diff --git a/.envrc b/.envrc
index 9731258f343..a6ab4f52174 100644
--- a/.envrc
+++ b/.envrc
@@ -5,6 +5,7 @@ PATH_add out/cockroachdb/bin
 PATH_add out/clickhouse
 PATH_add out/dendrite-stub/bin
 PATH_add out/mgd/root/opt/oxide/mgd/bin
+PATH_add out/mg-ddm/root/opt/oxide/mg-ddm/bin
 
 if [ "$OMICRON_USE_FLAKE" = 1 ] && nix flake show &> /dev/null
 then
diff --git a/Cargo.lock b/Cargo.lock
index e83da904c92..cd2e64bbad4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -102,7 +102,22 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
 dependencies = [
  "anstyle",
- "anstyle-parse",
+ "anstyle-parse 0.2.7",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse 1.0.0",
  "anstyle-query",
  "anstyle-wincon",
  "colorchoice",
@@ -112,9 +127,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.13"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
 [[package]]
 name = "anstyle-parse"
@@ -125,6 +140,15 @@ dependencies = [
  "utf8parse",
 ]
 
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
 [[package]]
 name = "anstyle-query"
 version = "1.1.5"
@@ -161,6 +185,17 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "api_identity"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "omicron-workspace-hack",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "approx"
 version = "0.5.1"
@@ -648,7 +683,7 @@ dependencies = [
  "bitflags 2.11.0",
  "cexpr",
  "clang-sys",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "log",
  "prettyplease",
  "proc-macro2",
@@ -824,7 +859,7 @@ dependencies = [
  "derive_more 0.99.20",
  "hex",
  "hkdf",
- "omicron-ledger",
+ "omicron-ledger 0.1.0",
  "omicron-workspace-hack",
  "proptest",
  "rand 0.8.6",
@@ -832,7 +867,7 @@ dependencies = [
  "serde",
  "serde_with",
  "sha3",
- "sled-hardware-types",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-async",
  "slog-error-chain",
@@ -844,6 +879,35 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "bootstore"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "bytes",
+ "camino",
+ "chacha20poly1305",
+ "ciborium",
+ "derive_more 0.99.20",
+ "hex",
+ "hkdf",
+ "omicron-ledger 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "omicron-workspace-hack",
+ "rand 0.8.6",
+ "secrecy 0.10.3",
+ "serde",
+ "serde_with",
+ "sha3",
+ "sled-hardware-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "slog",
+ "slog-error-chain",
+ "thiserror 2.0.18",
+ "tokio",
+ "uuid",
+ "vsss-rs",
+ "zeroize",
+]
+
 [[package]]
 name = "bootstrap-agent-api"
 version = "0.1.0"
@@ -855,9 +919,9 @@ dependencies = [
  "omicron-workspace-hack",
  "schemars 0.8.22",
  "serde",
- "sled-agent-types",
- "sled-agent-types-versions",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-agent-types-versions 0.1.0",
+ "sled-hardware-types 0.1.0",
  "tufaceous-artifact",
 ]
 
@@ -875,8 +939,8 @@ dependencies = [
  "schemars 0.8.22",
  "serde",
  "serde_json",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "uuid",
 ]
@@ -885,7 +949,7 @@ dependencies = [
 name = "bootstrap-agent-lockstep-api"
 version = "0.1.0"
 dependencies = [
- "bootstrap-agent-lockstep-types",
+ "bootstrap-agent-lockstep-types 0.1.0",
  "dropshot 0.17.0",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -905,8 +969,8 @@ dependencies = [
  "schemars 0.8.22",
  "serde",
  "serde_json",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
 ]
 
@@ -916,13 +980,30 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "omicron-common",
- "omicron-passwords",
+ "omicron-passwords 0.1.0",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "schemars 0.8.22",
+ "serde",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
+ "strum 0.27.2",
+]
+
+[[package]]
+name = "bootstrap-agent-lockstep-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "anyhow",
+ "omicron-common",
+ "omicron-passwords 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "schemars 0.8.22",
  "serde",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "sled-hardware-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "strum 0.27.2",
 ]
 
@@ -1041,7 +1122,7 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8c236e531d024b1524669ee2a56eca09ab8a40f3395dc2728cde9defa9c60d8"
 dependencies = [
- "anstream",
+ "anstream 0.6.21",
  "anstyle",
  "camino",
  "camino-tempfile",
@@ -1233,7 +1314,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
 dependencies = [
- "nom",
+ "nom 7.1.3",
 ]
 
 [[package]]
@@ -1402,9 +1483,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.60"
+version = "4.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2797f34da339ce31042b27d23607e051786132987f595b02ba4f6a6dffb7030a"
+checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -1412,11 +1493,11 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.60"
+version = "4.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24a241312cea5059b13574bb9b3861cabf758b879c15190b37b6d6fd63ab6876"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
 dependencies = [
- "anstream",
+ "anstream 1.0.0",
  "anstyle",
  "clap_lex",
  "strsim",
@@ -1425,9 +1506,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.55"
+version = "4.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a92793da1a46a5f2a02a6f4c46c6496b28c43638adea8306fcb0caa1634f24e5"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
@@ -1450,7 +1531,7 @@ dependencies = [
  "chrono",
  "clap",
  "clickhouse-admin-server-client",
- "clickhouse-admin-types",
+ "clickhouse-admin-types 0.1.0",
  "dropshot 0.17.0",
  "futures",
  "omicron-common",
@@ -1472,7 +1553,7 @@ dependencies = [
 name = "clickhouse-admin-api"
 version = "0.1.0"
 dependencies = [
- "clickhouse-admin-types-versions",
+ "clickhouse-admin-types-versions 0.1.0",
  "dropshot 0.17.0",
  "dropshot-api-manager-types",
  "omicron-common",
@@ -1488,7 +1569,7 @@ name = "clickhouse-admin-keeper-client"
 version = "0.1.0"
 dependencies = [
  "chrono",
- "clickhouse-admin-types",
+ "clickhouse-admin-types 0.1.0",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "progenitor 0.14.0",
@@ -1503,7 +1584,7 @@ name = "clickhouse-admin-server-client"
 version = "0.1.0"
 dependencies = [
  "chrono",
- "clickhouse-admin-types",
+ "clickhouse-admin-types 0.1.0",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "progenitor 0.14.0",
@@ -1518,7 +1599,7 @@ name = "clickhouse-admin-single-client"
 version = "0.1.0"
 dependencies = [
  "chrono",
- "clickhouse-admin-types",
+ "clickhouse-admin-types 0.1.0",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "progenitor 0.14.0",
@@ -1533,7 +1614,7 @@ name = "clickhouse-admin-test-utils"
 version = "0.1.0"
 dependencies = [
  "camino",
- "clickhouse-admin-types",
+ "clickhouse-admin-types 0.1.0",
  "clickward",
  "dropshot 0.17.0",
  "omicron-workspace-hack",
@@ -1543,7 +1624,16 @@ dependencies = [
 name = "clickhouse-admin-types"
 version = "0.1.0"
 dependencies = [
- "clickhouse-admin-types-versions",
+ "clickhouse-admin-types-versions 0.1.0",
+ "omicron-workspace-hack",
+]
+
+[[package]]
+name = "clickhouse-admin-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "clickhouse-admin-types-versions 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "omicron-workspace-hack",
 ]
 
@@ -1571,6 +1661,29 @@ dependencies = [
  "slog-term",
 ]
 
+[[package]]
+name = "clickhouse-admin-types-versions"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "anyhow",
+ "atomicwrites",
+ "camino",
+ "camino-tempfile",
+ "chrono",
+ "daft",
+ "derive_more 0.99.20",
+ "expectorate",
+ "iddqd",
+ "itertools 0.14.0",
+ "omicron-common",
+ "omicron-workspace-hack",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "slog",
+]
+
 [[package]]
 name = "clickhouse-cluster-dev"
 version = "0.1.0"
@@ -1580,7 +1693,7 @@ dependencies = [
  "clickward",
  "omicron-workspace-hack",
  "oxide-tokio-rt",
- "oximeter-db",
+ "oximeter-db 0.1.0",
  "oximeter-test-utils",
  "scopeguard",
  "slog",
@@ -1634,7 +1747,7 @@ dependencies = [
 name = "cockroach-admin-api"
 version = "0.1.0"
 dependencies = [
- "cockroach-admin-types-versions",
+ "cockroach-admin-types-versions 0.1.0",
  "dropshot 0.17.0",
  "dropshot-api-manager-types",
  "http",
@@ -1661,7 +1774,17 @@ dependencies = [
 name = "cockroach-admin-types"
 version = "0.1.0"
 dependencies = [
- "cockroach-admin-types-versions",
+ "cockroach-admin-types-versions 0.1.0",
+ "omicron-workspace-hack",
+ "serde",
+]
+
+[[package]]
+name = "cockroach-admin-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "cockroach-admin-types-versions 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "omicron-workspace-hack",
  "serde",
 ]
@@ -1682,6 +1805,20 @@ dependencies = [
  "thiserror 2.0.18",
 ]
 
+[[package]]
+name = "cockroach-admin-types-versions"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "chrono",
+ "csv",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "schemars 0.8.22",
+ "serde",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "colorchoice"
 version = "1.0.4"
@@ -1704,7 +1841,7 @@ version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -1720,7 +1857,7 @@ dependencies = [
 [[package]]
 name = "common"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/dendrite?branch=main#f20f786e67c86388dfaaf0ef3aa9d2693dfe1da4"
+source = "git+https://github.com/oxidecomputer/dendrite?branch=main#85d6fc96d95369f40c40778d48da87c5952f6745"
 dependencies = [
  "anyhow",
  "chrono",
@@ -1733,7 +1870,7 @@ dependencies = [
  "slog-async",
  "slog-bunyan",
  "slog-term",
- "smf 0.10.0",
+ "smf 0.10.0 (git+https://github.com/illumos/smf-rs)",
  "thiserror 1.0.69",
  "tokio",
 ]
@@ -1754,7 +1891,7 @@ dependencies = [
  "slog-async",
  "slog-bunyan",
  "slog-term",
- "smf 0.10.0",
+ "smf 0.10.0 (git+https://github.com/illumos/smf-rs)",
  "thiserror 1.0.69",
  "tokio",
 ]
@@ -1776,7 +1913,7 @@ dependencies = [
  "slog-async",
  "slog-bunyan",
  "slog-term",
- "smf 0.10.0",
+ "smf 0.10.0 (git+https://github.com/illumos/smf-rs)",
  "thiserror 1.0.69",
  "tokio",
 ]
@@ -2525,16 +2662,37 @@ dependencies = [
 [[package]]
 name = "ddm-admin-client"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/maghemite?rev=7696ee48d5ee29a917dea459e281fe2e8ff20513#7696ee48d5ee29a917dea459e281fe2e8ff20513"
+source = "git+https://github.com/oxidecomputer/maghemite?rev=9bb5037167c1ff0d812299f668841c9b7bda4480#9bb5037167c1ff0d812299f668841c9b7bda4480"
 dependencies = [
+ "ddm-api-types-versions",
  "oxnet",
- "progenitor 0.13.0",
+ "progenitor 0.14.0",
  "reqwest 0.13.2",
  "serde",
  "slog",
  "uuid",
 ]
 
+[[package]]
+name = "ddm-api-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/maghemite?rev=9bb5037167c1ff0d812299f668841c9b7bda4480#9bb5037167c1ff0d812299f668841c9b7bda4480"
+dependencies = [
+ "ddm-api-types-versions",
+]
+
+[[package]]
+name = "ddm-api-types-versions"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/maghemite?rev=9bb5037167c1ff0d812299f668841c9b7bda4480#9bb5037167c1ff0d812299f668841c9b7bda4480"
+dependencies = [
+ "oxnet",
+ "schemars 0.8.22",
+ "serde",
+ "serde_repr",
+ "uuid",
+]
+
 [[package]]
 name = "debug-ignore"
 version = "1.0.5"
@@ -2937,11 +3095,11 @@ dependencies = [
 [[package]]
 name = "dlpi"
 version = "0.2.0"
-source = "git+https://github.com/oxidecomputer/dlpi-sys#d9645f8d61187e76384474b1100f6537fb644993"
+source = "git+https://github.com/oxidecomputer/dlpi-sys#a611f32a2374579d25e628b395a9cb251f753388"
 dependencies = [
  "libc",
  "libdlpi-sys",
- "num_enum 0.7.5",
+ "num_enum 0.7.6",
  "pretty-hex",
  "thiserror 2.0.18",
 ]
@@ -2963,8 +3121,8 @@ dependencies = [
  "hickory-proto 0.25.2",
  "hickory-resolver 0.25.2",
  "hickory-server",
- "internal-dns-types",
- "internal-dns-types-versions",
+ "internal-dns-types 0.1.0",
+ "internal-dns-types-versions 0.1.0",
  "omicron-common",
  "omicron-test-utils",
  "omicron-workspace-hack",
@@ -2991,7 +3149,7 @@ dependencies = [
  "chrono",
  "dropshot 0.17.0",
  "dropshot-api-manager-types",
- "internal-dns-types-versions",
+ "internal-dns-types-versions 0.1.0",
  "omicron-workspace-hack",
  "schemars 0.8.22",
  "semver 1.0.28",
@@ -3005,7 +3163,7 @@ dependencies = [
  "chrono",
  "expectorate",
  "http",
- "internal-dns-types-versions",
+ "internal-dns-types-versions 0.1.0",
  "omicron-workspace-hack",
  "progenitor 0.14.0",
  "reqwest 0.13.2",
@@ -3026,7 +3184,7 @@ dependencies = [
  "dns-service-client",
  "dropshot 0.17.0",
  "expectorate",
- "internal-dns-types",
+ "internal-dns-types 0.1.0",
  "omicron-test-utils",
  "omicron-workspace-hack",
  "oxide-tokio-rt",
@@ -3084,7 +3242,7 @@ checksum = "117240f60069e65410b3ae1bb213295bd828f707b5bec6596a1afc8793ce0cbc"
 [[package]]
 name = "dpd-client"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/dendrite?branch=main#f20f786e67c86388dfaaf0ef3aa9d2693dfe1da4"
+source = "git+https://github.com/oxidecomputer/dendrite?branch=main#85d6fc96d95369f40c40778d48da87c5952f6745"
 dependencies = [
  "async-trait",
  "chrono",
@@ -3506,7 +3664,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "base64 0.22.1",
- "bootstrap-agent-lockstep-types",
+ "bootstrap-agent-lockstep-types 0.1.0",
  "bytes",
  "chrono",
  "clap",
@@ -3517,8 +3675,8 @@ dependencies = [
  "hickory-resolver 0.25.2",
  "http",
  "humantime",
- "internal-dns-resolver",
- "internal-dns-types",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "internet-checksum",
  "ispf",
  "macaddr",
@@ -3536,7 +3694,7 @@ dependencies = [
  "russh-keys",
  "serde",
  "serde_json",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "slog",
  "slog-error-chain",
  "socket2 0.5.10",
@@ -3579,7 +3737,7 @@ version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b2daee4ea451f429a58296525ddf28b45a3b64f1acf6587e2067437bb11e218d"
 dependencies = [
- "anstream",
+ "anstream 0.6.21",
  "anstyle",
  "env_filter",
  "log",
@@ -3624,6 +3782,20 @@ dependencies = [
  "thiserror 2.0.18",
 ]
 
+[[package]]
+name = "ereport-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "dropshot 0.17.0",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "errno"
 version = "0.3.14"
@@ -3631,7 +3803,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4050,8 +4222,8 @@ version = "0.1.0"
 dependencies = [
  "dropshot 0.17.0",
  "dropshot-api-manager-types",
- "ereport-types",
- "gateway-types-versions",
+ "ereport-types 0.1.0",
+ "gateway-types-versions 0.1.0",
  "omicron-common",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -4068,7 +4240,7 @@ dependencies = [
  "anyhow",
  "clap",
  "futures",
- "gateway-client",
+ "gateway-client 0.1.0",
  "gateway-messages",
  "omicron-common",
  "omicron-uuid-kinds",
@@ -4095,9 +4267,34 @@ dependencies = [
  "base64 0.22.1",
  "chrono",
  "daft",
- "ereport-types",
+ "ereport-types 0.1.0",
  "gateway-messages",
- "gateway-types",
+ "gateway-types 0.1.0",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "progenitor 0.14.0",
+ "rand 0.9.2",
+ "reqwest 0.13.2",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "slog",
+ "thiserror 2.0.18",
+ "tokio",
+ "uuid",
+]
+
+[[package]]
+name = "gateway-client"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "daft",
+ "ereport-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "gateway-messages",
+ "gateway-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "progenitor 0.14.0",
@@ -4184,9 +4381,9 @@ version = "0.1.0"
 dependencies = [
  "camino",
  "dropshot 0.17.0",
- "gateway-client",
+ "gateway-client 0.1.0",
  "gateway-messages",
- "gateway-types",
+ "gateway-types 0.1.0",
  "omicron-gateway",
  "omicron-test-utils",
  "omicron-workspace-hack",
@@ -4202,7 +4399,16 @@ dependencies = [
 name = "gateway-types"
 version = "0.1.0"
 dependencies = [
- "gateway-types-versions",
+ "gateway-types-versions 0.1.0",
+ "omicron-workspace-hack",
+]
+
+[[package]]
+name = "gateway-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "gateway-types-versions 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "omicron-workspace-hack",
 ]
 
@@ -4225,6 +4431,24 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "gateway-types-versions"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "daft",
+ "dropshot 0.17.0",
+ "gateway-messages",
+ "hex",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "schemars 0.8.22",
+ "serde",
+ "thiserror 2.0.18",
+ "tufaceous-artifact",
+ "uuid",
+]
+
 [[package]]
 name = "generic-array"
 version = "0.14.7"
@@ -4304,6 +4528,22 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "gfss"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "digest",
+ "omicron-workspace-hack",
+ "rand 0.9.2",
+ "schemars 0.8.22",
+ "secrecy 0.10.3",
+ "serde",
+ "subtle",
+ "thiserror 2.0.18",
+ "zeroize",
+]
+
 [[package]]
 name = "ghash"
 version = "0.5.1"
@@ -5113,7 +5353,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.3",
+ "socket2 0.5.10",
  "system-configuration",
  "tokio",
  "tower-layer",
@@ -5347,7 +5587,7 @@ dependencies = [
  "iddqd",
  "ipnetwork",
  "itertools 0.14.0",
- "key-manager-types",
+ "key-manager-types 0.1.0",
  "libc",
  "macaddr",
  "nix 0.31.2",
@@ -5364,7 +5604,7 @@ dependencies = [
  "schemars 0.8.22",
  "serde",
  "serde_json",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "slog",
  "slog-async",
  "slog-error-chain",
@@ -5381,38 +5621,87 @@ dependencies = [
 ]
 
 [[package]]
-name = "impl-trait-for-tuples"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0eb5a3343abf848c0984fe4604b2b105da9539376e24fc0a3b0007411ae4fd9"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
-[[package]]
-name = "indent_write"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cfe9645a18782869361d9c8732246be7b410ad4e919d3609ebabdac00ba12c3"
-
-[[package]]
-name = "indexmap"
-version = "1.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+name = "illumos-utils"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
 dependencies = [
- "autocfg",
- "hashbrown 0.12.3",
- "serde",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+ "anyhow",
+ "async-trait",
+ "bhyve_api",
+ "byteorder",
+ "camino",
+ "camino-tempfile",
+ "cfg-if",
+ "chrono",
+ "crucible-smf",
+ "debug-ignore",
+ "dropshot 0.17.0",
+ "futures",
+ "http",
+ "iddqd",
+ "ipnetwork",
+ "itertools 0.14.0",
+ "key-manager-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "libc",
+ "macaddr",
+ "nix 0.31.2",
+ "omicron-common",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "opte-ioctl",
+ "oxide-vpc",
+ "oxlog",
+ "oxnet",
+ "rustix 1.1.3",
+ "schemars 0.8.22",
+ "serde",
+ "sled-agent-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "slog",
+ "slog-async",
+ "slog-error-chain",
+ "slog-term",
+ "smf 0.2.3",
+ "thiserror 2.0.18",
+ "tofino",
+ "tokio",
+ "uuid",
+ "whoami 1.6.1",
+ "zone",
+]
+
+[[package]]
+name = "impl-trait-for-tuples"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0eb5a3343abf848c0984fe4604b2b105da9539376e24fc0a3b0007411ae4fd9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "indent_write"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cfe9645a18782869361d9c8732246be7b410ad4e919d3609ebabdac00ba12c3"
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
  "hashbrown 0.17.0",
@@ -5530,7 +5819,7 @@ dependencies = [
  "hex-literal",
  "http",
  "iddqd",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "installinator-client",
  "installinator-common",
  "ipcc",
@@ -5548,7 +5837,7 @@ dependencies = [
  "serde_json",
  "sha2",
  "sled-hardware",
- "sled-hardware-types",
+ "sled-hardware-types 0.1.0",
  "sled-storage",
  "slog",
  "slog-async",
@@ -5562,7 +5851,7 @@ dependencies = [
  "tokio-stream",
  "tufaceous-artifact",
  "tufaceous-lib",
- "update-engine",
+ "update-engine 0.1.0",
 ]
 
