@mriekki/project-forge 4.24.1 → 4.26.0

package/assets/generated/deployment/src/project_forge_deployment/box_platform_remote.py

@@ -250,7 +250,31 @@ upgrade_platform() {
     rm -rf "$candidate_dir" "$backup_dir"
 }
 
+# PF-06: read the exact managed Caddy container/network identity.
+# Only selected fields are returned; no Config.Env, mounts or provider secrets.
+# This cannot make an application accept a changed proxy peer.
+proxy_peer_status() {
+    local id name state image network_id networks members
+    id="$(docker inspect --format '{{.Id}}' "$CADDY_CONTAINER" 2>/dev/null)" || {
+        echo "Managed proxy container is missing or unavailable." >&2; exit 31;
+    }
+    name="$(docker inspect --format '{{.Name}}' "$CADDY_CONTAINER" 2>/dev/null)" || exit 31
+    name="${name#/}"
+    state="$(docker inspect --format '{{.State.Status}}' "$CADDY_CONTAINER" 2>/dev/null)" || exit 31
+    image="$(docker inspect --format '{{.Config.Image}}' "$CADDY_CONTAINER" 2>/dev/null)" || exit 31
+    network_id="$(docker network inspect --format '{{.Id}}' "$NETWORK_NAME" 2>/dev/null)" || {
+        echo "Managed proxy network is missing or unavailable." >&2; exit 32;
+    }
+    networks="$(docker inspect --format '{{json .NetworkSettings.Networks}}' "$CADDY_CONTAINER" 2>/dev/null)" || exit 33
+    members="$(docker network inspect --format '{{json .Containers}}' "$NETWORK_NAME" 2>/dev/null)" || exit 33
+    printf 'containerId=%s\ncontainerName=%s\ncontainerState=%s\ncontainerImage=%s\nnetworkId=%s\nnetworks=%s\nmembers=%s\n' \
+        "$id" "$name" "$state" "$image" "$network_id" "$networks" "$members"
+}
+
 case "$ACTION" in
+    proxy-peer)
+        proxy_peer_status
+        ;;
     status)
         status
         ;;

package/assets/generated/deployment/src/project_forge_deployment/cli.py

@@ -12,6 +12,7 @@ from .box_platform import (
     apply_platform_change,
     plan_platform_change,
     platform_doctor,
+    platform_proxy_peer,
     platform_status,
 )
 from .doctor import target_doctor, workstation_doctor
@@ -230,6 +231,26 @@ def build_parser() -> argparse.ArgumentParser:
     agent_add.add_argument("name")
     agent_add.add_argument("--yes", action="store_true")
 
