@mriekki/project-forge 4.24.1 → 4.26.0

package/assets/components.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.24.1",
+  "version": "4.26.0",
   "defaultProfile": "greenfield-project",
   "profiles": {
     "greenfield-project": {
@@ -13,15 +13,15 @@
   },
   "components": {
     "core": {
-      "revision": "59f5657bbb6f1edc45d1e8619ab1d0875b7907e0",
-      "version": "4.2.1",
+      "revision": "39bc7661db49266743317e9dfedab800674f9c30",
+      "version": "4.3.0",
       "distribution": "greenfield-workspace",
       "descriptor": "assets/core/distribution.json",
       "sourceRoot": "assets/generated/core",
       "canonicalDescriptor": "distributions/greenfield-workspace.json"
     },
     "deployment": {
-      "revision": "3b31a8690720aa1eb8f5af27ddac5e0e6d3779ba",
+      "revision": "e9ca6e12e5b19f691b25ce0aba758a43c3df2913",
       "distribution": "greenfield-project",
       "descriptor": "assets/deployment/distribution.json",
       "sourceRoot": "assets/generated/deployment",

package/assets/deployment/distribution.json

@@ -7,6 +7,7 @@
     {"source": "src/project_forge_deployment/__init__.py", "destination": "tools/project-forge-deployment/project_forge_deployment/__init__.py"},
     {"source": "src/project_forge_deployment/__main__.py", "destination": "tools/project-forge-deployment/project_forge_deployment/__main__.py"},
     {"source": "src/project_forge_deployment/access_cli.py", "destination": "tools/project-forge-deployment/project_forge_deployment/access_cli.py"},
+    {"source": "src/project_forge_deployment/agent_session.py", "destination": "tools/project-forge-deployment/project_forge_deployment/agent_session.py"},
     {"source": "src/project_forge_deployment/access_diagnosis.py", "destination": "tools/project-forge-deployment/project_forge_deployment/access_diagnosis.py"},
     {"source": "src/project_forge_deployment/app_cli.py", "destination": "tools/project-forge-deployment/project_forge_deployment/app_cli.py"},
     {"source": "src/project_forge_deployment/app_deployment.py", "destination": "tools/project-forge-deployment/project_forge_deployment/app_deployment.py"},
@@ -43,11 +44,13 @@
     {"source": "src/project_forge_deployment/profiles.py", "destination": "tools/project-forge-deployment/project_forge_deployment/profiles.py"},
     {"source": "src/project_forge_deployment/project_topology.py", "destination": "tools/project-forge-deployment/project_forge_deployment/project_topology.py"},
     {"source": "src/project_forge_deployment/proof_receipt.py", "destination": "tools/project-forge-deployment/project_forge_deployment/proof_receipt.py"},
+    {"source": "src/project_forge_deployment/proxy_peer.py", "destination": "tools/project-forge-deployment/project_forge_deployment/proxy_peer.py"},
     {"source": "src/project_forge_deployment/recovery_scope.py", "destination": "tools/project-forge-deployment/project_forge_deployment/recovery_scope.py"},
     {"source": "src/project_forge_deployment/registry_access.py", "destination": "tools/project-forge-deployment/project_forge_deployment/registry_access.py"},
     {"source": "src/project_forge_deployment/registry_cli.py", "destination": "tools/project-forge-deployment/project_forge_deployment/registry_cli.py"},
     {"source": "src/project_forge_deployment/route_registry.py", "destination": "tools/project-forge-deployment/project_forge_deployment/route_registry.py"},
     {"source": "src/project_forge_deployment/route_registry_remote.py", "destination": "tools/project-forge-deployment/project_forge_deployment/route_registry_remote.py"},
+    {"source": "src/project_forge_deployment/safe_diagnostics.py", "destination": "tools/project-forge-deployment/project_forge_deployment/safe_diagnostics.py"},
     {"source": "src/project_forge_deployment/security.py", "destination": "tools/project-forge-deployment/project_forge_deployment/security.py"},
     {"source": "src/project_forge_deployment/sqlite_adapter.py", "destination": "tools/project-forge-deployment/project_forge_deployment/sqlite_adapter.py"},
     {"source": "src/project_forge_deployment/sqlite_adapter_remote.py", "destination": "tools/project-forge-deployment/project_forge_deployment/sqlite_adapter_remote.py"},

