC 7513 32-Core Processor
+	Voltage: 1.1 V
+	External Clock: 100 MHz
+	Max Speed: 3675 MHz
+	Current Speed: 2600 MHz
+	Status: Populated, Enabled
+	Upgrade: Socket SP3
+	L1 Cache Handle: 0x0057
+	L2 Cache Handle: 0x0058
+	L3 Cache Handle: 0x0059
+	Serial Number: Unknown
+	Asset Tag: Unknown
+	Part Number: Unknown
+	Core Count: 32
+	Core Enabled: 32
+	Thread Count: 64
+	Characteristics:
+		64-bit capable
+		Multi-Core
+		Hardware Thread
+		Execute Protection
+		Enhanced Virtualization
+		Power/Performance Control
+

spinifex/runtime/host/nodefacts/testdata/node1/lldp.json

@@ -0,0 +1 @@
+{"Neighbors":[{"InterfaceIndex":2,"InterfaceName":"eno1","InterfaceAlternativeNames":["enp97s0f0","enx74563c072e4f"],"Neighbors":[{"ChassisID":"04:f4:1c:ec:da:9e","RawChassisID":[4,4,244,28,236,218,158],"PortID":"ether18","RawPortID":[5,101,116,104,101,114,49,56],"PortDescription":"bridge/ether18","SystemName":"MikroTik 1gbe","SystemDescription":"MikroTik RouterOS 7.19.6 (stable) 2025-09-12 09:02:42 CRS326-24G-2S+","EnabledCapabilities":20}]},{"InterfaceIndex":19,"InterfaceName":"enp33s0f0np0","InterfaceAlternativeNames":["enxb8599fe8b142"],"Neighbors":[{"ChassisID":"d0:ea:11:a8:91:4c","RawChassisID":[4,208,234,17,168,145,76],"PortID":"qsfp28-7-1","RawPortID":[5,113,115,102,112,50,56,45,55,45,49],"PortDescription":"bridge/qsfp28-7-1","SystemName":"MikroTik 100gbe","SystemDescription":"MikroTik RouterOS 7.20.8 (long-term) 2026-01-30 09:17:54 CRS520-4XS-16XQ","EnabledCapabilities":20}]},{"InterfaceIndex":20,"InterfaceName":"enp33s0f1np1","InterfaceAlternativeNames":["enxb8599fe8b143"],"Neighbors":[{"ChassisID":"d0:ea:11:a8:91:4c","RawChassisID":[4,208,234,17,168,145,76],"PortID":"qsfp28-5-1","RawPortID":[5,113,115,102,112,50,56,45,53,45,49],"PortDescription":"bridge/qsfp28-5-1","SystemName":"MikroTik 100gbe","SystemDescription":"MikroTik RouterOS 7.20.8 (long-term) 2026-01-30 09:17:54 CRS520-4XS-16XQ","EnabledCapabilities":20}]}]}

spinifex/runtime/roles/awsgw/awsgw.go

@@ -717,6 +717,7 @@ func launchService(config *config.ClusterConfig) error {
 		Credentials: bedrockCredentials,
 		Access:      bedrockAccess,
 
+		NetworkTests:           operatoradmin.NewKVNetworkTests(js),
 		Quota:                  quotaSvc,
 		BucketStore:            objStore,
 		SignupMaxAccounts:      signupMaxAccounts,

spinifex/runtime/roles/spinifexui/frontend/dist/assets/CompositeItem-C2LaHoT5.js

@@ -1 +0,0 @@
-import{Ft as e,Mt as t,Pt as n}from"./schemas-CKmbY8gV.js";import{s as r}from"./tabs-C7-u1MlW.js";function i(i){let{render:a,className:o,style:s,state:c=e,props:l=n,refs:u=n,metadata:d,stateAttributesMapping:f,tag:p=`div`,...m}=i,{compositeProps:h,compositeRef:g}=r({metadata:d});return t(p,i,{state:c,ref:[g,...u],props:[h,...l,m],stateAttributesMapping:f})}export{i as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/CompositeItem-DqJfacHh.js

@@ -0,0 +1 @@
+import{Ct as e,Et as t,Tt as n}from"./schemas-DCQXG11d.js";import{r}from"./CompositeRoot-CmHoR-Tk.js";function i(i){let{render:a,className:o,style:s,state:c=t,props:l=n,refs:u=n,metadata:d,stateAttributesMapping:f,tag:p=`div`,...m}=i,{compositeProps:h,compositeRef:g}=r({metadata:d});return e(p,i,{state:c,ref:[g,...u],props:[h,...l,m],stateAttributesMapping:f})}export{i as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/CompositeRoot-CmHoR-Tk.js

@@ -0,0 +1 @@
+import{r as e}from"./rolldown-runtime-XKyaHtl9.js";import{Ct as t,Et as n,It as r,Lt as i,Q as a,Tt as o,Z as s,et as c,kt as l,tt as u}from"./schemas-DCQXG11d.js";import{$ as d,_ as f,a as p,d as m,i as h,l as g,m as _,n as v,p as y,r as b,s as x,t as S,u as C,v as w}from"./composite-DysENEse.js";import{i as T,n as E,r as D,t as O}from"./isElementDisabled-B7Ri5ug6.js";var k=e(i(),1);function A(e={}){let{highlightItemOnHover:t,highlightedIndex:n,onHighlightedIndexChange:r}=a(),{ref:i,index:o}=E(e),s=n===o,c=k.useRef(null),u=l(i,c);return{compositeProps:{tabIndex:s?0:-1,onFocus(){r(o)},onMouseMove(){let e=c.current;if(!t||!e)return;let n=e.hasAttribute(`disabled`)||e.ariaDisabled===`true`;!s&&!n&&e.focus()}},compositeRef:u,index:o}}var j=`data-composite-item-active`;function M(e){let{loopFocus:t=!0,orientation:n=`both`,grid:r,onLoop:i,direction:a,highlightedIndex:s,onHighlightedIndexChange:x,rootRef:T,enableHomeAndEndKeys:E=!1,stopEventPropagation:D,disabledIndices:A,modifierKeys:j=o}=e,[M,F]=k.useState(0),I=r!=null,L=k.useRef(null),R=l(L,T),z=k.useRef([]),B=k.useRef(!1),V=k.useRef(null),H=s??M,U=u((e,t=!1)=>{if(V.current=z.current[e]??null,(x??F)(e),t){let t=z.current[e];C(L.current,t,a,n)}}),W=u(e=>{if(e.size===0)return;if(B.current){let e=z.current,t=e.indexOf(V.current);if(t===-1){let t=e[H];!t||w(e,H,A)?U(N(e,A)):V.current=t}else t!==H&&U(t);return}B.current=!0;let t=Array.from(e.keys()),r=t.find(e=>e?.hasAttribute(`data-composite-item-active`))??null,i=r?e.get(r)?.index??-1:-1;if(i!==-1)U(i);else if(w(t,H,A)){let e=m(t,{disabledIndices:A});f(t,e)||U(e)}C(L.current,r,a,n)});c(()=>{if(A==null||s!=null||!B.current)return;let e=z.current;if(w(e,H,A)){let t=m(e,{disabledIndices:A});f(e,t)||U(t)}},[A,s,H,z,U]);let G=u((e,t,n)=>i?i(e,t,n,z):n),K=u(e=>{let o=e.key===`Home`||e.key===`End`;if(!p.has(e.key)||!E&&o||P(e,j)||!L.current)return;let s=a===`rtl`,c=s?v:b,l=s?b:v,u=n===`vertical`?S:c,x=n===`vertical`?h:l,C=d(e.nativeEvent);if(C!=null&&g(C)&&!O(C)){let t=C.selectionStart,n=C.selectionEnd,r=C.value;if(t==null||e.shiftKey||t!==n||e.key!==x&&t<r.length||e.key!==u&&t>0)return}let w=H,T=_(z,A),k=y(z,A);r!=null&&(w=r({disabledIndices:A,elementsRef:z,event:e,highlightedIndex:H,loopFocus:t,maxIndex:k,minIndex:T,onLoop:G,orientation:n,rtl:s}));let M=n!==`vertical`&&e.key===c||n!==`horizontal`&&e.key===`ArrowDown`,N=n!==`vertical`&&e.key===l||n!==`horizontal`&&e.key===`ArrowUp`;E&&(e.key===`Home`?w=T:e.key===`End`&&(w=k)),w===H&&(M||N)&&(t&&w===k&&M?(w=T,i&&(w=i(e,H,w,z))):t&&w===T&&N?(w=k,i&&(w=i(e,H,w,z))):w=m(z.current,{startingIndex:w,decrement:N,disabledIndices:A})),w!==H&&!f(z.current,w)&&(D&&e.stopPropagation(),(I||o||M||N)&&e.preventDefault(),U(w,!0),queueMicrotask(()=>{z.current[w]?.focus()}))});return{props:{ref:R,onFocus(e){let t=L.current,n=d(e.nativeEvent);t&&n!=null&&g(n)&&n.setSelectionRange(0,n.value.length)},onKeyDown:K},highlightedIndex:H,onHighlightedIndexChange:U,elementsRef:z,onMapChange:W,relayKeyboardEvent:K}}function N(e,t){let n=-1;for(let r=0;r<e.length;r+=1){let i=e[r];if(i&&!w(e,r,t)){if(i.hasAttribute(`data-composite-item-active`))return r;n===-1&&(n=r)}}return Math.max(n,0)}function P(e,t){for(let n of x)if(!t.includes(n)&&e.getModifierState(n))return!0;return!1}var F=r();function I(e){let{render:r,className:i,style:a,refs:c=o,props:l=o,state:u=n,stateAttributesMapping:d,highlightedIndex:f,onHighlightedIndexChange:p,orientation:m,grid:h,loopFocus:g,onLoop:_,enableHomeAndEndKeys:v,onMapChange:y,stopEventPropagation:b=!0,rootRef:x,disabledIndices:S,modifierKeys:C,highlightItemOnHover:w=!1,tag:E=`div`,...O}=e,{props:A,highlightedIndex:j,onHighlightedIndexChange:N,elementsRef:P,onMapChange:I,relayKeyboardEvent:L}=M({grid:h,loopFocus:g,onLoop:_,orientation:m,highlightedIndex:f,onHighlightedIndexChange:p,rootRef:x,stopEventPropagation:b,enableHomeAndEndKeys:v,direction:T(),disabledIndices:S,modifierKeys:C}),R=t(E,e,{state:u,ref:c,props:[A,...l,O],stateAttributesMapping:d}),z=k.useMemo(()=>({highlightedIndex:j,onHighlightedIndexChange:N,highlightItemOnHover:w,relayKeyboardEvent:L}),[j,N,w,L]);return(0,F.jsx)(s.Provider,{value:z,children:(0,F.jsx)(D,{elementsRef:P,onMapChange:e=>{y?.(e),I(e)},children:R})})}export{j as n,A as r,I as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/Match-BpUvkIdT.js

@@ -1 +0,0 @@
-import{r as e}from"./rolldown-runtime-XKyaHtl9.js";import{Gt as t,Kt as n}from"./schemas-CKmbY8gV.js";import{i as r,p as i,r as a}from"./matchContext-C_cBF5rG.js";import{n as o}from"./x-BuYxxvoG.js";import{t as s}from"./useSelector-BuHlvrXV.js";var c=e(n(),1),l=t(),u=()=>!0,d=()=>!1;function f({children:e,fallback:t=null}){return(0,l.jsx)(c.Fragment,{children:p()?e:t})}function p(e=!0){return c.useSyncExternalStore(m,u,e?d:u)}function m(){return()=>{}}function h(e){let t=r(),n=`not-found-${s(t.stores.location,e=>e.pathname)}-${s(t.stores.status)}`;return(0,l.jsx)(o,{getResetKey:()=>n,onCatch:(t,n)=>{if(i(t))e.onCatch?.(t,n);else throw t},errorComponent:({error:t})=>{if(i(t))return e.fallback?.(t);throw t},children:e.children})}function g(){return(0,l.jsx)(`p`,{children:`Not Found`})}function _(e,t,n){return t.options.notFoundComponent?(0,l.jsx)(t.options.notFoundComponent,{...n}):e.options.defaultNotFoundComponent?(0,l.jsx)(e.options.defaultNotFoundComponent,{...n}):(0,l.jsx)(g,{})}function v(e,t){let n=t?.options.pendingComponent??e.options.defaultPendingComponent;return n?(0,l.jsx)(n,{}):null}var y=(e,t)=>e[0]===t[0]&&e[1]===t[1],b=(e,t,n)=>!t.isRoot||t.options.shellComponent||t.options.wrapInSuspense||n===!1||n===`data-only`||!e.ssr,x=c.memo(function({routeId:e}){let t=r(),n=t.stores.getMatchStore(e);return S(t,s(n))});function S(e,t){let n=e.routesById[t.routeId],r=v(e,n),s=n.options.errorComponent??e.options.defaultErrorComponent,u=n.options.onCatch??e.options.defaultOnCatch,d=n.isRoot?n.options.notFoundComponent??e.options.notFoundRoute?.options.component:n.options.notFoundComponent,p=t.ssr===!1||t.ssr===`data-only`,m=b(e,n,t.ssr)&&(n.options.wrapInSuspense??r??(n.options.errorComponent?.preload||p)),g=(0,l.jsx)(C,{match:t});p&&(g=(0,l.jsx)(f,{fallback:r,children:g})),d&&(g=(0,l.jsx)(h,{fallback:e=>{if(e.routeId??=t.routeId,e.routeId!==t.routeId)throw e;return c.createElement(d,e)},children:g})),s&&(g=(0,l.jsx)(o,{getResetKey:()=>t,errorComponent:s,onCatch:(e,n)=>{if(i(e))throw e.routeId??=t.routeId,e;u?.(e,n)},children:g})),m&&(g=(0,l.jsx)(c.Suspense,{fallback:r,children:g}));let _=n.isRoot&&n.options.shellComponent;return _?(0,l.jsx)(a.Provider,{value:t.routeId,children:(0,l.jsxs)(_,{children:[g,null]})}):(0,l.jsxs)(a.Provider,{value:t.routeId,children:[g,null]})}var C=c.memo(function({match:e}){let t=r(),n=e.routeId,i=t.routesById[n],a=c.useMemo(()=>{let r=(i.options.remountDeps??t.options.defaultRemountDeps)?.({routeId:n,loaderDeps:e.loaderDeps,params:e._strictParams,search:e._strictSearch});return r?JSON.stringify(r):void 0},[n,e.loaderDeps,e._strictParams,e._strictSearch,i.options.remountDeps,t.options.defaultRemountDeps]),o=c.useMemo(()=>{let e=i.options.component??t.options.defaultComponent;return e?(0,l.jsx)(e,{},a):(0,l.jsx)(w,{})},[a,i.options.component,t.options.defaultComponent]);if(e.status===`pending`){if(t.ssr&&!b(t,i,e.ssr))return o;if(t._tx)throw t._tx[5];return v(t,i)}if(e.status===`notFound`)return _(t,i,e.error);if(e.status===`error`)throw e.error;return o}),w=c.memo(function(){let e=r(),t=c.useContext(a),n,i,o;{let r=e.stores.getMatchStore(t);[n,i]=s(r,e=>[!!e._notFound,e.error],{compare:y}),o=s(e.stores.ids,e=>e[e.indexOf(t)+1])}if(n)return _(e,e.routesById[t],i);if(!o)return null;let u=(0,l.jsx)(x,{routeId:o});return t===`__root__`?(0,l.jsx)(c.Suspense,{fallback:v(e),children:u}):u});export{p as i,w as n,v as r,x as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/Match-DoMGE6F5.js