+    agent_session = target_sub.add_parser(
+        "agent-session",
+        help="Reuse a workstation SSH agent/key and run one normal Deployment Kit command",
+    )
+    agent_session.add_argument("name", help="Exact configured SSH target identity to load")
+    agent_session.add_argument(
+        "session_args", nargs=argparse.REMAINDER,
+        help="After --, a normal Deployment Kit command (with its usual authorization gates)",
+    )
+
+    agent_run = target_sub.add_parser(
+        "agent-run",
+        help="Run one repository-defined local program with the target's SSH agent, no shell",
+    )
+    agent_run.add_argument("name", help="Exact configured SSH target identity to load")
+    agent_run.add_argument(
+        "run_args", nargs=argparse.REMAINDER,
+        help="After --, exact executable and arguments for a normal local program",
+    )
+
     trust_candidates = target_sub.add_parser(
         "trust-candidates",
         help="Read candidate host-key fingerprints; candidates are never trusted by discovery",
@@ -320,6 +341,15 @@ def build_parser() -> argparse.ArgumentParser:
     )
     platform_doctor_parser.add_argument("name")
     platform_doctor_parser.add_argument("--json", action="store_true")
+    proxy_peer = platform_sub.add_parser(
+        "peer-inspect",
+        help="Read exact managed Caddy peer identity and review required application convergence",
+    )
+    proxy_peer.add_argument("name")
+    proxy_peer.add_argument("--configured-peer", help="Exact peer IP currently trusted by this application")
+    proxy_peer.add_argument("--previous-container-id", help="Previously reviewed Caddy container ID")
+    proxy_peer.add_argument("--previous-network-id", help="Previously reviewed Docker network ID")
+    proxy_peer.add_argument("--json", action="store_true")
     for command in ("install", "upgrade"):
         change = platform_sub.add_parser(
             command,
@@ -373,6 +403,47 @@ def main(argv: list[str] | None = None) -> int:
         if args.group == "target" and args.command == "agent-status":
             _print(agent_status(load_profile(args.name)), as_json=args.json)
             return 0
+        if args.group == "target" and args.command == "agent-run":
+            import subprocess
+
+            command = list(args.run_args)
+            if command and command[0] == "--":
+                command.pop(0)
+            if not command:
+                raise DeploymentKitError(
+                    "Supply an exact local executable and argv after '--'. "
+                    "The agent-run command does not authorize the program's writes."
+                )
+            from .agent_session import target_agent_session
+
+            with target_agent_session(load_profile(args.name)) as session:
+                print(
+                    f"SSH agent ready for {session['targetName']} ({session['agent']}); "
+                    "the launched program retains its own authorization gates.",
+                    file=sys.stderr,
+                )
+                # No shell, eval, redirection, or implicit --yes. The caller
+                # selects an already-reviewed repository-owned program.
+                return subprocess.run(command, check=False).returncode
+        if args.group == "target" and args.command == "agent-session":
+            command = list(args.session_args)
+            if command and command[0] == "--":
+                command.pop(0)
+            if not command or command[:2] == ["target", "agent-session"]:
+                raise DeploymentKitError(
+                    "Supply a non-nested Deployment Kit subcommand after '--'. "
+                    "The SSH-agent session does not authorize remote operations."
+                )
+            from .agent_session import target_agent_session
+            from .entrypoint import main as dispatch
+
+            with target_agent_session(load_profile(args.name)) as session:
+                print(
+                    f"SSH agent ready for {session['targetName']} ({session['agent']}); "
+                    "normal CLI checks and write gates still apply.",
+                    file=sys.stderr,
+                )
+                return dispatch(command)
         if args.group == "target" and args.command == "agent-add":
             profile = load_profile(args.name)
             status = agent_status(profile)
@@ -425,6 +496,17 @@ def main(argv: list[str] | None = None) -> int:
         if args.group == "platform" and args.command == "doctor":
             _print(platform_doctor(args.name), as_json=args.json)
             return 0
+        if args.group == "platform" and args.command == "peer-inspect":
+            _print(
+                platform_proxy_peer(
+                    args.name,
+                    configured_peer=args.configured_peer,
+                    previous_container_id=args.previous_container_id,
+                    previous_network_id=args.previous_network_id,
+                ),
+                as_json=args.json,
+            )
+            return 0
         if args.group == "platform" and args.command in {"install", "upgrade"}:
             return _platform_change(args)
         raise DeploymentKitError("Unsupported command.")

package/assets/generated/deployment/src/project_forge_deployment/environment_setup.py

@@ -15,6 +15,7 @@ from .environment_probe import plan_environment_proof
 from .errors import DeploymentKitError
 from .profiles import load_profile
 from .proof_receipt import load_environment_proof_receipt
+from .safe_diagnostics import project_setup_summary
 from .ssh import diagnose_access
 
 
@@ -126,6 +127,21 @@ def _access_recovery(status: dict[str, Any]) -> dict[str, Any]:
                 "Do not reinstall keys repeatedly, enable password SSH, widen AllowUsers, or weaken host verification implicitly."
             ),
         }
+    if category == "local-signing-unproven":
+        return {
+            "kind": "local-prerequisite",
+            "action": "use-existing-target-agent-session",
+            "command": (
+                f"project-forge-deploy target agent-session {target} "
+                f"-- environment setup status {target} --json"
+            ),
+            "reason": detail.get("guidance"),
+            "safety": (
+                "Prepare the configured local signer using the existing supported "
+                "agent-session helper in a trusted interactive terminal. "
+                "No remote SSH policy change, new key or trust alteration is authorized."
+            ),
+        }
     if category == "local-signing-failed":
         return {
             "kind": "local-repair",
@@ -362,8 +378,12 @@ def remote_setup_plan(
             "previousProof": receipt,
         }
 