package/assets/generated/ASSEMBLY.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.24.1",
+  "version": "4.26.0",
   "components": {
     "core": {
-      "revision": "59f5657bbb6f1edc45d1e8619ab1d0875b7907e0",
-      "version": "4.2.1",
+      "revision": "39bc7661db49266743317e9dfedab800674f9c30",
+      "version": "4.3.0",
       "distribution": "greenfield-workspace",
       "files": [
         {
@@ -56,7 +56,7 @@
         {
           "source": "core/skills/setup/SKILL.md",
           "destination": ".github/skills/setup/SKILL.md",
-          "sha256": "8f92aed1684a3dfd2ecffeb584b5da4daa9c7d7d7ab7ca7f01c8c6a4c82eaa1d"
+          "sha256": "30a9dbfbd132f7c333ca515736a7957494bbe2fd4b5860dfff90ba3437bc135d"
         },
         {
           "source": "core/skills/build/SKILL.md",
@@ -91,7 +91,7 @@
         {
           "source": "core/skills/deliver/SKILL.md",
           "destination": ".github/skills/deliver/SKILL.md",
-          "sha256": "6a3886493e9b59725ff53652972c1830478176a8c8da648448401d9051820db4"
+          "sha256": "5e4d64d91e429b636e0fda4094a84dd2f0b09aa7c1f281cbba7d630b67820076"
         },
         {
           "source": "core/skills/work-item-status/SKILL.md",
@@ -126,12 +126,12 @@
         {
           "source": "core/skills/deployment-readiness/SKILL.md",
           "destination": ".github/skills/deployment-readiness/SKILL.md",
-          "sha256": "30202702cc368c872e62ce731e8ffe84a796aae243b287e3e670c8c8e1cd6531"
+          "sha256": "8b83d06056cbc10c0a9df69d1bb76db62753b52f5d4be9858488e400cd4b836d"
         },
         {
           "source": "core/skills/deploy/SKILL.md",
           "destination": ".github/skills/deploy/SKILL.md",
-          "sha256": "f5d40e549ca958cb51606ced7ca482651d9a436327b6070a9a94171f22401700"
+          "sha256": "3ac67207c9cb6870c56313b2c4ce02d15c0756cb092937013f66512d2ec9576a"
         },
         {
           "source": "core/skills/tear-down/SKILL.md",
@@ -196,7 +196,7 @@
         {
           "source": "core/process/INTERACTIVE_SESSION_GUIDE.md",
           "destination": "docs/process/INTERACTIVE_SESSION_GUIDE.md",
-          "sha256": "f7573b9926878da3db4353db7297b66c9d907844142ae6486c7fd7580f187e3b"
+          "sha256": "43bb5959fcc71755a76f9c4adcbc24576907db817d9dc0ced4e1607630493843"
         },
         {
           "source": "core/process/COACHING_GUIDE.md",
@@ -386,7 +386,7 @@
       ]
     },
     "deployment": {
-      "revision": "3b31a8690720aa1eb8f5af27ddac5e0e6d3779ba",
+      "revision": "e9ca6e12e5b19f691b25ce0aba758a43c3df2913",
       "distribution": "greenfield-project",
       "files": [
         {
@@ -409,6 +409,11 @@
           "destination": "tools/project-forge-deployment/project_forge_deployment/access_cli.py",
           "sha256": "007d01ae0c4e28e64f75fb96f9e8e7b99db5c4c8129698a78923baeac2f51953"
         },
+        {
+          "source": "src/project_forge_deployment/agent_session.py",
+          "destination": "tools/project-forge-deployment/project_forge_deployment/agent_session.py",
+          "sha256": "c1bc83cc9a4daa50e86fdfe54cc5902ae5052fe1ad8c193082d0b1966cf8a1d0"
+        },
         {
           "source": "src/project_forge_deployment/access_diagnosis.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/access_diagnosis.py",
@@ -442,7 +447,7 @@
         {
           "source": "src/project_forge_deployment/box_platform.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/box_platform.py",
-          "sha256": "163c022bbd8ecccadebbebdc8cef8e272fc95dd0dc3cdb35d4e6e10013c91040"
+          "sha256": "a11603daa47e33570732e349f59720811b5fdc2ec26ea04d08896764e089b682"
         },
         {
           "source": "src/project_forge_deployment/box_platform_assets.py",
@@ -452,7 +457,7 @@
         {
           "source": "src/project_forge_deployment/box_platform_remote.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/box_platform_remote.py",
-          "sha256": "65de94ac4b6e980d83ce99ea55b9555aa96959c11808cce8c6ed537b27c15533"
+          "sha256": "18a47000d0755c645d5fe8a950f917331abedc332f3e11b9d6638946843a3f0e"
         },
         {
           "source": "src/project_forge_deployment/cloudflare_api.py",
@@ -477,7 +482,7 @@
         {
           "source": "src/project_forge_deployment/cli.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/cli.py",
-          "sha256": "3c3e7d4fadeccc1b8a7691c1a213250790fb728400914894c0d4e70a1ec91cc7"
+          "sha256": "5f22a0fed79fe7dcb12b94f670bda04ea503f5254ccacfd841f03dfedd2ceeb5"
         },
         {
           "source": "src/project_forge_deployment/doctor.py",
@@ -507,7 +512,7 @@
         {
           "source": "src/project_forge_deployment/environment_setup.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/environment_setup.py",
-          "sha256": "47ce6af4ab3b03c441725ec8cc1b356212ef7a1706635fe191affd959b09a5f5"
+          "sha256": "934b6d8f2309128da07ced858ea4b9c56b04c5ff67b6efc5c52d81a10a1a696b"
         },
         {
           "source": "src/project_forge_deployment/errors.py",
@@ -589,6 +594,11 @@
           "destination": "tools/project-forge-deployment/project_forge_deployment/proof_receipt.py",
           "sha256": "9b4bbb559747fc4ee3ba984a050fc6425e532527ae82f9897c73e04d8d0291b6"
         },
+        {
+          "source": "src/project_forge_deployment/proxy_peer.py",
+          "destination": "tools/project-forge-deployment/project_forge_deployment/proxy_peer.py",
+          "sha256": "ae6c8cb26b83ed07765fa4740ce5c68f52cafd2209b4f055887a4457cfb41c03"
+        },
         {
           "source": "src/project_forge_deployment/recovery_scope.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/recovery_scope.py",
@@ -614,6 +624,11 @@
           "destination": "tools/project-forge-deployment/project_forge_deployment/route_registry_remote.py",
           "sha256": "c8f397a09ff9efc904230eeec68aa85bab9c21529e44dd925e5db0f02f406b6f"
         },
+        {
+          "source": "src/project_forge_deployment/safe_diagnostics.py",
+          "destination": "tools/project-forge-deployment/project_forge_deployment/safe_diagnostics.py",
+          "sha256": "58372e220e25fc468be490c8a788e347a1026ccbdff899217cdbe8aecb7c00ce"
+        },
         {
           "source": "src/project_forge_deployment/security.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/security.py",
@@ -642,7 +657,7 @@
         {
           "source": "src/project_forge_deployment/ssh.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/ssh.py",
-          "sha256": "88d59b62f63dc6b7206b6074dd109af4ea7c8f022f506e67f7204f1f06240d26"
+          "sha256": "b45ace8c35e622cb336ade9aeafa7405f96660e1e4faed0303faa4edb24b95c5"
         },
         {
           "source": "src/project_forge_deployment/teardown.py",