 [[package]]
@@ -5581,7 +5870,7 @@ dependencies = [
  "serde",
  "slog",
  "tufaceous-artifact",
- "update-engine",
+ "update-engine 0.1.0",
  "uuid",
 ]
 
@@ -5599,7 +5888,7 @@ dependencies = [
  "serde",
  "serde_json",
  "slog",
- "update-engine",
+ "update-engine 0.1.0",
 ]
 
 [[package]]
@@ -5608,7 +5897,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "camino",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "installinator-common-versions",
  "libc",
  "omicron-common",
@@ -5621,7 +5910,7 @@ dependencies = [
  "test-strategy",
  "thiserror 2.0.18",
  "tokio",
- "update-engine",
+ "update-engine 0.1.0",
 ]
 
 [[package]]
@@ -5651,8 +5940,8 @@ dependencies = [
  "clap",
  "dropshot 0.17.0",
  "hickory-resolver 0.25.2",
- "internal-dns-resolver",
- "internal-dns-types",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "omicron-common",
  "omicron-workspace-hack",
  "oxide-tokio-rt",
@@ -5674,7 +5963,7 @@ dependencies = [
  "futures",
  "hickory-proto 0.25.2",
  "hickory-resolver 0.25.2",
- "internal-dns-types",
+ "internal-dns-types 0.1.0",
  "omicron-common",
  "omicron-test-utils",
  "omicron-uuid-kinds",
@@ -5692,6 +5981,24 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "internal-dns-resolver"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "futures",
+ "hickory-proto 0.25.2",
+ "hickory-resolver 0.25.2",
+ "internal-dns-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "omicron-common",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "qorb",
+ "reqwest 0.13.2",
+ "slog",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "internal-dns-types"
 version = "0.1.0"
@@ -5699,7 +6006,7 @@ dependencies = [
  "anyhow",
  "chrono",
  "expectorate",
- "internal-dns-types-versions",
+ "internal-dns-types-versions 0.1.0",
  "omicron-common",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -5709,9 +6016,38 @@ dependencies = [
  "strum 0.27.2",
 ]
 
+[[package]]
+name = "internal-dns-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "internal-dns-types-versions 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "omicron-common",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "schemars 0.8.22",
+ "serde",
+ "strum 0.27.2",
+]
+
+[[package]]
+name = "internal-dns-types-versions"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "omicron-common",
+ "omicron-workspace-hack",
+ "schemars 0.8.22",
+ "serde",
+]
+
 [[package]]
 name = "internal-dns-types-versions"
 version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
 dependencies = [
  "anyhow",
  "chrono",
@@ -5793,7 +6129,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi 0.5.2",
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5870,7 +6206,7 @@ dependencies = [
  "portable-atomic",
  "portable-atomic-util",
  "serde_core",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5956,7 +6292,7 @@ version = "0.1.0"
 dependencies = [
  "async-trait",
  "hkdf",
- "key-manager-types",
+ "key-manager-types 0.1.0",
  "omicron-common",
  "omicron-workspace-hack",
  "secrecy 0.10.3",
@@ -5975,6 +6311,15 @@ dependencies = [
  "secrecy 0.10.3",
 ]
 
+[[package]]
+name = "key-manager-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "omicron-workspace-hack",
+ "secrecy 0.10.3",
+]
+
 [[package]]
 name = "knuffel"
 version = "3.2.0"
@@ -6079,7 +6424,7 @@ checksum = "52ff2c0fe9bc6cb6b14a0592c2ff4fa9ceb83eea9db979b0487cd054946a2b8f"
 [[package]]
 name = "libdlpi-sys"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/dlpi-sys#d9645f8d61187e76384474b1100f6537fb644993"
+source = "git+https://github.com/oxidecomputer/dlpi-sys#a611f32a2374579d25e628b395a9cb251f753388"
 
 [[package]]
 name = "libefi-illumos"
@@ -6159,23 +6504,23 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 [[package]]
 name = "libnet"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/netadm-sys?branch=main#1e40efd8497973ef3b7d6f0285510424f53f43c5"
+source = "git+https://github.com/oxidecomputer/netadm-sys?branch=main#ca2cb23e186d8f75dd1f206a7bbe9699758ab12d"
 dependencies = [
  "anyhow",
  "cfg-if",
  "colored 3.1.1",
  "dlpi",
  "libc",
- "num_enum 0.7.5",
+ "num_enum 0.7.6",
  "nvpair",
  "nvpair-sys",
  "oxnet",
- "rand 0.10.0",
+ "rand 0.10.1",
  "rusty-doors",
  "socket2 0.6.3",
  "thiserror 2.0.18",
  "tracing",
- "winnow 0.7.14",
+ "winnow 1.0.3",
 ]
 
 [[package]]
@@ -6243,7 +6588,7 @@ version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5297962ef19edda4ce33aaa484386e0a5b3d7f2f4e037cbeee00503ef6b29d33"
 dependencies = [
- "anstream",
+ "anstream 0.6.21",
  "anstyle",
  "clap",
  "escape8259",
@@ -6340,14 +6685,15 @@ dependencies = [
 [[package]]
 name = "lldpd-client"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/lldp#d22509dfdb051321b859e924948605115691b93c"
+source = "git+https://github.com/oxidecomputer/lldp#ed02e1a3a96f98107cbbe90f90c7ed1c16edf97d"
 dependencies = [
  "chrono",
  "futures",
  "lldpd-common",
- "progenitor 0.11.2",
+ "lldpd-types-versions",
+ "progenitor 0.13.0",
  "protocol",
- "reqwest 0.12.28",
+ "reqwest 0.13.2",
  "schemars 0.8.22",
  "serde",
  "serde_json",
@@ -6358,7 +6704,7 @@ dependencies = [
 [[package]]
 name = "lldpd-common"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/lldp#d22509dfdb051321b859e924948605115691b93c"
+source = "git+https://github.com/oxidecomputer/lldp#ed02e1a3a96f98107cbbe90f90c7ed1c16edf97d"
 dependencies = [
  "anyhow",
  "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?branch=main)",
@@ -6372,6 +6718,18 @@ dependencies = [
  "thiserror 1.0.69",
 ]
 
+[[package]]
+name = "lldpd-types-versions"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/lldp#ed02e1a3a96f98107cbbe90f90c7ed1c16edf97d"
+dependencies = [
+ "chrono",
+ "protocol",
+ "schemars 0.8.22",
+ "serde",
+ "uuid",
+]
+
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -6557,6 +6915,73 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "mg-admin-client"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/maghemite?rev=9bb5037167c1ff0d812299f668841c9b7bda4480#9bb5037167c1ff0d812299f668841c9b7bda4480"
+dependencies = [
+ "chrono",
+ "colored 3.1.1",
+ "mg-api-types-versions",
+ "mg-common",
+ "progenitor 0.14.0",
+ "reqwest 0.13.2",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "slog",
+ "tabwriter",
+ "uuid",
+]
+
+[[package]]
+name = "mg-api-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/maghemite?rev=9bb5037167c1ff0d812299f668841c9b7bda4480#9bb5037167c1ff0d812299f668841c9b7bda4480"
+dependencies = [
+ "mg-api-types-versions",
+]
+
+[[package]]
+name = "mg-api-types-versions"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/maghemite?rev=9bb5037167c1ff0d812299f668841c9b7bda4480#9bb5037167c1ff0d812299f668841c9b7bda4480"
+dependencies = [
+ "chrono",
+ "nom 8.0.0",
+ "num_enum 0.7.6",
+ "oxnet",
+ "schemars 0.8.22",
+ "serde",
+ "slog",
+ "thiserror 2.0.18",
+ "uuid",
+]
+
+[[package]]
+name = "mg-common"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/maghemite?rev=9bb5037167c1ff0d812299f668841c9b7bda4480#9bb5037167c1ff0d812299f668841c9b7bda4480"
+dependencies = [
+ "anstyle",
+ "anyhow",
+ "backoff",
+ "clap",
+ "ddm-api-types",
+ "libc",
+ "libnet",
+ "oximeter 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "oximeter-producer 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "oxnet",
+ "schemars 0.8.22",
+ "serde",
+ "slog",
+ "slog-async",
+ "slog-bunyan",
+ "smf 0.10.0 (git+https://github.com/illumos/smf-rs?branch=main)",
+ "uuid",
+]
+
 [[package]]
 name = "mgs-dev"
 version = "0.1.0"
@@ -6565,7 +6990,7 @@ dependencies = [
  "camino",
  "clap",
  "futures",
- "gateway-client",
+ "gateway-client 0.1.0",
  "gateway-messages",
  "gateway-test-utils",
  "libc",
@@ -6796,7 +7221,7 @@ dependencies = [
  "newtype_derive",
  "nexus-db-fixed-data",
  "nexus-db-model",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-rpaths",
  "omicron-test-utils",
@@ -6832,7 +7257,32 @@ dependencies = [
  "chrono",
  "futures",
  "iddqd",
- "nexus-types",
+ "nexus-types 0.1.0",
+ "omicron-common",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "oxnet",
+ "progenitor 0.14.0",
+ "regress 0.10.5",
+ "reqwest 0.13.2",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "sled-agent-types 0.1.0",
+ "sled-agent-types-versions 0.1.0",
+ "slog",
+ "uuid",
+]
+
+[[package]]
+name = "nexus-client"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "chrono",
+ "futures",
+ "iddqd",
+ "nexus-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "omicron-common",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -6843,8 +7293,8 @@ dependencies = [
  "schemars 0.8.22",
  "serde",
  "serde_json",
- "sled-agent-types",
- "sled-agent-types-versions",
+ "sled-agent-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "sled-agent-types-versions 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "slog",
  "uuid",
 ]
@@ -6859,7 +7309,7 @@ dependencies = [
  "expectorate",
  "ipnet",
  "libc",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -6868,7 +7318,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_with",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "tokio-postgres",
  "toml 0.8.23",
  "uuid",
@@ -6890,7 +7340,7 @@ name = "nexus-db-fixed-data"
 version = "0.1.0"
 dependencies = [
  "nexus-db-model",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-rpaths",
  "omicron-uuid-kinds",
@@ -6915,7 +7365,7 @@ dependencies = [
  "nexus-db-model",
  "nexus-db-queries",
  "nexus-db-schema",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-rpaths",
  "omicron-test-utils",
@@ -6936,16 +7386,16 @@ dependencies = [
  "camino",
  "camino-tempfile",
  "chrono",
- "clickhouse-admin-types",
- "cockroach-admin-types",
+ "clickhouse-admin-types 0.1.0",
+ "cockroach-admin-types 0.1.0",
  "db-macros",
  "derive-where",
  "diesel",
- "ereport-types",
+ "ereport-types 0.1.0",
  "expectorate",
  "hex",
  "iddqd",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "ipnetwork",
  "itertools 0.14.0",
  "macaddr",
@@ -6953,11 +7403,11 @@ dependencies = [
  "nexus-config",
  "nexus-db-schema",
  "nexus-defaults",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-certificates",
  "omicron-cockroach-metrics",
  "omicron-common",
- "omicron-passwords",
+ "omicron-passwords 0.1.0",
  "omicron-rpaths",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -6973,8 +7423,8 @@ dependencies = [
  "serde",
  "serde_json",
  "sled-agent-client",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
  "sqlparser",
@@ -6983,7 +7433,7 @@ dependencies = [
  "test-strategy",
  "thiserror 2.0.18",
  "tokio",
- "trust-quorum-protocol",
+ "trust-quorum-protocol 0.1.0",
  "tufaceous-artifact",
  "uuid",
  "vergen-gitcl",
@@ -7000,26 +7450,26 @@ dependencies = [
  "camino",
  "camino-tempfile",
  "chrono",
- "clickhouse-admin-types",
- "cockroach-admin-types",
+ "clickhouse-admin-types 0.1.0",
+ "cockroach-admin-types 0.1.0",
  "const_format",
  "criterion",
  "db-macros",
  "diesel",
  "diesel-dtrace",
  "dropshot 0.17.0",
- "ereport-types",
+ "ereport-types 0.1.0",
  "expectorate",
  "fmd-adm-sys",
  "futures",
- "gateway-client",
- "gateway-types",
+ "gateway-client 0.1.0",
+ "gateway-types 0.1.0",
  "hex",
  "hyper-rustls",
  "iddqd",
- "illumos-utils",
- "internal-dns-resolver",
- "internal-dns-types",
+ "illumos-utils 0.1.0",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "ipnetwork",
  "itertools 0.14.0",
  "macaddr",
@@ -7033,11 +7483,11 @@ dependencies = [
  "nexus-inventory",
  "nexus-reconfigurator-planning",
  "nexus-test-utils",
- "nexus-types",
+ "nexus-types 0.1.0",
  "nonempty",
  "omicron-cockroach-metrics",
  "omicron-common",
- "omicron-passwords",
+ "omicron-passwords 0.1.0",
  "omicron-rpaths",
  "omicron-sled-agent",
  "omicron-test-utils",
@@ -7068,8 +7518,8 @@ dependencies = [
  "serde_with",
  "sha2",
  "sled-agent-client",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
  "static_assertions",
@@ -7080,8 +7530,8 @@ dependencies = [
  "term 0.7.0",
  "thiserror 2.0.18",
  "tokio",
- "trust-quorum-protocol",
- "trust-quorum-types",
+ "trust-quorum-protocol 0.1.0",
+ "trust-quorum-types 0.1.0",
  "tufaceous-artifact",
  "url",
  "usdt 0.5.0",
@@ -7122,7 +7572,7 @@ name = "nexus-external-api"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "api_identity",
+ "api_identity 0.1.0",
  "base64 0.22.1",
  "chrono",
  "dropshot 0.17.0",
@@ -7131,21 +7581,21 @@ dependencies = [
  "hyper",
  "ipnetwork",
  "itertools 0.14.0",
- "nexus-types",
- "nexus-types-versions",
+ "nexus-types 0.1.0",
+ "nexus-types-versions 0.1.0",
  "omicron-common",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "openapiv3",
  "oximeter-types-versions 0.1.0",
  "oxnet",
- "oxql-types",
+ "oxql-types 0.1.0",
  "schemars 0.8.22",
  "scim2-rs",
  "serde",
  "serde_json",
  "slog-error-chain",
- "trust-quorum-types",
+ "trust-quorum-types 0.1.0",
  "tufaceous-artifact",
  "uuid",
 ]
@@ -7156,10 +7606,10 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "chrono",
- "ereport-types",
+ "ereport-types 0.1.0",
  "iddqd",
  "nexus-reconfigurator-planning",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-test-utils",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -7179,13 +7629,13 @@ dependencies = [
  "dropshot 0.17.0",
  "dropshot-api-manager-types",
  "http",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "schemars 0.8.22",
  "serde",
- "sled-agent-types-versions",
+ "sled-agent-types-versions 0.1.0",
  "uuid",
 ]
 
@@ -7199,22 +7649,22 @@ dependencies = [
  "chrono",
  "clickhouse-admin-keeper-client",
  "clickhouse-admin-server-client",
- "clickhouse-admin-types",
- "cockroach-admin-types",
+ "clickhouse-admin-types 0.1.0",
+ "cockroach-admin-types 0.1.0",
  "dns-service-client",
  "expectorate",
  "fmd-adm-sys",
  "futures",
- "gateway-client",
+ "gateway-client 0.1.0",
  "gateway-messages",
  "gateway-test-utils",
- "gateway-types",
+ "gateway-types 0.1.0",
  "httpmock",
  "iddqd",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "itertools 0.14.0",
- "nexus-client",
- "nexus-types",
+ "nexus-client 0.1.0",
+ "nexus-types 0.1.0",
  "ntp-admin-client",
  "omicron-cockroach-metrics",
  "omicron-common",
@@ -7227,9 +7677,9 @@ dependencies = [
  "serde_json",
  "sled-agent-client",
  "sled-agent-resolvable-files-examples",
- "sled-agent-types",
- "sled-agent-types-versions",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-agent-types-versions 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
  "strum 0.27.2",
@@ -7247,15 +7697,15 @@ version = "0.1.0"
 dependencies = [
  "dropshot 0.17.0",
  "http",
- "nexus-types",
- "nexus-types-versions",
+ "nexus-types 0.1.0",
+ "nexus-types-versions 0.1.0",
  "omicron-common",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "schemars 0.8.22",
  "serde",
- "sled-hardware-types",
- "trust-quorum-types",
+ "sled-hardware-types 0.1.0",
+ "trust-quorum-types 0.1.0",
  "uuid",
 ]
 
@@ -7263,13 +7713,13 @@ dependencies = [
 name = "nexus-lockstep-client"
 version = "0.1.0"
 dependencies = [
- "bootstrap-agent-lockstep-types",
+ "bootstrap-agent-lockstep-types 0.1.0",
  "chrono",
  "futures",
  "iddqd",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
- "omicron-passwords",
+ "omicron-passwords 0.1.0",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "oxnet",
@@ -7279,9 +7729,9 @@ dependencies = [
  "schemars 0.8.22",
  "serde",
  "serde_json",
- "sled-agent-types",
- "sled-agent-types-versions",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-agent-types-versions 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "uuid",
 ]
@@ -7311,7 +7761,7 @@ dependencies = [
  "nexus-db-queries",
  "nexus-db-schema",
  "nexus-test-utils",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-rpaths",
  "omicron-test-utils",
@@ -7335,17 +7785,17 @@ dependencies = [
  "chrono",
  "dropshot 0.17.0",
  "futures",
- "gateway-client",
+ "gateway-client 0.1.0",
  "gateway-messages",
  "gateway-test-utils",
- "gateway-types",
+ "gateway-types 0.1.0",
  "http",
  "hubtools 0.4.7 (git+https://github.com/oxidecomputer/hubtools.git?rev=2b1ef9b38d75563ea800baa3b17327eec17b1b7a)",
  "iddqd",
- "illumos-utils",
- "internal-dns-resolver",
- "internal-dns-types",
- "nexus-types",
+ "illumos-utils 0.1.0",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-test-utils",
  "omicron-uuid-kinds",
@@ -7358,10 +7808,10 @@ dependencies = [
  "sha2",
  "sled-agent-api",
  "sled-agent-client",
- "sled-agent-types",
- "sled-agent-types-versions",
+ "sled-agent-types 0.1.0",
+ "sled-agent-types-versions 0.1.0",
  "sled-diagnostics",
- "sled-hardware-types",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
  "sp-sim",
@@ -7369,7 +7819,7 @@ dependencies = [
  "tokio",
  "tokio-stream",
  "tokio-util",
- "trust-quorum-types",
+ "trust-quorum-types 0.1.0",
  "tufaceous-artifact",
  "uuid",
 ]
@@ -7380,9 +7830,9 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "futures",
- "gateway-client",
- "internal-dns-resolver",
- "internal-dns-types",
+ "gateway-client 0.1.0",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "ipnetwork",
  "nexus-db-lookup",
  "nexus-db-queries",
@@ -7394,8 +7844,8 @@ dependencies = [
  "pq-sys",
  "reqwest 0.13.2",
  "sled-agent-client",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "static_assertions",
  "thiserror 2.0.18",
@@ -7408,12 +7858,12 @@ version = "0.1.0"
 dependencies = [
  "ipnet",
  "nexus-reconfigurator-planning",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-test-utils",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "tufaceous-artifact",
 ]
 