-    return {
+    result = {
         **status,
         "next": next_action,
         "mutated": False,
     }
+    # Additive safe, bounded, versioned projection. Retain the full evidence
+    # in its existing owner; never echo arbitrary remote stderr to summaries.
+    result["diagnosticSummary"] = project_setup_summary(result)
+    return result

package/assets/generated/deployment/src/project_forge_deployment/proxy_peer.py

@@ -0,0 +1,168 @@
+"""Read-only exact Caddy peer observation and reconciliation proposal (PF-06).
+
+No Docker/network/provider writes, no configuration mutation, no trust bypass.
+A completed observation is an input to a separately reviewed application
+convergence plan, never automatic authorization to rewrite trusted peer IPs.
+"""
+
+from __future__ import annotations
+
+import ipaddress
+import json
+import re
+from typing import Any
+
+from .box_platform_assets import CADDY_CONTAINER, CADDY_IMAGE, NETWORK_NAME
+from .errors import DeploymentKitError
+
+_SCHEMA_VERSION = 1
+_HEX_ID = re.compile(r"[0-9a-f]{64}")
+_KEYS = frozenset({
+    "containerId", "containerName", "containerState", "containerImage",
+    "networkId", "networks", "members",
+})
+_MAX_BYTES = 65536
+
+
+def _require_exact_ip(raw: Any) -> str:
+    if not isinstance(raw, str):
+        raise DeploymentKitError("Managed proxy address is not an IPv4 string.")
+    try:
+        address = ipaddress.IPv4Address(raw)
+    except ipaddress.AddressValueError as error:
+        raise DeploymentKitError("Managed proxy address is invalid.") from error
+    if not address.is_private or address.is_unspecified or address.is_loopback or address.is_multicast or address.is_link_local:
+        raise DeploymentKitError("Managed proxy address is not a suitable private-network peer.")
+    return str(address)
+
+
+def parse_peer_observation(stdout: str) -> dict[str, Any]:
+    """Validate an allowlisted remote observation without propagating raw output."""
+    if not isinstance(stdout, str) or len(stdout.encode("utf-8")) > _MAX_BYTES:
+        raise DeploymentKitError("Managed proxy observation exceeds the bounded read-only format.")
+    fields: dict[str, str] = {}
+    for line in stdout.splitlines():
+        if "=" not in line:
+            raise DeploymentKitError("Malformed managed proxy observation.")
+        name, value = line.split("=", 1)
+        if name not in _KEYS or name in fields or not value:
+            raise DeploymentKitError("Unexpected or duplicate managed proxy observation field.")
+        fields[name] = value
+    if set(fields) != _KEYS:
+        raise DeploymentKitError("Managed proxy observation is incomplete.")
+
+    container_id, network_id = fields["containerId"], fields["networkId"]
+    if not _HEX_ID.fullmatch(container_id) or not _HEX_ID.fullmatch(network_id):
+        raise DeploymentKitError("Managed proxy identity is not an exact full Docker identifier.")
+    if fields["containerName"] != CADDY_CONTAINER or fields["containerState"] != "running":
+        raise DeploymentKitError("Expected managed proxy container is not running.")
+    if fields["containerImage"] != CADDY_IMAGE:
+        raise DeploymentKitError("Managed proxy image differs from the pinned Kit image.")
+    try:
+        networks = json.loads(fields["networks"])
+        members = json.loads(fields["members"])
+    except json.JSONDecodeError as error:
+        raise DeploymentKitError("Managed proxy Docker network observation is malformed.") from error
+    if not isinstance(networks, dict) or set(networks) != {NETWORK_NAME}:
+        raise DeploymentKitError("Managed proxy has an unexpected network attachment.")
+    net = networks[NETWORK_NAME]
+    if not isinstance(net, dict) or net.get("NetworkID") != network_id:
+        raise DeploymentKitError("Managed proxy network identity mismatch.")
+    address = _require_exact_ip(net.get("IPAddress"))
+    if not isinstance(members, dict) or container_id not in members:
+        raise DeploymentKitError("Managed proxy is missing from the named network member registry.")
+    member = members[container_id]
+    if not isinstance(member, dict) or member.get("Name") != CADDY_CONTAINER:
+        raise DeploymentKitError("Managed proxy membership does not match its exact identity.")
+    cidr = member.get("IPv4Address")
+    if not isinstance(cidr, str) or cidr.split("/", 1)[0] != address:
+        raise DeploymentKitError("Managed proxy IP disagrees with Docker network membership.")
