feat(cli): build offline artifact packs

Author: Dicklesworthstone

.beads/issues.jsonl

@@ -412,6 +412,17 @@ acfs() {
         return 1
       fi
       ;;
+    offline-pack|artifact-pack)
+      if [[ -f "$acfs_home/scripts/lib/offline_artifact_pack.sh" ]]; then
+        bash "$acfs_home/scripts/lib/offline_artifact_pack.sh" "$@"
+      elif [[ -x "$acfs_bin" ]]; then
+        "$acfs_bin" offline-pack "$@"
+      else
+        echo "Error: offline_artifact_pack.sh not found"
+        echo "Re-run the ACFS installer to get the latest scripts"
+        return 1
+      fi
+      ;;
     landing-plane|land|closeout)
       if [[ -f "$acfs_home/scripts/lib/landing_plane.sh" ]]; then
         bash "$acfs_home/scripts/lib/landing_plane.sh" "$@"
@@ -493,6 +504,7 @@ acfs() {
       echo "  session         List/export/import agent sessions (cass)"
       echo "  support-bundle  Collect diagnostic data for troubleshooting"
       echo "  provisioning-packet Validate/render provider packet JSON"
+      echo "  offline-pack    Build verified offline artifact packs"
       echo "  landing-plane   Closeout checklist for gates, Beads, Mail, and reservations"
       echo "  provenance      Installed-tool provenance ledger for diagnostics"
       echo "  changelog       Show recent changes (--all, --since 7d, --json)"

acfs/zsh/acfs.zshrc

@@ -337,6 +337,26 @@ Future pack builder commands must:
   module counts
 - emit JSON output for CI and support
 
+## Builder Command
+
+`acfs offline-pack build` prepares `acfs-offline-pack/` from a connected
+machine:
+
+```bash
+acfs offline-pack build --output /tmp/acfs-pack --module stack.rch
+acfs offline-pack build --dry-run --json
+```
+
+The command resolves modules from `acfs.manifest.yaml`, includes only modules
+with `verified_installer` metadata, reads source URLs and SHA256 values from
+`checksums.yaml`, downloads each approved installer into `artifacts/`, verifies
+the downloaded bytes, copies the local ACFS scripts/configuration needed for
+offline verification, and writes `manifest.json`.
+
+Default behavior is fail-closed: any missing checksum entry, unsupported module,
+download failure, timeout, or hash mismatch aborts the pack. `--best-effort`
+must be set explicitly to write a diagnostic pack with failure metadata.
+
 ## Consumer Requirements
 
 Future installer consumers must:

docs/operations/offline-artifact-pack.md

@@ -7093,6 +7093,7 @@ finalize() {
     try_step "Installing swarm_inventory.sh" install_asset "scripts/lib/swarm_inventory.sh" "$ACFS_HOME/scripts/lib/swarm_inventory.sh" || return 1
     try_step "Installing landing_plane.sh" install_asset "scripts/lib/landing_plane.sh" "$ACFS_HOME/scripts/lib/landing_plane.sh" || return 1
     try_step "Installing provenance.sh" install_asset "scripts/lib/provenance.sh" "$ACFS_HOME/scripts/lib/provenance.sh" || return 1
+    try_step "Installing offline_artifact_pack.sh" install_asset "scripts/lib/offline_artifact_pack.sh" "$ACFS_HOME/scripts/lib/offline_artifact_pack.sh" || return 1
     try_step "Installing changelog.sh" install_asset "scripts/lib/changelog.sh" "$ACFS_HOME/scripts/lib/changelog.sh" || return 1
     try_step "Installing export-config.sh" install_asset "scripts/lib/export-config.sh" "$ACFS_HOME/scripts/lib/export-config.sh" || return 1
     try_step "Installing cheatsheet.sh" install_asset "scripts/lib/cheatsheet.sh" "$ACFS_HOME/scripts/lib/cheatsheet.sh" || return 1

install.sh

@@ -360,6 +360,7 @@ const INTERNAL_SCRIPTS_TO_CHECKSUM = [
   'scripts/lib/update.sh',
   'scripts/lib/doctor.sh',
   'scripts/lib/doctor_fix.sh',
+  'scripts/lib/offline_artifact_pack.sh',
   'scripts/lib/autofix.sh',
   'scripts/lib/install_helpers.sh',
   'scripts/lib/logging.sh',

