feat: add staging deployment bundles and tooling

Makefile

@@ -38,7 +38,7 @@ workspace-build:
 		rm -f $(WORKSPACE_OVERRIDE); \
 	fi
 
-.PHONY: help generate init up down restart clean nuke fresh logs pull build cli status guppy regen debug-upload ensure-state check-docker workspace-build shell-guppy shell-piri shell-upload shell-hilt
+.PHONY: help generate init up down restart clean nuke fresh logs pull build cli status guppy regen debug-upload ensure-state check-docker workspace-build shell-guppy shell-piri shell-upload shell-hilt staging-keygen staging-bootstrap staging-provision-core staging-provision-piri staging-vault-init staging-deploy-core staging-allowlist-piri staging-deploy-piri staging-register-piri staging-register-ingot staging-fund-payer staging-reset
 
 # Default target - show help
 help:
@@ -82,6 +82,20 @@ help:
 	@echo "Debugging:"
 	@echo "  make debug-upload  Run upload (sprue) under Delve on localhost:2345"
 	@echo ""
+	@echo "Staging deployment (see docs/STAGING_DEPLOY.md):"
+	@echo "  make staging-keygen          Ensure keys+wallets+proofs exist in 1Password (idempotent)"
+	@echo "  make staging-bootstrap       One-time: prepare the box (repo, dirs, Caddy)"
+	@echo "  make staging-provision-core  Render core secrets from 1Password and ship to the box (dev machine only)"
+	@echo "  make staging-provision-piri  Render piri secrets from 1Password and ship to the box (dev machine only)"
+	@echo "  make staging-vault-init      Init + unseal hilt-vault; store keys in 1Password (run between provision-core and deploy-core)"
+	@echo "  make staging-deploy-core     Deploy the core bundle (sprue + signing-service + delegator + hilt + plc)"
+	@echo "  make staging-allowlist-piri  Allow-list the piri DID with the delegator (run before deploy-piri)"
+	@echo "  make staging-deploy-piri     Deploy the piri bundle (piri-0 + ingot)"
+	@echo "  make staging-register-piri   Register piri as a storage provider with sprue (run after both deploys)"
+	@echo "  make staging-register-ingot  Register ingot as hilt's regional provider (run after both deploys)"
+	@echo "  make staging-fund-payer      Deposit USDFC into FilecoinPay so piri can create a proof set"
+	@echo "  make staging-reset           Wipe ALL staging data and redeploy both bundles from scratch (destructive; keeps keys+wallets)"
+	@echo ""
 	@echo "Options:"
 	@echo "  YES=1              Skip confirmation prompts (e.g., make nuke YES=1)"
 	@echo "  SMELT_WORKSPACE=1  Run containers against binaries built from your local"
@@ -260,6 +274,95 @@ regen:
 	@echo "Keys and proofs regenerated."
 	@echo "Run 'make clean && make up' to restart services with new keys."
 