package/assets/generated/core/core/process/INTERACTIVE_SESSION_GUIDE.md

@@ -104,7 +104,7 @@ When the host has no structured question UI, use a concise textual fallback. A n
 
 When an authorized action must run in the developer's own terminal because it requires an interactive prompt, secure local input, or another terminal-owned interaction, treat the command handoff as continuation of the workflow rather than as a generic blocker.
 
-- If the action has its own bounded authorization, collect that authorization first through the host-native structured question control when available. Once the exact action is authorized, do not ask for the same permission again merely because execution moves to the terminal.
+- If the action has its own bounded authorization, collect that authorization first through the host-native structured question control when available. Once the exact action is authorized, do not ask for the same permission again merely because execution moves to the terminal. When the installed deterministic CLI exposes a scoped `--yes` option, prefer it **only after** the matching exact plan/stage has been approved through the native Chat gate, avoiding duplicate typed confirmation phrases. Do not use `--yes` as a standing default, bypass a changed plan, or suppress independent destructive/trust/credential authorizations. SSH passphrase entry remains interactive and never belongs in Chat.
 - Immediately after authorization, provide the exact command in a **standalone fenced code block**. State the working directory when it is not already unambiguous. Do not bury the command inside explanatory prose.
 - Briefly describe the local prompt the developer should expect and which sensitive values must be entered **only in the terminal**. Never ask for a passphrase, password, token, private key, or other secret through chat, and never place such a secret in the command arguments merely to avoid an interactive prompt.
 - State what observable result or concise evidence the developer should report back so the workflow can verify the action and continue. Prefer deterministic verification after the local step instead of asking for secret-bearing terminal transcripts.
@@ -140,3 +140,72 @@ Compound action skills may also define their own bounded authorization. In parti
 If a tool/channel interruption leaves a compound workflow partially complete, a later invocation should inspect current state and resume from the furthest safe point rather than assuming nothing happened or requiring the same routine authorization again.
 