packages/manifest/src/generate.ts

@@ -90,6 +90,25 @@ _acfs() {
                         '-h[Show help message]' \
                         '--help[Show help message]'
                     ;;
+                offline-pack|artifact-pack)
+                    _arguments \
+                        '1: :((build\\:Build\\ verified\\ offline\\ artifact\\ pack))' \
+                        '--json[Emit machine-readable JSON]' \
+                        '--markdown[Emit human-readable output]' \
+                        '--output[Output directory]:directory:_files -/' \
+                        '--module[Manifest module id to include]:module id:' \
+                        '--dry-run[Print resolved plan without writing files]' \
+                        '--best-effort[Write diagnostic pack after download failures]' \
+                        '--source-root[ACFS source root]:directory:_files -/' \
+                        '--manifest-file[Manifest YAML file]:file:_files' \
+                        '--checksums-file[checksums.yaml file]:file:_files' \
+                        '--arch[Target architecture]:architecture:(x86_64 aarch64)' \
+                        '--ubuntu-version[Target Ubuntu version]:version:' \
+                        '--timeout[Per-download timeout in seconds]:seconds:' \
+                        '--expires-days[Pack expiry window in days]:days:' \
+                        '-h[Show help message]' \
+                        '--help[Show help message]'
+                    ;;
                 swarm)
                     _arguments -C \
                         '1: :_acfs_swarm_commands' \
@@ -443,6 +462,8 @@ _acfs_commands() {
         'swarm_inventory:Local host inventory report/import/export/validate'
         'provisioning-packet:Validate/render provider provisioning packet JSON'
         'provider-packet:Validate/render provider packet JSON'
+        'offline-pack:Build verified offline artifact packs'
+        'artifact-pack:Build verified offline artifact packs'
         'coordinate:Coordination preflight helpers'
         'coord:Coordination helpers (alias for coordinate)'
         'cheatsheet:Command reference (aliases, shortcuts)'

scripts/completions/_acfs

@@ -8,7 +8,7 @@ _acfs_completions() {
     local cur prev words cword
     _init_completion || return
 
-    local commands="newproj new services svc services-setup setup doctor check session sessions update status continue progress info i capacity cap policy-lint policy_lint credential-preflight credential_preflight secrets-preflight secrets_preflight swarm swarm-plan swarm_plan swarm-status swarm_status swarm-simulate swarm_simulate swarm-packet swarm_packet swarm-assign swarm_assign swarm-convergence swarm_convergence swarm-calibration swarm_calibration swarm-inventory swarm_inventory provisioning-packet provider-packet coordinate coord cheatsheet cs changelog changes log export-config export dashboard dash support-bundle bundle version help"
+    local commands="newproj new services svc services-setup setup doctor check session sessions update status continue progress info i capacity cap policy-lint policy_lint credential-preflight credential_preflight secrets-preflight secrets_preflight swarm swarm-plan swarm_plan swarm-status swarm_status swarm-simulate swarm_simulate swarm-packet swarm_packet swarm-assign swarm_assign swarm-convergence swarm_convergence swarm-calibration swarm_calibration swarm-inventory swarm_inventory provisioning-packet provider-packet offline-pack artifact-pack coordinate coord cheatsheet cs changelog changes log export-config export dashboard dash support-bundle bundle version help"
 
     # Subcommand-specific flags
     local newproj_flags="-i --interactive --no-br --no-claude --no-agents -h --help"
@@ -29,6 +29,7 @@ _acfs_completions() {
     local swarm_calibration_flags="--json --markdown --artifact-dir --rch-file -h --help"
     local swarm_inventory_flags="report import export validate --json --markdown --inventory --input --output --format --artifact-dir -h --help"
     local provisioning_packet_flags="--json --markdown --file --packet -h --help"
+    local offline_pack_flags="build --json --markdown --output --module --dry-run --best-effort --source-root --manifest-file --checksums-file --arch --ubuntu-version --timeout --expires-days -h --help"
     local coordinate_subcommands="doctor preflight help"
     local cheatsheet_flags="--json"
     local changelog_flags="--all --since --json -h --help"
@@ -49,7 +50,7 @@ _acfs_completions() {
     local cmd=""
     for ((i=1; i < cword; i++)); do
         case "${words[i]}" in
-            newproj|new|services|svc|services-setup|setup|doctor|check|session|sessions|update|status|continue|progress|info|i|capacity|cap|policy-lint|policy_lint|credential-preflight|credential_preflight|secrets-preflight|secrets_preflight|swarm|swarm-plan|swarm_plan|swarm-status|swarm_status|swarm-simulate|swarm_simulate|swarm-packet|swarm_packet|swarm-assign|swarm_assign|swarm-convergence|swarm_convergence|swarm-calibration|swarm_calibration|swarm-inventory|swarm_inventory|provisioning-packet|provider-packet|coordinate|coord|cheatsheet|cs|changelog|changes|log|export-config|export|dashboard|dash|support-bundle|bundle|version|help)
+            newproj|new|services|svc|services-setup|setup|doctor|check|session|sessions|update|status|continue|progress|info|i|capacity|cap|policy-lint|policy_lint|credential-preflight|credential_preflight|secrets-preflight|secrets_preflight|swarm|swarm-plan|swarm_plan|swarm-status|swarm_status|swarm-simulate|swarm_simulate|swarm-packet|swarm_packet|swarm-assign|swarm_assign|swarm-convergence|swarm_convergence|swarm-calibration|swarm_calibration|swarm-inventory|swarm_inventory|provisioning-packet|provider-packet|offline-pack|artifact-pack|coordinate|coord|cheatsheet|cs|changelog|changes|log|export-config|export|dashboard|dash|support-bundle|bundle|version|help)
                 cmd="${words[i]}"
                 break
                 ;;
@@ -89,6 +90,10 @@ _acfs_completions() {
             mapfile -t COMPREPLY < <(compgen -W "$provisioning_packet_flags" -- "$cur")
             return
             ;;
+        offline-pack|artifact-pack)
+            mapfile -t COMPREPLY < <(compgen -W "$offline_pack_flags" -- "$cur")
+            return
+            ;;
         swarm)
             local swarm_cmd=""
             for ((j=i+1; j < cword; j++)); do