+# --- Staging deployment ---------------------------------------------------
+# Thin wrappers over the staging tooling; full runbook in docs/STAGING_DEPLOY.md.
+
+# Ensure staging keys, EVM wallets, and UCAN proofs exist (idempotent: existing
+# 1Password fields are reused, only missing ones are generated); write proofs to
+# environments/staging/proofs/ (commit them); write wallet addresses (incl.
+# PAYER_ADDRESS) into environments/staging/wallets.env (commit it).
+staging-keygen:
+	@go run ./cmd/smelt staging keygen
+
+# One-time: prepare the box — clone/update the repo, create secrets + data dirs,
+# wire the Caddy snippet, verify. Pass REPO_URL on first run.
+staging-bootstrap:
+	@./scripts/staging-bootstrap.sh
+
+# Render configs/keys from 1Password and stream them to the box. Developer
+# machine only (needs your op session + SSH); never run from CI. Per-bundle, since
+# we typically deploy one bundle at a time.
+staging-provision-core:
+	@./scripts/staging-provision.sh core
+
+staging-provision-piri:
+	@./scripts/staging-provision.sh piri
+
+# Initialize + unseal the persistent (Raft) hilt-vault and store its unseal key +
+# root token in 1Password. Run after provision-core and before deploy-core: the
+# unseal key/root token are minted at runtime by `vault operator init` (not by
+# keygen) and rendered into vault-secrets.env, which deploy-core consumes.
+# Developer machine only (needs your op session + jq). Idempotent.
+staging-vault-init:
+	@./scripts/staging-vault-init.sh
+
+# Deploy a bundle: pull pinned images, recreate, verify health.
+staging-deploy-core:
+	@./scripts/staging-deploy.sh core
+
+# Allow-list the piri DID with the core delegator. Run after deploy-core and
+# before deploy-piri, else `piri init` step [4/7] gets a 403 from the delegator.
+staging-allowlist-piri:
+	@./scripts/staging-allowlist-piri.sh
+
+staging-deploy-piri:
+	@./scripts/staging-deploy.sh piri
+
+# Register the piri node as a storage provider with sprue. Run after BOTH
+# bundles are healthy, else uploads fail with "no storage providers available"
+# (locally sprue's post_start hook does this; across bundles it can't).
+staging-register-piri:
+	@./scripts/staging-register-piri.sh
+
+# Register ingot as hilt's regional provider. Run after BOTH bundles are healthy
+# and BEFORE creating any tenants, else the Tenant API rejects the region
+# (locally hilt's post_start hook does this; across bundles it can't).
+staging-register-ingot:
+	@./scripts/staging-register-ingot.sh
+
+# Deposit USDFC into FilecoinPay for the payer + grant the warm-storage service
+# operator approval, so `piri init`'s proof-set creation clears
+# InsufficientLockupFunds. Developer machine only (needs your op session + cast).
+# Amounts are baked in but env-overridable; see scripts/staging-fund-payer.sh.
+staging-fund-payer:
+	@./scripts/staging-fund-payer.sh
+
+# Full destructive reset of BOTH staging bundles in one shot: wipe all data
+# (Hilt tenants + access keys, piri objects, ingot buckets + blob_locations,
+# Postgres, DynamoDB, MinIO, the hilt-vault Raft store) and redeploy from
+# scratch. Runs the whole provision -> vault-init -> deploy -> register sequence
+# in the correct order, aborting on the first failure.
+#
+# What SURVIVES: all Ed25519 service identities and EVM wallet addresses (only
+# re-shipped from 1Password, never regenerated) and all on-chain state (wallet
+# balances, the payer's FilecoinPay deposit). What ROTATES: the hilt-vault unseal
+# key + root token, since the Vault store is wiped and `vault operator init`
+# mints them at runtime (staging-vault-init overwrites the two 1Password fields).
+#
+# Set FORGE_REF to deploy a branch other than main:
+#   FORGE_REF=staging-deployment make staging-reset
+# Developer machine only (needs your op session + SSH); never run from CI.
+staging-reset:
+	@$(MAKE) --no-print-directory staging-provision-core
+	@$(MAKE) --no-print-directory staging-provision-piri
+	@$(MAKE) --no-print-directory staging-vault-init
+	@$(MAKE) --no-print-directory staging-deploy-core
+	@$(MAKE) --no-print-directory staging-allowlist-piri
+	@$(MAKE) --no-print-directory staging-deploy-piri
+	@$(MAKE) --no-print-directory staging-register-piri
+	@$(MAKE) --no-print-directory staging-register-ingot
+	@echo "staging-reset complete."
+
 # Pull latest pre-built images (ignores failures for local-only images)
 pull: generated/compose/piri.yml ensure-state
 	$(COMPOSE) pull --ignore-pull-failures