 `/wait-what` is different. It is a one-turn, read-only communication repair for the immediately preceding explanation. It re-establishes context and clarity, then returns control to the current workflow without silently continuing a pending action or approval gate.
+
+## Operational continuity and bounded retries (PF-03/PF-04)
+
+Use these rules within existing Project Forge skills and repository-defined
+operations. This is **not** a new approval store, model selection policy, or
+background execution system.
+
+### Scope a working authorization before a consequential action
+
+Before a multi-stage or unattended continuation, state a short **reviewed-stage
+envelope** in the already-existing work item/review context:
+
+- Exact Project, named logical environment/target, host identity where relevant,
+  and intended operation(s).
+- Immutable artifact, plan identity and reviewed evidence, including freshness
+  and expiry when the installed capability exposes them.
+- Allowed mechanical continuation and **separate** Production runtime, public
+  route, trust/credential, destructive data, merge, and release boundaries.
+- Remaining secret-input or human decision points and the precise stop conditions.
+
+One currently approved, unchanged reviewed stage authorizes its supported
+routine mechanics; never request a second identical shell phrase or chat
+permission when the installed deterministic command supports scoped execution.
+However, authorization is **not** a standing token: changed target, plan, peer,
+data/backup risk, credential, identity, exposure, trust or other consequence
+reopens the relevant gate. Never infer indefinite authority from elapsed time
+or a prior session. Explain any interactive passphrase/provider action **before**
+the developer leaves an unattended workflow; do not promise unattended
+completion if required local input or a human approval remains.
+
+### Read safe results without losing the failed phase
+
+When the installed Deployment Kit supplies an additive safe
+`diagnosticSummary`, use it only if the **observed installed** schema and
+capability version match the documented contract (currently schema 1,
+`remote-environment-setup` capability 1). Preserve phase, fixed reasonCode,
+proved/failed/blocked/notChecked dimensions, observedAt, mutation, consequence
+and any safe evidence reference. An unknown capability, reason, malformed
+summary or mixed stderr becomes **unclassified**, never green/success.
+Report unsupported or older installed tooling honestly; do not reconstruct the
+same field by parsing private exceptions or create a new runtime prerequisite
+during Bootstrap. A concise summary is not a complete reviewed mutation plan.
+
+### Avoid no-information attempts and context inflation
+
+If the **same** fixed reason code and non-secret exact target/phase/context have
+failed twice with unchanged inputs **and no new evidence**, change the method
+(e.g. inspect a different bounded proof) or stop with the precise missing fact.
+Do not perform a third identical attempt, rerun an unchanged reviewer objective,
+replay a failed login, or repeatedly ask for the same fact. A newly loaded SSH
+agent, changed plan, confirmed host identity, updated installed helper or other
+material new evidence resets the same-phase retry comparison.
+
+Start a continuation with the smallest authoritative repository/state
+checkpoint: current work-item state, exact commit/PR/CI, package/component
+provenance, observed capability and proof freshness, unresolved decision, and
+next safe action. Follow links to deeper current evidence only as needed.
+Do not reload a whole incident transcript, broad skill catalog or all historical
+retries just because context is available. Favor one bounded wait/read of a
+known CI run ID over repeated short polling and large tool output. Use only
+relevant skill and artifact slices; keep full evidence available separately.
+
+Measure improvements with one matched, bounded replay holding the same fault,
+safety obligations and environmental assumptions. Record model/tool rounds,
+operator prompts, elapsed/waiting time and cache-adjusted token volume:
+input tokens minus cache reads plus output tokens, respecting each counter's
+semantics. Candidate >=50% reductions are **targets**, not guaranteed savings.
+Never hide failed checks, truncate material mutation evidence, skip security
+gates, or change model tier automatically to make metrics look better.

package/assets/generated/core/core/skills/deliver/SKILL.md

@@ -21,7 +21,7 @@ Existing repository conventions outrank Project Forge defaults. Preserve branch
 
 ## 1. Authorization model
 
-Because `/deliver` is manually invoked, invoking it is one bounded authorization for the routine delivery mechanics of the already-reviewed/accepted work item:
+Because `/deliver` is manually invoked, invoking it is one bounded authorization for the routine delivery mechanics of the already-reviewed/accepted work item. Keep a delivery started in VS Code Copilot Chat in that interface when host tools can run the deterministic repository commands; a separate Copilot CLI session is not required for automation:
 
 ```text
 establish/recover the short-lived work branch when needed
@@ -185,6 +185,12 @@ Delivery state preserved. Re-run /deliver to resume.
 ```
 
 Do not insert a new write-authorization prompt merely because CI is pending.
+Use the exact known workflow/run ID and one bounded wait/recheck when possible
+rather than repeated short polling, reloading the same CI output, or relaunching
+a Reviewer on an unchanged objective. Treat two unchanged, no-information
+attempts at one phase as a stop/change-method condition. Preserve the PR/commit
+and CI status as a concise authoritative resumption checkpoint. See
+`core/process/INTERACTIVE_SESSION_GUIDE.md` for freshness and context rules.
 