@@ -7431,7 +7881,7 @@ dependencies = [
  "nexus-reconfigurator-preparation",
  "nexus-test-utils",
  "nexus-test-utils-macros",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-nexus",
  "omicron-rpaths",
@@ -7459,15 +7909,15 @@ dependencies = [
  "clickhouse-admin-keeper-client",
  "clickhouse-admin-server-client",
  "clickhouse-admin-single-client",
- "clickhouse-admin-types",
+ "clickhouse-admin-types 0.1.0",
  "cockroach-admin-client",
  "diesel",
  "fmd-adm-sys",
  "futures",
  "httptest",
  "iddqd",
- "internal-dns-resolver",
- "internal-dns-types",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "ipnet",
  "ipnetwork",
  "newtype-uuid",
@@ -7483,7 +7933,7 @@ dependencies = [
  "nexus-reconfigurator-preparation",
  "nexus-test-utils",
  "nexus-test-utils-macros",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-nexus",
  "omicron-rpaths",
@@ -7494,11 +7944,11 @@ dependencies = [
  "pq-sys",
  "reqwest 0.13.2",
  "sled-agent-client",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "slog",
  "slog-error-chain",
  "tokio",
- "update-engine",
+ "update-engine 0.1.0",
  "uuid",
 ]
 
@@ -7512,21 +7962,21 @@ dependencies = [
  "camino-tempfile",
  "chrono",
  "clap",
- "clickhouse-admin-types",
- "cockroach-admin-types",
+ "clickhouse-admin-types 0.1.0",
+ "cockroach-admin-types 0.1.0",
  "daft",
  "debug-ignore",
  "dropshot 0.17.0",
  "expectorate",
- "gateway-client",
- "gateway-types",
+ "gateway-client 0.1.0",
+ "gateway-types 0.1.0",
  "hex-literal",
  "hickory-resolver 0.25.2",
  "iddqd",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "indexmap 2.14.0",
- "internal-dns-resolver",
- "internal-dns-types",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "ipnet",
  "itertools 0.14.0",
  "maplit",
@@ -7534,7 +7984,7 @@ dependencies = [
  "nexus-inventory",
  "nexus-reconfigurator-blippy",
  "nexus-reconfigurator-simulation",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-deployment-graph",
  "omicron-test-utils",
@@ -7547,8 +7997,8 @@ dependencies = [
  "reconfigurator-cli",
  "semver 1.0.28",
  "sled-agent-client",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
  "sp-sim",
@@ -7576,14 +8026,14 @@ dependencies = [
  "futures",
  "nexus-db-model",
  "nexus-db-queries",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-rpaths",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "pq-sys",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
 ]
@@ -7598,7 +8048,7 @@ dependencies = [
  "nexus-db-model",
  "nexus-db-queries",
  "nexus-db-schema",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-rpaths",
  "omicron-test-utils",
@@ -7625,13 +8075,13 @@ dependencies = [
  "itertools 0.14.0",
  "nexus-inventory",
  "nexus-reconfigurator-planning",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "petname",
  "sapling-renderdag",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "slog",
  "strum 0.27.2",
  "swrite",
@@ -7654,7 +8104,7 @@ dependencies = [
  "nexus-db-queries",
  "nexus-test-utils",
  "nexus-test-utils-macros",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-rpaths",
  "omicron-test-utils",
@@ -7675,16 +8125,16 @@ name = "nexus-test-interface"
 version = "0.1.0"
 dependencies = [
  "async-trait",
- "bootstrap-agent-lockstep-types",
+ "bootstrap-agent-lockstep-types 0.1.0",
  "nexus-config",
  "nexus-db-queries",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-rpaths",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "pq-sys",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "slog",
  "tokio",
  "uuid",
@@ -7695,7 +8145,7 @@ name = "nexus-test-utils"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "bootstrap-agent-lockstep-types",
+ "bootstrap-agent-lockstep-types 0.1.0",
  "bytes",
  "camino",
  "camino-tempfile",
@@ -7714,18 +8164,18 @@ dependencies = [
  "http-body-util",
  "hyper",
  "iddqd",
- "illumos-utils",
- "internal-dns-resolver",
- "internal-dns-types",
- "nexus-client",
+ "illumos-utils 0.1.0",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
+ "nexus-client 0.1.0",
  "nexus-config",
  "nexus-db-queries",
  "nexus-lockstep-client",
  "nexus-test-interface",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-cockroach-admin",
  "omicron-common",
- "omicron-passwords",
+ "omicron-passwords 0.1.0",
  "omicron-rpaths",
  "omicron-sled-agent",
  "omicron-test-utils",
@@ -7733,7 +8183,7 @@ dependencies = [
  "omicron-workspace-hack",
  "oximeter 0.1.0",
  "oximeter-collector",
- "oximeter-producer",
+ "oximeter-producer 0.1.0",
  "oxnet",
  "pq-sys",
  "pretty_assertions",
@@ -7741,7 +8191,7 @@ dependencies = [
  "serde_json",
  "serde_urlencoded",
  "sled-agent-client",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "slog",
  "slog-error-chain",
  "tokio",
@@ -7765,46 +8215,46 @@ name = "nexus-types"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "api_identity",
+ "api_identity 0.1.0",
  "async-trait",
  "base64 0.22.1",
- "bootstrap-agent-lockstep-types",
+ "bootstrap-agent-lockstep-types 0.1.0",
  "chrono",
  "clap",
- "clickhouse-admin-types",
- "cockroach-admin-types",
+ "clickhouse-admin-types 0.1.0",
+ "cockroach-admin-types 0.1.0",
  "cookie",
  "daft",
  "derive-where",
  "derive_more 0.99.20",
  "dropshot 0.17.0",
  "either",
- "ereport-types",
+ "ereport-types 0.1.0",
  "expectorate",
  "futures",
- "gateway-client",
- "gateway-types",
+ "gateway-client 0.1.0",
+ "gateway-types 0.1.0",
  "http",
  "humantime",
  "iddqd",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "indent_write",
- "internal-dns-types",
+ "internal-dns-types 0.1.0",
  "ipnet",
  "ipnetwork",
  "itertools 0.14.0",
  "newtype-uuid",
  "newtype_derive",
- "nexus-types-versions",
+ "nexus-types-versions 0.1.0",
  "omicron-common",
- "omicron-passwords",
+ "omicron-passwords 0.1.0",
  "omicron-test-utils",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "openssl",
- "oximeter-db",
+ "oximeter-db 0.1.0",
  "oxnet",
- "oxql-types",
+ "oxql-types 0.1.0",
  "parse-display",
  "proptest",
  "regex",
@@ -7813,9 +8263,83 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_with",
- "sled-agent-types",
- "sled-agent-types-versions",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-agent-types-versions 0.1.0",
+ "sled-hardware-types 0.1.0",
+ "slog",
+ "slog-error-chain",
+ "steno",
+ "strum 0.27.2",
+ "swrite",
+ "tabled 0.15.0",
+ "test-strategy",
+ "textwrap 0.16.2",
+ "thiserror 2.0.18",
+ "tokio",
+ "tough",
+ "trust-quorum-protocol 0.1.0",
+ "trust-quorum-types 0.1.0",
+ "tufaceous-artifact",
+ "unicode-width 0.1.14",
+ "update-engine 0.1.0",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "nexus-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "anyhow",
+ "api_identity 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "async-trait",
+ "base64 0.22.1",
+ "bootstrap-agent-lockstep-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "chrono",
+ "clap",
+ "clickhouse-admin-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "cockroach-admin-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "cookie",
+ "daft",
+ "derive-where",
+ "derive_more 0.99.20",
+ "dropshot 0.17.0",
+ "either",
+ "ereport-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "futures",
+ "gateway-client 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "gateway-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "http",
+ "humantime",
+ "iddqd",
+ "illumos-utils 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "indent_write",
+ "internal-dns-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "ipnet",
+ "ipnetwork",
+ "itertools 0.14.0",
+ "newtype-uuid",
+ "newtype_derive",
+ "nexus-types-versions 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "omicron-common",
+ "omicron-passwords 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "openssl",
+ "oximeter-db 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "oxnet",
+ "oxql-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "parse-display",
+ "regex",
+ "schemars 0.8.22",
+ "semver 1.0.28",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "sled-agent-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "sled-agent-types-versions 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "sled-hardware-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "slog",
  "slog-error-chain",
  "steno",
@@ -7827,11 +8351,48 @@ dependencies = [
  "thiserror 2.0.18",
  "tokio",
  "tough",
- "trust-quorum-protocol",
- "trust-quorum-types",
+ "trust-quorum-protocol 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "trust-quorum-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "tufaceous-artifact",
  "unicode-width 0.1.14",
- "update-engine",
+ "update-engine 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "nexus-types-versions"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "api_identity 0.1.0",
+ "base64 0.22.1",
+ "chrono",
+ "daft",
+ "dropshot 0.17.0",
+ "http",
+ "mg-admin-client 0.1.0 (git+https://github.com/oxidecomputer/maghemite?rev=9bb5037167c1ff0d812299f668841c9b7bda4480)",
+ "mg-api-types",
+ "omicron-common",
+ "omicron-passwords 0.1.0",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "openssl",
+ "oxnet",
+ "oxql-types 0.1.0",
+ "parse-display",
+ "regex",
+ "schemars 0.8.22",
+ "semver 1.0.28",
+ "serde",
+ "serde_json",
+ "sled-agent-types-versions 0.1.0",
+ "sled-hardware-types 0.1.0",
+ "slog-error-chain",
+ "strum 0.27.2",
+ "thiserror 2.0.18",
+ "tough",
+ "tufaceous-artifact",
  "url",
  "uuid",
 ]
@@ -7839,30 +8400,31 @@ dependencies = [
 [[package]]
 name = "nexus-types-versions"
 version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
 dependencies = [
  "anyhow",
- "api_identity",
+ "api_identity 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "base64 0.22.1",
  "chrono",
  "daft",
  "dropshot 0.17.0",
  "http",
- "mg-admin-client",
+ "mg-admin-client 0.1.0 (git+https://github.com/oxidecomputer/maghemite?rev=7696ee48d5ee29a917dea459e281fe2e8ff20513)",
  "omicron-common",
- "omicron-passwords",
+ "omicron-passwords 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "openssl",
  "oxnet",
- "oxql-types",
+ "oxql-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "parse-display",
  "regex",
  "schemars 0.8.22",
  "semver 1.0.28",
  "serde",
  "serde_json",
- "sled-agent-types-versions",
- "sled-hardware-types",
+ "sled-agent-types-versions 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "sled-hardware-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "slog-error-chain",
  "strum 0.27.2",
  "thiserror 2.0.18",
@@ -7946,6 +8508,15 @@ dependencies = [
  "minimal-lexical",
 ]
 
+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "nonempty"
 version = "0.12.0"
@@ -8024,7 +8595,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -8156,11 +8727,11 @@ dependencies = [
 
 [[package]]
 name = "num_enum"
-version = "0.7.5"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1207a7e20ad57b847bbddc6776b968420d38292bbfe2089accff5e19e82454c"
+checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26"
 dependencies = [
- "num_enum_derive 0.7.5",
+ "num_enum_derive 0.7.6",
  "rustversion",
 ]
 
@@ -8178,9 +8749,9 @@ dependencies = [
 
 [[package]]
 name = "num_enum_derive"
-version = "0.7.5"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff32365de1b6743cb203b710788263c44a03de03802daf96092f2da4fe6ba4d7"
+checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
 dependencies = [
  "proc-macro-crate 3.4.0",
  "proc-macro2",
@@ -8274,13 +8845,13 @@ dependencies = [
  "clap",
  "clickhouse-admin-api",
  "clickhouse-admin-test-utils",
- "clickhouse-admin-types",
+ "clickhouse-admin-types 0.1.0",
  "clickward",
  "dropshot 0.17.0",
  "expectorate",
  "flume",
  "http",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "omicron-common",
  "omicron-test-utils",
  "omicron-uuid-kinds",
@@ -8289,7 +8860,7 @@ dependencies = [
  "openapiv3",
  "oxide-tokio-rt",
  "oximeter 0.1.0",
- "oximeter-db",
+ "oximeter-db 0.1.0",
  "oximeter-test-utils",
  "schemars 0.8.22",
  "serde",
@@ -8317,14 +8888,14 @@ dependencies = [
  "chrono",
  "clap",
  "cockroach-admin-api",
- "cockroach-admin-types",
- "cockroach-admin-types-versions",
+ "cockroach-admin-types 0.1.0",
+ "cockroach-admin-types-versions 0.1.0",
  "csv",
  "dropshot 0.17.0",
  "expectorate",
  "fmd-adm-sys",
  "http",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "nexus-test-utils",
  "omicron-common",
  "omicron-rpaths",
@@ -8360,7 +8931,7 @@ dependencies = [
  "anyhow",
  "chrono",
  "cockroach-admin-client",
- "cockroach-admin-types",
+ "cockroach-admin-types 0.1.0",
  "futures",
  "omicron-workspace-hack",
  "parallel-task-set",
@@ -8378,7 +8949,7 @@ name = "omicron-common"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "api_identity",
+ "api_identity 0.1.0",
  "async-trait",
  "backoff",
  "backon",
@@ -8396,7 +8967,7 @@ dependencies = [
  "itertools 0.14.0",
  "libc",
  "macaddr",
- "omicron-ledger",
+ "omicron-ledger 0.1.0",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "oxnet",
@@ -8438,7 +9009,7 @@ dependencies = [
  "progenitor-client 0.14.0",
  "reqwest 0.13.2",
  "serde",
- "sled-hardware-types",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
  "thiserror 2.0.18",
@@ -8466,7 +9037,7 @@ dependencies = [
  "expectorate",
  "fmd-adm-sys",
  "futures",
- "gateway-client",
+ "gateway-client 0.1.0",
  "gateway-test-utils",
  "libc",
  "nexus-config",
@@ -8539,21 +9110,21 @@ dependencies = [
  "chrono",
  "clap",
  "dropshot 0.17.0",
- "ereport-types",
+ "ereport-types 0.1.0",
  "expectorate",
  "futures",
  "gateway-api",
- "gateway-client",
+ "gateway-client 0.1.0",
  "gateway-messages",
  "gateway-sp-comms",
  "gateway-test-utils",
- "gateway-types",
- "gateway-types-versions",
+ "gateway-types 0.1.0",
+ "gateway-types-versions 0.1.0",
  "hex",
  "http",
  "hyper",
  "iddqd",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "ipcc",
  "omicron-common",
  "omicron-test-utils",
@@ -8562,7 +9133,7 @@ dependencies = [
  "oxide-tokio-rt",
  "oximeter 0.1.0",
  "oximeter-instruments",
- "oximeter-producer",
+ "oximeter-producer 0.1.0",
  "schemars 0.8.22",
  "serde",
  "serde_json",
@@ -8600,6 +9171,22 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "omicron-ledger"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "async-trait",
+ "camino",
+ "omicron-workspace-hack",
+ "serde",
+ "serde_json",
+ "slog",
+ "slog-error-chain",
+ "thiserror 2.0.18",
+ "tokio",
+]
+
 [[package]]
 name = "omicron-live-tests"
 version = "0.1.0"
@@ -8609,8 +9196,8 @@ dependencies = [
  "dns-service-client",
  "dropshot 0.17.0",
  "futures",
- "internal-dns-resolver",
- "internal-dns-types",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "live-tests-macros",
  "nexus-config",
  "nexus-db-model",
@@ -8619,7 +9206,7 @@ dependencies = [
  "nexus-lockstep-client",
  "nexus-reconfigurator-planning",
  "nexus-reconfigurator-preparation",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-rpaths",
  "omicron-test-utils",
@@ -8628,7 +9215,7 @@ dependencies = [
  "pq-sys",
  "reqwest 0.13.2",
  "serde",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "slog",
  "slog-error-chain",
  "textwrap 0.16.2",
@@ -8668,7 +9255,7 @@ dependencies = [
  "async-bb8-diesel",
  "async-trait",
  "base64 0.22.1",
- "bootstrap-agent-lockstep-types",
+ "bootstrap-agent-lockstep-types 0.1.0",
  "buf-list",
  "bytes",
  "camino",
@@ -8690,15 +9277,15 @@ dependencies = [
  "dns-service-client",
  "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=187aee7de2e50f907099ea06c04aac96c3455665)",
  "dropshot 0.17.0",
- "ereport-types",
+ "ereport-types 0.1.0",
  "expectorate",
  "fatfs",
  "fmd-adm-sys",
  "futures",
- "gateway-client",
+ "gateway-client 0.1.0",
  "gateway-messages",
  "gateway-test-utils",
- "gateway-types",
+ "gateway-types 0.1.0",
  "headers",
  "hex",
  "hickory-resolver 0.25.2",
@@ -8712,9 +9299,9 @@ dependencies = [
  "hyper-rustls",
  "hyper-staticfile",
  "iddqd",
- "illumos-utils",
- "internal-dns-resolver",
- "internal-dns-types",
+ "illumos-utils 0.1.0",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "ipnet",
  "ipnetwork",
  "itertools 0.14.0",
@@ -8722,10 +9309,11 @@ dependencies = [
  "lldpd-client",
  "macaddr",
  "maplit",
- "mg-admin-client",
+ "mg-admin-client 0.1.0 (git+https://github.com/oxidecomputer/maghemite?rev=9bb5037167c1ff0d812299f668841c9b7bda4480)",
+ "mg-api-types",
  "nexus-auth",
  "nexus-background-task-interface",
- "nexus-client",
+ "nexus-client 0.1.0",
  "nexus-config",
  "nexus-db-lookup",
  "nexus-db-model",
@@ -8749,13 +9337,13 @@ dependencies = [
  "nexus-test-interface",
  "nexus-test-utils",
  "nexus-test-utils-macros",
- "nexus-types",
- "nexus-types-versions",
+ "nexus-types 0.1.0",
+ "nexus-types-versions 0.1.0",
  "ntp-admin-client",
  "num-integer",
  "omicron-cockroach-metrics",
  "omicron-common",
- "omicron-passwords",
+ "omicron-passwords 0.1.0",
  "omicron-rpaths",
  "omicron-sled-agent",
  "omicron-test-utils",
@@ -8769,11 +9357,11 @@ dependencies = [
  "oximeter 0.1.0",
  "oximeter-client",
  "oximeter-collector",
- "oximeter-db",
+ "oximeter-db 0.1.0",
  "oximeter-instruments",
- "oximeter-producer",
+ "oximeter-producer 0.1.0",
  "oxnet",
- "oxql-types",
+ "oxql-types 0.1.0",
  "parallel-task-set",
  "parse-display",
  "paste",
@@ -8789,7 +9377,6 @@ dependencies = [
  "range-requests",
  "raw-cpuid",
  "rcgen",
- "rdb-types",
  "ref-cast",
  "regex",
  "reqwest 0.12.28",
@@ -8810,9 +9397,9 @@ dependencies = [
  "sha2",
  "similar-asserts",
  "sled-agent-client",
- "sled-agent-types",
- "sled-agent-types-versions",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-agent-types-versions 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-async",
  "slog-dtrace",
@@ -8832,12 +9419,12 @@ dependencies = [
  "tokio-test",
  "tokio-util",
  "tough",
- "trust-quorum-types",
+ "trust-quorum-types 0.1.0",
  "tufaceous",
  "tufaceous-artifact",
  "tufaceous-lib",
  "update-common",
- "update-engine",
+ "update-engine 0.1.0",
  "usdt 0.5.0",
  "uuid",
  "zip 4.6.1",
@@ -8908,21 +9495,21 @@ dependencies = [
  "diesel",
  "dropshot 0.17.0",
  "dyn-clone",
- "ereport-types",
+ "ereport-types 0.1.0",
  "expectorate",
  "fmd-adm-sys",
  "futures",
- "gateway-client",
+ "gateway-client 0.1.0",
  "gateway-messages",
  "gateway-test-utils",
- "gateway-types",
+ "gateway-types 0.1.0",
  "http",
  "humantime",
  "iddqd",
  "indent_write",
  "indicatif",
- "internal-dns-resolver",
- "internal-dns-types",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "ipnetwork",
  "itertools 0.14.0",
  "multimap",
@@ -8938,7 +9525,7 @@ dependencies = [
  "nexus-saga-recovery",
  "nexus-test-utils",
  "nexus-test-utils-macros",
- "nexus-types",
+ "nexus-types 0.1.0",
  "ntp-admin-client",
  "omicron-common",
  "omicron-nexus",
@@ -8949,7 +9536,7 @@ dependencies = [
  "owo-colors 4.3.0",
  "oxide-tokio-rt",
  "oximeter-client",
- "oximeter-db",
+ "oximeter-db 0.1.0",
  "oxnet",
  "petgraph 0.8.3",
  "pq-sys",
@@ -8960,8 +9547,8 @@ dependencies = [
  "serde_json",
  "sigpipe",
  "sled-agent-client",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
  "steno",
@@ -8972,10 +9559,10 @@ dependencies = [
  "tabled 0.15.0",
  "textwrap 0.16.2",
  "tokio",
- "trust-quorum-types",
+ "trust-quorum-types 0.1.0",
  "tufaceous-artifact",
  "unicode-width 0.1.14",
- "update-engine",
+ "update-engine 0.1.0",
  "url",
  "uuid",
  "vergen-gitcl",
@@ -8993,7 +9580,7 @@ dependencies = [
  "expectorate",
  "futures",
  "hex",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "indent_write",
  "indicatif",
  "omicron-workspace-hack",
@@ -9038,6 +9625,21 @@ dependencies = [
  "thiserror 2.0.18",
 ]
 