+    # The network may contain unrelated application peers. Do not trust the
+    # entire network, require its exclusivity, or grant those peers authority.
+    for other_id, other in members.items():
+        if not isinstance(other_id, str) or not _HEX_ID.fullmatch(other_id):
+            raise DeploymentKitError("Managed network member identity is malformed.")
+        if not isinstance(other, dict):
+            raise DeploymentKitError("Managed network member record is malformed.")
+        other_ip = other.get("IPv4Address")
+        if not isinstance(other_ip, str):
+            raise DeploymentKitError("Managed network member address is malformed.")
+        if other_id != container_id and other_ip.split("/", 1)[0] == address:
+            raise DeploymentKitError("Managed proxy address conflicts with another network member.")
+    return {
+        "schemaVersion": _SCHEMA_VERSION,
+        "containerName": CADDY_CONTAINER,
+        "containerId": container_id,
+        "containerImage": CADDY_IMAGE,
+        "networkName": NETWORK_NAME,
+        "networkId": network_id,
+        "peerIp": address,
+        "verifiedBy": "read-only-docker-observation",
+        "mutated": False,
+    }
+
+
+def assess_configured_peer(
+    observation: dict[str, Any],
+    configured_peer: str | None,
+    *,
+    previous_container_id: str | None = None,
+    previous_network_id: str | None = None,
+) -> dict[str, Any]:
+    """Produce a no-write convergence decision requiring separate review."""
+    if not isinstance(observation, dict) or observation.get("schemaVersion") != _SCHEMA_VERSION:
+        raise DeploymentKitError("Managed proxy observation schema is unsupported.")
+    required = {
+        "schemaVersion", "containerName", "containerId", "containerImage",
+        "networkName", "networkId", "peerIp", "verifiedBy", "mutated",
+    }
+    if set(observation) != required or observation.get("mutated") is not False or (
+        observation.get("verifiedBy") != "read-only-docker-observation"
+    ):
+        raise DeploymentKitError("Untrusted managed proxy observation.")
+    for id_value in (observation["containerId"], observation["networkId"]):
+        if not isinstance(id_value, str) or not _HEX_ID.fullmatch(id_value):
+            raise DeploymentKitError("Managed proxy observation lacks exact identity.")
+    observed = _require_exact_ip(observation["peerIp"])
+    if (observation["containerName"] != CADDY_CONTAINER or
+        observation["containerImage"] != CADDY_IMAGE or
+        observation["networkName"] != NETWORK_NAME):
+        raise DeploymentKitError("Managed proxy observation is for a different owned component.")
+
+    if configured_peer is not None:
+        configured_peer = _require_exact_ip(configured_peer)
+    for prior in (previous_container_id, previous_network_id):
+        if prior is not None and (not isinstance(prior, str) or not _HEX_ID.fullmatch(prior)):
+            raise DeploymentKitError("Prior peer identity must be the exact reviewed Docker ID.")
+    changed = (
+        (configured_peer is not None and configured_peer != observed) or
+        (previous_container_id is not None and previous_container_id != observation["containerId"]) or
+        (previous_network_id is not None and previous_network_id != observation["networkId"])
+    )
+    state = (
+        "requires-reviewed-convergence" if changed
+        else "needs-explicit-initial-binding" if configured_peer is None
+        else "needs-reviewed-identity-baseline" if (
+            previous_container_id is None or previous_network_id is None
+        )
+        else "observed-match"
+    )
+    return {
+        **observation,
+        "state": state,
+        "configuredPeerIp": configured_peer,
+        "nextAction": (
+            "review-peer-and-application-configuration" if changed
+            else "review-initial-peer-binding" if configured_peer is None
+            else "record-reviewed-peer-identities" if state == "needs-reviewed-identity-baseline"
+            else "retain-reviewed-peer-binding"
+        ),
+        "requiresAuthorization": state != "observed-match",
+        "doesNotProve": [
+            "application trust middleware enforcement",
+            "live public-origin request contract",
+            "exclusive Docker network ownership",
+            "future Docker address stability",
+        ],
+        "mutated": False,
+    }

package/assets/generated/deployment/src/project_forge_deployment/safe_diagnostics.py