 ### Failed
 

package/assets/generated/core/core/skills/deploy/SKILL.md

@@ -224,13 +224,36 @@ Resolve the exact phrase from the installed tool/version. For a staged rollout,
 
 Authorization applies only to the exact environment, resolved classification, placement/target/provider, artifact, reviewed plan/stage, current isolation evidence and route evidence, and evidence shown. Material changes require renewed review/authorization.
 
+**Avoid duplicate terminal approval:** when the Builder has explicitly approved this exact current stage in VS Code Copilot Chat, the assistant may pass the installed Deployment Kit's supported `--yes` flag for **that stage only** instead of making the Builder type the displayed phrase again in Bash/PowerShell. `--yes` is an execution flag, not approval evidence; never use it because the human previously approved a different plan, artifact, target, route, session, or stage. If the installed command lacks the flag, preserve its normal gate. Destructive resets/restores and SSH trust/credential changes are independent consequences and are not authorized by a deployment approval.
+
+Before unattended rollout, identify a concise reviewed-stage envelope:
+exact target, immutable artifact, permitted operations, current plan/proof
+identity and freshness, distinct runtime/route/data/trust boundaries, and any
+remaining local secret or human approval stop. Do not promise to finish
+unattended if those stops remain. Repeat safe mechanics within unchanged
+authority; reopen only for changed evidence or a genuinely new consequence.
+After two unchanged failures with no new evidence, change the method or
+stop instead of repeatedly recreating the same plan. Apply the bounded
+continuation policy in `core/process/INTERACTIVE_SESSION_GUIDE.md`.
+
 A runtime authorization never authorizes the route stage. A route authorization never retroactively authorizes a changed runtime artifact. If the rollout contains both stages, preserve the separate gates even though the Builder reviewed one coherent outcome.
 
+For authenticated public ingress relying on a pinned exact Caddy peer,
+preserve current read-only managed peer evidence (when supported) as a
+separate plan dimension from DNS, route and image readiness. If observed
+Caddy container/network identity or peer IP changed from the reviewed
+application binding, **do not silently update the trusted proxy**, change
+the release image, or continue the public-authentication rollout. Prepare a
+separate app-owned reviewed convergence/health/rollback stage.
+Proxy observation alone neither authorizes runtime writes nor proves live end-to-end
+OIDC/public-origin behavior. Follow the PF-06 producer's immutable identity
+review boundary, or report the installed capability as unavailable.
+
 ## 9. Preview and execute only the approved contract
 
 Before mutation, show concise non-secret evidence such as exact environment, purpose, placement, target/provider when applicable, proof freshness, immutable application artifact, persistence/migration, exposure/route, application isolation state/fingerprint when exposed, shared failure-domain note when relevant, planned stages, endpoint state at each stage, and the exact required authorization phrase for the next consequence only.
 
-After authorization, invoke only the repository-provided deterministic launcher. Never redirect to another environment/host/provider, weaken trust/exposure, force through lock contention, or invent recovery writes.
+After authorization, invoke only the repository-provided deterministic launcher. For remote SSH placement, prefer the installed Deployment Kit's `target agent-session <target> -- <normal Deployment Kit command>` wrapper when supported; it reuses local SSH authentication across WSL/Linux, macOS, and native Windows VS Code sessions without copying long socket paths. For a Project-owned, repository-reviewed deployment script, use `target agent-run <target> -- <explicit local executable and argv>` when installed; it does not execute a shell, add `--yes`, or replace the script's approvals. Do not switch the workflow from VS Code Copilot Chat to Copilot CLI merely for terminal automation. A key passphrase, when required, stays in the developer-owned terminal and never in Chat. The session wrapper does not provide remote authorization or replace current plan/host checks. Never redirect to another environment/host/provider, weaken trust/exposure, force through lock contention, or invent recovery writes.
 
 The deterministic launcher must revalidate current isolation immediately before real application mutation when the installed contract provides that capability. If current isolation changed or became blocked after review, stop and create/review a fresh plan rather than continuing under the old authorization.
 

package/assets/generated/core/core/skills/deployment-readiness/SKILL.md

@@ -198,7 +198,46 @@ The current address is connectivity information, not trusted identity. Preserve
 
 Before asking questions, inspect existing non-secret profile/target evidence. Classify the workstation's target setup as `CONFIGURED`, `PARTIAL`, or `NOT CONFIGURED` and ask only for the smallest missing fact.
 