+[[package]]
+name = "omicron-passwords"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "argon2",
+ "omicron-workspace-hack",
+ "rand 0.9.2",
+ "schemars 0.8.22",
+ "secrecy 0.10.3",
+ "serde",
+ "serde_with",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "omicron-pins"
 version = "0.1.0"
@@ -9059,13 +9661,13 @@ dependencies = [
  "camino",
  "clap",
  "dropshot 0.17.0",
- "internal-dns-resolver",
- "internal-dns-types",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "nexus-db-model",
  "nexus-db-queries",
  "nexus-mgs-updates",
  "nexus-reconfigurator-execution",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-rpaths",
  "omicron-uuid-kinds",
@@ -9078,7 +9680,7 @@ dependencies = [
  "slog",
  "supports-color 3.0.2",
  "tokio",
- "update-engine",
+ "update-engine 0.1.0",
  "uuid",
 ]
 
@@ -9170,11 +9772,11 @@ dependencies = [
  "async-trait",
  "atomicwrites",
  "base64 0.22.1",
- "bootstore",
+ "bootstore 0.1.0",
  "bootstrap-agent-api",
  "bootstrap-agent-client",
  "bootstrap-agent-lockstep-api",
- "bootstrap-agent-lockstep-types",
+ "bootstrap-agent-lockstep-types 0.1.0",
  "bytes",
  "camino",
  "camino-tempfile",
@@ -9182,7 +9784,7 @@ dependencies = [
  "cfg-if",
  "chrono",
  "clap",
- "clickhouse-admin-types",
+ "clickhouse-admin-types 0.1.0",
  "crucible-agent-client",
  "derive_more 0.99.20",
  "dice-verifier 0.3.0-pre0 (git+https://github.com/oxidecomputer/dice-util?branch=main)",
@@ -9205,23 +9807,23 @@ dependencies = [
  "hyper",
  "hyper-staticfile",
  "iddqd",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "installinator-common",
- "internal-dns-resolver",
- "internal-dns-types",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "ipnetwork",
  "itertools 0.14.0",
  "key-manager",
  "libc",
  "macaddr",
- "nexus-client",
+ "nexus-client 0.1.0",
  "nexus-config",
  "nexus-lockstep-client",
- "nexus-types",
+ "nexus-types 0.1.0",
  "nix 0.31.2",
  "omicron-common",
  "omicron-ddm-admin-client",
- "omicron-ledger",
+ "omicron-ledger 0.1.0",
  "omicron-rpaths",
  "omicron-test-utils",
  "omicron-uuid-kinds",
@@ -9230,7 +9832,7 @@ dependencies = [
  "oxide-tokio-rt",
  "oximeter 0.1.0",
  "oximeter-instruments",
- "oximeter-producer",
+ "oximeter-producer 0.1.0",
  "oxnet",
  "pretty_assertions",
  "progenitor 0.14.0",
@@ -9259,11 +9861,11 @@ dependencies = [
  "sled-agent-measurements",
  "sled-agent-rack-setup",
  "sled-agent-resolvable-files",
- "sled-agent-types",
- "sled-agent-types-versions",
+ "sled-agent-types 0.1.0",
+ "sled-agent-types-versions 0.1.0",
  "sled-diagnostics",
  "sled-hardware",
- "sled-hardware-types",
+ "sled-hardware-types 0.1.0",
  "sled-storage",
  "slog",
  "slog-async",
@@ -9285,8 +9887,8 @@ dependencies = [
  "toml 0.8.23",
  "transient-dns-server",
  "trust-quorum",
- "trust-quorum-protocol",
- "trust-quorum-types",
+ "trust-quorum-protocol 0.1.0",
+ "trust-quorum-types 0.1.0",
  "tufaceous-artifact",
  "tufaceous-brand-metadata",
  "usdt 0.5.0",
@@ -9360,6 +9962,7 @@ version = "0.1.0"
 dependencies = [
  "ahash",
  "aho-corasick",
+ "anstream 0.6.21",
  "anyhow",
  "aws-lc-rs",
  "base16ct",
@@ -9426,7 +10029,6 @@ dependencies = [
  "inout",
  "ipnet",
  "ipnetwork",
- "itertools 0.13.0",
  "lalrpop-util",
  "lazy_static",
  "libc",
@@ -9821,7 +10423,7 @@ dependencies = [
 [[package]]
 name = "oximeter"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/omicron?branch=main#ccede3cb5287e447b0f30916000c7943b1596689"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
 dependencies = [
  "anyhow",
  "chrono",
@@ -9877,10 +10479,10 @@ dependencies = [
  "expectorate",
  "futures",
  "httpmock",
- "internal-dns-resolver",
- "internal-dns-types",
- "nexus-client",
- "nexus-types",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
+ "nexus-client 0.1.0",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-test-utils",
  "omicron-workspace-hack",
@@ -9890,7 +10492,7 @@ dependencies = [
  "oximeter 0.1.0",
  "oximeter-api",
  "oximeter-client",
- "oximeter-db",
+ "oximeter-db 0.1.0",
  "oximeter-types 0.1.0",
  "proptest",
  "qorb",
@@ -9929,7 +10531,7 @@ dependencies = [
  "chrono",
  "chrono-tz",
  "clap",
- "clickhouse-admin-types",
+ "clickhouse-admin-types 0.1.0",
  "clickward",
  "const_format",
  "criterion",
@@ -9946,7 +10548,7 @@ dependencies = [
  "indexmap 2.14.0",
  "itertools 0.14.0",
  "libc",
- "nom",
+ "nom 7.1.3",
  "num",
  "omicron-common",
  "omicron-test-utils",
@@ -9954,7 +10556,7 @@ dependencies = [
  "oxide-tokio-rt",
  "oximeter 0.1.0",
  "oximeter-test-utils",
- "oxql-types",
+ "oxql-types 0.1.0",
  "parse-display",
  "peg",
  "qorb",
@@ -9985,6 +10587,61 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "oximeter-db"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "anyhow",
+ "async-recursion",
+ "async-trait",
+ "bcs",
+ "bytes",
+ "camino",
+ "chrono",
+ "chrono-tz",
+ "clap",
+ "clickhouse-admin-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "clickward",
+ "const_format",
+ "debug-ignore",
+ "dropshot 0.17.0",
+ "futures",
+ "gethostname",
+ "highway",
+ "iana-time-zone",
+ "iddqd",
+ "indexmap 2.14.0",
+ "libc",
+ "nom 7.1.3",
+ "num",
+ "omicron-common",
+ "omicron-workspace-hack",
+ "oxide-tokio-rt",
+ "oximeter 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "oxql-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "parse-display",
+ "qorb",
+ "quote",
+ "regex",
+ "reqwest 0.13.2",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "slog",
+ "slog-async",
+ "slog-dtrace",
+ "slog-error-chain",
+ "slog-term",
+ "strum 0.27.2",
+ "termtree",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokio-util",
+ "usdt 0.5.0",
+ "uuid",
+]
+
 [[package]]
 name = "oximeter-instruments"
 version = "0.1.0"
@@ -10024,7 +10681,7 @@ dependencies = [
 [[package]]
 name = "oximeter-macro-impl"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/omicron?branch=main#ccede3cb5287e447b0f30916000c7943b1596689"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
 dependencies = [
  "omicron-workspace-hack",
  "proc-macro2",
@@ -10036,26 +10693,51 @@ dependencies = [
 name = "oximeter-producer"
 version = "0.1.0"
 dependencies = [
- "anyhow",
+ "anyhow",
+ "chrono",
+ "clap",
+ "dropshot 0.17.0",
+ "either",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
+ "nexus-client 0.1.0",
+ "omicron-common",
+ "omicron-test-utils",
+ "omicron-workspace-hack",
+ "oximeter 0.1.0",
+ "oximeter-producer-api 0.1.0",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "slog",
+ "slog-dtrace",
+ "slog-error-chain",
+ "slog-term",
+ "thiserror 2.0.18",
+ "tokio",
+ "uuid",
+]
+
+[[package]]
+name = "oximeter-producer"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
  "chrono",
- "clap",
  "dropshot 0.17.0",
  "either",
- "internal-dns-resolver",
- "internal-dns-types",
- "nexus-client",
+ "internal-dns-resolver 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "internal-dns-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "nexus-client 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "omicron-common",
- "omicron-test-utils",
  "omicron-workspace-hack",
- "oximeter 0.1.0",
- "oximeter-producer-api",
+ "oximeter 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "oximeter-producer-api 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "schemars 0.8.22",
  "serde",
- "serde_json",
  "slog",
  "slog-dtrace",
  "slog-error-chain",
- "slog-term",
  "thiserror 2.0.18",
  "tokio",
  "uuid",
@@ -10070,6 +10752,16 @@ dependencies = [
  "oximeter-types-versions 0.1.0",
 ]
 
+[[package]]
+name = "oximeter-producer-api"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "dropshot 0.17.0",
+ "omicron-workspace-hack",
+ "oximeter-types-versions 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+]
+
 [[package]]
 name = "oximeter-schema"
 version = "0.1.0"
@@ -10093,7 +10785,7 @@ dependencies = [
 [[package]]
 name = "oximeter-schema"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/omicron?branch=main#ccede3cb5287e447b0f30916000c7943b1596689"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
 dependencies = [
  "anyhow",
  "chrono",
@@ -10120,7 +10812,7 @@ dependencies = [
  "clickward",
  "omicron-test-utils",
  "omicron-workspace-hack",
- "oximeter-db",
+ "oximeter-db 0.1.0",
  "oximeter-macro-impl 0.1.0",
  "oximeter-types 0.1.0",
  "slog",
@@ -10142,7 +10834,7 @@ dependencies = [
 [[package]]
 name = "oximeter-timeseries-macro"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/omicron?branch=main#ccede3cb5287e447b0f30916000c7943b1596689"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
 dependencies = [
  "omicron-workspace-hack",
  "oximeter-schema 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
@@ -10171,22 +10863,10 @@ dependencies = [
 [[package]]
 name = "oximeter-types"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/omicron?branch=main#ccede3cb5287e447b0f30916000c7943b1596689"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
 dependencies = [
- "bytes",
- "chrono",
- "float-ord",
- "num",
- "omicron-common",
  "omicron-workspace-hack",
  "oximeter-types-versions 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
- "parse-display",
- "regex",
- "schemars 0.8.22",
- "serde",
- "strum 0.27.2",
- "thiserror 2.0.18",
- "uuid",
 ]
 
 [[package]]
@@ -10214,13 +10894,20 @@ dependencies = [
 [[package]]
 name = "oximeter-types-versions"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/omicron?branch=main#ccede3cb5287e447b0f30916000c7943b1596689"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
 dependencies = [
+ "bytes",
  "chrono",
+ "float-ord",
+ "num",
  "omicron-common",
  "omicron-workspace-hack",
+ "parse-display",
+ "regex",
  "schemars 0.8.22",
  "serde",
+ "strum 0.27.2",
+ "thiserror 2.0.18",
  "uuid",
 ]
 
@@ -10242,9 +10929,9 @@ dependencies = [
 
 [[package]]
 name = "oxnet"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dc6fb07ecd6d2a17ff1431bc5b3ce11036c0b6dd93a3c4904db5b910817b162"
+checksum = "057865b45bb202b17ed475d8f22f0416412de2c317c168fefecf9d207faf048d"
 dependencies = [
  "ipnetwork",
  "schemars 0.8.22",
@@ -10268,6 +10955,23 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "oxql-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "highway",
+ "num",
+ "omicron-workspace-hack",
+ "oximeter-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "uuid",
+]
+
 [[package]]
 name = "p256"
 version = "0.13.2"
@@ -10657,7 +11361,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9cd31dcfdbbd7431a807ef4df6edd6473228e94d5c805e8cf671227a21bad068"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.12.1",
  "proc-macro2",
  "quote",
  "rand 0.8.6",
@@ -11521,7 +12225,7 @@ dependencies = [
 [[package]]
 name = "protocol"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/lldp#d22509dfdb051321b859e924948605115691b93c"
+source = "git+https://github.com/oxidecomputer/lldp#ed02e1a3a96f98107cbbe90f90c7ed1c16edf97d"
 dependencies = [
  "anyhow",
  "schemars 0.8.22",
@@ -11605,7 +12309,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash",
  "rustls 0.23.37",
- "socket2 0.6.3",
+ "socket2 0.5.10",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -11643,9 +12347,9 @@ dependencies = [
  "cfg_aliases 0.2.1",
  "libc",
  "once_cell",
- "socket2 0.6.3",
+ "socket2 0.5.10",
  "tracing",
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -11713,9 +12417,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
  "chacha20 0.10.0",
  "getrandom 0.4.1",
@@ -11929,18 +12633,18 @@ dependencies = [
  "datatest-stable",
  "dropshot 0.17.0",
  "expectorate",
- "gateway-types",
+ "gateway-types 0.1.0",
  "humantime",
  "iddqd",
  "indent_write",
- "internal-dns-types",
+ "internal-dns-types 0.1.0",
  "itertools 0.14.0",
  "newtype-uuid",
  "nexus-inventory",
  "nexus-reconfigurator-blippy",
  "nexus-reconfigurator-planning",
  "nexus-reconfigurator-simulation",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-repl-utils",
  "omicron-rpaths",
@@ -11951,7 +12655,7 @@ dependencies = [
  "semver 1.0.28",
  "serde",
  "serde_json",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "slog",
  "slog-error-chain",
  "slog-term",
@@ -11976,21 +12680,21 @@ dependencies = [
  "clap",
  "dropshot 0.17.0",
  "futures",
- "gateway-client",
- "gateway-types",
+ "gateway-client 0.1.0",
+ "gateway-types 0.1.0",
  "humantime",
- "internal-dns-resolver",
- "internal-dns-types",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "nexus-mgs-updates",
- "nexus-types",
+ "nexus-types 0.1.0",
  "omicron-common",
  "omicron-repl-utils",
  "omicron-workspace-hack",
  "oxide-tokio-rt",
  "qorb",
  "serde_json",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "swrite",
  "tokio",
@@ -12238,6 +12942,7 @@ dependencies = [
  "bytes",
  "cookie",
  "cookie_store",
+ "encoding_rs",
  "futures-channel",
  "futures-core",
  "futures-util",
@@ -12250,6 +12955,7 @@ dependencies = [
  "hyper-util",
  "js-sys",
  "log",
+ "mime",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
@@ -12556,7 +13262,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.11.0",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -12659,7 +13365,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -13523,12 +14229,12 @@ dependencies = [
  "schemars 0.8.22",
  "semver 1.0.28",
  "serde",
- "sled-agent-types",
- "sled-agent-types-versions",
+ "sled-agent-types 0.1.0",
+ "sled-agent-types-versions 0.1.0",
  "sled-diagnostics",
- "sled-hardware-types",
+ "sled-hardware-types 0.1.0",
  "slog-error-chain",
- "trust-quorum-types",
+ "trust-quorum-types 0.1.0",
  "tufaceous-artifact",
  "uuid",
  "x509-cert",
@@ -13552,11 +14258,11 @@ dependencies = [
  "schemars 0.8.22",
  "serde",
  "serde_json",
- "sled-agent-types",
- "sled-agent-types-versions",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-agent-types-versions 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
- "trust-quorum-types",
+ "trust-quorum-types 0.1.0",
  "uuid",
 ]
 
@@ -13581,13 +14287,13 @@ dependencies = [
  "futures",
  "glob",
  "iddqd",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "installinator-common",
  "key-manager",
- "key-manager-types",
+ "key-manager-types 0.1.0",
  "ntp-admin-v1-client",
  "omicron-common",
- "omicron-ledger",
+ "omicron-ledger 0.1.0",
  "omicron-test-utils",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -13602,8 +14308,8 @@ dependencies = [
  "sha2",
  "sled-agent-api",
  "sled-agent-resolvable-files-examples",
- "sled-agent-types",
- "sled-agent-types-versions",
+ "sled-agent-types 0.1.0",
+ "sled-agent-types-versions 0.1.0",
  "sled-hardware",
  "sled-storage",
  "slog",
@@ -13612,7 +14318,7 @@ dependencies = [
  "test-strategy",
  "thiserror 2.0.18",
  "tokio",
- "trust-quorum-types",
+ "trust-quorum-types 0.1.0",
  "tufaceous-artifact",
  "xshell",
  "zone",
@@ -13625,17 +14331,17 @@ dependencies = [
  "anyhow",
  "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=cc8e02a0800034c431c8cf96b889ea638da3d194)",
  "futures",
- "gateway-client",
+ "gateway-client 0.1.0",
  "http",
- "internal-dns-resolver",
- "internal-dns-types",
- "mg-admin-client",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
+ "mg-admin-client 0.1.0 (git+https://github.com/oxidecomputer/maghemite?rev=9bb5037167c1ff0d812299f668841c9b7bda4480)",
+ "mg-api-types",
  "omicron-common",
  "omicron-ddm-admin-client",
  "omicron-workspace-hack",
  "oxnet",
- "rdb-types",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "slog",
  "slog-error-chain",
  "thiserror 2.0.18",
@@ -13652,13 +14358,13 @@ dependencies = [
  "derive_more 0.99.20",
  "dropshot 0.17.0",
  "futures",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "omicron-common",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "serde",
  "sled-agent-api",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "slog",
  "slog-error-chain",
  "thiserror 2.0.18",
@@ -13678,8 +14384,8 @@ dependencies = [
  "serde",
  "sled-agent-config-reconciler",
  "sled-agent-resolvable-files",
- "sled-agent-types",
- "sled-agent-types-versions",
+ "sled-agent-types 0.1.0",
+ "sled-agent-types-versions 0.1.0",
  "slog",
  "slog-error-chain",
  "thiserror 2.0.18",
@@ -13691,8 +14397,8 @@ name = "sled-agent-rack-setup"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "bootstore",
- "bootstrap-agent-lockstep-types",
+ "bootstore 0.1.0",
+ "bootstrap-agent-lockstep-types 0.1.0",
  "camino",
  "camino-tempfile",
  "cancel-safe-futures",
@@ -13702,17 +14408,17 @@ dependencies = [
  "futures",
  "http",
  "iddqd",
- "illumos-utils",
- "internal-dns-resolver",
- "internal-dns-types",
+ "illumos-utils 0.1.0",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "itertools 0.14.0",
  "nexus-lockstep-client",
  "nexus-reconfigurator-blippy",
- "nexus-types",
+ "nexus-types 0.1.0",
  "ntp-admin-client",
  "omicron-common",
  "omicron-ddm-admin-client",
- "omicron-ledger",
+ "omicron-ledger 0.1.0",
  "omicron-test-utils",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -13724,8 +14430,8 @@ dependencies = [
  "serde",
  "sled-agent-client",
  "sled-agent-config-reconciler",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "sled-storage",
  "slog",
  "slog-error-chain",
@@ -13734,8 +14440,8 @@ dependencies = [
  "tokio",
  "toml 0.8.23",
  "trust-quorum",
- "trust-quorum-protocol",
- "trust-quorum-types",
+ "trust-quorum-protocol 0.1.0",
+ "trust-quorum-types 0.1.0",
  "uuid",
 ]
 