@@ -0,0 +1 @@
+import{r as e}from"./rolldown-runtime-XKyaHtl9.js";import{It as t,Lt as n}from"./schemas-DCQXG11d.js";import{d as r,r as i}from"./matchContext-CUAcfcYw.js";import{n as a}from"./x-mlA6pp-8.js";import{t as o}from"./useRouter-B_eSHXWd.js";import{t as s}from"./useSelector-CDb-n1FW.js";var c=e(n(),1),l=t(),u=()=>!0,d=()=>!1;function f({children:e,fallback:t=null}){return(0,l.jsx)(c.Fragment,{children:p()?e:t})}function p(e=!0){return c.useSyncExternalStore(m,u,e?d:u)}function m(){return()=>{}}function h(e){let t=o(),n=`not-found-${s(t.stores.location,e=>e.pathname)}-${s(t.stores.status)}`;return(0,l.jsx)(a,{getResetKey:()=>n,onCatch:(t,n)=>{if(r(t))e.onCatch?.(t,n);else throw t},errorComponent:({error:t})=>{if(r(t))return e.fallback?.(t);throw t},children:e.children})}function g(){return(0,l.jsx)(`p`,{children:`Not Found`})}function _(e,t,n){return t.options.notFoundComponent?(0,l.jsx)(t.options.notFoundComponent,{...n}):e.options.defaultNotFoundComponent?(0,l.jsx)(e.options.defaultNotFoundComponent,{...n}):(0,l.jsx)(g,{})}function v(e,t){let n=t?.options.pendingComponent??e.options.defaultPendingComponent;return n?(0,l.jsx)(n,{}):null}var y=(e,t)=>e[0]===t[0]&&e[1]===t[1],b=(e,t,n)=>!t.isRoot||t.options.shellComponent||t.options.wrapInSuspense||n===!1||n===`data-only`||!e.ssr,x=c.memo(function({routeId:e}){let t=o(),n=t.stores.getMatchStore(e);return S(t,s(n))});function S(e,t){let n=e.routesById[t.routeId],o=v(e,n),s=n.options.errorComponent??e.options.defaultErrorComponent,u=n.options.onCatch??e.options.defaultOnCatch,d=n.isRoot?n.options.notFoundComponent??e.options.notFoundRoute?.options.component:n.options.notFoundComponent,p=t.ssr===!1||t.ssr===`data-only`,m=b(e,n,t.ssr)&&(n.options.wrapInSuspense??o??(n.options.errorComponent?.preload||p)),g=(0,l.jsx)(C,{match:t});p&&(g=(0,l.jsx)(f,{fallback:o,children:g})),d&&(g=(0,l.jsx)(h,{fallback:e=>{if(e.routeId??=t.routeId,e.routeId!==t.routeId)throw e;return c.createElement(d,e)},children:g})),s&&(g=(0,l.jsx)(a,{getResetKey:()=>t,errorComponent:s,onCatch:(e,n)=>{if(r(e))throw e.routeId??=t.routeId,e;u?.(e,n)},children:g})),m&&(g=(0,l.jsx)(c.Suspense,{fallback:o,children:g}));let _=n.isRoot&&n.options.shellComponent;return _?(0,l.jsx)(i.Provider,{value:t.routeId,children:(0,l.jsxs)(_,{children:[g,null]})}):(0,l.jsxs)(i.Provider,{value:t.routeId,children:[g,null]})}var C=c.memo(function({match:e}){let t=o(),n=e.routeId,r=t.routesById[n],i=c.useMemo(()=>{let i=(r.options.remountDeps??t.options.defaultRemountDeps)?.({routeId:n,loaderDeps:e.loaderDeps,params:e._strictParams,search:e._strictSearch});return i?JSON.stringify(i):void 0},[n,e.loaderDeps,e._strictParams,e._strictSearch,r.options.remountDeps,t.options.defaultRemountDeps]),a=c.useMemo(()=>{let e=r.options.component??t.options.defaultComponent;return e?(0,l.jsx)(e,{},i):(0,l.jsx)(w,{})},[i,r.options.component,t.options.defaultComponent]);if(e.status===`pending`){if(t.ssr&&!b(t,r,e.ssr))return a;if(t._tx)throw t._tx[5];return v(t,r)}if(e.status===`notFound`)return _(t,r,e.error);if(e.status===`error`)throw e.error;return a}),w=c.memo(function(){let e=o(),t=c.useContext(i),n,r,a;{let i=e.stores.getMatchStore(t);[n,r]=s(i,e=>[!!e._notFound,e.error],{compare:y}),a=s(e.stores.ids,e=>e[e.indexOf(t)+1])}if(n)return _(e,e.routesById[t],r);if(!a)return null;let u=(0,l.jsx)(x,{routeId:a});return t===`__root__`?(0,l.jsx)(c.Suspense,{fallback:v(e),children:u}):u});export{p as i,w as n,v as r,x as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/QueryClientProvider-BuG40HBe.js

@@ -1 +1 @@
-import{r as e}from"./rolldown-runtime-XKyaHtl9.js";import{Gt as t,Kt as n}from"./schemas-CKmbY8gV.js";var r=e(n(),1),i=t(),a=r.createContext(void 0),o=e=>{let t=r.useContext(a);if(e)return e;if(!t)throw Error(`No QueryClient set, use QueryClientProvider to set one`);return t},s=({client:e,children:t})=>(r.useEffect(()=>(e.mount(),()=>{e.unmount()}),[e]),(0,i.jsx)(a.Provider,{value:e,children:t}));export{o as n,s as t};
+import{r as e}from"./rolldown-runtime-XKyaHtl9.js";import{It as t,Lt as n}from"./schemas-DCQXG11d.js";var r=e(n(),1),i=t(),a=r.createContext(void 0),o=e=>{let t=r.useContext(a);if(e)return e;if(!t)throw Error(`No QueryClient set, use QueryClientProvider to set one`);return t},s=({client:e,children:t})=>(r.useEffect(()=>(e.mount(),()=>{e.unmount()}),[e]),(0,i.jsx)(a.Provider,{value:e,children:t}));export{o as n,s as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/ToolbarRootContext-iMMgkc2r.js

@@ -0,0 +1 @@
+import{r as e}from"./rolldown-runtime-XKyaHtl9.js";import{$ as t,Lt as n}from"./schemas-DCQXG11d.js";var r=e(n(),1),i=r.createContext(void 0);function a(e){let n=r.useContext(i);if(n===void 0&&!e)throw Error(t(69));return n}export{a as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_-7KkIsFVy.js

@@ -1 +0,0 @@
-import{Gt as e,Vt as t,Y as n}from"./schemas-CKmbY8gV.js";import{t as r}from"./object-browser-D7yr9rgb.js";import{t as i}from"./_-CFb8JFvm.js";var a=t(),o=e();function s(){let e=(0,a.c)(10),{bucket:t,_splat:s}=i.useParams(),c=s??``,l;e[0]===c?l=e[1]:(l=n(c),e[0]=c,e[1]=l);let u=l,d=i.useSearch(),f=i.useNavigate(),p;e[2]===f?p=e[3]:(p=function(e){f({search:t=>({...t,...e}),replace:!(`selected`in e)})},e[2]=f,e[3]=p);let m=p,h=`${t}/${u}`,g;return e[4]!==t||e[5]!==u||e[6]!==m||e[7]!==d||e[8]!==h?(g=(0,o.jsx)(r,{bucket:t,folder:u,onSearchChange:m,search:d},h),e[4]=t,e[5]=u,e[6]=m,e[7]=d,e[8]=h,e[9]=g):g=e[9],g}export{s as component};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_-CFb8JFvm.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_-7KkIsFVy.js","assets/schemas-CKmbY8gV.js","assets/rolldown-runtime-XKyaHtl9.js","assets/object-browser-D7yr9rgb.js","assets/QueryClientProvider-B3gFFx5-.js","assets/queryOptions-C3LOV3Yq.js","assets/useQuery-DgGWYOhJ.js","assets/lazyRouteComponent-BIOh5GOe.js","assets/matchContext-C_cBF5rG.js","assets/link-CoQQT1u0.js","assets/useSelector-BuHlvrXV.js","assets/data-table-D9AZRPew.js","assets/visuallyHidden-Di6ozTl7.js","assets/check-BURgRfkZ.js","assets/useRegisterFieldControl-BpMxH-yS.js","assets/useAriaLabelledBy-C1btqlkM.js","assets/useControlled-CliDS5IQ.js","assets/table-Br7RGWB8.js","assets/error-banner-6H_aBcIY.js","assets/chevron-right-BaqRZN6V.js","assets/upload-CUlCi7gE.js","assets/sliders-horizontal-B4nfPbkq.js","assets/detail-panel-BUy-SsXi.js","assets/x-BuYxxvoG.js","assets/chevron-down-CiWCIUx5.js","assets/copy-Clj54gC8.js","assets/loader-circle-BWw23_DY.js","assets/useScrollLock-tbqBjaVX.js","assets/useValueAsRef-DtjtqpoE.js","assets/ToolbarRootContext-CPQMf91l.js","assets/isElementDisabled-DwizONlP.js","assets/store-Dx1XhYcs.js","assets/collapsible-NKtgkvXc.js","assets/tabs-C7-u1MlW.js","assets/use-copy-to-clipboard-B2jqkkCP.js","assets/input-group-CdRkywl6.js","assets/field-D45t5nwl.js","assets/textarea-DjPTve3M.js","assets/trash-DU2S79Q3.js","assets/uploads-ypeWSAfE.js","assets/awsClient-Da_1PWK9.js","assets/auth-LWMosi88.js","assets/index.browser-BEm-79SP.js","assets/s3-GemFNNG4.js","assets/useMutation-0VvC4-D7.js","assets/s3-e8hHPZ7C.js","assets/page-heading-DOCwCs80.js","assets/resource-view-RaCpeI0k.js","assets/selection-bar-Bb4fd2ci.js","assets/use-row-selection-DGXO__u7.js","assets/bulk-delete-CdjUpmX4.js","assets/circle-x-YQRHw4rt.js","assets/alert-dialog-B2wM6M0p.js","assets/DialogTitle-BlGk2Olt.js","assets/confirm-phrase-HKyrGgCW.js","assets/resource-delete-dialog-DB-hXwnM.js","assets/delete-confirmation-dialog-khwGiTUy.js"])))=>i.map(i=>d[i]);
-import{Y as e,s as t}from"./schemas-CKmbY8gV.js";import{n,t as r}from"./lazyRouteComponent-BIOh5GOe.js";import{t as i}from"./searchMiddleware-CN1kfGOC.js";import{f as a,p as o}from"./detail-panel-BUy-SsXi.js";import{Mo as s}from"./awsClient-Da_1PWK9.js";import{t as c}from"./s3-e8hHPZ7C.js";var l=n(`/_auth/s3/ls/$bucket/$`)({validateSearch:t(o),search:{middlewares:[i(a)]},loader:async({context:t,params:n})=>{await t.queryClient.query({...c(n.bucket,e(n._splat??``)),staleTime:`static`})},head:({params:t})=>({meta:[{title:`${t.bucket}/${e(t._splat??``)} | Object Storage | Mulga`}]}),component:r(()=>s(()=>import(`./_-7KkIsFVy.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56])),`component`)});export{l as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_-EgUy8iPZ.js