@@ -0,0 +1,172 @@
+"""Small, fixed-field, secret-free diagnostic summaries for exact-target setup.
+
+This is an additive v1 projection. Full reviewed plans and evidence stay in
+their canonical storage. Never reflect arbitrary stderr, provider responses,
+host exception text, paths, URLs or untrusted string fields into this summary.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+import json
+import re
+from typing import Any
+
+DIAGNOSTIC_SCHEMA = 1
+CAPABILITY = "remote-environment-setup"
+CAPABILITY_VERSION = 1
+SUMMARY_MAX_BYTES = 8192
+
+_PHASES = (
+    "workspace",
+    "targetDefinition",
+    "targetAccess",
+    "hostPlatform",
+    "deploymentPath",
+    "application",
+)
+_ALLOWED_CODES = frozenset({
+    "missing-identity",
+    "missing-trust",
+    "local-security-or-trust-invalid",
+    "name-resolution-failed",
+    "transport-failed",
+    "host-identity-rejected",
+    "local-signing-failed",
+    "local-signing-unproven",
+    "remote-authentication-rejected",
+    "remote-account-policy-rejected",  # legacy consumers; not inferred from key offer
+    "authentication-rejected",
+    "ssh-verification-failed",
+    "unclassified-failure",
+})
+_ALLOWED_ACTIONS = frozenset({
+    "remote-environment-ready",
+    "configure-target-profile",
+    "create-or-select-key",
+    "verify-and-enroll-host-trust",
+    "set-verified-address",
+    "repair-target-profile",
+    "inspect-remote-account-access-policy",
+    "repair-local-key-signing",
+    "use-existing-target-agent-session",
+    "reverify-host-identity",
+    "repair-target-address-or-network-path",
+    "diagnose-target-access",
+    "install-host-platform",
+    "upgrade-host-platform",
+    "inspect-host-platform",
+    "plan-deployment-path-proof",
+    "review-deployment-path-proof",
+    "resolve-environment-isolation-collision",
+})
+_ACTION_KIND = frozenset({
+    "complete",
+    "read-only",
+    "local-prerequisite",
+    "local-repair",
+    "operator-action-required",
+    "human-verification",
+    "missing-facts",
+    "blocked",
+    "write-gated",
+    "proof-context-required",
+})
+
+
+def _safe_target(value: object) -> str:
+    # A selected local *logical name* only; never include hostnames, IPs,
+    # filesystem paths, URLs or provider identifiers by default.
+    if (not isinstance(value, str) or "." in value or
+            re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_-]{0,63}", value) is None):
+        return "unknown-target"
+    return value
+
+
+def _dimension_state(value: str) -> str:
+    if value in {"ready", "proven"}:
+        return "proved"
+    if value in {"not-proven", "not-part-of-setup"}:
+        return "notChecked"
+    if value.startswith("blocked") or value == "needs-profile":
+        return "blocked"
+    return "failed"
+
+
+def project_setup_summary(
+    result: dict[str, Any], *, observed_at: datetime | None = None
+) -> dict[str, Any]:
+    """Return an allowlisted, byte-bounded projection of remote setup evidence.
+
+    Unknown states or reasons must not be reported as success. No arbitrary
+    nested data, messages or paths are copied from the untrusted input.
+    """
+    stamp = observed_at if observed_at is not None else datetime.now(timezone.utc)
