[AmrMsCLL]

Fixes from the review of the deploy agent, plus the volume backup labels that existing volumes could not take.

Agent (host/agent.py)

Finding	Fix
A signed compose could ask for anything as root	Every project except console, edge and backup is checked before anything is written: no privileged, pid, ipc, uts, userns_mode, network_mode, cgroup, cap_add, devices, volumes_from, sysctls, ports, build, env_file, no security_opt beyond no-new-privileges, bind mounts only under ./, no external, foreign or driver-option volumes, only the external edge network, config files only under ./ and never from the environment. The list of projects with host access lives in agent.py on the host, so CI cannot change it.
A route could claim another project's hostname	A route may only use Host(...) rules, may not name a hostname another route file already holds, and may only send traffic to its own containers (http://<project>:port or <project>-*).
A compose could read the agent's token	Not in the review: Compose interpolates from the process environment, so ${DEPLOY_TOKEN} would have reached a container. graphite-up and compose down now run with only PATH and HOME.
Unbounded body, single thread	Content-Length is required and capped at 4 MiB; clients time out after 30 s; a threaded server keeps /healthz answering while one lock keeps deploys serial.
/reapply exposed	Removed with CONSOLE_TOKEN; the console redeploys through a host unit instead (console PR). The public route now passes only /deploy and /healthz.
Legacy secrets action	Removed, with scripts/agent.py's secrets command. The secrets repository's Apply workflow fails from now on; disable it.
Replay within five minutes	Each accepted signature is remembered for ten minutes and refused again.

Containers on the host can still reach 172.17.0.1:9000; with /reapply gone, only signed /deploy requests do anything there.

Deploy trigger

The graphite-deploy app can push to main past review (it is a bypass actor) and every project's CI can mint its token, so a compromised project CI could push any file and Deploy would run it. The app has no workflows permission, so deploy.yml is the place to check: a push by a bot now fails Deploy unless it changes only IMAGE_TAG=sha-… lines in deploy/*/values. projects/** no longer triggers Deploy, so registry syncs never deploy on their own; deploy by hand after a hosting change.

Backups

Docker cannot add labels to existing volumes, so the deploys kept console_data and strata_files-data without graphite.backup and printed a recreate prompt each time. The label moves to the container: graphite.backup.volumes: <volume>[,<volume>] on the service that mounts them, which backup.py reads.

Redeploy hint

graphite-up touches /srv/graphite/<project>/.applied after a successful up. The console compares a project's env file with it, so a redeploy that recreates nothing (a secret no container reads) still clears "needs redeploy".

Rollout

After merge, install the new agent and edge route over SSH, then run Deploy with project all:

source=https://raw.githubusercontent.com/project-graphite/platform/main/host
sudo curl -fsSL -o /srv/graphite/bin/agent.py "$source/agent.py"
sudo curl -fsSL -o /srv/graphite/bin/graphite-up "$source/graphite-up"
sudo chmod 755 /srv/graphite/bin/graphite-up
sudo systemctl restart graphite-agent

CONSOLE_TOKEN can be deleted from /agent/ in the console.

Checks

The policy was run against the flattened compose and route of Strata, Tracker and PixelPocket (no findings) and against a crafted compose and route (each rule caught); a replayed signature is refused. deploy.py check, check-values.py, check-memory.py pass.