-Only after explicit `[REMOTE READ ONLY]` authorization under the installed/repository contract may new remote checks occur. Never scan/select another host or weaken host-key verification merely to get a green result.
+Invoking `/deployment-readiness <environment>` or directly asking to check readiness authorizes bounded **read-only** diagnostics for the exact resolved environment/target. Do not ask for a second `[REMOTE READ ONLY]` typed phrase or chat approval for each check once that scope is established. The consequence label remains useful in the plan, but the workflow request is the read-only authorization. Never scan/select another host, expand to a different target, change target trust, or weaken host-key verification merely to get a green result.
+
+When the installed Deployment Kit supports `target agent-session`, run supported remote checks via `target agent-session <target> -- <normal Deployment Kit command>` rather than copying `SSH_AUTH_SOCK` paths into each command. For existing Project-owned Python readiness scripts that use the same verified target, use the installed `target agent-run <target> -- <exact reviewed local executable and argv>` to inherit this SSH context without shell evaluation; do not invent script arguments or bypass their gates. This prepares only local SSH authentication (WSL/Linux stable private agent; macOS existing SSH agent or private fallback; native Windows OpenSSH agent service). It must not start or configure a Windows system service, enroll trust, skip an SSH passphrase, or authorize any remote write. If the key needs interactive local input, hand the exact non-secret command to the developer-owned terminal once and resume validation afterward. For older installed kits, use their supported SSH workflow and report the update opportunity rather than fabricating a command.
+
+### Safe diagnostic continuation and no-progress bound
+
+When the installed Deployment Kit exposes a recognized v1 `diagnosticSummary`,
+read the fixed reasonCode, failure phase, independently proved/blocked/notChecked
+dimensions, observedAt and mutation status **without** losing unrelated good
+readiness evidence. Continue using the existing exact-target read-only
+authorization. If schema/capability versions are unknown or no usable reason
+is present, state that diagnosis is unclassified, not successful.
+For `local-signing-unproven`, use the supported configured
+`target agent-session` before investigating remote policy; a server's
+preliminary key acceptance does not prove that the client signed. Older
+installed kits may lack these fields: do not invent them.
+
+Use the bounded retry and evidence-freshness policy in
+`core/process/INTERACTIVE_SESSION_GUIDE.md`: after two unchanged,
+no-information attempts at the same phase, change the diagnostic method or
+report the exact evidence gap. Do not replay CI/reviewers or request the
+same unchanged read authorization.
+
+### Exact authenticated-origin peer convergence (PF-06)
+
+For an application whose approved public-origin policy pins the managed Caddy
+peer, use the **installed** Deployment Kit's read-only
+`platform peer-inspect <target> --configured-peer <ip> --previous-container-id <full-id> --previous-network-id <full-id> --json`
+when supported and the application's previously reviewed identity evidence
+exists. Preserve the exact named target and classify a mismatch as a
+**review-required stop**. A missing previous full identity is
+`needs-reviewed-identity-baseline`, not established trust. Do not resolve a
+missing baseline by assuming current Docker identity is implicitly approved.
+
+This observation is not a token/certificate proving Caddy authenticity, not
+permission to rewrite the application-configured peer, and not proof of
+Cloudflare forwarding or of application middleware enforcement. Never trust
+a Docker subnet or allow all LAN peers as a workaround. If the installed Kit
+does not support this inspection, report the capability gap rather than
+inventing a new script or changing Production.
 
 #### Real application isolation preflight
 

package/assets/generated/core/core/skills/setup/SKILL.md

@@ -397,11 +397,30 @@ remote account/source-policy rejection
 
 Keep credentials, private keys, raw secure-prompt content, and unbounded SSH transcripts out of conversational diagnostics and journals.
 
+For workstation SSH-agent readiness, prefer the installed Deployment Kit's `target agent-session <target> -- <normal Deployment Kit command>` when supported; for repository-owned Python operations requiring SSH use `target agent-run <target> -- <exact local executable and arguments>` when available. This is a **local** convenience that works with the WSL/Linux private reused socket, the macOS agent or private fallback, and the native Windows OpenSSH agent service; the remote target OS is independent. Do not require the Builder to copy `SSH_AUTH_SOCK` paths across VS Code Chat terminal calls, switch to Copilot CLI, or type `[SSH AGENT WRITE]` as a second authorization merely to load the already-configured key. Keep the OpenSSH passphrase in the interactive terminal; never change the Windows agent service, host trust, or saved credentials without separate authority. After the key is ready, continue normal exact-target verification and the original write gates.
+
 For fingerprint input, show the expected public form such as `SHA256:<fingerprint>` and validate that shape before progressing. Distinguish the **server host fingerprint**, the **client public-key fingerprint**, and passwords/passphrases. If input looks credential-like rather than fingerprint-shaped, do not repeat it into commands, reports, journals, or upstream issues.
 
 If a local key/agent operation requires a passphrase or another terminal-owned secret prompt, follow the interactive-terminal handoff contract: collect any distinct bounded authorization once, then immediately provide the exact standalone copyable command, correct machine/working directory, expected local prompt, and the non-secret completion evidence to report. Do not ask for the passphrase through chat or ask a second ceremonial question merely to repeat the same authorized command.
 