@@ -0,0 +1 @@
+import{B as e,It as t,Mt as n}from"./schemas-DCQXG11d.js";import{t as r}from"./object-browser-D2G7ChbT.js";import{t as i}from"./_-jsAX0S-n.js";var a=n(),o=t();function s(){let t=(0,a.c)(10),{bucket:n,_splat:s}=i.useParams(),c=s??``,l;t[0]===c?l=t[1]:(l=e(c),t[0]=c,t[1]=l);let u=l,d=i.useSearch(),f=i.useNavigate(),p;t[2]===f?p=t[3]:(p=function(e){f({search:t=>({...t,...e}),replace:!(`selected`in e)})},t[2]=f,t[3]=p);let m=p,h=`${n}/${u}`,g;return t[4]!==n||t[5]!==u||t[6]!==m||t[7]!==d||t[8]!==h?(g=(0,o.jsx)(r,{bucket:n,folder:u,onSearchChange:m,search:d},h),t[4]=n,t[5]=u,t[6]=m,t[7]=d,t[8]=h,t[9]=g):g=t[9],g}export{s as component};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_-jsAX0S-n.js

@@ -0,0 +1,2 @@
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_-EgUy8iPZ.js","assets/schemas-DCQXG11d.js","assets/rolldown-runtime-XKyaHtl9.js","assets/object-browser-D2G7ChbT.js","assets/QueryClientProvider-BuG40HBe.js","assets/queryOptions-Cu2lvOFG.js","assets/useQuery-D6TojLgI.js","assets/link-BX-1BPor.js","assets/matchContext-CUAcfcYw.js","assets/useRouter-B_eSHXWd.js","assets/data-table-9n7xOy9s.js","assets/useSelector-CDb-n1FW.js","assets/visuallyHidden-BHQz5bmH.js","assets/check-DPoQ9cBn.js","assets/useRegisterFieldControl-DkI655of.js","assets/useAriaLabelledBy-DStQJVTn.js","assets/useTransitionStatus-Dn-09Anc.js","assets/useValueChanged-wii0yYWk.js","assets/useControlled-NIWPmeG5.js","assets/table-BLvCYTga.js","assets/useNavigate-cMdr_EJ0.js","assets/chevron-right-DZULbaNT.js","assets/upload-uiiRWdV_.js","assets/eye-yi4wz0yh.js","assets/input-group-TEGNx6dm.js","assets/useValueAsRef-uzS1fuI8.js","assets/field-iLG94M00.js","assets/textarea-BG1iGvVs.js","assets/sliders-horizontal-DsGbsnBU.js","assets/trash-BajuWzqn.js","assets/detail-panel-DLM1ExsZ.js","assets/x-mlA6pp-8.js","assets/info-tip-Cxa2GEOd.js","assets/useScrollLock-iGnmnC-h.js","assets/composite-DysENEse.js","assets/useAnchoredPopupScrollLock-CoHshdlQ.js","assets/isElementDisabled-B7Ri5ug6.js","assets/store-BVhNJayb.js","assets/ToolbarRootContext-iMMgkc2r.js","assets/chevron-down-BgudX6bq.js","assets/copy-B9ICxw_u.js","assets/loader-circle-C7EgoGp_.js","assets/collapsible-DddM174D.js","assets/tabs-9tHEWpNn.js","assets/CompositeRoot-CmHoR-Tk.js","assets/panel-search-LDLf8HCe.js","assets/error-banner-Cahg3Ix2.js","assets/use-copy-to-clipboard-D-PxomFK.js","assets/uploads-BF3vgNvM.js","assets/awsClient-BvDfQdL8.js","assets/auth-BS4WytAe.js","assets/fetch-http-handler-B--F8e2N.js","assets/toUtf8.browser-RsrLknAJ.js","assets/index.browser-D7GVEViY.js","assets/s3-Dw9Wbkov.js","assets/useMutation-lRi0DDcO.js","assets/s3-C7kuNeMZ.js","assets/page-heading-ZfrnK2wu.js","assets/resource-view-CPdFr_3k.js","assets/selection-bar-WnknBhRB.js","assets/use-row-selection-DB6L9NiD.js","assets/bulk-delete-CXIUB03J.js","assets/circle-x-C6c0uvb-.js","assets/alert-dialog-D9jG-rkO.js","assets/DialogTitle-nAIOTphJ.js","assets/confirm-phrase-C4Dux-0Y.js","assets/resource-delete-dialog-D3NYuO-k.js","assets/delete-confirmation-dialog-O7cqOW0Y.js"])))=>i.map(i=>d[i]);
+import{B as e,s as t}from"./schemas-DCQXG11d.js";import{n,t as r}from"./lazyRouteComponent-PMetaA3O.js";import{t as i}from"./searchMiddleware-Clk50hy1.js";import{U as a}from"./fetch-http-handler-B--F8e2N.js";import{t as o}from"./s3-C7kuNeMZ.js";import{r as s,t as c}from"./panel-search-LDLf8HCe.js";var l=n(`/_auth/s3/ls/$bucket/$`)({validateSearch:t(s),search:{middlewares:[i(c)]},loader:async({context:t,params:n})=>{await t.queryClient.query({...o(n.bucket,e(n._splat??``)),staleTime:`static`})},head:({params:t})=>({meta:[{title:`${t.bucket}/${e(t._splat??``)} | Object Storage | Mulga`}]}),component:r(()=>a(()=>import(`./_-EgUy8iPZ.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67])),`component`)});export{l as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_bucket-3kFDB96F.js

@@ -1 +1 @@
-import{Gt as e,Vt as t}from"./schemas-CKmbY8gV.js";import{t as n}from"./object-browser-D7yr9rgb.js";import{t as r}from"./_bucket-DJ9W9e9C.js";var i=t(),a=e();function o(){let e=(0,i.c)(6),{bucket:t}=r.useParams(),o=r.useSearch(),s=r.useNavigate(),c;e[0]===s?c=e[1]:(c=function(e){s({search:t=>({...t,...e}),replace:!(`selected`in e)})},e[0]=s,e[1]=c);let l=c,u;return e[2]!==t||e[3]!==l||e[4]!==o?(u=(0,a.jsx)(n,{bucket:t,folder:``,onSearchChange:l,search:o},t),e[2]=t,e[3]=l,e[4]=o,e[5]=u):u=e[5],u}export{o as component};
+import{It as e,Mt as t}from"./schemas-DCQXG11d.js";import{t as n}from"./object-browser-D2G7ChbT.js";import{t as r}from"./_bucket-aGUJujUa.js";var i=t(),a=e();function o(){let e=(0,i.c)(6),{bucket:t}=r.useParams(),o=r.useSearch(),s=r.useNavigate(),c;e[0]===s?c=e[1]:(c=function(e){s({search:t=>({...t,...e}),replace:!(`selected`in e)})},e[0]=s,e[1]=c);let l=c,u;return e[2]!==t||e[3]!==l||e[4]!==o?(u=(0,a.jsx)(n,{bucket:t,folder:``,onSearchChange:l,search:o},t),e[2]=t,e[3]=l,e[4]=o,e[5]=u):u=e[5],u}export{o as component};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_bucket-DJ9W9e9C.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_bucket-ButZaAoi.js","assets/schemas-CKmbY8gV.js","assets/rolldown-runtime-XKyaHtl9.js","assets/object-browser-D7yr9rgb.js","assets/QueryClientProvider-B3gFFx5-.js","assets/queryOptions-C3LOV3Yq.js","assets/useQuery-DgGWYOhJ.js","assets/lazyRouteComponent-BIOh5GOe.js","assets/matchContext-C_cBF5rG.js","assets/link-CoQQT1u0.js","assets/useSelector-BuHlvrXV.js","assets/data-table-D9AZRPew.js","assets/visuallyHidden-Di6ozTl7.js","assets/check-BURgRfkZ.js","assets/useRegisterFieldControl-BpMxH-yS.js","assets/useAriaLabelledBy-C1btqlkM.js","assets/useControlled-CliDS5IQ.js","assets/table-Br7RGWB8.js","assets/error-banner-6H_aBcIY.js","assets/chevron-right-BaqRZN6V.js","assets/upload-CUlCi7gE.js","assets/sliders-horizontal-B4nfPbkq.js","assets/detail-panel-BUy-SsXi.js","assets/x-BuYxxvoG.js","assets/chevron-down-CiWCIUx5.js","assets/copy-Clj54gC8.js","assets/loader-circle-BWw23_DY.js","assets/useScrollLock-tbqBjaVX.js","assets/useValueAsRef-DtjtqpoE.js","assets/ToolbarRootContext-CPQMf91l.js","assets/isElementDisabled-DwizONlP.js","assets/store-Dx1XhYcs.js","assets/collapsible-NKtgkvXc.js","assets/tabs-C7-u1MlW.js","assets/use-copy-to-clipboard-B2jqkkCP.js","assets/input-group-CdRkywl6.js","assets/field-D45t5nwl.js","assets/textarea-DjPTve3M.js","assets/trash-DU2S79Q3.js","assets/uploads-ypeWSAfE.js","assets/awsClient-Da_1PWK9.js","assets/auth-LWMosi88.js","assets/index.browser-BEm-79SP.js","assets/s3-GemFNNG4.js","assets/useMutation-0VvC4-D7.js","assets/s3-e8hHPZ7C.js","assets/page-heading-DOCwCs80.js","assets/resource-view-RaCpeI0k.js","assets/selection-bar-Bb4fd2ci.js","assets/use-row-selection-DGXO__u7.js","assets/bulk-delete-CdjUpmX4.js","assets/circle-x-YQRHw4rt.js","assets/alert-dialog-B2wM6M0p.js","assets/DialogTitle-BlGk2Olt.js","assets/confirm-phrase-HKyrGgCW.js","assets/resource-delete-dialog-DB-hXwnM.js","assets/delete-confirmation-dialog-khwGiTUy.js"])))=>i.map(i=>d[i]);
-import{s as e}from"./schemas-CKmbY8gV.js";import{n as t,t as n}from"./lazyRouteComponent-BIOh5GOe.js";import{t as r}from"./searchMiddleware-CN1kfGOC.js";import{f as i,p as a}from"./detail-panel-BUy-SsXi.js";import{Mo as o}from"./awsClient-Da_1PWK9.js";import{t as s}from"./s3-e8hHPZ7C.js";var c=t(`/_auth/s3/ls/$bucket/`)({validateSearch:e(a),search:{middlewares:[r(i)]},loader:async({context:e,params:t})=>{await e.queryClient.query({...s(t.bucket,``),staleTime:`static`})},head:({params:e})=>({meta:[{title:`${e.bucket} | Object Storage | Mulga`}]}),component:n(()=>o(()=>import(`./_bucket-ButZaAoi.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56])),`component`)});export{c as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_bucket-aGUJujUa.js

