{
  name        = "fleet_agent",
  version     = "0.1.0",
  description = "Node-side autonomic executor for libre-forge fleets. Subscribes to fleet.libre-forge.nodes.<host>.command.>, emits NodeEvent::Heartbeat/Bound/Released/DrainComplete on fleet.libre-forge.nodes.<host>.events.>. Binary is `oras pull`'d from daoreg.../libre-forge/fleet-agent:<semver> and run under systemd. Requires fleet_base (provides /etc/fleet/age.key surface used to decrypt the NATS nkey seed at deploy time).",
  tags        = ["fleet", "agent", "nats", "control-plane", "autonomic"],
  modes       = ["systemd_unit"],
  dependencies = [
    { id = "fleet_base", kind = 'Required, reason = "provides /etc/fleet/age.key; agent.creds is sops-decrypted before deploy" },
  ],
  provides    = [{ id = "fleet-agent", version = "0.1", interface = "fleet-agent" }],
  requires    = [
    { capability = "vm-lifecycle", kind = 'Required },
    { capability = "ssh-access",   kind = 'Required },
    { capability = "oci-pull",     kind = 'Required },
  ],
  conflicts_with = [],
  best_practices = ["agent-runs-as-system-user", "creds-mode-0400", "no-buildkitd-interference"],
}