@@ -13748,7 +14454,7 @@ dependencies = [
  "dropshot 0.17.0",
  "expectorate",
  "iddqd",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "omicron-common",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -13759,7 +14465,7 @@ dependencies = [
  "sha2",
  "sled-agent-config-reconciler",
  "sled-agent-resolvable-files-examples",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "sled-storage",
  "slog",
  "slog-error-chain",
@@ -13779,7 +14485,7 @@ dependencies = [
  "omicron-workspace-hack",
  "serde_json",
  "sha2",
- "sled-agent-types",
+ "sled-agent-types 0.1.0",
  "sled-storage",
  "tufaceous-artifact",
 ]
@@ -13790,7 +14496,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "bootstore",
+ "bootstore 0.1.0",
  "byte-wrapper",
  "camino",
  "chrono",
@@ -13804,8 +14510,8 @@ dependencies = [
  "schemars 0.8.22",
  "serde",
  "serde_json",
- "sled-agent-types-versions",
- "sled-hardware-types",
+ "sled-agent-types-versions 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
  "swrite",
@@ -13815,6 +14521,36 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "sled-agent-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "bootstore 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "byte-wrapper",
+ "camino",
+ "chrono",
+ "daft",
+ "iddqd",
+ "omicron-common",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "oxnet",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "sled-agent-types-versions 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "sled-hardware-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "slog",
+ "slog-error-chain",
+ "swrite",
+ "thiserror 2.0.18",
+ "tufaceous-artifact",
+ "uuid",
+]
+
 [[package]]
 name = "sled-agent-types-versions"
 version = "0.1.0"
@@ -13822,7 +14558,7 @@ dependencies = [
  "anyhow",
  "assert_matches",
  "async-trait",
- "bootstore",
+ "bootstore 0.1.0",
  "byte-wrapper",
  "camino",
  "chrono",
@@ -13832,8 +14568,8 @@ dependencies = [
  "ipnetwork",
  "itertools 0.14.0",
  "omicron-common",
- "omicron-ledger",
- "omicron-passwords",
+ "omicron-ledger 0.1.0",
+ "omicron-passwords 0.1.0",
  "omicron-test-utils",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -13846,14 +14582,53 @@ dependencies = [
  "serde_json",
  "serde_with",
  "sha3",
- "sled-hardware-types",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
  "strum 0.27.2",
  "test-strategy",
  "thiserror 2.0.18",
  "toml 0.8.23",
- "trust-quorum-types-versions",
+ "trust-quorum-types-versions 0.1.0",
+ "tufaceous-artifact",
+ "uuid",
+]
+
+[[package]]
+name = "sled-agent-types-versions"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "bootstore 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "byte-wrapper",
+ "camino",
+ "chrono",
+ "daft",
+ "iddqd",
+ "indent_write",
+ "ipnetwork",
+ "itertools 0.14.0",
+ "omicron-common",
+ "omicron-ledger 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "omicron-passwords 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "oxnet",
+ "propolis-api-types-versions",
+ "propolis_api_types",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "sha3",
+ "sled-hardware-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "slog",
+ "slog-error-chain",
+ "strum 0.27.2",
+ "thiserror 2.0.18",
+ "trust-quorum-types-versions 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "tufaceous-artifact",
  "uuid",
 ]
@@ -13868,7 +14643,7 @@ dependencies = [
  "chrono",
  "fs-err 3.3.0",
  "futures",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "jiff",
  "libc",
  "omicron-common",
@@ -13901,7 +14676,7 @@ dependencies = [
  "futures",
  "gethostname",
  "illumos-devinfo",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "libc",
  "libefi-illumos",
  "libnvme",
@@ -13913,7 +14688,7 @@ dependencies = [
  "rand 0.9.2",
  "schemars 0.8.22",
  "serde",
- "sled-hardware-types",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
  "thiserror 2.0.18",
@@ -13937,6 +14712,19 @@ dependencies = [
  "thiserror 2.0.18",
 ]
 
+[[package]]
+name = "sled-hardware-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "daft",
+ "omicron-workspace-hack",
+ "schemars 0.8.22",
+ "serde",
+ "slog",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "sled-storage"
 version = "0.1.0"
@@ -13952,7 +14740,7 @@ dependencies = [
  "futures",
  "glob",
  "iddqd",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "key-manager",
  "omicron-common",
  "omicron-test-utils",
@@ -14133,6 +14921,17 @@ dependencies = [
  "thiserror 1.0.69",
 ]
 
+[[package]]
+name = "smf"
+version = "0.10.0"
+source = "git+https://github.com/illumos/smf-rs?branch=main#72389b5161d2cca1f0e239b337af68bf31f191f4"
+dependencies = [
+ "libc",
+ "libscf-sys",
+ "num-traits",
+ "thiserror 1.0.69",
+]
+
 [[package]]
 name = "smf"
 version = "0.10.0"
@@ -14188,7 +14987,7 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
- "heck 0.5.0",
+ "heck 0.4.1",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -14225,10 +15024,10 @@ dependencies = [
  "futures",
  "gateway-ereport-messages",
  "gateway-messages",
- "gateway-types",
+ "gateway-types 0.1.0",
  "hex",
  "hubtools 0.4.7 (git+https://github.com/oxidecomputer/hubtools.git?rev=2b1ef9b38d75563ea800baa3b17327eec17b1b7a)",
- "nexus-types",
+ "nexus-types 0.1.0",
  "nix 0.31.2",
  "omicron-common",
  "omicron-workspace-hack",
@@ -14825,7 +15624,7 @@ dependencies = [
  "getrandom 0.4.1",
  "once_cell",
  "rustix 1.1.3",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -14845,7 +15644,7 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8c27177b12a6399ffc08b98f76f7c9a1f4fe9fc967c784c5a071fa8d93cf7e1"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -15158,7 +15957,7 @@ dependencies = [
 [[package]]
 name = "tofino"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/tofino#7e56ab6e9a64ebae27cd97cd6e10ebf2cfdc3a33"
+source = "git+https://github.com/oxidecomputer/tofino#e25e52991785039e967fd8fe7d86554d976e6d4b"
 dependencies = [
  "anyhow",
  "cc",
@@ -15575,10 +16374,10 @@ dependencies = [
  "reconfigurator-cli",
  "reedline",
  "serde_json",
- "sled-hardware-types",
+ "sled-hardware-types 0.1.0",
  "slog",
  "tabled 0.15.0",
- "trust-quorum-protocol",
+ "trust-quorum-protocol 0.1.0",
  "trust-quorum-test-utils",
 ]
 
@@ -15628,7 +16427,7 @@ dependencies = [
 [[package]]
 name = "transceiver-controller"
 version = "0.1.1"
-source = "git+https://github.com/oxidecomputer/transceiver-control?branch=main#11afc484d5957b13d3058e44db274aa720cea1c4"
+source = "git+https://github.com/oxidecomputer/transceiver-control?branch=main#81167659157860d6587713b3362b7bc791dfb530"
 dependencies = [
  "anyhow",
  "clap",
@@ -15676,7 +16475,7 @@ dependencies = [
 [[package]]
 name = "transceiver-decode"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/transceiver-control?branch=main#11afc484d5957b13d3058e44db274aa720cea1c4"
+source = "git+https://github.com/oxidecomputer/transceiver-control?branch=main#81167659157860d6587713b3362b7bc791dfb530"
 dependencies = [
  "schemars 0.8.22",
  "serde",
@@ -15700,7 +16499,7 @@ dependencies = [
 [[package]]
 name = "transceiver-messages"
 version = "0.1.1"
-source = "git+https://github.com/oxidecomputer/transceiver-control?branch=main#11afc484d5957b13d3058e44db274aa720cea1c4"
+source = "git+https://github.com/oxidecomputer/transceiver-control?branch=main#81167659157860d6587713b3362b7bc791dfb530"
 dependencies = [
  "bitflags 2.11.0",
  "clap",
@@ -15733,7 +16532,7 @@ dependencies = [
  "dropshot 0.17.0",
  "hickory-proto 0.25.2",
  "hickory-resolver 0.25.2",
- "internal-dns-types",
+ "internal-dns-types 0.1.0",
  "omicron-workspace-hack",
  "slog",
  "tempfile",
@@ -15746,7 +16545,7 @@ dependencies = [
  "anyhow",
  "assert_matches",
  "attest-mock",
- "bootstore",
+ "bootstore 0.1.0",
  "bytes",
  "camino",
  "chacha20poly1305",
@@ -15756,11 +16555,11 @@ dependencies = [
  "derive_more 0.99.20",
  "dropshot 0.17.0",
  "futures",
- "gfss",
+ "gfss 0.1.0",
  "hex",
  "hkdf",
  "iddqd",
- "omicron-ledger",
+ "omicron-ledger 0.1.0",
  "omicron-test-utils",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -15772,8 +16571,8 @@ dependencies = [
  "serde_with",
  "sha3",
  "sled-agent-measurements",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
  "sprockets-tls",
@@ -15783,9 +16582,9 @@ dependencies = [
  "test-strategy",
  "thiserror 2.0.18",
  "tokio",
- "trust-quorum-protocol",
+ "trust-quorum-protocol 0.1.0",
  "trust-quorum-test-utils",
- "trust-quorum-types",
+ "trust-quorum-types 0.1.0",
  "uuid",
  "zeroize",
 ]
@@ -15796,7 +16595,7 @@ version = "0.1.0"
 dependencies = [
  "assert_matches",
  "attest-mock",
- "bootstore",
+ "bootstore 0.1.0",
  "bytes",
  "camino",
  "chacha20poly1305",
@@ -15804,7 +16603,7 @@ dependencies = [
  "daft",
  "derive_more 0.99.20",
  "dropshot 0.17.0",
- "gfss",
+ "gfss 0.1.0",
  "hex",
  "hkdf",
  "iddqd",
@@ -15818,8 +16617,8 @@ dependencies = [
  "serde_json",
  "serde_with",
  "sha3",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
  "static_assertions",
@@ -15827,7 +16626,42 @@ dependencies = [
  "test-strategy",
  "thiserror 2.0.18",
  "trust-quorum-test-utils",
- "trust-quorum-types",
+ "trust-quorum-types 0.1.0",
+ "uuid",
+ "zeroize",
+]
+
+[[package]]
+name = "trust-quorum-protocol"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "bootstore 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "bytes",
+ "camino",
+ "chacha20poly1305",
+ "ciborium",
+ "daft",
+ "derive_more 0.99.20",
+ "gfss 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "hex",
+ "hkdf",
+ "iddqd",
+ "omicron-uuid-kinds",
+ "omicron-workspace-hack",
+ "rand 0.9.2",
+ "secrecy 0.10.3",
+ "serde",
+ "serde_with",
+ "sha3",
+ "sled-agent-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "sled-hardware-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+ "slog",
+ "slog-error-chain",
+ "static_assertions",
+ "subtle",
+ "thiserror 2.0.18",
+ "trust-quorum-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "uuid",
  "zeroize",
 ]
@@ -15836,40 +16670,71 @@ dependencies = [
 name = "trust-quorum-test-utils"
 version = "0.1.0"
 dependencies = [
- "bootstore",
+ "bootstore 0.1.0",
  "camino",
  "daft",
  "dropshot 0.17.0",
- "gfss",
+ "gfss 0.1.0",
  "iddqd",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "secrecy 0.10.3",
  "serde",
  "serde_json",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
- "trust-quorum-protocol",
- "trust-quorum-types",
+ "trust-quorum-protocol 0.1.0",
+ "trust-quorum-types 0.1.0",
+]
+
+[[package]]
+name = "trust-quorum-types"
+version = "0.1.0"
+dependencies = [
+ "omicron-workspace-hack",
+ "trust-quorum-types-versions 0.1.0",
 ]
 
 [[package]]
 name = "trust-quorum-types"
 version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "omicron-workspace-hack",
+ "trust-quorum-types-versions 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
+]
+
+[[package]]
+name = "trust-quorum-types-versions"
+version = "0.1.0"
 dependencies = [
+ "byte-wrapper",
+ "daft",
+ "derive_more 0.99.20",
+ "gfss 0.1.0",
+ "iddqd",
+ "omicron-uuid-kinds",
  "omicron-workspace-hack",
- "trust-quorum-types-versions",
+ "rand 0.9.2",
+ "schemars 0.8.22",
+ "serde",
+ "serde_with",
+ "sled-hardware-types 0.1.0",
+ "slog",
+ "slog-error-chain",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
 name = "trust-quorum-types-versions"
 version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
 dependencies = [
  "byte-wrapper",
  "daft",
  "derive_more 0.99.20",
- "gfss",
+ "gfss 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "iddqd",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -15877,7 +16742,7 @@ dependencies = [
  "schemars 0.8.22",
  "serde",
  "serde_with",
- "sled-hardware-types",
+ "sled-hardware-types 0.1.0 (git+https://github.com/oxidecomputer/omicron?branch=main)",
  "slog",
  "slog-error-chain",
  "thiserror 2.0.18",
@@ -16377,6 +17242,36 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "update-engine"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/omicron?branch=main#915f229f78bc15859eeaf575f2e436710a51fd4a"
+dependencies = [
+ "anyhow",
+ "cancel-safe-futures",
+ "chrono",
+ "debug-ignore",
+ "derive-where",
+ "either",
+ "futures",
+ "indent_write",
+ "indexmap 2.14.0",
+ "libsw",
+ "linear-map",
+ "omicron-workspace-hack",
+ "owo-colors 4.3.0",
+ "petgraph 0.8.3",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "slog",
+ "swrite",
+ "tokio",
+ "unicode-width 0.1.14",
+ "uuid",
+]
+
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -16940,7 +17835,7 @@ dependencies = [
  "itertools 0.14.0",
  "maplit",
  "omicron-common",
- "omicron-passwords",
+ "omicron-passwords 0.1.0",
  "omicron-workspace-hack",
  "owo-colors 4.3.0",
  "proptest",
@@ -16951,8 +17846,8 @@ dependencies = [
  "serde",
  "serde_json",
  "shell-words",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-async",
  "slog-envlogger",
@@ -16970,7 +17865,7 @@ dependencies = [
  "tufaceous-artifact",
  "tui-tree-widget",
  "unicode-width 0.1.14",
- "update-engine",
+ "update-engine 0.1.0",
  "wicket-common",
  "wicketd-client",
  "zeroize",
@@ -16983,8 +17878,8 @@ dependencies = [
  "anyhow",
  "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=187aee7de2e50f907099ea06c04aac96c3455665)",
  "dropshot 0.17.0",
- "gateway-client",
- "gateway-types",
+ "gateway-client 0.1.0",
+ "gateway-types 0.1.0",
  "maplit",
  "omicron-common",
  "omicron-workspace-hack",
@@ -16995,8 +17890,8 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "slog-error-chain",
  "thiserror 2.0.18",
@@ -17004,7 +17899,7 @@ dependencies = [
  "toml 0.8.23",
  "transceiver-controller 0.1.1 (git+https://github.com/oxidecomputer/transceiver-control)",
  "tufaceous-artifact",
- "update-engine",
+ "update-engine 0.1.0",
 ]
 
 [[package]]
@@ -17054,29 +17949,29 @@ dependencies = [
  "flume",
  "fs-err 3.3.0",
  "futures",
- "gateway-client",
+ "gateway-client 0.1.0",
  "gateway-messages",
  "gateway-test-utils",
- "gateway-types",
+ "gateway-types 0.1.0",
  "hex",
  "hickory-resolver 0.25.2",
  "http",
  "http-body-util",
  "hubtools 0.4.7 (git+https://github.com/oxidecomputer/hubtools.git?rev=2b1ef9b38d75563ea800baa3b17327eec17b1b7a)",
  "hyper",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "installinator",
  "installinator-api",
  "installinator-client",
  "installinator-common",
- "internal-dns-resolver",
- "internal-dns-types",
+ "internal-dns-resolver 0.1.0",
+ "internal-dns-types 0.1.0",
  "itertools 0.14.0",
  "maplit",
  "omicron-certificates",
  "omicron-common",
  "omicron-ddm-admin-client",
- "omicron-passwords",
+ "omicron-passwords 0.1.0",
  "omicron-test-utils",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
@@ -17094,8 +17989,8 @@ dependencies = [
  "sled-agent-config-reconciler",
  "sled-agent-resolvable-files",
  "sled-agent-resolvable-files-examples",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "sled-storage",
  "slog",
  "slog-dtrace",
@@ -17113,7 +18008,7 @@ dependencies = [
  "tufaceous-artifact",
  "tufaceous-lib",
  "update-common",
- "update-engine",
+ "update-engine 0.1.0",
  "uuid",
  "wicket",
  "wicket-common",
@@ -17127,15 +18022,15 @@ version = "0.1.0"
 dependencies = [
  "bootstrap-agent-lockstep-client",
  "dropshot 0.17.0",
- "gateway-client",
+ "gateway-client 0.1.0",
  "omicron-common",
- "omicron-passwords",
+ "omicron-passwords 0.1.0",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "schemars 0.8.22",
  "semver 1.0.28",
  "serde",
- "sled-hardware-types",
+ "sled-hardware-types 0.1.0",
  "slog",
  "tufaceous-artifact",
  "wicket-common",
@@ -17145,7 +18040,7 @@ dependencies = [
 name = "wicketd-client"
 version = "0.1.0"
 dependencies = [
- "bootstrap-agent-lockstep-types",
+ "bootstrap-agent-lockstep-types 0.1.0",
  "chrono",
  "installinator-common",
  "omicron-common",
@@ -17158,10 +18053,10 @@ dependencies = [
  "semver 1.0.28",
  "serde",
  "serde_json",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
- "update-engine",
+ "update-engine 0.1.0",
  "uuid",
  "wicket-common",
 ]
@@ -17194,7 +18089,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -17597,6 +18492,15 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "winnow"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "winreg"
 version = "0.50.0"
@@ -17971,7 +18875,7 @@ dependencies = [
  "async-trait",
  "camino",
  "camino-tempfile",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "key-manager",
  "omicron-common",
  "omicron-uuid-kinds",
@@ -18044,14 +18948,14 @@ dependencies = [
  "camino",
  "clap",
  "dropshot 0.17.0",
- "illumos-utils",
+ "illumos-utils 0.1.0",
  "omicron-common",
  "omicron-workspace-hack",
  "oxide-tokio-rt",
  "oxnet",
  "serde_json",
- "sled-agent-types",
- "sled-hardware-types",
+ "sled-agent-types 0.1.0",
+ "sled-hardware-types 0.1.0",
  "slog",
  "tokio",
  "uzers",
diff --git a/Cargo.toml b/Cargo.toml
index 0a9cc97e5c7..22a4f88a548 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -454,7 +454,7 @@ cfg-if = "1.0"
 chrono = { version = "0.4", features = [ "serde" ] }
 chrono-tz = { version = "0.10.4", features = [ "serde" ] }
 ciborium = "0.2.2"
-clap = { version = "4.5", features = ["cargo", "derive", "env", "wrap_help"] }
+clap = { version = "4.6", features = ["cargo", "derive", "env", "wrap_help"] }
 clickana = { path = "dev-tools/clickana" }
 clickhouse-admin-api = { path = "clickhouse-admin/api" }
 clickhouse-admin-keeper-client = { path = "clients/clickhouse-admin-keeper-client" }
@@ -611,8 +611,9 @@ ntp-admin-client = { path = "clients/ntp-admin-client" }
 ntp-admin-v1-client = { path = "clients/ntp-admin-v1-client" }
 ntp-admin-types = { path = "ntp-admin/types" }
 ntp-admin-types-versions = { path = "ntp-admin/types/versions" }
-mg-admin-client = { git = "https://github.com/oxidecomputer/maghemite", rev = "7696ee48d5ee29a917dea459e281fe2e8ff20513" }
-ddm-admin-client = { git = "https://github.com/oxidecomputer/maghemite", rev = "7696ee48d5ee29a917dea459e281fe2e8ff20513" }
+mg-admin-client = { git = "https://github.com/oxidecomputer/maghemite", rev = "9bb5037167c1ff0d812299f668841c9b7bda4480" }
+mg-api-types = { git = "https://github.com/oxidecomputer/maghemite", rev = "9bb5037167c1ff0d812299f668841c9b7bda4480" }
+ddm-admin-client = { git = "https://github.com/oxidecomputer/maghemite", rev = "9bb5037167c1ff0d812299f668841c9b7bda4480" }
 multimap = "0.10.1"
 nexus-auth = { path = "nexus/auth" }
 nexus-background-task-interface = { path = "nexus/background-task-interface" }
@@ -676,7 +677,7 @@ oxide-client = { path = "clients/oxide-client" }
 oxide-tokio-rt = "0.1.4"
 oxide-vpc = { git = "https://github.com/oxidecomputer/opte", rev = "2c6efefe14321dafe7e9e80129d38316adb2d238", features = [ "api", "std" ] }
 oxlog = { path = "dev-tools/oxlog" }
-oxnet = "0.1.4"
+oxnet = "0.1.5"
 once_cell = "1.21.3"
 openapi-lint = { git = "https://github.com/oxidecomputer/openapi-lint", branch = "main" }
 openapiv3 = "2.2.0"
@@ -749,7 +750,6 @@ rats-corim = { git = "https://github.com/oxidecomputer/rats-corim.git", rev = "f
 raw-cpuid = { git = "https://github.com/oxidecomputer/rust-cpuid.git", rev = "a4cf01df76f35430ff5d39dc2fe470bcb953503b" }
 rayon = "1.10"
 rcgen = "0.12.1"
-rdb-types = { git = "https://github.com/oxidecomputer/maghemite", rev = "7696ee48d5ee29a917dea459e281fe2e8ff20513" }
 reconfigurator-cli = { path = "dev-tools/reconfigurator-cli" }
 reedline = "0.40.0"
 ref-cast = "1.0"
@@ -1129,3 +1129,8 @@ path = "workspace-hack"
 [patch."https://github.com/oxidecomputer/omicron"]
 omicron-uuid-kinds = { path = "uuid-kinds" }
 omicron-common = { path = "common" }
+# oxlog is built as a binary by omicron-package. Without this patch,
+# transitive git-pulls of oxlog (illumos-utils -> oxlog, via maghemite's
+# branch=main omicron deps) leave both local and git copies in the dep graph,
+# and cargo's `--package oxlog` fails as ambiguous.
+oxlog = { path = "dev-tools/oxlog" }
diff --git a/clients/ddm-admin-client/src/lib.rs b/clients/ddm-admin-client/src/lib.rs
index 7a8b56d499d..466a8883918 100644
--- a/clients/ddm-admin-client/src/lib.rs
+++ b/clients/ddm-admin-client/src/lib.rs
@@ -13,6 +13,7 @@ pub use ddm_admin_client::types;
 