@@ -0,0 +1,2 @@
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_bucket-3kFDB96F.js","assets/schemas-DCQXG11d.js","assets/rolldown-runtime-XKyaHtl9.js","assets/object-browser-D2G7ChbT.js","assets/QueryClientProvider-BuG40HBe.js","assets/queryOptions-Cu2lvOFG.js","assets/useQuery-D6TojLgI.js","assets/link-BX-1BPor.js","assets/matchContext-CUAcfcYw.js","assets/useRouter-B_eSHXWd.js","assets/data-table-9n7xOy9s.js","assets/useSelector-CDb-n1FW.js","assets/visuallyHidden-BHQz5bmH.js","assets/check-DPoQ9cBn.js","assets/useRegisterFieldControl-DkI655of.js","assets/useAriaLabelledBy-DStQJVTn.js","assets/useTransitionStatus-Dn-09Anc.js","assets/useValueChanged-wii0yYWk.js","assets/useControlled-NIWPmeG5.js","assets/table-BLvCYTga.js","assets/useNavigate-cMdr_EJ0.js","assets/chevron-right-DZULbaNT.js","assets/upload-uiiRWdV_.js","assets/eye-yi4wz0yh.js","assets/input-group-TEGNx6dm.js","assets/useValueAsRef-uzS1fuI8.js","assets/field-iLG94M00.js","assets/textarea-BG1iGvVs.js","assets/sliders-horizontal-DsGbsnBU.js","assets/trash-BajuWzqn.js","assets/detail-panel-DLM1ExsZ.js","assets/x-mlA6pp-8.js","assets/info-tip-Cxa2GEOd.js","assets/useScrollLock-iGnmnC-h.js","assets/composite-DysENEse.js","assets/useAnchoredPopupScrollLock-CoHshdlQ.js","assets/isElementDisabled-B7Ri5ug6.js","assets/store-BVhNJayb.js","assets/ToolbarRootContext-iMMgkc2r.js","assets/chevron-down-BgudX6bq.js","assets/copy-B9ICxw_u.js","assets/loader-circle-C7EgoGp_.js","assets/collapsible-DddM174D.js","assets/tabs-9tHEWpNn.js","assets/CompositeRoot-CmHoR-Tk.js","assets/panel-search-LDLf8HCe.js","assets/error-banner-Cahg3Ix2.js","assets/use-copy-to-clipboard-D-PxomFK.js","assets/uploads-BF3vgNvM.js","assets/awsClient-BvDfQdL8.js","assets/auth-BS4WytAe.js","assets/fetch-http-handler-B--F8e2N.js","assets/toUtf8.browser-RsrLknAJ.js","assets/index.browser-D7GVEViY.js","assets/s3-Dw9Wbkov.js","assets/useMutation-lRi0DDcO.js","assets/s3-C7kuNeMZ.js","assets/page-heading-ZfrnK2wu.js","assets/resource-view-CPdFr_3k.js","assets/selection-bar-WnknBhRB.js","assets/use-row-selection-DB6L9NiD.js","assets/bulk-delete-CXIUB03J.js","assets/circle-x-C6c0uvb-.js","assets/alert-dialog-D9jG-rkO.js","assets/DialogTitle-nAIOTphJ.js","assets/confirm-phrase-C4Dux-0Y.js","assets/resource-delete-dialog-D3NYuO-k.js","assets/delete-confirmation-dialog-O7cqOW0Y.js"])))=>i.map(i=>d[i]);
+import{s as e}from"./schemas-DCQXG11d.js";import{n as t,t as n}from"./lazyRouteComponent-PMetaA3O.js";import{t as r}from"./searchMiddleware-Clk50hy1.js";import{U as i}from"./fetch-http-handler-B--F8e2N.js";import{t as a}from"./s3-C7kuNeMZ.js";import{r as o,t as s}from"./panel-search-LDLf8HCe.js";var c=t(`/_auth/s3/ls/$bucket/`)({validateSearch:e(o),search:{middlewares:[r(s)]},loader:async({context:e,params:t})=>{await e.queryClient.query({...a(t.bucket,``),staleTime:`static`})},head:({params:e})=>({meta:[{title:`${e.bucket} | Object Storage | Mulga`}]}),component:n(()=>i(()=>import(`./_bucket-3kFDB96F.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67])),`component`)});export{c as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_clusterName-BGH9f9jv.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_clusterName-Bz2ox1A8.js","assets/schemas-CKmbY8gV.js","assets/rolldown-runtime-XKyaHtl9.js","assets/cluster-details-9mUgBIvg.js","assets/select-DEWJs_zZ.js","assets/visuallyHidden-Di6ozTl7.js","assets/check-BURgRfkZ.js","assets/chevron-down-CiWCIUx5.js","assets/useScrollLock-tbqBjaVX.js","assets/useValueAsRef-DtjtqpoE.js","assets/useRegisterFieldControl-BpMxH-yS.js","assets/useControlled-CliDS5IQ.js","assets/ToolbarRootContext-CPQMf91l.js","assets/isElementDisabled-DwizONlP.js","assets/clamp-D0kAXd-u.js","assets/QueryClientProvider-B3gFFx5-.js","assets/useMutation-0VvC4-D7.js","assets/queryOptions-C3LOV3Yq.js","assets/useQuery-DgGWYOhJ.js","assets/useSuspenseQuery-CfG96AGi.js","assets/link-CoQQT1u0.js","assets/matchContext-C_cBF5rG.js","assets/error-banner-6H_aBcIY.js","assets/circle-arrow-up-DPplcU0J.js","assets/sliders-horizontal-B4nfPbkq.js","assets/detail-panel-BUy-SsXi.js","assets/x-BuYxxvoG.js","assets/copy-Clj54gC8.js","assets/loader-circle-BWw23_DY.js","assets/store-Dx1XhYcs.js","assets/collapsible-NKtgkvXc.js","assets/tabs-C7-u1MlW.js","assets/use-copy-to-clipboard-B2jqkkCP.js","assets/maximize-2-N7ntOlKC.js","assets/plus-hsII00cK.js","assets/cli-command-panel-Bbgu_PHE.js","assets/trash-DU2S79Q3.js","assets/triangle-alert-DOQ-ERJ6.js","assets/field-D45t5nwl.js","assets/auth-LWMosi88.js","assets/awsClient-Da_1PWK9.js","assets/index.browser-BEm-79SP.js","assets/ec2-BL5MCjb2.js","assets/eks-Bewuh5MW.js","assets/iam-Cd60dYHn.js","assets/json-BYhzhOil.js","assets/delete-confirmation-dialog-khwGiTUy.js","assets/alert-dialog-B2wM6M0p.js","assets/DialogTitle-BlGk2Olt.js","assets/confirm-phrase-HKyrGgCW.js","assets/state-badge-60FZam9q.js","assets/subnet-calculator-DDrAb5xp.js","assets/form-lock-ETWruSvZ.js","assets/form-panel-FvMLLm-S.js","assets/gpu-instance-type-select-DJI4N_hg.js","assets/index.esm-BQMPsB0n.js","assets/zod-BWB4pUhT.js","assets/switch-list-5HWTHr5V.js","assets/switch-ARpklVus.js","assets/useAriaLabelledBy-C1btqlkM.js","assets/badge-Cq9eeDnq.js","assets/useRender-vkaUf9E1.js","assets/form-fields-Dz0ldQ7r.js","assets/json-editor-oM4Sz7Jd.js","assets/textarea-DjPTve3M.js"])))=>i.map(i=>d[i]);
-import{s as e}from"./schemas-CKmbY8gV.js";import{n as t,t as n}from"./lazyRouteComponent-BIOh5GOe.js";import{t as r}from"./searchMiddleware-CN1kfGOC.js";import{p as i}from"./detail-panel-BUy-SsXi.js";import{Mo as a}from"./awsClient-Da_1PWK9.js";import{s as o,t as s,u as c}from"./eks-Bewuh5MW.js";var l=t(`/_auth/eks/(clusters)/list-clusters/$clusterName`)({validateSearch:e({tab:i.tab}),search:{middlewares:[r({tab:`overview`})]},loader:async({context:e,params:t})=>{await Promise.all([e.queryClient.query({...o(t.clusterName),staleTime:`static`}),e.queryClient.query({...c(t.clusterName),staleTime:`static`}),e.queryClient.query({...s(t.clusterName),staleTime:`static`})])},head:({params:e})=>({meta:[{title:`${e.clusterName} | EKS | Mulga`}]}),component:n(()=>a(()=>import(`./_clusterName-Bz2ox1A8.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64])),`component`)});export{l as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_clusterName-BYyd5uEn.js

@@ -1 +1 @@
-import{Gt as e,Vt as t}from"./schemas-CKmbY8gV.js";import{t as n}from"./cluster-details-9mUgBIvg.js";import{t as r}from"./_clusterName-BGH9f9jv.js";var i=t(),a=e();function o(){let e=(0,i.c)(8),{clusterName:t}=r.useParams(),{tab:o}=r.useSearch(),s=r.useNavigate(),c,l;e[0]===s?(c=e[1],l=e[2]):(c=()=>{s({to:`/eks/list-clusters`})},l=e=>{s({search:{tab:e},replace:!0})},e[0]=s,e[1]=c,e[2]=l);let u;return e[3]!==t||e[4]!==c||e[5]!==l||e[6]!==o?(u=(0,a.jsx)(n,{clusterName:t,layout:`page`,onClose:c,onTabChange:l,tab:o}),e[3]=t,e[4]=c,e[5]=l,e[6]=o,e[7]=u):u=e[7],u}export{o as component};
+import{It as e,Mt as t}from"./schemas-DCQXG11d.js";import{t as n}from"./cluster-details-1bW7KNv3.js";import{t as r}from"./_clusterName-b030G2HU.js";var i=t(),a=e();function o(){let e=(0,i.c)(8),{clusterName:t}=r.useParams(),{tab:o}=r.useSearch(),s=r.useNavigate(),c,l;e[0]===s?(c=e[1],l=e[2]):(c=()=>{s({to:`/eks/list-clusters`})},l=e=>{s({search:{tab:e},replace:!0})},e[0]=s,e[1]=c,e[2]=l);let u;return e[3]!==t||e[4]!==c||e[5]!==l||e[6]!==o?(u=(0,a.jsx)(n,{clusterName:t,layout:`page`,onClose:c,onTabChange:l,tab:o}),e[3]=t,e[4]=c,e[5]=l,e[6]=o,e[7]=u):u=e[7],u}export{o as component};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_clusterName-CF57bBZp.js

@@ -0,0 +1,2 @@
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_clusterName-IhxHlZV4.js","assets/schemas-DCQXG11d.js","assets/rolldown-runtime-XKyaHtl9.js","assets/useSuspenseQuery--dusmE-Q.js","assets/queryOptions-Cu2lvOFG.js","assets/QueryClientProvider-BuG40HBe.js","assets/ecs-D2Xj5Fk-.js","assets/awsClient-BvDfQdL8.js","assets/auth-BS4WytAe.js","assets/fetch-http-handler-B--F8e2N.js","assets/toUtf8.browser-RsrLknAJ.js","assets/index.browser-D7GVEViY.js","assets/commandBuilder-Bb9dqTZ7.js","assets/back-link-B8ejy5Fm.js","assets/link-BX-1BPor.js","assets/matchContext-CUAcfcYw.js","assets/useRouter-B_eSHXWd.js","assets/info-tip-Cxa2GEOd.js","assets/visuallyHidden-BHQz5bmH.js","assets/useScrollLock-iGnmnC-h.js","assets/useValueAsRef-uzS1fuI8.js","assets/useTransitionStatus-Dn-09Anc.js","assets/composite-DysENEse.js","assets/useAnchoredPopupScrollLock-CoHshdlQ.js","assets/useValueChanged-wii0yYWk.js","assets/isElementDisabled-B7Ri5ug6.js","assets/store-BVhNJayb.js","assets/ToolbarRootContext-iMMgkc2r.js","assets/cluster-details-B8veXcs_.js","assets/select-UwOVJofC.js","assets/check-DPoQ9cBn.js","assets/chevron-down-BgudX6bq.js","assets/useRegisterFieldControl-DkI655of.js","assets/useControlled-NIWPmeG5.js","assets/clamp-D0kAXd-u.js","assets/useQuery-D6TojLgI.js","assets/eye-yi4wz0yh.js","assets/maximize-2-BAlKoEj8.js","assets/play-qJowxtRp.js","assets/plus-BK_7eO_G.js","assets/server-D03m5B1l.js","assets/sliders-horizontal-DsGbsnBU.js","assets/cli-command-panel-Do14gxB9.js","assets/copy-B9ICxw_u.js","assets/use-copy-to-clipboard-D-PxomFK.js","assets/trash-BajuWzqn.js","assets/field-iLG94M00.js","assets/detail-panel-DLM1ExsZ.js","assets/x-mlA6pp-8.js","assets/loader-circle-C7EgoGp_.js","assets/collapsible-DddM174D.js","assets/tabs-9tHEWpNn.js","assets/CompositeRoot-CmHoR-Tk.js","assets/panel-search-LDLf8HCe.js","assets/error-banner-Cahg3Ix2.js","assets/ec2-C2FdJaHg.js","assets/commandBuilder-D7SsohHF.js","assets/ecs-iecx1cKL.js","assets/useMutation-lRi0DDcO.js","assets/signed-fetch-BqrfDScu.js","assets/delete-confirmation-dialog-O7cqOW0Y.js","assets/alert-dialog-D9jG-rkO.js","assets/DialogTitle-nAIOTphJ.js","assets/confirm-phrase-C4Dux-0Y.js","assets/state-badge-CQPRxt3J.js","assets/resource-tags-CGeRAZrb.js","assets/tags-BVcAJWuE.js","assets/commandBuilder-CfqGUk7K.js","assets/commandBuilder-CV-6DENN.js","assets/inline-tags-nfRc9elZ.js","assets/pencil-DLzYMCIc.js","assets/form-lock-D8Cu0Sfu.js","assets/form-panel-CtjudV7b.js","assets/gpu-instance-type-select-DsB5oPSo.js","assets/system-managed-Dk7ySh_E.js","assets/panel-list-ChJfng6E.js","assets/system-image-required-BJr-Ejzz.js","assets/rotate-cw-DhHI5fTM.js","assets/triangle-alert-Ckml5FoO.js","assets/stop-task-dialog-C0_MtdlP.js"])))=>i.map(i=>d[i]);
+import{s as e}from"./schemas-DCQXG11d.js";import{n as t,t as n}from"./lazyRouteComponent-PMetaA3O.js";import{t as r}from"./searchMiddleware-Clk50hy1.js";import{U as i}from"./fetch-http-handler-B--F8e2N.js";import{i as a,s as o,t as s}from"./ecs-D2Xj5Fk-.js";import{r as c}from"./panel-search-LDLf8HCe.js";var l=t(`/_auth/ecs/(clusters)/list-clusters/$clusterName`)({validateSearch:e({tab:c.tab}),search:{middlewares:[r({tab:`overview`})]},loader:async({context:e,params:t})=>{await Promise.all([e.queryClient.query({...s(t.clusterName),staleTime:`static`}),e.queryClient.query({...a(t.clusterName),staleTime:`static`}),e.queryClient.query({...o(t.clusterName),staleTime:`static`})])},head:({params:e})=>({meta:[{title:`${e.clusterName} | ECS | Mulga`}]}),component:n(()=>i(()=>import(`./_clusterName-IhxHlZV4.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79])),`component`)});export{l as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_clusterName-DPQe-y79.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_clusterName-PGXuLpFG.js","assets/schemas-CKmbY8gV.js","assets/rolldown-runtime-XKyaHtl9.js","assets/useSuspenseQuery-CfG96AGi.js","assets/queryOptions-C3LOV3Yq.js","assets/QueryClientProvider-B3gFFx5-.js","assets/ecs-B4PUYbCf.js","assets/awsClient-Da_1PWK9.js","assets/auth-LWMosi88.js","assets/index.browser-BEm-79SP.js","assets/back-link-CxXZw47s.js","assets/link-CoQQT1u0.js","assets/matchContext-C_cBF5rG.js","assets/error-banner-6H_aBcIY.js","assets/visuallyHidden-Di6ozTl7.js","assets/cluster-details-CBeOlQb_.js","assets/select-DEWJs_zZ.js","assets/check-BURgRfkZ.js","assets/chevron-down-CiWCIUx5.js","assets/useScrollLock-tbqBjaVX.js","assets/useValueAsRef-DtjtqpoE.js","assets/useRegisterFieldControl-BpMxH-yS.js","assets/useControlled-CliDS5IQ.js","assets/ToolbarRootContext-CPQMf91l.js","assets/isElementDisabled-DwizONlP.js","assets/clamp-D0kAXd-u.js","assets/useQuery-DgGWYOhJ.js","assets/sliders-horizontal-B4nfPbkq.js","assets/detail-panel-BUy-SsXi.js","assets/x-BuYxxvoG.js","assets/copy-Clj54gC8.js","assets/loader-circle-BWw23_DY.js","assets/store-Dx1XhYcs.js","assets/collapsible-NKtgkvXc.js","assets/tabs-C7-u1MlW.js","assets/use-copy-to-clipboard-B2jqkkCP.js","assets/maximize-2-N7ntOlKC.js","assets/play-DKnIFJgX.js","assets/plus-hsII00cK.js","assets/server-HG9g5czd.js","assets/cli-command-panel-Bbgu_PHE.js","assets/trash-DU2S79Q3.js","assets/field-D45t5nwl.js","assets/ec2-BL5MCjb2.js","assets/ecs-Du4d90q-.js","assets/useMutation-0VvC4-D7.js","assets/signed-fetch-DutYaOyQ.js","assets/delete-confirmation-dialog-khwGiTUy.js","assets/alert-dialog-B2wM6M0p.js","assets/DialogTitle-BlGk2Olt.js","assets/confirm-phrase-HKyrGgCW.js","assets/state-badge-60FZam9q.js","assets/form-lock-ETWruSvZ.js","assets/form-panel-FvMLLm-S.js","assets/gpu-instance-type-select-DJI4N_hg.js","assets/system-managed-Dk7ySh_E.js","assets/panel-list-BXltOhHx.js","assets/system-image-required-CWswR3An.js","assets/rotate-cw-D7aE4Xve.js","assets/triangle-alert-DOQ-ERJ6.js","assets/stop-task-dialog-Y2qFyyMV.js"])))=>i.map(i=>d[i]);
-import{s as e}from"./schemas-CKmbY8gV.js";import{n as t,t as n}from"./lazyRouteComponent-BIOh5GOe.js";import{t as r}from"./searchMiddleware-CN1kfGOC.js";import{p as i}from"./detail-panel-BUy-SsXi.js";import{Mo as a}from"./awsClient-Da_1PWK9.js";import{i as o,s,t as c}from"./ecs-B4PUYbCf.js";var l=t(`/_auth/ecs/(clusters)/list-clusters/$clusterName`)({validateSearch:e({tab:i.tab}),search:{middlewares:[r({tab:`overview`})]},loader:async({context:e,params:t})=>{await Promise.all([e.queryClient.query({...c(t.clusterName),staleTime:`static`}),e.queryClient.query({...o(t.clusterName),staleTime:`static`}),e.queryClient.query({...s(t.clusterName),staleTime:`static`})])},head:({params:e})=>({meta:[{title:`${e.clusterName} | ECS | Mulga`}]}),component:n(()=>a(()=>import(`./_clusterName-PGXuLpFG.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60])),`component`)});export{l as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_clusterName-IhxHlZV4.js