scripts/completions/acfs.bash

@@ -10,9 +10,10 @@
 declare -gA ACFS_INTERNAL_CHECKSUMS=(
   [scripts/lib/security.sh]="34a72de448d98229913465ad5914d19f9d17d8921b33f5438ef8bb0e1ef9fb60"
   [scripts/lib/agents.sh]="66fac24c48c9ce7d17ae213ff2f8669a1902e77f01266f4eeaccdcef09e02856"
-  [scripts/lib/update.sh]="59ba47a1284d590319e2d392e6c8838d545a35e09efb1f3ac8cbfb834ef9d4c6"
-  [scripts/lib/doctor.sh]="8315bdeb06051af7e12143f229e0ddec36eda69a2f5e7845ee9bdf754aa1e9e7"
+  [scripts/lib/update.sh]="7bcad29c1bf19308841c4f090361b405b3a7ae1ddc2b0783705686f45b9cfb86"
+  [scripts/lib/doctor.sh]="f784629ae65d0a258d92d759b9dc785d66a68b6b439930c78bef79f038c476ea"
   [scripts/lib/doctor_fix.sh]="074e8512b1b5cc6a6d27513d5463b585b0e5c35540180e58747793a7c67d3a6f"
+  [scripts/lib/offline_artifact_pack.sh]="38c6c2821044e2ac197b686403902419d73859f5eb370244f27e2ae54a5f1db1"
   [scripts/lib/autofix.sh]="0468d4889d304a404f161778ddf393a71fa7657317f88f692a47442760ed78d9"
   [scripts/lib/install_helpers.sh]="7fb952755e0401bec1c2a20b247d35809eab73ce51a1de1c2b6d725be9431481"
   [scripts/lib/logging.sh]="af95380f740a905f990e68a627508eb6dbaa6f83e03014c8eea2b69c2750dabe"
@@ -27,5 +28,5 @@ declare -gA ACFS_INTERNAL_CHECKSUMS=(
   [scripts/acfs-update]="3ab9578caa95e7866a706c543bc8af9302ccf20538b716cca621e5c037ee24b0"
 )
 
-ACFS_INTERNAL_CHECKSUMS_COUNT=17
+ACFS_INTERNAL_CHECKSUMS_COUNT=18
 ACFS_INTERNAL_CHECKSUMS_GENERATED="$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo unknown)"

scripts/generated/internal_checksums.sh

@@ -1007,6 +1007,7 @@ print_acfs_help() {
     echo "  swarm calibration   Artifact-backed capacity calibration report"
     echo "  swarm inventory     Local host inventory report/import/export/validate"
     echo "  provisioning-packet Validate/render provider provisioning packet JSON"
+    echo "  offline-pack        Build verified offline artifact packs"
     echo "  coordinate doctor   Alias for swarm doctor"
     echo "  cheatsheet          Command reference (aliases, shortcuts)"
     echo "  changelog [options] Show recent project changes"
@@ -4673,6 +4674,18 @@ main() {
             echo "Error: provisioning_packet.sh not found" >&2
             return 1
             ;;
+        offline-pack|artifact-pack)
+            shift
+            local offline_artifact_pack_script=""
+            offline_artifact_pack_script="$(_acfs_doctor_find_lib_script "offline_artifact_pack.sh" 2>/dev/null || true)"
+
+            if [[ -n "$offline_artifact_pack_script" ]]; then
+                _acfs_doctor_exec_bash_script "$offline_artifact_pack_script" "$@"
+            fi
+
+            echo "Error: offline_artifact_pack.sh not found" >&2
+            return 1
+            ;;
         version|-v|--version)
             local version_file=""
             version_file="$(_acfs_doctor_find_project_path "VERSION" 2>/dev/null || true)"