 use ddm_admin_client::Client as InnerClient;
 use either::Either;
+use omicron_common::address::DDMD_PORT;
 use oxnet::Ipv6Net;
 use sled_hardware_types::underlay::BOOTSTRAP_MASK;
 use sled_hardware_types::underlay::BOOTSTRAP_PREFIX;
@@ -26,9 +27,6 @@ use thiserror::Error;
 
 use crate::types::EnableStatsRequest;
 
-// TODO-cleanup Is it okay to hardcode this port number here?
-const DDMD_PORT: u16 = 8000;
-
 #[derive(Debug, Error, SlogInlineError)]
 pub enum DdmError {
     #[error("Failed to construct an HTTP client:")]
diff --git a/dev-tools/downloader/src/lib.rs b/dev-tools/downloader/src/lib.rs
index 44fb340de28..a7e5a65683b 100644
--- a/dev-tools/downloader/src/lib.rs
+++ b/dev-tools/downloader/src/lib.rs
@@ -69,6 +69,9 @@ enum Target {
     /// Maghemite mgd binary
     MaghemiteMgd,
 
+    /// Maghemite ddmd binary
+    MaghemiteDdmd,
+
     /// SoftNPU, an admin program (scadm) and a pre-compiled P4 program.
     Softnpu,
 
@@ -137,6 +140,7 @@ pub async fn run_cmd(args: DownloadArgs) -> Result<()> {
                     Target::Console => downloader.download_console().await,
                     Target::DendriteStub => downloader.download_dendrite_stub().await,
                     Target::MaghemiteMgd => downloader.download_maghemite_mgd().await,
+                    Target::MaghemiteDdmd => downloader.download_maghemite_ddmd().await,
                     Target::Softnpu => downloader.download_softnpu().await,
                     Target::TransceiverControl => {
                         downloader.download_transceiver_control().await
@@ -946,6 +950,84 @@ impl Downloader<'_> {
         Ok(())
     }
 
+    async fn download_maghemite_ddmd(&self) -> Result<()> {
+        let download_dir = self.output_dir.join("downloads");
+        tokio::fs::create_dir_all(&download_dir).await?;
+
+        let checksums_path = self.versions_dir.join("maghemite_mgd_checksums");
+        let [mg_ddm_sha2, ddmd_linux_sha2] = get_values_from_file(
+            ["MG_DDM_SHA256", "DDMD_LINUX_SHA256"],
+            &checksums_path,
+        )
+        .await?;
+        let commit_path =
+            self.versions_dir.join("maghemite_ddm_openapi_version");
+        let [commit] = get_values_from_file(["COMMIT"], &commit_path).await?;
+
+        let repo = "oxidecomputer/maghemite";
+        let base_url = format!("{BUILDOMAT_URL}/{repo}/image/{commit}");
+
+        let filename = "mg-ddm.tar.gz";
+        let tarball_path = download_dir.join(filename);
+        download_file_and_verify(
+            &self.log,
+            &tarball_path,
+            &format!("{base_url}/{filename}"),
+            ChecksumAlgorithm::Sha2,
+            &mg_ddm_sha2,
+        )
+        .await?;
+        unpack_tarball(&self.log, &tarball_path, &download_dir).await?;
+
+        let destination_dir = self.output_dir.join("mg-ddm");
+        let _ = tokio::fs::remove_dir_all(&destination_dir).await;
+        tokio::fs::create_dir_all(&destination_dir).await?;
+        copy_dir_all(
+            &download_dir.join("root"),
+            &destination_dir.join("root"),
+        )?;
+
+        let binary_dir = destination_dir.join("root/opt/oxide/mg-ddm/bin");
+
+        match os_name()? {
+            Os::Linux => {
+                let filename = "ddmd";
+                let path = download_dir.join(filename);
+                download_file_and_verify(
+                    &self.log,
+                    &path,
+                    &format!(
+                        "{BUILDOMAT_URL}/{repo}/linux/{commit}/{filename}"
+                    ),
+                    ChecksumAlgorithm::Sha2,
+                    &ddmd_linux_sha2,
+                )
+                .await?;
+                set_permissions(&path, 0o755).await?;
+                tokio::fs::copy(path, binary_dir.join(filename)).await?;
+            }
+            Os::Mac => {
+                info!(
+                    self.log,
+                    "Building maghemite ddmd from source for macOS"
+                );
+
+                let binaries = [("ddmd", &["--no-default-features"][..])];
+
+                let built_binaries = self
+                    .build_from_git("maghemite", &commit, &binaries)
+                    .await?;
+
+                let dest = binary_dir.join("ddmd");
+                tokio::fs::copy(&built_binaries[0], &dest).await?;
+                set_permissions(&dest, 0o755).await?;
+            }
+            Os::Illumos => (),
+        }
+
+        Ok(())
+    }
+
     async fn download_softnpu(&self) -> Result<()> {
         let destination_dir = self.output_dir.join("npuzone");
         tokio::fs::create_dir_all(&destination_dir).await?;
diff --git a/env.sh b/env.sh
index 6a84c35902a..114b53f07ed 100644
--- a/env.sh
+++ b/env.sh
@@ -12,6 +12,7 @@ export PATH="$OMICRON_WS/out/cockroachdb/bin:$PATH"
 export PATH="$OMICRON_WS/out/clickhouse:$PATH"
 export PATH="$OMICRON_WS/out/dendrite-stub/bin:$PATH"
 export PATH="$OMICRON_WS/out/mgd/root/opt/oxide/mgd/bin:$PATH"
+export PATH="$OMICRON_WS/out/mg-ddm/root/opt/oxide/mg-ddm/bin:$PATH"
 
 # if xtrace was set previously, do not unset it
 case $OLD_SHELL_OPTS in
diff --git a/internal-dns/types/src/config.rs b/internal-dns/types/src/config.rs
index d5bef144343..5b4f736e2c5 100644
--- a/internal-dns/types/src/config.rs
+++ b/internal-dns/types/src/config.rs
@@ -163,6 +163,20 @@ pub struct DnsConfigBuilder {
     service_instances_sleds: BTreeMap<ServiceName, BTreeMap<Sled, u16>>,
 }
 
+/// Ports for the per-switch services published in internal DNS by
+/// [`DnsConfigBuilder::host_zone_switch`].
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct HostSwitchZonePorts {
+    /// Dendrite (`dpd`) admin API port.
+    pub dendrite: u16,
+    /// Management Gateway Service (`mgs`) port.
+    pub mgs: u16,
+    /// Maghemite `mgd` admin API port.
+    pub mgd: u16,
+    /// Maghemite `ddmd` admin API port.
+    pub ddm: u16,
+}
+
 /// Describes a host of type "sled" in the control plane DNS zone
 #[derive(Clone, Debug, Hash, PartialEq, Eq, PartialOrd, Ord)]
 pub struct Sled(SledUuid);
@@ -396,10 +410,14 @@ impl DnsConfigBuilder {
         &mut self,
         sled_id: SledUuid,
         switch_zone_ip: Ipv6Addr,
-        dendrite_port: u16,
-        mgs_port: u16,
-        mgd_port: u16,
+        ports: HostSwitchZonePorts,
     ) -> anyhow::Result<()> {
+        let HostSwitchZonePorts {
+            dendrite: dendrite_port,
+            mgs: mgs_port,
+            mgd: mgd_port,
+            ddm: ddm_port,
+        } = ports;
         let zone = self.host_dendrite(sled_id, switch_zone_ip)?;
         self.service_backend_zone(ServiceName::Dendrite, &zone, dendrite_port)?;
         self.service_backend_zone(
@@ -407,7 +425,8 @@ impl DnsConfigBuilder {
             &zone,
             mgs_port,
         )?;
-        self.service_backend_zone(ServiceName::Mgd, &zone, mgd_port)
+        self.service_backend_zone(ServiceName::Mgd, &zone, mgd_port)?;
+        self.service_backend_zone(ServiceName::Ddm, &zone, ddm_port)
     }
 
     /// Higher-level shorthand for adding a Nexus zone with both its internal
@@ -731,7 +750,9 @@ impl DnsConfigBuilder {
 
 #[cfg(test)]
 mod test {
-    use super::{DnsConfigBuilder, Host, ServiceName};
+    use super::{
+        DnsConfigBuilder, DnsRecord, Host, HostSwitchZonePorts, ServiceName,
+    };
     use crate::{config::Zone, names::DNS_ZONE};
     use omicron_common::api::external::Generation;
     use omicron_uuid_kinds::{OmicronZoneUuid, SledUuid};
@@ -779,6 +800,8 @@ mod test {
             "_oximeter-reader._tcp",
         );
         assert_eq!(ServiceName::Dendrite.dns_name(), "_dendrite._tcp",);
+        assert_eq!(ServiceName::Mgd.dns_name(), "_mgd._tcp",);
+        assert_eq!(ServiceName::Ddm.dns_name(), "_ddm._tcp",);
         assert_eq!(
             ServiceName::CruciblePantry.dns_name(),
             "_crucible-pantry._tcp",
@@ -796,6 +819,71 @@ mod test {
         );
     }
 
+    #[test]
+    fn host_zone_switch_publishes_all_services() {
+        let sled_uuid: SledUuid =
+            "001de000-51ed-4000-8000-000000000001".parse().unwrap();
+        let switch_zone_ip = Ipv6Addr::new(0, 0, 0, 0, 0, 0, 0, 1);
+
+        // Use distinct port numbers so an arg-order swap in `host_zone_switch`
+        // surfaces as a port mismatch on the affected service.
+        let dendrite_port = 11;
+        let mgs_port = 13;
+        let mgd_port = 17;
+        let ddm_port = 19;
+
+        let mut builder = DnsConfigBuilder::new();
+        builder
+            .host_zone_switch(
+                sled_uuid,
+                switch_zone_ip,
+                HostSwitchZonePorts {
+                    dendrite: dendrite_port,
+                    mgs: mgs_port,
+                    mgd: mgd_port,
+                    ddm: ddm_port,
+                },
+            )
+            .unwrap();
+
+        let config = builder.build_full_config_for_initial_generation();
+
+        let mut by_name: BTreeMap<&str, &[DnsRecord]> = BTreeMap::new();
+        for zone in &config.zones {
+            for (name, records) in &zone.records {
+                by_name.insert(name.as_str(), records.as_slice());
+            }
+        }
+
+        for (expected_name, expected_port) in [
+            ("_dendrite._tcp", dendrite_port),
+            ("_mgs._tcp", mgs_port),
+            ("_mgd._tcp", mgd_port),
+            ("_ddm._tcp", ddm_port),
+        ] {
+            let records = by_name.get(expected_name).unwrap_or_else(|| {
+                panic!(
+                    "expected {expected_name} in published switch-zone \
+                     services; got {by_name:?}"
+                )
+            });
+            let srv_port = records
+                .iter()
+                .find_map(|r| match r {
+                    DnsRecord::Srv(s) => Some(s.port),
+                    _ => None,
+                })
+                .unwrap_or_else(|| {
+                    panic!("no SRV record for {expected_name}: {records:?}")
+                });
+
+            assert_eq!(
+                srv_port, expected_port,
+                "wrong SRV port for {expected_name}"
+            );
+        }
+    }
+
     #[test]
     fn display_hosts() {
         let sled_uuid = SledUuid::nil();
diff --git a/internal-dns/types/src/names.rs b/internal-dns/types/src/names.rs
index 73b2439e48e..105d0222f3c 100644
--- a/internal-dns/types/src/names.rs
+++ b/internal-dns/types/src/names.rs
@@ -75,6 +75,7 @@ pub enum ServiceName {
     BoundaryNtp,
     InternalNtp,
     Mgd,
+    Ddm,
 }
 
 impl ServiceName {
@@ -116,6 +117,7 @@ impl ServiceName {
             ServiceName::BoundaryNtp => "boundary-ntp",
             ServiceName::InternalNtp => "internal-ntp",
             ServiceName::Mgd => "mgd",
+            ServiceName::Ddm => "ddm",
         }
     }
 
@@ -144,7 +146,8 @@ impl ServiceName {
             | ServiceName::CruciblePantry
             | ServiceName::BoundaryNtp
             | ServiceName::InternalNtp
-            | ServiceName::Mgd => {
+            | ServiceName::Mgd
+            | ServiceName::Ddm => {
                 format!("_{}._tcp", self.service_kind())
             }
             ServiceName::SledAgent(id) => {
diff --git a/nexus/Cargo.toml b/nexus/Cargo.toml
index acb8784355c..dab2fc223a7 100644
--- a/nexus/Cargo.toml
+++ b/nexus/Cargo.toml
@@ -63,6 +63,7 @@ jiff.workspace = true
 lldpd_client.workspace = true
 macaddr.workspace = true
 maplit.workspace = true
+mg-api-types.workspace = true
 nexus-background-task-interface.workspace = true
 # Not under "dev-dependencies"; these also need to be implemented for
 # integration tests.
@@ -96,7 +97,6 @@ qorb.workspace = true
 rand.workspace = true
 range-requests.workspace = true
 ref-cast.workspace = true
-rdb-types.workspace = true
 regex.workspace = true
 reqwest = { workspace = true, features = ["http2", "json"] }
 reqwest012 = { workspace = true }
diff --git a/nexus/reconfigurator/execution/src/dns.rs b/nexus/reconfigurator/execution/src/dns.rs
index 685c7c85e6f..0a85c4dd114 100644
--- a/nexus/reconfigurator/execution/src/dns.rs
+++ b/nexus/reconfigurator/execution/src/dns.rs
@@ -988,9 +988,8 @@ mod test {
         //    the previous pass (i.e., that corresponds to an Omicron zone).
         //
         // There are some ServiceNames missing here because they are not part of
-        // our representative config (e.g., ClickhouseKeeper) or they don't
-        // currently have DNS record at all (e.g., SledAgent, Maghemite, Mgd,
-        // Tfport).
+        // our representative config (e.g., ClickhouseKeeper) or because they
+        // do not currently have a DNS record at all (e.g., SledAgent).
         let mut srv_kinds_expected = BTreeSet::from([
             ServiceName::Clickhouse,
             ServiceName::ClickhouseNative,
@@ -1001,6 +1000,8 @@ mod test {
             ServiceName::NexusLockstep,
             ServiceName::Oximeter,
             ServiceName::Dendrite,
+            ServiceName::Mgd,
+            ServiceName::Ddm,
             ServiceName::CruciblePantry,
             ServiceName::BoundaryNtp,
             ServiceName::InternalNtp,
diff --git a/nexus/reconfigurator/execution/src/test_utils.rs b/nexus/reconfigurator/execution/src/test_utils.rs
index cd46adacd0b..fdb17289225 100644
--- a/nexus/reconfigurator/execution/src/test_utils.rs
+++ b/nexus/reconfigurator/execution/src/test_utils.rs
@@ -113,10 +113,12 @@ pub fn overridables_for_test(
         let dendrite_port =
             cptestctx.dendrite.read().unwrap().get(&switch_slot).unwrap().port;
         let mgd_port = cptestctx.mgd.get(&switch_slot).unwrap().port;
+        let ddm_port = cptestctx.ddm.get(&switch_slot).unwrap().port;
         overrides.override_switch_zone_ip(sled_id, ip);
         overrides.override_dendrite_port(sled_id, dendrite_port);
         overrides.override_mgs_port(sled_id, mgs_port);
         overrides.override_mgd_port(sled_id, mgd_port);
+        overrides.override_ddm_port(sled_id, ddm_port);
     }
     overrides
 }
diff --git a/nexus/reconfigurator/planning/src/example.rs b/nexus/reconfigurator/planning/src/example.rs
index a1f865e2934..7dbbf3640dc 100644
--- a/nexus/reconfigurator/planning/src/example.rs
+++ b/nexus/reconfigurator/planning/src/example.rs
@@ -1854,7 +1854,8 @@ mod tests {
                 | ServiceName::RepoDepot
                 | ServiceName::ManagementGatewayService
                 | ServiceName::Dendrite
-                | ServiceName::Mgd => {
+                | ServiceName::Mgd
+                | ServiceName::Ddm => {
                     out.insert(service, Ok(()));
                 }
                 // InternalNtp is too large to fit in a single DNS packet and
diff --git a/nexus/src/app/background/tasks/sync_switch_configuration.rs b/nexus/src/app/background/tasks/sync_switch_configuration.rs
index 91dcc66b070..f4abc9e549b 100644
--- a/nexus/src/app/background/tasks/sync_switch_configuration.rs
+++ b/nexus/src/app/background/tasks/sync_switch_configuration.rs
@@ -30,13 +30,22 @@ use dpd_client::{Client as DpdClient, types as DpdTypes};
 use futures::FutureExt;
 use futures::future::BoxFuture;
 use mg_admin_client::types::{
-    AddStaticRoute4Request, AddStaticRoute6Request, ApplyRequest,
-    BestpathFanoutRequest, BgpPeerConfig, CheckerSource,
-    DeleteStaticRoute4Request, DeleteStaticRoute6Request,
+    ApplyRequest, BgpPeerConfig, UnnumberedBgpPeerConfig,
+};
+use mg_api_types::bgp::config::{
+    CheckerSource, Ipv4UnicastConfig, Ipv6UnicastConfig, JitterRange,
+    ShaperSource,
+};
+use mg_api_types::bgp::policy::{
     ImportExportPolicy4 as MgImportExportPolicy4,
-    ImportExportPolicy6 as MgImportExportPolicy6, Ipv4UnicastConfig,
-    Ipv6UnicastConfig, JitterRange, ShaperSource, StaticRoute4,
-    StaticRoute4List, StaticRoute6, StaticRoute6List, UnnumberedBgpPeerConfig,
+    ImportExportPolicy6 as MgImportExportPolicy6,
+};
+use mg_api_types::rdb::prefix::{Prefix, Prefix4, Prefix6};
+use mg_api_types::rib::BestpathFanoutRequest;
+use mg_api_types::static_routes::{
+    AddStaticRoute4Request, AddStaticRoute6Request, DeleteStaticRoute4Request,
+    DeleteStaticRoute6Request, StaticRoute4, StaticRoute4List, StaticRoute6,
+    StaticRoute6List,
 };
 use nexus_db_queries::{
     context::OpContext,
@@ -49,7 +58,6 @@ use omicron_common::{
     address::{Ipv6Subnet, get_sled_address},
     api::external::{DataPageParams, Name},
 };
-use rdb_types::{Prefix, Prefix4, Prefix6};
 use serde_json::json;
 use sled_agent_client::types::HostPortConfig;
 use sled_agent_types::early_networking::BgpConfig as SledBgpConfig;
@@ -998,7 +1006,7 @@ impl BackgroundTask for SwitchPortSettingsManager {
                         "switch_slot" => ?switch_slot,
                         "config" => ?config,
                     );
-                    if let Err(e) = client.bgp_apply_v2(config).await {
+                    if let Err(e) = client.bgp_apply(config).await {
                         error!(log, "error while applying bgp configuration"; "error" => ?e);
                     }
 