@@ -1 +1 @@
-import{Gt as e,Vt as t}from"./schemas-CKmbY8gV.js";import{t as n}from"./useSuspenseQuery-CfG96AGi.js";import{t as r}from"./ecs-B4PUYbCf.js";import{t as i}from"./_clusterName-DPQe-y79.js";import{t as a}from"./back-link-CxXZw47s.js";import{t as o}from"./cluster-details-CBeOlQb_.js";var s=t(),c=e();function l(){let e=(0,s.c)(11),{clusterName:t}=i.useParams(),{tab:l}=i.useSearch(),u=i.useNavigate(),d;e[0]===t?d=e[1]:(d=r(t),e[0]=t,e[1]=d);let{data:f}=n(d);if(!f){let t;return e[2]===Symbol.for(`react.memo_cache_sentinel`)?(t=(0,c.jsxs)(c.Fragment,{children:[(0,c.jsx)(a,{to:`/ecs/list-clusters`,children:`Back to clusters`}),(0,c.jsx)(`p`,{className:`text-muted-foreground`,children:`Cluster not found.`})]}),e[2]=t):t=e[2],t}let p,m;e[3]===u?(p=e[4],m=e[5]):(p=()=>{u({to:`/ecs/list-clusters`})},m=e=>{u({search:{tab:e},replace:!0})},e[3]=u,e[4]=p,e[5]=m);let h;return e[6]!==f||e[7]!==p||e[8]!==m||e[9]!==l?(h=(0,c.jsx)(o,{cluster:f,layout:`page`,onClose:p,onTabChange:m,tab:l}),e[6]=f,e[7]=p,e[8]=m,e[9]=l,e[10]=h):h=e[10],h}export{l as component};
+import{It as e,Mt as t}from"./schemas-DCQXG11d.js";import{t as n}from"./useSuspenseQuery--dusmE-Q.js";import{t as r}from"./ecs-D2Xj5Fk-.js";import{t as i}from"./_clusterName-CF57bBZp.js";import{t as a}from"./back-link-B8ejy5Fm.js";import{t as o}from"./cluster-details-B8veXcs_.js";var s=t(),c=e();function l(){let e=(0,s.c)(11),{clusterName:t}=i.useParams(),{tab:l}=i.useSearch(),u=i.useNavigate(),d;e[0]===t?d=e[1]:(d=r(t),e[0]=t,e[1]=d);let{data:f}=n(d);if(!f){let t;return e[2]===Symbol.for(`react.memo_cache_sentinel`)?(t=(0,c.jsxs)(c.Fragment,{children:[(0,c.jsx)(a,{to:`/ecs/list-clusters`,children:`Back to clusters`}),(0,c.jsx)(`p`,{className:`text-muted-foreground`,children:`Cluster not found.`})]}),e[2]=t):t=e[2],t}let p,m;e[3]===u?(p=e[4],m=e[5]):(p=()=>{u({to:`/ecs/list-clusters`})},m=e=>{u({search:{tab:e},replace:!0})},e[3]=u,e[4]=p,e[5]=m);let h;return e[6]!==f||e[7]!==p||e[8]!==m||e[9]!==l?(h=(0,c.jsx)(o,{cluster:f,layout:`page`,onClose:p,onTabChange:m,tab:l}),e[6]=f,e[7]=p,e[8]=m,e[9]=l,e[10]=h):h=e[10],h}export{l as component};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_clusterName-b030G2HU.js

@@ -0,0 +1,2 @@
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_clusterName-BYyd5uEn.js","assets/schemas-DCQXG11d.js","assets/rolldown-runtime-XKyaHtl9.js","assets/cluster-details-1bW7KNv3.js","assets/select-UwOVJofC.js","assets/visuallyHidden-BHQz5bmH.js","assets/check-DPoQ9cBn.js","assets/chevron-down-BgudX6bq.js","assets/useScrollLock-iGnmnC-h.js","assets/useValueAsRef-uzS1fuI8.js","assets/useTransitionStatus-Dn-09Anc.js","assets/composite-DysENEse.js","assets/useRegisterFieldControl-DkI655of.js","assets/useValueChanged-wii0yYWk.js","assets/useAnchoredPopupScrollLock-CoHshdlQ.js","assets/isElementDisabled-B7Ri5ug6.js","assets/useControlled-NIWPmeG5.js","assets/ToolbarRootContext-iMMgkc2r.js","assets/clamp-D0kAXd-u.js","assets/QueryClientProvider-BuG40HBe.js","assets/useMutation-lRi0DDcO.js","assets/queryOptions-Cu2lvOFG.js","assets/useQuery-D6TojLgI.js","assets/useSuspenseQuery--dusmE-Q.js","assets/link-BX-1BPor.js","assets/matchContext-CUAcfcYw.js","assets/useRouter-B_eSHXWd.js","assets/circle-arrow-up-CFARPO9V.js","assets/eye-yi4wz0yh.js","assets/maximize-2-BAlKoEj8.js","assets/plus-BK_7eO_G.js","assets/sliders-horizontal-DsGbsnBU.js","assets/cli-command-panel-Do14gxB9.js","assets/copy-B9ICxw_u.js","assets/use-copy-to-clipboard-D-PxomFK.js","assets/trash-BajuWzqn.js","assets/triangle-alert-Ckml5FoO.js","assets/field-iLG94M00.js","assets/detail-panel-DLM1ExsZ.js","assets/x-mlA6pp-8.js","assets/info-tip-Cxa2GEOd.js","assets/store-BVhNJayb.js","assets/loader-circle-C7EgoGp_.js","assets/collapsible-DddM174D.js","assets/tabs-9tHEWpNn.js","assets/CompositeRoot-CmHoR-Tk.js","assets/panel-search-LDLf8HCe.js","assets/error-banner-Cahg3Ix2.js","assets/auth-BS4WytAe.js","assets/awsClient-BvDfQdL8.js","assets/fetch-http-handler-B--F8e2N.js","assets/toUtf8.browser-RsrLknAJ.js","assets/index.browser-D7GVEViY.js","assets/tags-BVcAJWuE.js","assets/commandBuilder-D7SsohHF.js","assets/commandBuilder-Bb9dqTZ7.js","assets/commandBuilder-CfqGUk7K.js","assets/commandBuilder-CV-6DENN.js","assets/ec2-C2FdJaHg.js","assets/eks-ard8HOD6.js","assets/iam-INCULz7q.js","assets/json-DSPw_Fae.js","assets/delete-confirmation-dialog-O7cqOW0Y.js","assets/alert-dialog-D9jG-rkO.js","assets/DialogTitle-nAIOTphJ.js","assets/confirm-phrase-C4Dux-0Y.js","assets/state-badge-CQPRxt3J.js","assets/subnet-calculator-DDrAb5xp.js","assets/resource-tags-CGeRAZrb.js","assets/inline-tags-nfRc9elZ.js","assets/pencil-DLzYMCIc.js","assets/form-lock-D8Cu0Sfu.js","assets/form-panel-CtjudV7b.js","assets/gpu-instance-type-select-DsB5oPSo.js","assets/index.esm-C31mnnYl.js","assets/zod-nOHMBkds.js","assets/form-fields-CcTBfvl9.js","assets/switch-list-X53OOONN.js","assets/switch-CFqwHFZR.js","assets/useAriaLabelledBy-DStQJVTn.js","assets/badge-DmU0agld.js","assets/useRender-B8US0bW6.js","assets/json-editor-Ch9m2EYE.js","assets/textarea-BG1iGvVs.js"])))=>i.map(i=>d[i]);
+import{s as e}from"./schemas-DCQXG11d.js";import{n as t,t as n}from"./lazyRouteComponent-PMetaA3O.js";import{t as r}from"./searchMiddleware-Clk50hy1.js";import{U as i}from"./fetch-http-handler-B--F8e2N.js";import{s as a,t as o,u as s}from"./eks-ard8HOD6.js";import{r as c}from"./panel-search-LDLf8HCe.js";var l=t(`/_auth/eks/(clusters)/list-clusters/$clusterName`)({validateSearch:e({tab:c.tab}),search:{middlewares:[r({tab:`overview`})]},loader:async({context:e,params:t})=>{await Promise.all([e.queryClient.query({...a(t.clusterName),staleTime:`static`}),e.queryClient.query({...s(t.clusterName),staleTime:`static`}),e.queryClient.query({...o(t.clusterName),staleTime:`static`})])},head:({params:e})=>({meta:[{title:`${e.clusterName} | EKS | Mulga`}]}),component:n(()=>i(()=>import(`./_clusterName-BYyd5uEn.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83])),`component`)});export{l as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_groupName-BqIKUK6U.js

@@ -1 +1 @@
-import{Gt as e,Vt as t}from"./schemas-CKmbY8gV.js";import{t as n}from"./useSuspenseQuery-CfG96AGi.js";import{t as r}from"./group-details-ChGGYn39.js";import{s as i}from"./iam-Cd60dYHn.js";import{t as a}from"./_groupName-DVuTQKjk.js";import{t as o}from"./back-link-CxXZw47s.js";var s=t(),c=e();function l(){let e=(0,s.c)(11),{groupName:t}=a.useParams(),{tab:l}=a.useSearch(),u=a.useNavigate(),d;e[0]===t?d=e[1]:(d=i(t),e[0]=t,e[1]=d);let{data:f}=n(d),p=f.Group;if(!p){let t;return e[2]===Symbol.for(`react.memo_cache_sentinel`)?(t=(0,c.jsxs)(c.Fragment,{children:[(0,c.jsx)(o,{to:`/iam/list-groups`,children:`Back to groups`}),(0,c.jsx)(`p`,{className:`text-muted-foreground`,children:`Group not found.`})]}),e[2]=t):t=e[2],t}let m,h;e[3]===u?(m=e[4],h=e[5]):(m=()=>{u({to:`/iam/list-groups`})},h=e=>{u({search:{tab:e},replace:!0})},e[3]=u,e[4]=m,e[5]=h);let g;return e[6]!==p||e[7]!==m||e[8]!==h||e[9]!==l?(g=(0,c.jsx)(r,{layout:`page`,onClose:m,onTabChange:h,group:p,tab:l}),e[6]=p,e[7]=m,e[8]=h,e[9]=l,e[10]=g):g=e[10],g}export{l as component};
+import{It as e,Mt as t}from"./schemas-DCQXG11d.js";import{t as n}from"./useSuspenseQuery--dusmE-Q.js";import{t as r}from"./group-details-DqBJW31W.js";import{s as i}from"./iam-INCULz7q.js";import{t as a}from"./_groupName-DVWrDQpm.js";import{t as o}from"./back-link-B8ejy5Fm.js";var s=t(),c=e();function l(){let e=(0,s.c)(11),{groupName:t}=a.useParams(),{tab:l}=a.useSearch(),u=a.useNavigate(),d;e[0]===t?d=e[1]:(d=i(t),e[0]=t,e[1]=d);let{data:f}=n(d),p=f.Group;if(!p){let t;return e[2]===Symbol.for(`react.memo_cache_sentinel`)?(t=(0,c.jsxs)(c.Fragment,{children:[(0,c.jsx)(o,{to:`/iam/list-groups`,children:`Back to groups`}),(0,c.jsx)(`p`,{className:`text-muted-foreground`,children:`Group not found.`})]}),e[2]=t):t=e[2],t}let m,h;e[3]===u?(m=e[4],h=e[5]):(m=()=>{u({to:`/iam/list-groups`})},h=e=>{u({search:{tab:e},replace:!0})},e[3]=u,e[4]=m,e[5]=h);let g;return e[6]!==p||e[7]!==m||e[8]!==h||e[9]!==l?(g=(0,c.jsx)(r,{layout:`page`,onClose:m,onTabChange:h,group:p,tab:l}),e[6]=p,e[7]=m,e[8]=h,e[9]=l,e[10]=g):g=e[10],g}export{l as component};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_groupName-DVWrDQpm.js