-If client-side evidence shows that the configured key reached the server but access is still rejected, stop reinstalling the same key. Route to a trusted target console or already-authorized administrative session to inspect effective account/source policy. Do not guess that `AllowUsers`, `AllowGroups`, PAM, or another server rule is the exact cause until server-side evidence establishes it.
+**SSH signing proof matters:** a preliminary `Server accepts key` message
+means the public key was eligible, **not** that local signing finished or the
+remote account rejected an authenticated user. If the selected agent is absent
+or signing is unproven (the fixed diagnostic code is `local-signing-unproven`),
+try the already-supported exact-target
+`target agent-session` in a trusted local terminal (only with the required
+bounded local authority), then retry the unchanged read-only check once.
+If client signature evidence exists but SSH is still rejected, report remote
+authentication failure without claiming a particular account policy. Inspect
+server account/source policy from a trusted console only when the evidence
+actually justifies that branch. Do not repeatedly reinstall a key, weaken
+trust, turn on password authentication or invent a server configuration fix.
+
+Use recognized installed v1 `diagnosticSummary` fields and the bounded
+continuation/no-progress policy in `core/process/INTERACTIVE_SESSION_GUIDE.md`
+when available; older Kit output remains an explicitly limited capability.
+Keep independent readiness evidence and do not reflect arbitrary exceptions
+or secret-bearing stderr to Chat.
 
 ### One bounded trusted-console diagnostic bundle
 

package/assets/generated/deployment/src/project_forge_deployment/agent_session.py

@@ -0,0 +1,154 @@
+"""Explicit, reusable workstation SSH-agent session for Deployment Kit commands.
+
+This owns *local* authentication only. It does not authorize any remote write,
+alter target host trust, start an SSH tunnel, or change an operating-system service.
+"""
+from __future__ import annotations
+
+from contextlib import contextmanager
+import hashlib
+import os
+from pathlib import Path
+import platform
+import shutil
+import stat
+import subprocess
+from typing import Iterator
+
+from .errors import DeploymentKitError
+from .keys import add_key_to_agent, agent_status
+from .security import check_identity_security
+
+
+def _private_agent_directory(profile: dict[str, str]) -> Path:
+    identity = Path(profile["identityFile"])
+    check_identity_security(identity)
+    ssh_dir = next((p for p in identity.parents if p.name.lower() == ".ssh"), None)
+    if ssh_dir is None:
+        raise DeploymentKitError("The configured identity is outside the user's .ssh directory.")
+    directory = ssh_dir / "project-forge-agents"
+    if not directory.exists() and not directory.is_symlink():
+        directory.mkdir(mode=0o700)
+    try:
+        metadata = directory.lstat()
+    except OSError as error:
+        raise DeploymentKitError("Cannot inspect the dedicated SSH-agent directory.") from error
+    if (
+        not stat.S_ISDIR(metadata.st_mode)
+        or metadata.st_uid != os.getuid()
+        or metadata.st_mode & 0o077
+    ):
+        raise DeploymentKitError(
+            "Dedicated SSH-agent directory must be a real, current-user-owned directory with mode 0700."
+        )
+    return directory
+
+
+def _agent_socket(profile: dict[str, str]) -> Path:
+    directory = _private_agent_directory(profile)
+    digest = hashlib.sha256(
+        str(Path(profile["identityFile"]).resolve()).encode("utf-8")
+    ).hexdigest()[:16]
+    socket = directory / f"pf-{digest}.sock"
+    # Some OSes limit Unix-domain socket paths to ~104 bytes.
+    if len(os.fsencode(socket)) > 100:
+        raise DeploymentKitError(
+            "The dedicated SSH-agent socket path is too long for portable Unix socket support."
+        )
+    return socket
+
+
+def _ensure_posix_agent_socket(profile: dict[str, str]) -> str:
+    socket = _agent_socket(profile)
+    if socket.is_symlink():
+        raise DeploymentKitError("Refusing to follow a symlink at the dedicated SSH-agent socket.")
+    if socket.exists():
+        metadata = socket.lstat()
+        if not stat.S_ISSOCK(metadata.st_mode) or metadata.st_uid != os.getuid():
+            raise DeploymentKitError("Dedicated SSH-agent socket is not a current-user-owned Unix socket.")
+    else:
+        agent = shutil.which("ssh-agent")
+        if not agent:
+            raise DeploymentKitError("OpenSSH ssh-agent is not installed on this workstation.")
+        result = subprocess.run(
+            [agent, "-a", str(socket), "-s"],
+            check=False, text=True, capture_output=True,
+        )
+        if result.returncode or not socket.is_socket():
+            raise DeploymentKitError(
+                "Cannot start the dedicated SSH agent. Inspect the private socket directory; "
+                "no existing agent process or socket will be removed automatically."
+            )
+
+    # Do not trust an old socket solely because it looks like a socket: it must
+    # respond to the usual identity check under the exact selected environment.
+    return str(socket)
+
+
+def _set_socket(value: str | None) -> None:
+    if value is None:
+        os.environ.pop("SSH_AUTH_SOCK", None)
+    else:
+        os.environ["SSH_AUTH_SOCK"] = value
+
+
+@contextmanager
+def target_agent_session(profile: dict[str, str]) -> Iterator[dict[str, str | bool]]:
+    """Temporarily bind the selected target's agent to commands in this process.
+
+    WSL/Linux: a stable per-identity local OpenSSH agent survives separate
+    VS Code terminal processes. macOS: prefer its existing launchd agent when
+    available, otherwise use the same private stable POSIX fallback.
+    Native Windows: use the existing Windows OpenSSH agent *service* only.
+    Its service setup/start requires a separately authorized workstation action.
+    """
+    system = platform.system()
+    previous = os.environ.get("SSH_AUTH_SOCK")
+    managed_socket = False
+    try:
+        if system == "Windows":
+            # A native Windows OpenSSH service does not use SSH_AUTH_SOCK.
+            # Never start or reconfigure the privileged service automatically.
+            _set_socket(None)
+        elif system in {"Linux", "Darwin"}:
+            if system == "Darwin" and previous:
+                status = agent_status(profile)
+                if status["state"] == "agent-unavailable":
+                    _set_socket(_ensure_posix_agent_socket(profile))
+                    managed_socket = True
+            else:
+                _set_socket(_ensure_posix_agent_socket(profile))
+                managed_socket = True
+        else:
+            raise DeploymentKitError(
+                f"Unsupported workstation OS for SSH-agent session: {system}."
+            )
+
+        status = agent_status(profile)
+        if status["state"] == "agent-unavailable":
+            if system == "Windows":
+                raise DeploymentKitError(
+                    "Windows OpenSSH ssh-agent service is unavailable. "
+                    "Have the workstation administrator enable/start the ssh-agent service; "
+                    "Project Forge will not change its configuration automatically."
+                )
+            raise DeploymentKitError(
+                "The selected SSH-agent socket is unresponsive. "
+                "Inspect the private socket and agent process; Project Forge will not delete it automatically."
+            )
+
+        # The explicit 'agent-session' command authorizes this bounded local
+        # key load. SSH passphrase input remains with OpenSSH in the terminal.
+        if not status["loaded"]:
+            result = add_key_to_agent(profile)
+            if not result["loaded"]:
+                raise DeploymentKitError("Dedicated SSH identity is not loaded.")
+        yield {
+            "targetName": profile["targetName"],
+            "loaded": True,
+            "agent": "windows-service" if system == "Windows"
+                     else "dedicated-socket" if managed_socket
+                     else "existing-macos-agent",
+        }
+    finally:
+        _set_socket(previous)