diff --git a/nexus/src/app/bgp.rs b/nexus/src/app/bgp.rs
index 53cc41996c5..0ca95b2f294 100644
--- a/nexus/src/app/bgp.rs
+++ b/nexus/src/app/bgp.rs
@@ -177,7 +177,7 @@ impl super::Nexus {
 
             for r in &router_info {
                 let asn = r.asn;
-                let selector = mg_admin_client::types::ExportedSelector {
+                let selector = mg_api_types::bgp::session::ExportedSelector {
                     afi: None,
                     asn,
                     peer: None,
@@ -199,12 +199,12 @@ impl super::Nexus {
                 for (peer_id, exports) in exported {
                     for ex in exports.iter() {
                         let prefix = match ex {
-                            rdb_types::Prefix::V4(v4) => {
+                            mg_api_types::rdb::prefix::Prefix::V4(v4) => {
                                 oxnet::IpNet::V4(oxnet::Ipv4Net::new_unchecked(
                                     v4.value, v4.length,
                                 ))
                             }
-                            rdb_types::Prefix::V6(v6) => {
+                            mg_api_types::rdb::prefix::Prefix::V6(v6) => {
                                 oxnet::IpNet::V6(oxnet::Ipv6Net::new_unchecked(
                                     v6.value, v6.length,
                                 ))
diff --git a/nexus/test-utils/src/nexus_test.rs b/nexus/test-utils/src/nexus_test.rs
index 693aea88732..48c945e742b 100644
--- a/nexus/test-utils/src/nexus_test.rs
+++ b/nexus/test-utils/src/nexus_test.rs
@@ -117,6 +117,7 @@ pub struct ControlPlaneTestContext<N> {
     /// Ports of stopped dendrite instances (for use by start_dendrite)
     pub stopped_dendrite_ports: RwLock<HashMap<SwitchSlot, u16>>,
     pub mgd: HashMap<SwitchSlot, dev::maghemite::MgdInstance>,
+    pub ddm: HashMap<SwitchSlot, dev::maghemite::DdmInstance>,
     pub external_dns_zone_name: String,
     pub external_dns: TransientDnsServer,
     pub internal_dns: TransientDnsServer,
@@ -320,6 +321,9 @@ impl<N: NexusServer> ControlPlaneTestContext<N> {
         for (_, mut mgd) in self.mgd {
             mgd.cleanup().await.unwrap();
         }
+        for (_, mut ddm) in self.ddm {
+            ddm.cleanup().await.unwrap();
+        }
         self.logctx.cleanup_successful();
     }
 }
diff --git a/nexus/test-utils/src/starter.rs b/nexus/test-utils/src/starter.rs
index 3822be75d1f..bb84aed361c 100644
--- a/nexus/test-utils/src/starter.rs
+++ b/nexus/test-utils/src/starter.rs
@@ -23,6 +23,7 @@ use futures::future::BoxFuture;
 use gateway_test_utils::setup::GatewayTestContext;
 use iddqd::IdOrdMap;
 use internal_dns_types::config::DnsConfigBuilder;
+use internal_dns_types::config::HostSwitchZonePorts;
 use internal_dns_types::names::DNS_ZONE_EXTERNAL_TESTING;
 use internal_dns_types::names::ServiceName;
 use nexus_config::Database;
@@ -146,6 +147,7 @@ pub struct ControlPlaneStarter<'a, N: NexusServer> {
     pub gateway: BTreeMap<SwitchSlot, GatewayTestContext>,
     pub dendrite: RwLock<HashMap<SwitchSlot, dev::dendrite::DendriteInstance>>,
     pub mgd: HashMap<SwitchSlot, dev::maghemite::MgdInstance>,
+    pub ddm: HashMap<SwitchSlot, dev::maghemite::DdmInstance>,
 
     // NOTE: Only exists after starting Nexus, until external Nexus is
     // initialized.
@@ -203,6 +205,7 @@ impl<'a, N: NexusServer> ControlPlaneStarter<'a, N> {
             gateway: BTreeMap::new(),
             dendrite: RwLock::new(HashMap::new()),
             mgd: HashMap::new(),
+            ddm: HashMap::new(),
             nexus_internal: None,
             nexus_internal_addr: None,
             external_dns_zone_name: None,
@@ -465,6 +468,17 @@ impl<'a, N: NexusServer> ControlPlaneStarter<'a, N> {
         self.config.pkg.mgd.insert(switch_slot, config);
     }
 
+    pub async fn start_ddm(&mut self, switch_slot: SwitchSlot) {
+        let log = &self.logctx.log;
+        debug!(log, "Starting DDM sim"; "switch_slot" => ?switch_slot);
+
+        let ddm = dev::maghemite::DdmInstance::start().await.unwrap();
+        let port = ddm.port;
+        self.ddm.insert(switch_slot, ddm);
+
+        debug!(log, "DDM sim started"; "port" => port);
+    }
+
     pub async fn record_switch_dns(
         &mut self,
         sled_id: SledUuid,
@@ -483,9 +497,18 @@ impl<'a, N: NexusServer> ControlPlaneStarter<'a, N> {
             .host_zone_switch(
                 sled_id,
                 Ipv6Addr::LOCALHOST,
-                self.dendrite.read().unwrap().get(&switch_slot).unwrap().port,
-                self.gateway.get(&switch_slot).unwrap().port,
-                self.mgd.get(&switch_slot).unwrap().port,
+                HostSwitchZonePorts {
+                    dendrite: self
+                        .dendrite
+                        .read()
+                        .unwrap()
+                        .get(&switch_slot)
+                        .unwrap()
+                        .port,
+                    mgs: self.gateway.get(&switch_slot).unwrap().port,
+                    mgd: self.mgd.get(&switch_slot).unwrap().port,
+                    ddm: self.ddm.get(&switch_slot).unwrap().port,
+                },
             )
             .unwrap()
     }
@@ -1254,6 +1277,7 @@ impl<'a, N: NexusServer> ControlPlaneStarter<'a, N> {
             dendrite: RwLock::new(self.dendrite.into_inner().unwrap()),
             stopped_dendrite_ports: RwLock::new(HashMap::new()),
             mgd: self.mgd,
+            ddm: self.ddm,
             external_dns_zone_name: self.external_dns_zone_name.unwrap(),
             external_dns: self.external_dns.unwrap(),
             internal_dns: self.internal_dns.unwrap(),
@@ -1295,6 +1319,9 @@ impl<'a, N: NexusServer> ControlPlaneStarter<'a, N> {
         for (_, mut mgd) in self.mgd {
             mgd.cleanup().await.unwrap();
         }
+        for (_, mut ddm) in self.ddm {
+            ddm.cleanup().await.unwrap();
+        }
         self.logctx.cleanup_successful();
     }
 
@@ -1635,6 +1662,12 @@ pub(crate) async fn setup_with_config_impl<N: NexusServer>(
                         builder.start_mgd(SwitchSlot::Switch0).boxed()
                     }),
                 ),
+                (
+                    "start_ddm_switch0",
+                    Box::new(|builder| {
+                        builder.start_ddm(SwitchSlot::Switch0).boxed()
+                    }),
+                ),
                 (
                     "record_switch_dns",
                     Box::new(|builder| {
@@ -1679,6 +1712,12 @@ pub(crate) async fn setup_with_config_impl<N: NexusServer>(
                             builder.start_mgd(SwitchSlot::Switch1).boxed()
                         }),
                     ),
+                    (
+                        "start_ddm_switch1",
+                        Box::new(|builder| {
+                            builder.start_ddm(SwitchSlot::Switch1).boxed()
+                        }),
+                    ),
                     (
                         "record_switch_dns",
                         Box::new(|builder| {
diff --git a/nexus/tests/integration_tests/initialization.rs b/nexus/tests/integration_tests/initialization.rs
index 350757cf1de..714880feb37 100644
--- a/nexus/tests/integration_tests/initialization.rs
+++ b/nexus/tests/integration_tests/initialization.rs
@@ -158,6 +158,11 @@ async fn test_nexus_boots_before_dendrite() {
     starter.start_mgd(SwitchSlot::Switch1).await;
     info!(log, "Started mgd");
 
+    info!(log, "Starting ddm");
+    starter.start_ddm(SwitchSlot::Switch0).await;
+    starter.start_ddm(SwitchSlot::Switch1).await;
+    info!(log, "Started ddm");
+
     info!(log, "Populating internal DNS records");
     starter
         .record_switch_dns(
@@ -197,6 +202,8 @@ async fn nexus_schema_test_setup(
     starter.start_dendrite(SwitchSlot::Switch1).await;
     starter.start_mgd(SwitchSlot::Switch0).await;
     starter.start_mgd(SwitchSlot::Switch1).await;
+    starter.start_ddm(SwitchSlot::Switch0).await;
+    starter.start_ddm(SwitchSlot::Switch1).await;
     starter.populate_internal_dns().await;
 }
 
diff --git a/nexus/types/src/deployment/execution/dns.rs b/nexus/types/src/deployment/execution/dns.rs
index 009377fd8d9..c901dcc92f7 100644
--- a/nexus/types/src/deployment/execution/dns.rs
+++ b/nexus/types/src/deployment/execution/dns.rs
@@ -155,9 +155,7 @@ pub fn blueprint_internal_dns_config(
         dns_builder.host_zone_switch(
             scrimlet.id(),
             switch_zone_ip,
-            overrides.dendrite_port(scrimlet.id()),
-            overrides.mgs_port(scrimlet.id()),
-            overrides.mgd_port(scrimlet.id()),
+            overrides.host_switch_zone_ports(scrimlet.id()),
         )?;
     }
 
diff --git a/nexus/types/src/deployment/execution/overridables.rs b/nexus/types/src/deployment/execution/overridables.rs
index 881a7c49bdd..bf46374d1dc 100644
--- a/nexus/types/src/deployment/execution/overridables.rs
+++ b/nexus/types/src/deployment/execution/overridables.rs
@@ -2,6 +2,8 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
+use internal_dns_types::config::HostSwitchZonePorts;
+use omicron_common::address::DDMD_PORT;
 use omicron_common::address::DENDRITE_PORT;
 use omicron_common::address::Ipv6Subnet;
 use omicron_common::address::MGD_PORT;
@@ -29,6 +31,8 @@ pub struct Overridables {
     pub mgs_ports: BTreeMap<SledUuid, u16>,
     /// map: sled id -> TCP port on which that sled's MGD is listening
     pub mgd_ports: BTreeMap<SledUuid, u16>,
+    /// map: sled id -> TCP port on which that sled's DDM is listening
+    pub ddm_ports: BTreeMap<SledUuid, u16>,
     /// map: sled id -> IP address of the sled's switch zone
     pub switch_zone_ips: BTreeMap<SledUuid, Ipv6Addr>,
 }
@@ -67,6 +71,32 @@ impl Overridables {
         self.mgd_ports.get(&sled_id).copied().unwrap_or(MGD_PORT)
     }
 
+    /// Specify the TCP port on which this sled's DDM is listening
+    pub fn override_ddm_port(&mut self, sled_id: SledUuid, port: u16) {
+        self.ddm_ports.insert(sled_id, port);
+    }
+
+    /// Returns the TCP port on which this sled's DDM is listening
+    pub fn ddm_port(&self, sled_id: SledUuid) -> u16 {
+        self.ddm_ports.get(&sled_id).copied().unwrap_or(DDMD_PORT)
+    }
+
+    /// Returns the per-switch-zone service ports for this sled.
+    ///
+    /// Bundles the four switch-zone admin ports into a single
+    /// [`HostSwitchZonePorts`] so callers cannot swap fields by accident.
+    pub fn host_switch_zone_ports(
+        &self,
+        sled_id: SledUuid,
+    ) -> HostSwitchZonePorts {
+        HostSwitchZonePorts {
+            dendrite: self.dendrite_port(sled_id),
+            mgs: self.mgs_port(sled_id),
+            mgd: self.mgd_port(sled_id),
+            ddm: self.ddm_port(sled_id),
+        }
+    }
+
     /// Specify the IP address of this switch zone
     pub fn override_switch_zone_ip(
         &mut self,
diff --git a/nexus/types/versions/Cargo.toml b/nexus/types/versions/Cargo.toml
index 6c0a2274c6e..ddffa6b880c 100644
--- a/nexus/types/versions/Cargo.toml
+++ b/nexus/types/versions/Cargo.toml
@@ -16,6 +16,7 @@ daft.workspace = true
 dropshot.workspace = true
 http.workspace = true
 mg-admin-client.workspace = true
+mg-api-types.workspace = true
 omicron-common.workspace = true
 omicron-passwords.workspace = true
 omicron-uuid-kinds.workspace = true
diff --git a/nexus/types/versions/src/impls/networking.rs b/nexus/types/versions/src/impls/networking.rs
index 0831b35c920..ddbcec8479f 100644
--- a/nexus/types/versions/src/impls/networking.rs
+++ b/nexus/types/versions/src/impls/networking.rs
@@ -21,11 +21,11 @@ impl From<IpNet> for latest::networking::AddressLotBlockCreate {
     }
 }
 
-impl From<mg_admin_client::types::FsmStateKind>
+impl From<mg_api_types::bgp::session::FsmStateKind>
     for latest::networking::BgpPeerState
 {
-    fn from(s: mg_admin_client::types::FsmStateKind) -> Self {
-        use mg_admin_client::types::FsmStateKind;
+    fn from(s: mg_api_types::bgp::session::FsmStateKind) -> Self {
+        use mg_api_types::bgp::session::FsmStateKind;
         match s {
             FsmStateKind::Idle => Self::Idle,
             FsmStateKind::Connect => Self::Connect,
diff --git a/package-manifest.toml b/package-manifest.toml
index 204a5436de3..4fb73b4ce58 100644
--- a/package-manifest.toml
+++ b/package-manifest.toml
@@ -683,10 +683,10 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "7696ee48d5ee29a917dea459e281fe2e8ff20513"
+source.commit = "9bb5037167c1ff0d812299f668841c9b7bda4480"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/mg-ddm-gz.sha256.txt
-source.sha256 = "ce52b9094adf0ed567bd3ed1e3ac48ac1c983cc7859adacf4f392e415a1189ad"
+source.sha256 = "c3322ac1e14b0abf697921e0c04c1cc542d08d1e7dd2120a7bebb30e6ed94f54"
 output.type = "tarball"
 
 [package.mg-ddm]
@@ -699,10 +699,10 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "7696ee48d5ee29a917dea459e281fe2e8ff20513"
+source.commit = "9bb5037167c1ff0d812299f668841c9b7bda4480"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/mg-ddm.sha256.txt
-source.sha256 = "23950a4e73a07fa7f087ba3312e4bc5a8981fd9ebad54af2350baaa86ad6bbf3"
+source.sha256 = "93338b5869817a4b882fea68bac350e8be7efca0ae0da2e90f3152483c48bab1"
 output.type = "zone"
 output.intermediate_only = true
 
@@ -714,10 +714,10 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "7696ee48d5ee29a917dea459e281fe2e8ff20513"
+source.commit = "9bb5037167c1ff0d812299f668841c9b7bda4480"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/mgd.sha256.txt
-source.sha256 = "301d31ca481e4822f69484feacca31dd08a7c4aae87d96641d384bda3178d2f3"
+source.sha256 = "9b202ecbbe9727fd3c898e19b4ad519fd38218749e1a789e25eb8295cb749520"
 output.type = "zone"
 output.intermediate_only = true
 
diff --git a/sled-agent/early-networking/Cargo.toml b/sled-agent/early-networking/Cargo.toml
index 0ae4cc1428c..8fb7b9e21f7 100644
--- a/sled-agent/early-networking/Cargo.toml
+++ b/sled-agent/early-networking/Cargo.toml
@@ -19,11 +19,11 @@ http.workspace = true
 internal-dns-resolver.workspace = true
 internal-dns-types.workspace = true
 mg-admin-client.workspace = true
+mg-api-types.workspace = true
 omicron-common.workspace = true
 omicron-ddm-admin-client.workspace = true
 omicron-workspace-hack.workspace = true
 oxnet.workspace = true
-rdb-types.workspace = true
 sled-agent-types.workspace = true
 slog.workspace = true
 slog-error-chain.workspace = true
diff --git a/sled-agent/early-networking/src/lib.rs b/sled-agent/early-networking/src/lib.rs
index b4e9e6f768b..edf0bf400a0 100644
--- a/sled-agent/early-networking/src/lib.rs
+++ b/sled-agent/early-networking/src/lib.rs
@@ -16,18 +16,23 @@ use internal_dns_resolver::{ResolveError, Resolver as DnsResolver};
 use internal_dns_types::names::ServiceName;
 use mg_admin_client::Client as MgdClient;
 use mg_admin_client::types::{
-    AddStaticRoute4Request, AddStaticRoute6Request, ApplyRequest,
-    BestpathFanoutRequest, CheckerSource,
-    ImportExportPolicy4 as MgImportExportPolicy4,
-    ImportExportPolicy6 as MgImportExportPolicy6, JitterRange, ShaperSource,
-    StaticRoute4, StaticRoute4List, StaticRoute6, StaticRoute6List,
+    ApplyRequest, BfdPeerConfig as MgBfdPeerConfig,
+    BgpPeerConfig as MgBgpPeerConfig,
+    UnnumberedBgpPeerConfig as MgUnnumberedBgpPeerConfig,
 };
-use mg_admin_client::types::{
-    BfdPeerConfig as MgBfdPeerConfig, Ipv4UnicastConfig,
+use mg_api_types::bgp::config::{
+    CheckerSource, Ipv4UnicastConfig, Ipv6UnicastConfig, JitterRange,
+    ShaperSource,
 };
-use mg_admin_client::types::{
-    BgpPeerConfig as MgBgpPeerConfig, Ipv6UnicastConfig,
-    UnnumberedBgpPeerConfig as MgUnnumberedBgpPeerConfig,
+use mg_api_types::bgp::policy::{
+    ImportExportPolicy4 as MgImportExportPolicy4,
+    ImportExportPolicy6 as MgImportExportPolicy6,
+};
+use mg_api_types::rdb::prefix::{Prefix, Prefix4, Prefix6};
+use mg_api_types::rib::BestpathFanoutRequest;
+use mg_api_types::static_routes::{
+    AddStaticRoute4Request, AddStaticRoute6Request, StaticRoute4,
+    StaticRoute4List, StaticRoute6, StaticRoute6List,
 };
 use omicron_common::OMICRON_DPD_TAG;
 use omicron_common::address::DENDRITE_PORT;
@@ -37,7 +42,6 @@ use omicron_common::backoff::{
 };
 use omicron_ddm_admin_client::DdmError;
 use oxnet::IpNet;
-use rdb_types::{Prefix, Prefix4, Prefix6};
 use sled_agent_types::early_networking::{
     BfdMode, BgpConfig, BgpPeerConfig, ImportExportPolicy, LinkFec, LinkSpeed,
     PortConfig, RouterPeerType, SwitchSlot, UplinkAddress,
@@ -712,7 +716,7 @@ impl<'a> EarlyNetworkSetup<'a> {
                     fanout: config.max_paths.as_nonzero_u8(),
                 };
 