@@ -0,0 +1,2 @@
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_groupName-BqIKUK6U.js","assets/schemas-DCQXG11d.js","assets/rolldown-runtime-XKyaHtl9.js","assets/useSuspenseQuery--dusmE-Q.js","assets/queryOptions-Cu2lvOFG.js","assets/QueryClientProvider-BuG40HBe.js","assets/group-details-DqBJW31W.js","assets/link-BX-1BPor.js","assets/matchContext-CUAcfcYw.js","assets/useRouter-B_eSHXWd.js","assets/visuallyHidden-BHQz5bmH.js","assets/eye-yi4wz0yh.js","assets/maximize-2-BAlKoEj8.js","assets/sliders-horizontal-DsGbsnBU.js","assets/trash-BajuWzqn.js","assets/useValueAsRef-uzS1fuI8.js","assets/useTransitionStatus-Dn-09Anc.js","assets/detail-panel-DLM1ExsZ.js","assets/x-mlA6pp-8.js","assets/info-tip-Cxa2GEOd.js","assets/useScrollLock-iGnmnC-h.js","assets/composite-DysENEse.js","assets/useAnchoredPopupScrollLock-CoHshdlQ.js","assets/useValueChanged-wii0yYWk.js","assets/isElementDisabled-B7Ri5ug6.js","assets/store-BVhNJayb.js","assets/ToolbarRootContext-iMMgkc2r.js","assets/check-DPoQ9cBn.js","assets/chevron-down-BgudX6bq.js","assets/copy-B9ICxw_u.js","assets/loader-circle-C7EgoGp_.js","assets/collapsible-DddM174D.js","assets/useControlled-NIWPmeG5.js","assets/tabs-9tHEWpNn.js","assets/CompositeRoot-CmHoR-Tk.js","assets/panel-search-LDLf8HCe.js","assets/error-banner-Cahg3Ix2.js","assets/use-copy-to-clipboard-D-PxomFK.js","assets/iam-Dxu_EThi.js","assets/useMutation-lRi0DDcO.js","assets/awsClient-BvDfQdL8.js","assets/auth-BS4WytAe.js","assets/fetch-http-handler-B--F8e2N.js","assets/toUtf8.browser-RsrLknAJ.js","assets/index.browser-D7GVEViY.js","assets/commandBuilder-CfqGUk7K.js","assets/iam-INCULz7q.js","assets/json-DSPw_Fae.js","assets/delete-confirmation-dialog-O7cqOW0Y.js","assets/alert-dialog-D9jG-rkO.js","assets/DialogTitle-nAIOTphJ.js","assets/confirm-phrase-C4Dux-0Y.js","assets/field-iLG94M00.js","assets/useRegisterFieldControl-DkI655of.js","assets/resource-delete-dialog-D3NYuO-k.js","assets/iam-items-Ww3TvSwm.js","assets/inline-policies-panel-1LW88q6-.js","assets/useQuery-D6TojLgI.js","assets/plus-BK_7eO_G.js","assets/unlink-BigvXWQp.js","assets/json-editor-Ch9m2EYE.js","assets/textarea-BG1iGvVs.js","assets/iam-BG-N60hp.js","assets/delete-prerequisites-BjEJirR1.js","assets/back-link-B8ejy5Fm.js"])))=>i.map(i=>d[i]);
+import{s as e}from"./schemas-DCQXG11d.js";import{n as t,t as n}from"./lazyRouteComponent-PMetaA3O.js";import{t as r}from"./searchMiddleware-Clk50hy1.js";import{U as i}from"./fetch-http-handler-B--F8e2N.js";import{C as a,a as o,n as s,p as c,s as l}from"./iam-INCULz7q.js";import{r as u}from"./panel-search-LDLf8HCe.js";var d=t(`/_auth/iam/(groups)/list-groups/$groupName`)({validateSearch:e({tab:u.tab}),search:{middlewares:[r({tab:`overview`})]},loader:async({context:e,params:t})=>{await Promise.all([e.queryClient.query({...l(t.groupName),staleTime:`static`}),e.queryClient.query({...s(t.groupName),staleTime:`static`}),e.queryClient.query({...c,staleTime:`static`}),e.queryClient.query({...a,staleTime:`static`}),e.queryClient.query({...o(t.groupName),staleTime:`static`})])},head:({params:e})=>({meta:[{title:`${e.groupName} | IAM | Mulga`}]}),component:n(()=>i(()=>import(`./_groupName-BqIKUK6U.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64])),`component`)});export{d as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_groupName-DVuTQKjk.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_groupName-C66wYsWg.js","assets/schemas-CKmbY8gV.js","assets/rolldown-runtime-XKyaHtl9.js","assets/useSuspenseQuery-CfG96AGi.js","assets/queryOptions-C3LOV3Yq.js","assets/QueryClientProvider-B3gFFx5-.js","assets/group-details-ChGGYn39.js","assets/link-CoQQT1u0.js","assets/matchContext-C_cBF5rG.js","assets/visuallyHidden-Di6ozTl7.js","assets/error-banner-6H_aBcIY.js","assets/sliders-horizontal-B4nfPbkq.js","assets/detail-panel-BUy-SsXi.js","assets/x-BuYxxvoG.js","assets/check-BURgRfkZ.js","assets/chevron-down-CiWCIUx5.js","assets/copy-Clj54gC8.js","assets/loader-circle-BWw23_DY.js","assets/useScrollLock-tbqBjaVX.js","assets/useValueAsRef-DtjtqpoE.js","assets/ToolbarRootContext-CPQMf91l.js","assets/useControlled-CliDS5IQ.js","assets/isElementDisabled-DwizONlP.js","assets/store-Dx1XhYcs.js","assets/collapsible-NKtgkvXc.js","assets/tabs-C7-u1MlW.js","assets/use-copy-to-clipboard-B2jqkkCP.js","assets/maximize-2-N7ntOlKC.js","assets/trash-DU2S79Q3.js","assets/iam-Cd60dYHn.js","assets/awsClient-Da_1PWK9.js","assets/auth-LWMosi88.js","assets/index.browser-BEm-79SP.js","assets/json-BYhzhOil.js","assets/iam-CFV88tQE.js","assets/useMutation-0VvC4-D7.js","assets/delete-confirmation-dialog-khwGiTUy.js","assets/alert-dialog-B2wM6M0p.js","assets/DialogTitle-BlGk2Olt.js","assets/confirm-phrase-HKyrGgCW.js","assets/field-D45t5nwl.js","assets/useRegisterFieldControl-BpMxH-yS.js","assets/resource-delete-dialog-DB-hXwnM.js","assets/iam-items-DjjGc2aQ.js","assets/inline-policies-panel-CJ3DhTvu.js","assets/useQuery-DgGWYOhJ.js","assets/plus-hsII00cK.js","assets/unlink-DlScwunQ.js","assets/json-editor-oM4Sz7Jd.js","assets/textarea-DjPTve3M.js","assets/iam-CX9BBMw8.js","assets/delete-prerequisites-BjEJirR1.js","assets/back-link-CxXZw47s.js"])))=>i.map(i=>d[i]);
-import{s as e}from"./schemas-CKmbY8gV.js";import{n as t,t as n}from"./lazyRouteComponent-BIOh5GOe.js";import{t as r}from"./searchMiddleware-CN1kfGOC.js";import{p as i}from"./detail-panel-BUy-SsXi.js";import{Mo as a}from"./awsClient-Da_1PWK9.js";import{C as o,a as s,n as c,p as l,s as u}from"./iam-Cd60dYHn.js";var d=t(`/_auth/iam/(groups)/list-groups/$groupName`)({validateSearch:e({tab:i.tab}),search:{middlewares:[r({tab:`overview`})]},loader:async({context:e,params:t})=>{await Promise.all([e.queryClient.query({...u(t.groupName),staleTime:`static`}),e.queryClient.query({...c(t.groupName),staleTime:`static`}),e.queryClient.query({...l,staleTime:`static`}),e.queryClient.query({...o,staleTime:`static`}),e.queryClient.query({...s(t.groupName),staleTime:`static`})])},head:({params:e})=>({meta:[{title:`${e.groupName} | IAM | Mulga`}]}),component:n(()=>a(()=>import(`./_groupName-C66wYsWg.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52])),`component`)});export{d as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_guardrailId.edit-BF4NMzEE.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_guardrailId.edit-Bp3DUXUQ.js","assets/schemas-CKmbY8gV.js","assets/rolldown-runtime-XKyaHtl9.js","assets/useSuspenseQuery-CfG96AGi.js","assets/queryOptions-C3LOV3Yq.js","assets/QueryClientProvider-B3gFFx5-.js","assets/bedrock-BHkZEt0C.js","assets/awsClient-Da_1PWK9.js","assets/auth-LWMosi88.js","assets/index.browser-BEm-79SP.js","assets/bedrock-Dq3b2Oie.js","assets/useMutation-0VvC4-D7.js","assets/tags-Dow4PoR3.js","assets/guardrail-form-page-DPf-GoPw.js","assets/lazyRouteComponent-BIOh5GOe.js","assets/matchContext-C_cBF5rG.js","assets/link-CoQQT1u0.js","assets/useSelector-BuHlvrXV.js","assets/plus-hsII00cK.js","assets/visuallyHidden-Di6ozTl7.js","assets/cli-command-panel-Bbgu_PHE.js","assets/check-BURgRfkZ.js","assets/chevron-down-CiWCIUx5.js","assets/copy-Clj54gC8.js","assets/useValueAsRef-DtjtqpoE.js","assets/use-copy-to-clipboard-B2jqkkCP.js","assets/trash-DU2S79Q3.js","assets/field-D45t5nwl.js","assets/useRegisterFieldControl-BpMxH-yS.js","assets/useControlled-CliDS5IQ.js","assets/switch-ARpklVus.js","assets/useAriaLabelledBy-C1btqlkM.js","assets/textarea-DjPTve3M.js","assets/page-heading-DOCwCs80.js","assets/form-lock-ETWruSvZ.js","assets/error-banner-6H_aBcIY.js","assets/loader-circle-BWw23_DY.js","assets/index.esm-BQMPsB0n.js","assets/zod-BWB4pUhT.js","assets/back-link-CxXZw47s.js","assets/form-fields-Dz0ldQ7r.js","assets/select-DEWJs_zZ.js","assets/useScrollLock-tbqBjaVX.js","assets/ToolbarRootContext-CPQMf91l.js","assets/isElementDisabled-DwizONlP.js","assets/clamp-D0kAXd-u.js","assets/tags-field-array-DXxufWBT.js"])))=>i.map(i=>d[i]);
-import{n as e,t}from"./lazyRouteComponent-BIOh5GOe.js";import{Mo as n}from"./awsClient-Da_1PWK9.js";import{n as r}from"./bedrock-BHkZEt0C.js";var i=e(`/_auth/bedrock/(guardrails)/list-guardrails/$guardrailId/edit`)({loader:async({context:e,params:t})=>{await e.queryClient.query({...r(t.guardrailId),staleTime:`static`})},head:({params:e})=>({meta:[{title:`Edit ${e.guardrailId} | Guardrail | Mulga`}]}),component:t(()=>n(()=>import(`./_guardrailId.edit-Bp3DUXUQ.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46])),`component`)});export{i as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_guardrailId.edit-Bp3DUXUQ.js

@@ -1 +0,0 @@
-import{Gt as e,Vt as t}from"./schemas-CKmbY8gV.js";import{t as n}from"./useSuspenseQuery-CfG96AGi.js";import{n as r}from"./bedrock-BHkZEt0C.js";import{p as i}from"./bedrock-Dq3b2Oie.js";import{t as a}from"./_guardrailId.edit-BF4NMzEE.js";import{t as o}from"./guardrail-form-page-DPf-GoPw.js";var s=t(),c=e();function l(){let e=(0,s.c)(7),{guardrailId:t}=a.useParams(),l;e[0]===t?l=e[1]:(l=r(t),e[0]=t,e[1]=l);let{data:u}=n(l),d;e[2]===u?d=e[3]:(d=i(u),e[2]=u,e[3]=d);let f;return e[4]!==t||e[5]!==d?(f=(0,c.jsx)(o,{defaultValues:d,guardrailId:t,mode:`edit`}),e[4]=t,e[5]=d,e[6]=f):f=e[6],f}export{l as component};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_guardrailId.edit-CAKBZE4w.js