package/assets/generated/deployment/src/project_forge_deployment/box_platform.py

@@ -101,7 +101,7 @@ def _parse_status(output: str) -> dict[str, Any]:
 
 
 def _run_remote(profile: dict[str, Any], address: str, action: str, *, sudo: bool) -> str:
-    if action not in {"status", "install", "upgrade"}:
+    if action not in {"status", "install", "upgrade", "proxy-peer"}:
         raise DeploymentKitError(f"Unsupported host-platform action: {action}")
     remote_command = "bash -s -- " + shlex.quote(action)
     if sudo:
@@ -130,6 +130,36 @@ def platform_status(name: str) -> dict[str, Any]:
     return status
 
 
+def platform_proxy_peer(
+    name: str,
+    *,
+    configured_peer: str | None = None,
+    previous_container_id: str | None = None,
+    previous_network_id: str | None = None,
+) -> dict[str, Any]:
+    """Read current Caddy peer and produce a no-write app convergence decision.
+
+    This is NOT authority to update an application's trusted peer. That
+    requires its own verified plan, meaningful review and runtime write gate.
+    """
+    from .proxy_peer import assess_configured_peer, parse_peer_observation
+
+    profile = load_profile(name)
+    evidence = verify_access(profile)
+    observed = parse_peer_observation(
+        _run_remote(profile, evidence["address"], "proxy-peer", sudo=True)
+    )
+    plan = assess_configured_peer(
+        observed,
+        configured_peer,
+        previous_container_id=previous_container_id,
+        previous_network_id=previous_network_id,
+    )
+    plan["targetName"] = name
+    plan["mutated"] = False
+    return plan
+
+
 def platform_doctor(name: str) -> dict[str, Any]:
     status = platform_status(name)
     next_actions = {