[2026-10-19] eagle: personal/plans/balda-remote-agent.md personal/plans/workspace-gateway.md personal/projects/balda/balda.md personal/projects/balda/setup.md personal/projects/balda/ssh-acp-verification-2026-10-18.md personal/projects/balda/ssh-client-route-2026-10-19.md personal/projects/balda/ssh-seatbelt-2026-10-18.md

personal/projects/balda/ssh-client-route-2026-10-19.md

@@ -0,0 +1,66 @@
+# SSH Manager и Balda — маршрут и подтверждения, 2026-10-19
+
+Проверенная установка: [[personal/projects/balda/setup]]. Commits: SSH Manager `a86df58`, Balda `3e86b995`.
+
+
+Version 0.3.2 fixes the gap between operator-side bootstrap success and a usable
+client SSH connection. No target name, address or relay alias selects code paths.
+
+- A Docker deployment names its actual `client_container`, trusted `client_image`
+  and dedicated `client_volume`. The manager checks that the running container
+  mounts this volume read-only at `client_dir`.
+- With no explicit `via`, a native pinned no-auth handshake runs from that client.
+  A private temporary known_hosts file carries only the existing public pin and
+  is deleted after the probe. A pin failure never falls back to another route.
+- If the direct network route is unavailable, one registered relay is selected.
+  Zero or multiple candidates require explicit `via`. The normal owner form
+  includes the resolved route and exact scoped relay authorized_keys replacement.
+- Key installation and isolation acceptance alone do not yield success. A fresh
+  native SSH process in the actual client, using the installed dedicated identity
+  and pin, must return a random command marker. Success records client_verified_at.
+  Failure persists installed_unverified and returns a tool error. Such keys remain
+  revocable and cannot be forgotten or reused for a conflicting purpose.
+- Existing accepted registrations can repair the route and verify the same key,
+  without reinstalling it or changing the target's accepted sandbox policy.
+
+Verified:
+
+1. Go race/vet/build, route and pin regressions, incorrect client mount rejection,
+   failed verification persistence, retry without bootstrap, no success receipt on
+   failure, and a guard against removing an installed unverified key.
+2. Two temporary native sshd servers with randomized aliases: 15 lifecycle checks,
+   including actual isolation/ProxyJump, client pin rejection in ssh_authorize,
+   restart, revoke/authentication denial, removal and unrelated-key preservation.
+3. A separate temporary client using the actual Balda network namespace and only
+   its own fixture keys: 16 checks. Alias-only import omitted via; the manager
+   selected the registered fixture relay, updated its exact permitopen and
+   completed installed-key verification. Wrong pin/retry/revoke/restart passed.
+4. Production route repair used the existing registration/key id and one owner
+   form. It preserved the target identity and sandbox policy, personal SSH config
+   and known_hosts, and Balda config/Compose. An independent UID-1000 SSH call from
+   balda-mm-mac returned the expected marker using /run/ssh-manager/ssh_config.
+5. Real Codex model inside Balda invoked the deployed ssh_authorize. Session
+   01a152d6-e98f-7872-a49c-66ff415db44e received exactly one Owner confirmation and
+   returned registered with client_verified_at=2026-10-19T06:26:32.39965Z.
+   No generic MCP approval, target-key installation/rotation, model shell command
+   or external Mattermost test message occurred in that model check.
+
+Balda commit 3e86b995 fixes duplicate options independently: permissions.Service
+marks its complete presentation as already rendered; questions.Service retains
+structured answer options but does not append them again. A regression traverses
+permission review, session question delivery and decision resolution. Full Balda
+race suite, golangci-lint and architecture checks pass.
+
+Private evidence is stored in ~/.local/share/balda-workspace/candidate/client-route/.
+The SSH verification timestamp is a point-in-time receipt, not continuous health.
+The accepted target key remains isolated; host Docker/socket/sudo authority is not
+added by route repair. Full remote model setup and project Beads migrations remain
+outside this fix.
+
+Финальная повторная model-проверка после установки binaries из чистых commits: `01a152d9-7d04-7f21-9597-91c259813c7c`, ровно одна Owner confirmation, `client_verified_at=2026-10-19T06:29:15.692883Z`.
+
+SSH binary SHA256: `72d99bf3daca0465ba1a953f7fb8f2d460784f4e8af03158c5b95306653211d0`; Balda binary SHA256: `88dc7349c4eff1aae79daa95381d33e79c3bbb0097b95fde92834e4479392000`. Build metadata и запущенные binary hashes/inode совпадают; health/login 200.
+
+Коммиты сохранены локально. origin/main Balda имеет отдельную старую историю: 2 commits только в origin и 834 только в текущей установленной ветке; перенос старых DeepSeek/Zulip изменений и переписывание main в этот fix не включались.
+
+Remote publication: automatic approval review rejected pushing the installed source history to mallexxx/balda, branch deploy/balda-mm-mac-client-route-20261019, because separate permission for that payload and destination was missing. No push occurred. The local commits, deployed services and verified access remain intact; explicit publication permission is pending.