@@ -0,0 +1,2 @@
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_guardrailId.edit-CJtFqFm8.js","assets/schemas-DCQXG11d.js","assets/rolldown-runtime-XKyaHtl9.js","assets/useSuspenseQuery--dusmE-Q.js","assets/queryOptions-Cu2lvOFG.js","assets/QueryClientProvider-BuG40HBe.js","assets/bedrock-BuO1n8fj.js","assets/awsClient-BvDfQdL8.js","assets/auth-BS4WytAe.js","assets/fetch-http-handler-B--F8e2N.js","assets/toUtf8.browser-RsrLknAJ.js","assets/index.browser-D7GVEViY.js","assets/bedrock-cODWxxpg.js","assets/useMutation-lRi0DDcO.js","assets/tags-Ki2a29eH.js","assets/guardrail-form-page-B0tEFLJ6.js","assets/useNavigate-cMdr_EJ0.js","assets/useRouter-B_eSHXWd.js","assets/plus-BK_7eO_G.js","assets/visuallyHidden-BHQz5bmH.js","assets/cli-command-panel-Do14gxB9.js","assets/check-DPoQ9cBn.js","assets/chevron-down-BgudX6bq.js","assets/copy-B9ICxw_u.js","assets/useValueAsRef-uzS1fuI8.js","assets/useTransitionStatus-Dn-09Anc.js","assets/use-copy-to-clipboard-D-PxomFK.js","assets/trash-BajuWzqn.js","assets/field-iLG94M00.js","assets/useRegisterFieldControl-DkI655of.js","assets/useValueChanged-wii0yYWk.js","assets/switch-CFqwHFZR.js","assets/useAriaLabelledBy-DStQJVTn.js","assets/useControlled-NIWPmeG5.js","assets/textarea-BG1iGvVs.js","assets/page-heading-ZfrnK2wu.js","assets/form-lock-D8Cu0Sfu.js","assets/loader-circle-C7EgoGp_.js","assets/error-banner-Cahg3Ix2.js","assets/index.esm-C31mnnYl.js","assets/zod-nOHMBkds.js","assets/form-fields-CcTBfvl9.js","assets/select-UwOVJofC.js","assets/useScrollLock-iGnmnC-h.js","assets/composite-DysENEse.js","assets/useAnchoredPopupScrollLock-CoHshdlQ.js","assets/isElementDisabled-B7Ri5ug6.js","assets/ToolbarRootContext-iMMgkc2r.js","assets/clamp-D0kAXd-u.js","assets/info-tip-Cxa2GEOd.js","assets/store-BVhNJayb.js","assets/back-link-B8ejy5Fm.js","assets/link-BX-1BPor.js","assets/matchContext-CUAcfcYw.js","assets/tags-field-array-Drjjg7Rv.js"])))=>i.map(i=>d[i]);
+import{n as e,t}from"./lazyRouteComponent-PMetaA3O.js";import{U as n}from"./fetch-http-handler-B--F8e2N.js";import{n as r}from"./bedrock-BuO1n8fj.js";var i=e(`/_auth/bedrock/(guardrails)/list-guardrails/$guardrailId/edit`)({loader:async({context:e,params:t})=>{await e.queryClient.query({...r(t.guardrailId),staleTime:`static`})},head:({params:e})=>({meta:[{title:`Edit ${e.guardrailId} | Guardrail | Mulga`}]}),component:t(()=>n(()=>import(`./_guardrailId.edit-CJtFqFm8.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54])),`component`)});export{i as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_guardrailId.edit-CJtFqFm8.js

@@ -0,0 +1 @@
+import{It as e,Mt as t}from"./schemas-DCQXG11d.js";import{t as n}from"./useSuspenseQuery--dusmE-Q.js";import{n as r}from"./bedrock-BuO1n8fj.js";import{p as i}from"./bedrock-cODWxxpg.js";import{t as a}from"./_guardrailId.edit-CAKBZE4w.js";import{t as o}from"./guardrail-form-page-B0tEFLJ6.js";var s=t(),c=e();function l(){let e=(0,s.c)(7),{guardrailId:t}=a.useParams(),l;e[0]===t?l=e[1]:(l=r(t),e[0]=t,e[1]=l);let{data:u}=n(l),d;e[2]===u?d=e[3]:(d=i(u),e[2]=u,e[3]=d);let f;return e[4]!==t||e[5]!==d?(f=(0,c.jsx)(o,{defaultValues:d,guardrailId:t,mode:`edit`}),e[4]=t,e[5]=d,e[6]=f):f=e[6],f}export{l as component};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_guardrailId.index-B5Q5DXUE.js

@@ -1 +1 @@
-import{Gt as e,Vt as t}from"./schemas-CKmbY8gV.js";import{t as n}from"./useSuspenseQuery-CfG96AGi.js";import{n as r}from"./bedrock-BHkZEt0C.js";import{t as i}from"./guardrail-details-BY0N3gH5.js";import{t as a}from"./_guardrailId.index-qL3pS22-.js";var o=t(),s=e();function c(){let e=(0,o.c)(14),{guardrailId:t}=a.useParams(),{tab:c}=a.useSearch(),l=a.useNavigate(),u;e[0]===t?u=e[1]:(u=r(t),e[0]=t,e[1]=u);let{data:d}=n(u),f;e[2]!==d.name||e[3]!==d.status||e[4]!==t?(f={id:t,name:d.name,status:d.status},e[2]=d.name,e[3]=d.status,e[4]=t,e[5]=f):f=e[5];let p,m;e[6]===l?(p=e[7],m=e[8]):(p=()=>{l({to:`/bedrock/list-guardrails`})},m=e=>{l({search:{tab:e},replace:!0})},e[6]=l,e[7]=p,e[8]=m);let h;return e[9]!==f||e[10]!==p||e[11]!==m||e[12]!==c?(h=(0,s.jsx)(i,{guardrail:f,layout:`page`,onClose:p,onTabChange:m,tab:c}),e[9]=f,e[10]=p,e[11]=m,e[12]=c,e[13]=h):h=e[13],h}export{c as component};
+import{It as e,Mt as t}from"./schemas-DCQXG11d.js";import{t as n}from"./useSuspenseQuery--dusmE-Q.js";import{n as r}from"./bedrock-BuO1n8fj.js";import{t as i}from"./guardrail-details--ycYzrGj.js";import{t as a}from"./_guardrailId.index-CTsTb5EI.js";var o=t(),s=e();function c(){let e=(0,o.c)(14),{guardrailId:t}=a.useParams(),{tab:c}=a.useSearch(),l=a.useNavigate(),u;e[0]===t?u=e[1]:(u=r(t),e[0]=t,e[1]=u);let{data:d}=n(u),f;e[2]!==d.name||e[3]!==d.status||e[4]!==t?(f={id:t,name:d.name,status:d.status},e[2]=d.name,e[3]=d.status,e[4]=t,e[5]=f):f=e[5];let p,m;e[6]===l?(p=e[7],m=e[8]):(p=()=>{l({to:`/bedrock/list-guardrails`})},m=e=>{l({search:{tab:e},replace:!0})},e[6]=l,e[7]=p,e[8]=m);let h;return e[9]!==f||e[10]!==p||e[11]!==m||e[12]!==c?(h=(0,s.jsx)(i,{guardrail:f,layout:`page`,onClose:p,onTabChange:m,tab:c}),e[9]=f,e[10]=p,e[11]=m,e[12]=c,e[13]=h):h=e[13],h}export{c as component};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_guardrailId.index-CTsTb5EI.js

@@ -0,0 +1,2 @@
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_guardrailId.index-B5Q5DXUE.js","assets/schemas-DCQXG11d.js","assets/rolldown-runtime-XKyaHtl9.js","assets/useSuspenseQuery--dusmE-Q.js","assets/queryOptions-Cu2lvOFG.js","assets/QueryClientProvider-BuG40HBe.js","assets/bedrock-BuO1n8fj.js","assets/awsClient-BvDfQdL8.js","assets/auth-BS4WytAe.js","assets/fetch-http-handler-B--F8e2N.js","assets/toUtf8.browser-RsrLknAJ.js","assets/index.browser-D7GVEViY.js","assets/guardrail-details--ycYzrGj.js","assets/useMutation-lRi0DDcO.js","assets/link-BX-1BPor.js","assets/matchContext-CUAcfcYw.js","assets/useRouter-B_eSHXWd.js","assets/eye-yi4wz0yh.js","assets/visuallyHidden-BHQz5bmH.js","assets/maximize-2-BAlKoEj8.js","assets/pencil-DLzYMCIc.js","assets/sliders-horizontal-DsGbsnBU.js","assets/trash-BajuWzqn.js","assets/useValueAsRef-uzS1fuI8.js","assets/useTransitionStatus-Dn-09Anc.js","assets/field-iLG94M00.js","assets/useRegisterFieldControl-DkI655of.js","assets/useValueChanged-wii0yYWk.js","assets/detail-panel-DLM1ExsZ.js","assets/x-mlA6pp-8.js","assets/info-tip-Cxa2GEOd.js","assets/useScrollLock-iGnmnC-h.js","assets/composite-DysENEse.js","assets/useAnchoredPopupScrollLock-CoHshdlQ.js","assets/isElementDisabled-B7Ri5ug6.js","assets/store-BVhNJayb.js","assets/ToolbarRootContext-iMMgkc2r.js","assets/check-DPoQ9cBn.js","assets/chevron-down-BgudX6bq.js","assets/copy-B9ICxw_u.js","assets/loader-circle-C7EgoGp_.js","assets/collapsible-DddM174D.js","assets/useControlled-NIWPmeG5.js","assets/tabs-9tHEWpNn.js","assets/CompositeRoot-CmHoR-Tk.js","assets/panel-search-LDLf8HCe.js","assets/error-banner-Cahg3Ix2.js","assets/use-copy-to-clipboard-D-PxomFK.js","assets/bedrock-cODWxxpg.js","assets/tags-Ki2a29eH.js","assets/commandBuilder-ClDzvnte.js","assets/textarea-BG1iGvVs.js","assets/state-badge-CQPRxt3J.js","assets/resource-delete-dialog-D3NYuO-k.js","assets/delete-confirmation-dialog-O7cqOW0Y.js","assets/alert-dialog-D9jG-rkO.js","assets/DialogTitle-nAIOTphJ.js","assets/confirm-phrase-C4Dux-0Y.js"])))=>i.map(i=>d[i]);
+import{s as e}from"./schemas-DCQXG11d.js";import{n as t,t as n}from"./lazyRouteComponent-PMetaA3O.js";import{t as r}from"./searchMiddleware-Clk50hy1.js";import{U as i}from"./fetch-http-handler-B--F8e2N.js";import{n as a,r as o}from"./bedrock-BuO1n8fj.js";import{r as s}from"./panel-search-LDLf8HCe.js";var c=t(`/_auth/bedrock/(guardrails)/list-guardrails/$guardrailId/`)({validateSearch:e({tab:s.tab}),search:{middlewares:[r({tab:`overview`})]},loader:async({context:e,params:t})=>{await Promise.all([e.queryClient.query({...a(t.guardrailId),staleTime:`static`}),e.queryClient.query({...o(t.guardrailId),staleTime:`static`})])},head:({params:e})=>({meta:[{title:`${e.guardrailId} | Guardrail | Mulga`}]}),component:n(()=>i(()=>import(`./_guardrailId.index-B5Q5DXUE.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57])),`component`)});export{c as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_guardrailId.index-qL3pS22-.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_guardrailId.index-CrD1q_4U.js","assets/schemas-CKmbY8gV.js","assets/rolldown-runtime-XKyaHtl9.js","assets/useSuspenseQuery-CfG96AGi.js","assets/queryOptions-C3LOV3Yq.js","assets/QueryClientProvider-B3gFFx5-.js","assets/bedrock-BHkZEt0C.js","assets/awsClient-Da_1PWK9.js","assets/auth-LWMosi88.js","assets/index.browser-BEm-79SP.js","assets/guardrail-details-BY0N3gH5.js","assets/useMutation-0VvC4-D7.js","assets/link-CoQQT1u0.js","assets/matchContext-C_cBF5rG.js","assets/sliders-horizontal-B4nfPbkq.js","assets/visuallyHidden-Di6ozTl7.js","assets/detail-panel-BUy-SsXi.js","assets/x-BuYxxvoG.js","assets/error-banner-6H_aBcIY.js","assets/check-BURgRfkZ.js","assets/chevron-down-CiWCIUx5.js","assets/copy-Clj54gC8.js","assets/loader-circle-BWw23_DY.js","assets/useScrollLock-tbqBjaVX.js","assets/useValueAsRef-DtjtqpoE.js","assets/ToolbarRootContext-CPQMf91l.js","assets/useControlled-CliDS5IQ.js","assets/isElementDisabled-DwizONlP.js","assets/store-Dx1XhYcs.js","assets/collapsible-NKtgkvXc.js","assets/tabs-C7-u1MlW.js","assets/use-copy-to-clipboard-B2jqkkCP.js","assets/maximize-2-N7ntOlKC.js","assets/pencil-Es1j7lo2.js","assets/trash-DU2S79Q3.js","assets/field-D45t5nwl.js","assets/useRegisterFieldControl-BpMxH-yS.js","assets/bedrock-Dq3b2Oie.js","assets/tags-Dow4PoR3.js","assets/commandBuilder-BhiwXyoE.js","assets/textarea-DjPTve3M.js","assets/state-badge-60FZam9q.js","assets/resource-delete-dialog-DB-hXwnM.js","assets/delete-confirmation-dialog-khwGiTUy.js","assets/alert-dialog-B2wM6M0p.js","assets/DialogTitle-BlGk2Olt.js","assets/confirm-phrase-HKyrGgCW.js"])))=>i.map(i=>d[i]);
-import{s as e}from"./schemas-CKmbY8gV.js";import{n as t,t as n}from"./lazyRouteComponent-BIOh5GOe.js";import{t as r}from"./searchMiddleware-CN1kfGOC.js";import{p as i}from"./detail-panel-BUy-SsXi.js";import{Mo as a}from"./awsClient-Da_1PWK9.js";import{n as o,r as s}from"./bedrock-BHkZEt0C.js";var c=t(`/_auth/bedrock/(guardrails)/list-guardrails/$guardrailId/`)({validateSearch:e({tab:i.tab}),search:{middlewares:[r({tab:`overview`})]},loader:async({context:e,params:t})=>{await Promise.all([e.queryClient.query({...o(t.guardrailId),staleTime:`static`}),e.queryClient.query({...s(t.guardrailId),staleTime:`static`})])},head:({params:e})=>({meta:[{title:`${e.guardrailId} | Guardrail | Mulga`}]}),component:n(()=>a(()=>import(`./_guardrailId.index-CrD1q_4U.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46])),`component`)});export{c as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_id-3OrSPE1_.js