-                if let Err(e) = mgd.bgp_apply_v2(&request).await {
+                if let Err(e) = mgd.bgp_apply(&request).await {
                     error!(
                         self.log,
                         "BGP peer configuration failed";
diff --git a/sled-agent/rack-setup/src/plan/service.rs b/sled-agent/rack-setup/src/plan/service.rs
index 48de2b1d3e9..6ec735e8f62 100644
--- a/sled-agent/rack-setup/src/plan/service.rs
+++ b/sled-agent/rack-setup/src/plan/service.rs
@@ -13,7 +13,7 @@ use iddqd::errors::DuplicateItem;
 use iddqd::id_upcast;
 use illumos_utils::zpool::ZpoolName;
 use internal_dns_types::config::{
-    DnsConfigBuilder, DnsConfigParams, Host, Zone,
+    DnsConfigBuilder, DnsConfigParams, Host, HostSwitchZonePorts, Zone,
 };
 use internal_dns_types::names::ServiceName;
 use nexus_types::deployment::LastAllocatedSubnetIpOffset;
@@ -29,10 +29,10 @@ use nexus_types::deployment::{
 };
 use nexus_types::external_api::sled::SledState;
 use omicron_common::address::{
-    CP_SERVICES_RESERVED_ADDRESSES, DENDRITE_PORT, DNS_HTTP_PORT, DNS_PORT,
-    Ipv6Subnet, MGD_PORT, MGS_PORT, NEXUS_INTERNAL_PORT, NEXUS_LOCKSTEP_PORT,
-    NTP_PORT, NUM_SOURCE_NAT_PORTS, REPO_DEPOT_PORT, ReservedRackSubnet,
-    SLED_PREFIX, SLED_RESERVED_ADDRESSES, get_sled_address,
+    CP_SERVICES_RESERVED_ADDRESSES, DDMD_PORT, DENDRITE_PORT, DNS_HTTP_PORT,
+    DNS_PORT, Ipv6Subnet, MGD_PORT, MGS_PORT, NEXUS_INTERNAL_PORT,
+    NEXUS_LOCKSTEP_PORT, NTP_PORT, NUM_SOURCE_NAT_PORTS, REPO_DEPOT_PORT,
+    ReservedRackSubnet, SLED_PREFIX, SLED_RESERVED_ADDRESSES, get_sled_address,
     get_switch_zone_address,
 };
 use omicron_common::api::external::{Generation, MacAddr, Vni};
@@ -338,9 +338,12 @@ impl ServicePlan {
                 .host_zone_switch(
                     sled.sled_id,
                     address,
-                    DENDRITE_PORT,
-                    MGS_PORT,
-                    MGD_PORT,
+                    HostSwitchZonePorts {
+                        dendrite: DENDRITE_PORT,
+                        mgs: MGS_PORT,
+                        mgd: MGD_PORT,
+                        ddm: DDMD_PORT,
+                    },
                 )
                 .unwrap();
         }
diff --git a/test-utils/src/dev/maghemite.rs b/test-utils/src/dev/maghemite.rs
index eaae1af8cd4..3eedb4bdbd9 100644
--- a/test-utils/src/dev/maghemite.rs
+++ b/test-utils/src/dev/maghemite.rs
@@ -139,7 +139,7 @@ async fn discover_port(logfile: String) -> Result<u16, anyhow::Error> {
     let timeout = Instant::now() + MGD_TIMEOUT;
     tokio::time::timeout_at(timeout, find_mgd_port_in_log(logfile))
         .await
-        .context("time out while discovering mgd port number")?
+        .context("time out while discovering port number")?
 }
 
 async fn find_mgd_port_in_log(logfile: String) -> Result<u16, anyhow::Error> {
@@ -169,6 +169,108 @@ async fn find_mgd_port_in_log(logfile: String) -> Result<u16, anyhow::Error> {
     }
 }
 
+/// Test fixture that spawns and supervises a legit `ddmd` subprocess.
+///
+/// Owns a `tokio::process::Child` and a tempdir; discovers the bound admin
+/// port by scraping dropshot's startup `local_addr` records; kills the child
+/// on `cleanup`/`Drop`. Mirrors `MgdInstance`.
+///
+/// `ddmd` runs in sled global zones and switch zones in production. Spawned
+/// here with `--api-only`, which serves only the admin API and skips the
+/// discovery / exchange / routing daemons that need real network interfaces
+/// and illumos-only kernel facilities. Only switch-zone instances
+/// are registered in internal DNS as `ServiceName::Ddm`; sled-global-zone
+/// instances are accessed locally by their own host (RSS, sled-agent's
+/// prefix advertisement, etc.) and don't need DNS publication.
+pub struct DdmInstance {
+    /// Port number the ddmd instance is listening on.
+    pub port: u16,
+    /// Arguments provided to the `ddmd` cli command.
+    pub args: Vec<String>,
+    /// Child process spawned by running `ddmd`.
+    pub child: Option<tokio::process::Child>,
+    /// Temporary directory where logging output and other files generated by
+    /// `ddmd` are stored.
+    pub data_dir: Option<PathBuf>,
+}
+
+impl DdmInstance {
+    /// Start a `ddmd` instance with `--api-only`, bound to an auto-assigned
+    /// admin port on localhost.
+    pub async fn start() -> Result<Self, anyhow::Error> {
+        let temp_dir = TempDir::new()?;
+
+        let args = vec![
+            "--admin-addr".to_string(),
+            "::1".into(),
+            "--admin-port".into(),
+            "0".into(),
+            "--api-only".into(),
+            "--data-dir".into(),
+            temp_dir.path().display().to_string(),
+        ];
+
+        let child = tokio::process::Command::new("ddmd")
+            .args(&args)
+            .stdin(Stdio::null())
+            .stdout(Stdio::from(redirect_file(temp_dir.path(), "ddmd_stdout")?))
+            .stderr(Stdio::from(redirect_file(temp_dir.path(), "ddmd_stderr")?))
+            .spawn()
+            .with_context(|| {
+                format!("failed to spawn `ddmd` (with args: {:?})", &args)
+            })?;
+
+        let child = Some(child);
+
+        let temp_dir = temp_dir.keep();
+        let port =
+            discover_port(temp_dir.join("ddmd_stdout").display().to_string())
+                .await
+                .with_context(|| {
+                    format!(
+                        "failed to discover ddmd port from files in {}",
+                        temp_dir.display()
+                    )
+                })?;
+
+        Ok(Self { port, args, child, data_dir: Some(temp_dir) })
+    }
+
+    pub async fn cleanup(&mut self) -> Result<(), anyhow::Error> {
+        if let Some(mut child) = self.child.take() {
+            child.start_kill().context("Sending SIGKILL to child")?;
+            child.wait().await.context("waiting for child")?;
+        }
+        if let Some(dir) = self.data_dir.take() {
+            std::fs::remove_dir_all(&dir).with_context(|| {
+                format!("cleaning up temporary directory {}", dir.display())
+            })?;
+        }
+        Ok(())
+    }
+}
+
+impl Drop for DdmInstance {
+    fn drop(&mut self) {
+        if self.child.is_some() || self.data_dir.is_some() {
+            eprintln!(
+                "WARN: dropped DdmInstance without cleaning it up first \
+                (there may still be a child process running and a \
+                temporary directory leaked)"
+            );
+            if let Some(child) = self.child.as_mut() {
+                let _ = child.start_kill();
+            }
+            if let Some(path) = self.data_dir.take() {
+                eprintln!(
+                    "WARN: ddmd temporary directory leaked: {}",
+                    path.display()
+                );
+            }
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::find_mgd_port_in_log;
@@ -189,6 +291,16 @@ mod tests {
             .expect("Cannot find 'mgd' on PATH. Refer to README.md for installation instructions");
     }
 
+    #[tokio::test]
+    async fn test_ddmd_in_path() {
+        tokio::process::Command::new("ddmd")
+            .stdin(Stdio::null())
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .spawn()
+            .expect("Cannot find 'ddmd' on PATH. Refer to README.md for installation instructions");
+    }
+
     #[tokio::test]
     async fn test_discover_local_listening_port() {
         // Write some data to a fake log file
diff --git a/tools/install_builder_prerequisites.sh b/tools/install_builder_prerequisites.sh
index 0f1df7d2528..d79a923ca1f 100755
--- a/tools/install_builder_prerequisites.sh
+++ b/tools/install_builder_prerequisites.sh
@@ -230,6 +230,7 @@ retry xtask download \
     console \
     dendrite-stub \
     maghemite-mgd \
+    maghemite-ddmd \
     transceiver-control
 
 # Validate the PATH:
diff --git a/tools/maghemite_ddm_openapi_version b/tools/maghemite_ddm_openapi_version
index 060b3a13efb..2f9b1d6589e 100644
--- a/tools/maghemite_ddm_openapi_version
+++ b/tools/maghemite_ddm_openapi_version
@@ -1 +1 @@
-COMMIT="7696ee48d5ee29a917dea459e281fe2e8ff20513"
+COMMIT="9bb5037167c1ff0d812299f668841c9b7bda4480"
diff --git a/tools/maghemite_mg_openapi_version b/tools/maghemite_mg_openapi_version
index 060b3a13efb..2f9b1d6589e 100644
--- a/tools/maghemite_mg_openapi_version
+++ b/tools/maghemite_mg_openapi_version
@@ -1 +1 @@
-COMMIT="7696ee48d5ee29a917dea459e281fe2e8ff20513"
+COMMIT="9bb5037167c1ff0d812299f668841c9b7bda4480"
diff --git a/tools/maghemite_mgd_checksums b/tools/maghemite_mgd_checksums
index 470facaa671..1757d60dcfc 100644
--- a/tools/maghemite_mgd_checksums
+++ b/tools/maghemite_mgd_checksums
@@ -1,2 +1,4 @@
-CIDL_SHA256="301d31ca481e4822f69484feacca31dd08a7c4aae87d96641d384bda3178d2f3"
-MGD_LINUX_SHA256="95f9759a5fde2784d148c81df2218d29adde1d27fb72d5dbcf534de6450f0f7c"
\ No newline at end of file
+CIDL_SHA256="9b202ecbbe9727fd3c898e19b4ad519fd38218749e1a789e25eb8295cb749520"
+MGD_LINUX_SHA256="407a5f89cd2cb42dce854dc02968fd701d0bf60f3d9f9caabbb9214e1e8b80c6"
+MG_DDM_SHA256="93338b5869817a4b882fea68bac350e8be7efca0ae0da2e90f3152483c48bab1"
+DDMD_LINUX_SHA256="06681e40d355f8884ec91b44884c7c34f2f1fd94f6e4da25b3f470da84515d32"
\ No newline at end of file
diff --git a/tools/update_maghemite.sh b/tools/update_maghemite.sh
index 0051397b51d..0a482cb4440 100755
--- a/tools/update_maghemite.sh
+++ b/tools/update_maghemite.sh
@@ -54,6 +54,12 @@ function update_mgd {
     SHA_LINUX=$(get_sha "$REPO" "$TARGET_COMMIT" "mgd" "linux")
     OUTPUT_LINUX=$(printf "MGD_LINUX_SHA256=\"%s\"\n" "$SHA_LINUX")
 
+    SHA_MG_DDM=$(get_sha "$REPO" "$TARGET_COMMIT" "mg-ddm" "image")
+    OUTPUT_MG_DDM=$(printf "MG_DDM_SHA256=\"%s\"\n" "$SHA_MG_DDM")
+
+    SHA_DDMD_LINUX=$(get_sha "$REPO" "$TARGET_COMMIT" "ddmd" "linux")
+    OUTPUT_DDMD_LINUX=$(printf "DDMD_LINUX_SHA256=\"%s\"\n" "$SHA_DDMD_LINUX")
+
     if [ -n "$DRY_RUN" ]; then
         MGD_PATH="/dev/null"
     else
@@ -61,7 +67,7 @@ function update_mgd {
     fi
     echo "Updating Maghemite mgd from: $TARGET_COMMIT"
     set -x
-    printf "$OUTPUT\n$OUTPUT_LINUX" > $MGD_PATH
+    printf "$OUTPUT\n$OUTPUT_LINUX\n$OUTPUT_MG_DDM\n$OUTPUT_DDMD_LINUX" > $MGD_PATH
     set +x
 }
 
diff --git a/workspace-hack/Cargo.toml b/workspace-hack/Cargo.toml
index e04f06954c6..136dbd439df 100644
--- a/workspace-hack/Cargo.toml
+++ b/workspace-hack/Cargo.toml
@@ -20,6 +20,7 @@ workspace = true
 [dependencies]
 ahash = { version = "0.8.12" }
 aho-corasick = { version = "1.1.4" }
+anstream = { version = "0.6.21" }
 anyhow = { version = "1.0.102", features = ["backtrace"] }
 base16ct = { version = "0.2.0", default-features = false, features = ["alloc"] }
 base64 = { version = "0.22.1" }
@@ -32,8 +33,8 @@ bytes = { version = "1.11.1", features = ["serde"] }
 camino = { version = "1.2.2", default-features = false, features = ["serde1"] }
 chrono = { version = "0.4.44", features = ["serde"] }
 cipher = { version = "0.4.4", default-features = false, features = ["block-padding", "zeroize"] }
-clap = { version = "4.5.60", features = ["cargo", "derive", "env", "wrap_help"] }
-clap_builder = { version = "4.5.60", default-features = false, features = ["cargo", "color", "env", "std", "suggestions", "usage", "wrap_help"] }
+clap = { version = "4.6.1", features = ["cargo", "derive", "env", "unstable-styles", "wrap_help"] }
+clap_builder = { version = "4.6.0", default-features = false, features = ["cargo", "env", "std", "suggestions", "unstable-styles", "usage", "wrap_help"] }
 const-oid = { version = "0.9.6", default-features = false, features = ["db", "std"] }
 crossbeam-epoch = { version = "0.9.18" }
 crossbeam-utils = { version = "0.8.21" }
@@ -76,7 +77,6 @@ indexmap = { version = "2.14.0", features = ["serde"] }
 inout = { version = "0.1.4", default-features = false, features = ["std"] }
 ipnet = { version = "2.11.0", features = ["serde"] }
 ipnetwork = { version = "0.21.1", features = ["schemars", "serde"] }
-itertools = { version = "0.13.0" }
 lalrpop-util = { version = "0.19.12" }
 lazy_static = { version = "1.5.0", default-features = false, features = ["spin_no_std"] }
 libc = { version = "0.2.185", features = ["extra_traits"] }
@@ -111,7 +111,7 @@ rand_chacha-468e82937335b1c9 = { package = "rand_chacha", version = "0.3.1", def
 regex = { version = "1.12.3" }
 regex-automata = { version = "0.4.14", default-features = false, features = ["dfa", "hybrid", "meta", "nfa", "perf", "std", "unicode"] }
 regex-syntax = { version = "0.8.10" }
-reqwest-594e8ee84c453af0 = { package = "reqwest", version = "0.13.2", default-features = false, features = ["blocking", "cookies", "http2", "json", "query", "rustls", "stream"] }
+reqwest-594e8ee84c453af0 = { package = "reqwest", version = "0.13.2", features = ["blocking", "cookies", "json", "query", "stream"] }
 reqwest-5ef9efb8ec2df382 = { package = "reqwest", version = "0.12.28", features = ["blocking", "json", "rustls-tls", "stream"] }
 rsa = { version = "0.9.10", features = ["serde", "sha2"] }
 rustls = { version = "0.23.37", features = ["ring"] }
@@ -165,6 +165,7 @@ zip-3b31131e45eafb45 = { package = "zip", version = "0.6.6", default-features =
 [build-dependencies]
 ahash = { version = "0.8.12" }
 aho-corasick = { version = "1.1.4" }
+anstream = { version = "0.6.21" }
 anyhow = { version = "1.0.102", features = ["backtrace"] }
 base16ct = { version = "0.2.0", default-features = false, features = ["alloc"] }
 base64 = { version = "0.22.1" }
@@ -178,8 +179,8 @@ camino = { version = "1.2.2", default-features = false, features = ["serde1"] }
 cc = { version = "1.2.56", default-features = false, features = ["parallel"] }
 chrono = { version = "0.4.44", features = ["serde"] }
 cipher = { version = "0.4.4", default-features = false, features = ["block-padding", "zeroize"] }
-clap = { version = "4.5.60", features = ["cargo", "derive", "env", "wrap_help"] }
-clap_builder = { version = "4.5.60", default-features = false, features = ["cargo", "color", "env", "std", "suggestions", "usage", "wrap_help"] }
+clap = { version = "4.6.1", features = ["cargo", "derive", "env", "unstable-styles", "wrap_help"] }
+clap_builder = { version = "4.6.0", default-features = false, features = ["cargo", "env", "std", "suggestions", "unstable-styles", "usage", "wrap_help"] }
 const-oid = { version = "0.9.6", default-features = false, features = ["db", "std"] }
 crossbeam-epoch = { version = "0.9.18" }
 crossbeam-utils = { version = "0.8.21" }
@@ -223,7 +224,6 @@ indexmap = { version = "2.14.0", features = ["serde"] }
 inout = { version = "0.1.4", default-features = false, features = ["std"] }
 ipnet = { version = "2.11.0", features = ["serde"] }
 ipnetwork = { version = "0.21.1", features = ["schemars", "serde"] }
-itertools = { version = "0.13.0" }
 lalrpop-util = { version = "0.19.12" }
 lazy_static = { version = "1.5.0", default-features = false, features = ["spin_no_std"] }
 libc = { version = "0.2.185", features = ["extra_traits"] }
@@ -258,7 +258,7 @@ rand_chacha-468e82937335b1c9 = { package = "rand_chacha", version = "0.3.1", def
 regex = { version = "1.12.3" }
 regex-automata = { version = "0.4.14", default-features = false, features = ["dfa", "hybrid", "meta", "nfa", "perf", "std", "unicode"] }
 regex-syntax = { version = "0.8.10" }
-reqwest-594e8ee84c453af0 = { package = "reqwest", version = "0.13.2", default-features = false, features = ["blocking", "cookies", "http2", "json", "query", "rustls", "stream"] }
+reqwest-594e8ee84c453af0 = { package = "reqwest", version = "0.13.2", features = ["blocking", "cookies", "json", "query", "stream"] }
 reqwest-5ef9efb8ec2df382 = { package = "reqwest", version = "0.12.28", features = ["blocking", "json", "rustls-tls", "stream"] }
 rsa = { version = "0.9.10", features = ["serde", "sha2"] }
 rustls = { version = "0.23.37", features = ["ring"] }