+    if stamp.tzinfo is None or stamp.utcoffset() is None:
+        raise ValueError("Observed time must include a timezone.")
+    phases = result.get("phases")
+    if not isinstance(phases, dict):
+        phases = {}
+    dimensions: dict[str, list[str]] = {
+        "proved": [], "failed": [], "blocked": [], "notChecked": []
+    }
+    for key in _PHASES:
+        phase = phases.get(key)
+        state = phase.get("state") if isinstance(phase, dict) else None
+        category = _dimension_state(state) if isinstance(state, str) else "notChecked"
+        dimensions[category].append(key)
+
+    next_action = result.get("next")
+    if not isinstance(next_action, dict):
+        next_action = {}
+    action = next_action.get("action")
+    action = action if isinstance(action, str) and action in _ALLOWED_ACTIONS else "unclassified-failure"
+    kind = next_action.get("kind")
+    kind = kind if isinstance(kind, str) and kind in _ACTION_KIND else "blocked"
+    # A malformed/mixed producer cannot turn failed or missing prerequisite
+    # observations into a success-shaped summary. Application is intentionally
+    # not part of foundational environment proof.
+    if action == "remote-environment-ready" and any(
+        key not in dimensions["proved"] for key in _PHASES[:-1]
+    ):
+        action = "unclassified-failure"
+        kind = "blocked"
+    elif action == "unclassified-failure":
+        kind = "blocked"
+    target_access = phases.get("targetAccess", {})
+    detail = target_access.get("detail") if isinstance(target_access, dict) else None
+    failure_code = detail.get("failureCategory") if isinstance(detail, dict) else None
+    reason_code = failure_code if isinstance(failure_code, str) and failure_code in _ALLOWED_CODES else action
+    phase = result.get("currentPhase")
+    phase = phase if isinstance(phase, str) and phase in _PHASES else "unknown"
+    # Caller-reported mutation cannot be silently represented as read-only.
+    # This shape is not an authorization token or operation receipt.
+    mutated = result.get("mutated")
+    mutation = "none" if mutated is False else "unknown" if mutated is None else "occurred"
+
+    summary = {
+        "schemaVersion": DIAGNOSTIC_SCHEMA,
+        "capability": CAPABILITY,
+        "capabilityVersion": CAPABILITY_VERSION,
+        "target": _safe_target(result.get("targetName")),
+        "observedAt": stamp.astimezone(timezone.utc).isoformat().replace("+00:00", "Z"),
+        "phase": phase,
+        "reasonCode": reason_code,
+        "dimensions": dimensions,
+        "mutation": mutation,
+        "nextAction": {
+            "code": action,
+            "kind": kind,
+            "consequence": (
+                "write-approval-required" if kind == "write-gated"
+                else "human-verification-required" if kind in {"human-verification", "operator-action-required"}
+                else "no-mutation"
+            ),
+        },
+        "evidenceRef": None,
+    }
+    serialized = json.dumps(summary, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    if len(serialized) > SUMMARY_MAX_BYTES:
+        # Never truncate failed/blocked dimensions to meet the bound.
+        raise ValueError("Diagnostic summary exceeded the fixed v1 bound.")
+    return summary