@@ -0,0 +1,2 @@
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_id-sT96k6cW.js","assets/schemas-DCQXG11d.js","assets/rolldown-runtime-XKyaHtl9.js","assets/useQuery-D6TojLgI.js","assets/queryOptions-Cu2lvOFG.js","assets/QueryClientProvider-BuG40HBe.js","assets/useSuspenseQuery--dusmE-Q.js","assets/ec2-C2FdJaHg.js","assets/awsClient-BvDfQdL8.js","assets/auth-BS4WytAe.js","assets/fetch-http-handler-B--F8e2N.js","assets/toUtf8.browser-RsrLknAJ.js","assets/index.browser-D7GVEViY.js","assets/commandBuilder-D7SsohHF.js","assets/back-link-B8ejy5Fm.js","assets/link-BX-1BPor.js","assets/matchContext-CUAcfcYw.js","assets/useRouter-B_eSHXWd.js","assets/info-tip-Cxa2GEOd.js","assets/visuallyHidden-BHQz5bmH.js","assets/useScrollLock-iGnmnC-h.js","assets/useValueAsRef-uzS1fuI8.js","assets/useTransitionStatus-Dn-09Anc.js","assets/composite-DysENEse.js","assets/useAnchoredPopupScrollLock-CoHshdlQ.js","assets/useValueChanged-wii0yYWk.js","assets/isElementDisabled-B7Ri5ug6.js","assets/store-BVhNJayb.js","assets/ToolbarRootContext-iMMgkc2r.js","assets/internet-gateway-details-Dx-SRdDD.js","assets/select-UwOVJofC.js","assets/check-DPoQ9cBn.js","assets/chevron-down-BgudX6bq.js","assets/useRegisterFieldControl-DkI655of.js","assets/useControlled-NIWPmeG5.js","assets/clamp-D0kAXd-u.js","assets/eye-yi4wz0yh.js","assets/link-2-C2tj8Xu3.js","assets/maximize-2-BAlKoEj8.js","assets/sliders-horizontal-DsGbsnBU.js","assets/trash-BajuWzqn.js","assets/unlink-BigvXWQp.js","assets/detail-panel-DLM1ExsZ.js","assets/x-mlA6pp-8.js","assets/copy-B9ICxw_u.js","assets/loader-circle-C7EgoGp_.js","assets/collapsible-DddM174D.js","assets/tabs-9tHEWpNn.js","assets/CompositeRoot-CmHoR-Tk.js","assets/panel-search-LDLf8HCe.js","assets/error-banner-Cahg3Ix2.js","assets/use-copy-to-clipboard-D-PxomFK.js","assets/ec2-7jxCkIMu.js","assets/useMutation-lRi0DDcO.js","assets/subnet-calculator-DDrAb5xp.js","assets/tags-Ki2a29eH.js","assets/delete-confirmation-dialog-O7cqOW0Y.js","assets/alert-dialog-D9jG-rkO.js","assets/DialogTitle-nAIOTphJ.js","assets/confirm-phrase-C4Dux-0Y.js","assets/field-iLG94M00.js","assets/state-badge-CQPRxt3J.js","assets/resource-tags-CGeRAZrb.js","assets/tags-BVcAJWuE.js","assets/commandBuilder-Bb9dqTZ7.js","assets/commandBuilder-CfqGUk7K.js","assets/commandBuilder-CV-6DENN.js","assets/inline-tags-nfRc9elZ.js","assets/pencil-DLzYMCIc.js","assets/plus-BK_7eO_G.js","assets/resource-delete-dialog-D3NYuO-k.js"])))=>i.map(i=>d[i]);
+import{s as e}from"./schemas-DCQXG11d.js";import{n as t,t as n}from"./lazyRouteComponent-PMetaA3O.js";import{t as r}from"./searchMiddleware-Clk50hy1.js";import{U as i}from"./fetch-http-handler-B--F8e2N.js";import{N as a,d as o}from"./ec2-C2FdJaHg.js";import{r as s}from"./panel-search-LDLf8HCe.js";var c=t(`/_auth/ec2/(internet-gateways)/describe-internet-gateways/$id`)({validateSearch:e({tab:s.tab}),search:{middlewares:[r({tab:`overview`})]},loader:async({context:e,params:t})=>{await Promise.all([e.queryClient.query({...o(t.id),staleTime:`static`}),e.queryClient.query({...a,staleTime:`static`})])},head:({params:e})=>({meta:[{title:`${e.id} | Internet Gateway | Mulga`}]}),component:n(()=>i(()=>import(`./_id-sT96k6cW.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70])),`component`)});export{c as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_id-5-T0keb0.js

@@ -1 +1 @@
-import{Gt as e,Vt as t}from"./schemas-CKmbY8gV.js";import{t as n}from"./useSuspenseQuery-CfG96AGi.js";import{S as r}from"./ec2-BL5MCjb2.js";import{t as i}from"./_id-OG5RbAYy.js";import{t as a}from"./back-link-CxXZw47s.js";import{t as o}from"./route-table-details-xQ8-QGIx.js";var s=t(),c=e();function l(){let e=(0,s.c)(11),{id:t}=i.useParams(),{tab:l}=i.useSearch(),u=i.useNavigate(),d;e[0]===t?d=e[1]:(d=r(t),e[0]=t,e[1]=d);let{data:f}=n(d),p=f.RouteTables?.[0];if(!p?.RouteTableId){let t;return e[2]===Symbol.for(`react.memo_cache_sentinel`)?(t=(0,c.jsxs)(c.Fragment,{children:[(0,c.jsx)(a,{to:`/ec2/describe-route-tables`,children:`Back to route tables`}),(0,c.jsx)(`p`,{className:`text-muted-foreground`,children:`Route table not found.`})]}),e[2]=t):t=e[2],t}let m,h;e[3]===u?(m=e[4],h=e[5]):(m=()=>{u({to:`/ec2/describe-route-tables`})},h=e=>{u({search:{tab:e},replace:!0})},e[3]=u,e[4]=m,e[5]=h);let g;return e[6]!==p||e[7]!==m||e[8]!==h||e[9]!==l?(g=(0,c.jsx)(o,{layout:`page`,onClose:m,onTabChange:h,rtb:p,tab:l}),e[6]=p,e[7]=m,e[8]=h,e[9]=l,e[10]=g):g=e[10],g}export{l as component};
+import{It as e,Mt as t}from"./schemas-DCQXG11d.js";import{t as n}from"./useSuspenseQuery--dusmE-Q.js";import{S as r}from"./ec2-C2FdJaHg.js";import{t as i}from"./_id-n454kA14.js";import{t as a}from"./back-link-B8ejy5Fm.js";import{t as o}from"./route-table-details-DKNB9Zbj.js";var s=t(),c=e();function l(){let e=(0,s.c)(11),{id:t}=i.useParams(),{tab:l}=i.useSearch(),u=i.useNavigate(),d;e[0]===t?d=e[1]:(d=r(t),e[0]=t,e[1]=d);let{data:f}=n(d),p=f.RouteTables?.[0];if(!p?.RouteTableId){let t;return e[2]===Symbol.for(`react.memo_cache_sentinel`)?(t=(0,c.jsxs)(c.Fragment,{children:[(0,c.jsx)(a,{to:`/ec2/describe-route-tables`,children:`Back to route tables`}),(0,c.jsx)(`p`,{className:`text-muted-foreground`,children:`Route table not found.`})]}),e[2]=t):t=e[2],t}let m,h;e[3]===u?(m=e[4],h=e[5]):(m=()=>{u({to:`/ec2/describe-route-tables`})},h=e=>{u({search:{tab:e},replace:!0})},e[3]=u,e[4]=m,e[5]=h);let g;return e[6]!==p||e[7]!==m||e[8]!==h||e[9]!==l?(g=(0,c.jsx)(o,{layout:`page`,onClose:m,onTabChange:h,rtb:p,tab:l}),e[6]=p,e[7]=m,e[8]=h,e[9]=l,e[10]=g):g=e[10],g}export{l as component};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_id-5A9XRxPT.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/_id-BNgCQABg.js","assets/schemas-CKmbY8gV.js","assets/rolldown-runtime-XKyaHtl9.js","assets/useSuspenseQuery-CfG96AGi.js","assets/queryOptions-C3LOV3Yq.js","assets/QueryClientProvider-B3gFFx5-.js","assets/ec2-BL5MCjb2.js","assets/auth-LWMosi88.js","assets/awsClient-Da_1PWK9.js","assets/index.browser-BEm-79SP.js","assets/back-link-CxXZw47s.js","assets/link-CoQQT1u0.js","assets/matchContext-C_cBF5rG.js","assets/error-banner-6H_aBcIY.js","assets/visuallyHidden-Di6ozTl7.js","assets/subnet-details-B_L_v-M0.js","assets/sliders-horizontal-B4nfPbkq.js","assets/detail-panel-BUy-SsXi.js","assets/x-BuYxxvoG.js","assets/check-BURgRfkZ.js","assets/chevron-down-CiWCIUx5.js","assets/copy-Clj54gC8.js","assets/loader-circle-BWw23_DY.js","assets/useScrollLock-tbqBjaVX.js","assets/useValueAsRef-DtjtqpoE.js","assets/ToolbarRootContext-CPQMf91l.js","assets/useControlled-CliDS5IQ.js","assets/isElementDisabled-DwizONlP.js","assets/store-Dx1XhYcs.js","assets/collapsible-NKtgkvXc.js","assets/tabs-C7-u1MlW.js","assets/use-copy-to-clipboard-B2jqkkCP.js","assets/maximize-2-N7ntOlKC.js","assets/trash-DU2S79Q3.js","assets/ec2-DUS7SFT_.js","assets/useMutation-0VvC4-D7.js","assets/subnet-calculator-DDrAb5xp.js","assets/tags-Dow4PoR3.js","assets/state-badge-60FZam9q.js","assets/resource-delete-dialog-DB-hXwnM.js","assets/delete-confirmation-dialog-khwGiTUy.js","assets/alert-dialog-B2wM6M0p.js","assets/DialogTitle-BlGk2Olt.js","assets/confirm-phrase-HKyrGgCW.js","assets/field-D45t5nwl.js","assets/useRegisterFieldControl-BpMxH-yS.js"])))=>i.map(i=>d[i]);
-import{s as e}from"./schemas-CKmbY8gV.js";import{n as t,t as n}from"./lazyRouteComponent-BIOh5GOe.js";import{t as r}from"./searchMiddleware-CN1kfGOC.js";import{p as i}from"./detail-panel-BUy-SsXi.js";import{Mo as a}from"./awsClient-Da_1PWK9.js";import{O as o}from"./ec2-BL5MCjb2.js";var s=t(`/_auth/ec2/(subnet)/describe-subnets/$id`)({validateSearch:e({tab:i.tab}),search:{middlewares:[r({tab:`overview`})]},loader:async({context:e,params:t})=>{await e.queryClient.query({...o(t.id),staleTime:`static`})},head:({params:e})=>({meta:[{title:`${e.id} | Subnet | Mulga`}]}),component:n(()=>a(()=>import(`./_id-BNgCQABg.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45])),`component`)});export{s as t};

spinifex/runtime/roles/spinifexui/frontend/dist/assets/_id-85gB-eYL.js

@@ -0,0 +1 @@
+import{G as e,It as t,Mt as n}from"./schemas-DCQXG11d.js";import{t as r}from"./useSuspenseQuery--dusmE-Q.js";import{t as i}from"./load-balancer-details-CCgPZ1hi.js";import{i as a}from"./elbv2-BUGSqzYp.js";import{t as o}from"./_id-BAOyYbKw.js";import{t as s}from"./back-link-B8ejy5Fm.js";var c=n(),l=t();function u(){let t=(0,c.c)(12),{id:n}=o.useParams(),{tab:u}=o.useSearch(),d=o.useNavigate(),f,p;if(t[0]!==n){let i=e(n);f=r,p=a(i),t[0]=n,t[1]=f,t[2]=p}else f=t[1],p=t[2];let{data:m}=f(p),h=m.LoadBalancers?.[0];if(!h?.LoadBalancerArn){let e;return t[3]===Symbol.for(`react.memo_cache_sentinel`)?(e=(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(s,{to:`/ec2/describe-load-balancers`,children:`Back to load balancers`}),(0,l.jsx)(`p`,{className:`text-muted-foreground`,children:`Load balancer not found.`})]}),t[3]=e):e=t[3],e}let g,_;t[4]===d?(g=t[5],_=t[6]):(g=()=>{d({to:`/ec2/describe-load-balancers`})},_=e=>{d({search:{tab:e},replace:!0})},t[4]=d,t[5]=g,t[6]=_);let v;return t[7]!==h||t[8]!==g||t[9]!==_||t[10]!==u?(v=(0,l.jsx)(i,{layout:`page`,lb:h,onClose:g,onTabChange:_,tab:u}),t[7]=h,t[8]=g,t[9]=_,t[10]=u,t[11]=v):v=t[11],v}export{u as component};