cmd/smelt/cmd/staging.go

@@ -0,0 +1,110 @@
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/fil-forge/smelt/pkg/staging"
+	"github.com/spf13/cobra"
+)
+
+var stagingCmd = &cobra.Command{
+	Use:   "staging",
+	Short: "Manage the Forge staging deployment",
+}
+
+var stagingKeygenCmd = &cobra.Command{
+	Use:   "keygen",
+	Short: "Ensure staging keys, wallets, and proofs exist (idempotent)",
+	Long: `Ensures the staging stack's long-lived secrets exist in 1Password and writes
+the (non-secret) UCAN delegation proofs into environments/staging/proofs/ to be
+committed.
+
+The ceremony is idempotent: every field the 1Password item already holds is
+reused byte-for-byte — funded wallets, registered DIDs, and shipped keys survive
+a re-run — and only missing fields are generated and added. Proofs are re-issued
+only when missing or when a key they depend on was freshly generated.
+
+It covers:
+  - Ed25519 service identity keys (PEM), incl. hilt and ingot
+  - real random secp256k1 EVM wallets for the payer, delegator transactor, and
+    piri owner — their addresses are printed so you can fund them via a Calibnet
+    faucet (private keys are stored in 1Password, never printed)
+  - random connection secrets (Postgres admin + per-service passwords, MinIO
+    keys, hilt partner key, ingot root S3 credentials)
+  - the indexing/egress/piri/hilt/ingot UCAN delegation proofs
+
+The hilt Vault unseal key + root token are NOT minted here — they are produced
+by "vault operator init" at runtime and stored in 1Password by
+"make staging-vault-init".
+
+To rotate a specific secret, delete its field from the 1Password item (and any
+proof files signed with it) and re-run.`,
+	RunE: runStagingKeygen,
+}
+
+func init() {
+	rootCmd.AddCommand(stagingCmd)
+	stagingCmd.AddCommand(stagingKeygenCmd)
+	stagingKeygenCmd.Flags().StringP("project-dir", "d", ".", "project root directory")
+	stagingKeygenCmd.Flags().String("op-vault", "Fil One", "1Password vault")
+	stagingKeygenCmd.Flags().String("op-item", "FilOne Forge Staging", "1Password item title")
+	stagingKeygenCmd.Flags().Bool("store", true, "store generated secrets into 1Password via the op CLI")
+	stagingKeygenCmd.Flags().Bool("proofs", true, "generate UCAN delegation proofs (requires ucantool)")
+	stagingKeygenCmd.Flags().String("ucantool", "ucantool", "ucantool binary name or path")
+}
+
+func runStagingKeygen(cmd *cobra.Command, args []string) error {
+	projectDir, _ := cmd.Flags().GetString("project-dir")
+	opVault, _ := cmd.Flags().GetString("op-vault")
+	opItem, _ := cmd.Flags().GetString("op-item")
+	store, _ := cmd.Flags().GetBool("store")
+	proofs, _ := cmd.Flags().GetBool("proofs")
+	ucantool, _ := cmd.Flags().GetString("ucantool")
+
+	result, err := staging.Keygen(staging.Options{
+		ProjectDir: projectDir,
+		OPVault:    opVault,
+		OPItem:     opItem,
+		Store:      store,
+		Proofs:     proofs,
+		Ucantool:   ucantool,
+	})
+	if err != nil {
+		return err
+	}
+
+	fmt.Println("Staging keygen complete.")
+	if len(result.GeneratedFields) > 0 {
+		fmt.Printf("\nNewly generated field(s):\n")
+		for _, f := range result.GeneratedFields {
+			fmt.Printf("  %s\n", f)
+		}
+	}
+	if len(result.ReusedFields) > 0 {
+		fmt.Printf("\nReused %d existing field(s) from 1Password (not rotated).\n", len(result.ReusedFields))
+	}
+	if len(result.GeneratedFields) == 0 && len(result.ReusedFields) > 0 {
+		fmt.Println("All secrets already existed — nothing was rotated.")
+	}
+	if len(result.ProofsWritten) > 0 {
+		fmt.Printf("\nProofs written (commit these):\n")
+		for _, p := range result.ProofsWritten {
+			fmt.Printf("  %s\n", p)
+		}
+	}
+	if len(result.OPFields) > 0 {
+		fmt.Printf("\nStored %d secret field(s) in 1Password item %q (vault %q):\n",
+			len(result.OPFields), opItem, opVault)
+		for _, f := range result.OPFields {
+			fmt.Printf("  %s\n", f)
+		}
+	}
+	if result.WalletsEnvPath != "" {
+		fmt.Printf("\nWrote wallet addresses to %s (commit it).\n", result.WalletsEnvPath)
+	}
+	fmt.Printf("\nFund these wallets on the Calibnet faucet (https://faucet.calibnet.chainsafe-fil.io):\n")
+	for role, addr := range result.FundAddresses {
+		fmt.Printf("  %-24s %s\n", role+":", addr)
+	}
+	return nil
+}