package/assets/generated/deployment/src/project_forge_deployment/ssh.py

@@ -10,7 +10,7 @@ from pathlib import Path
 from typing import Any
 
 from .errors import DeploymentKitError
-from .keys import key_fingerprint
+from .keys import agent_status, key_fingerprint
 from .security import check_ssh_material_security, validate_target_trust_file
 
 
@@ -195,7 +195,19 @@ def _tcp_probe(profile: dict[str, Any], address: str) -> dict[str, Any]:
         }
 
 
-def _classify_failure(text: str, *, auth: dict[str, Any], offered: bool, accepted: bool) -> str:
+def _classify_failure(
+    text: str,
+    *,
+    auth: dict[str, Any],
+    offered: bool,
+    accepted: bool,
+    signer_loaded: bool | None = None,
+) -> str:
+    """Classify only what the SSH evidence proves.
+
+    ``Server accepts key`` is a preliminary public-key handshake, not
+    proof of client signing or of a completed authenticated session.
+    """
     lower = text.lower()
     if "remote host identification has changed" in lower or "host key verification failed" in lower:
         return "host-identity-rejected"
@@ -213,9 +225,21 @@ def _classify_failure(text: str, *, auth: dict[str, Any], offered: bool, accepte
         return "transport-failed"
     if "permission denied" in lower:
         if accepted:
-            return "remote-account-policy-rejected"
-        if offered or auth.get("publicKeySupported"):
+            # No signer proof means neither a remote account-policy refusal
+            # nor a verified credential rejection can be asserted.
+            if "sign_and_send_pubkey: signing using" in lower:
+                # A signer (agent or directly usable key) did sign, but
+                # the remote side still refused authentication.
+                return "remote-authentication-rejected"
+            # Merely observing a loaded agent is not proof that this key signed.
+            return "local-signing-unproven"
+        if offered:
+            # The server has enough evidence to refuse the offered key.
             return "remote-authentication-rejected"
+        if auth.get("publicKeySupported") and signer_loaded is False:
+            # A publickey-capable server does not establish that this
+            # workstation could offer/sign the configured identity.
+            return "local-signing-unproven"
         return "authentication-rejected"
     return "ssh-verification-failed"
 
@@ -266,6 +290,7 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
         }
 
     fingerprint = key_fingerprint(identity)
+    local_signer: dict[str, Any] = {"state": "not-checked", "loaded": False}
     attempts: list[dict[str, Any]] = []
     for address in addresses:
         tcp = _tcp_probe(profile, address)
@@ -273,6 +298,19 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
             attempts.append({"address": address, "tcp": tcp, "state": "transport-failed"})
             continue
 
+        # Only examine the local agent when transport actually reached the
+        # selected target. This remains a read-only observation: do not start
+        # an agent, request a passphrase, or alter SSH trust during diagnosis.
+        if local_signer["state"] == "not-checked":
+            try:
+                agent = agent_status(profile)
+                local_signer = {
+                    "state": agent["state"],
+                    "loaded": agent["loaded"],
+                }
+            except (DeploymentKitError, OSError, KeyError):
+                local_signer = {"state": "not-verified", "loaded": False}
+
         auth = probe_authentication_methods(profile, address)
         result = _completed(ssh_args(profile, address, verbose=True))
         text = "\n".join(part for part in (result.stderr, result.stdout) if part)
@@ -284,6 +322,7 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
                 "state": "verified",
                 "address": address,
                 "identityFingerprint": fingerprint,
+                "localSigner": local_signer,
                 "authentication": auth,
                 "offeredConfiguredIdentity": offered,
                 "serverAcceptedConfiguredIdentity": accepted,
@@ -296,6 +335,7 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
                 "tcp": tcp,
                 "authentication": auth,
                 "identityFingerprint": fingerprint,
+                "localSigner": local_signer,
                 "offeredConfiguredIdentity": offered,
                 "serverAcceptedConfiguredIdentity": accepted,
                 "returnCode": result.returncode,
@@ -304,6 +344,7 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
                     auth=auth,
                     offered=offered,
                     accepted=accepted,
+                    signer_loaded=local_signer["loaded"],
                 ),
             }
         )
@@ -312,6 +353,7 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
     for candidate in (
         "host-identity-rejected",
         "local-signing-failed",
+        "local-signing-unproven",
         "remote-account-policy-rejected",
         "remote-authentication-rejected",
         "authentication-rejected",
@@ -325,6 +367,11 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
         "transport-failed": "Verify the configured address/port and network path; do not scan or silently switch targets.",
         "host-identity-rejected": "Re-verify host identity independently before any trust rotation.",
         "local-signing-failed": "Repair local key/passphrase/agent use; do not weaken remote authentication policy.",
+        "local-signing-unproven": (
+            "The server accepted a public key offer, but completed client signing "
+            "was not established. Reuse the exact target's supported local SSH agent-session "
+            "before investigating remote account policy. Do not weaken host trust."
+        ),
         "remote-authentication-rejected": (
             "The configured public-key path reached the server but authentication was rejected. "
             "Verify authorized_keys and remote account/source access policy from a trusted console or already-authorized session."
@@ -342,6 +389,7 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
         "state": "failed",
         "failureCategory": category,
         "identityFingerprint": fingerprint,
+        "localSigner": local_signer,
         "attempts": attempts,
         "guidance": guidance,
         "mutated": False,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.24.1",
+  "version": "4.26.0",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {