@mriekki/project-forge 4.25.0 → 4.26.1

package/assets/components.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.25.0",
+  "version": "4.26.1",
   "defaultProfile": "greenfield-project",
   "profiles": {
     "greenfield-project": {
@@ -13,15 +13,15 @@
   },
   "components": {
     "core": {
-      "revision": "5d7c1285793f502d58ad4b6f8f2e51c77453073b",
-      "version": "4.3.0",
+      "revision": "670b84af788323ce361a49677aff772c0d1541c4",
+      "version": "4.3.1",
       "distribution": "greenfield-workspace",
       "descriptor": "assets/core/distribution.json",
       "sourceRoot": "assets/generated/core",
       "canonicalDescriptor": "distributions/greenfield-workspace.json"
     },
     "deployment": {
-      "revision": "97dfcd7152619a434672da5045c0528f41984ced",
+      "revision": "e9ca6e12e5b19f691b25ce0aba758a43c3df2913",
       "distribution": "greenfield-project",
       "descriptor": "assets/deployment/distribution.json",
       "sourceRoot": "assets/generated/deployment",

package/assets/deployment/distribution.json

@@ -44,11 +44,13 @@
     {"source": "src/project_forge_deployment/profiles.py", "destination": "tools/project-forge-deployment/project_forge_deployment/profiles.py"},
     {"source": "src/project_forge_deployment/project_topology.py", "destination": "tools/project-forge-deployment/project_forge_deployment/project_topology.py"},
     {"source": "src/project_forge_deployment/proof_receipt.py", "destination": "tools/project-forge-deployment/project_forge_deployment/proof_receipt.py"},
+    {"source": "src/project_forge_deployment/proxy_peer.py", "destination": "tools/project-forge-deployment/project_forge_deployment/proxy_peer.py"},
     {"source": "src/project_forge_deployment/recovery_scope.py", "destination": "tools/project-forge-deployment/project_forge_deployment/recovery_scope.py"},
     {"source": "src/project_forge_deployment/registry_access.py", "destination": "tools/project-forge-deployment/project_forge_deployment/registry_access.py"},
     {"source": "src/project_forge_deployment/registry_cli.py", "destination": "tools/project-forge-deployment/project_forge_deployment/registry_cli.py"},
     {"source": "src/project_forge_deployment/route_registry.py", "destination": "tools/project-forge-deployment/project_forge_deployment/route_registry.py"},
     {"source": "src/project_forge_deployment/route_registry_remote.py", "destination": "tools/project-forge-deployment/project_forge_deployment/route_registry_remote.py"},
+    {"source": "src/project_forge_deployment/safe_diagnostics.py", "destination": "tools/project-forge-deployment/project_forge_deployment/safe_diagnostics.py"},
     {"source": "src/project_forge_deployment/security.py", "destination": "tools/project-forge-deployment/project_forge_deployment/security.py"},
     {"source": "src/project_forge_deployment/sqlite_adapter.py", "destination": "tools/project-forge-deployment/project_forge_deployment/sqlite_adapter.py"},
     {"source": "src/project_forge_deployment/sqlite_adapter_remote.py", "destination": "tools/project-forge-deployment/project_forge_deployment/sqlite_adapter_remote.py"},

package/assets/generated/ASSEMBLY.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.25.0",
+  "version": "4.26.1",
   "components": {
     "core": {
-      "revision": "5d7c1285793f502d58ad4b6f8f2e51c77453073b",
-      "version": "4.3.0",
+      "revision": "670b84af788323ce361a49677aff772c0d1541c4",
+      "version": "4.3.1",
       "distribution": "greenfield-workspace",
       "files": [
         {
@@ -56,7 +56,7 @@
         {
           "source": "core/skills/setup/SKILL.md",
           "destination": ".github/skills/setup/SKILL.md",
-          "sha256": "fb1f752655c79d7ac68f3424adba2663492a8e9dd0b8d268cabb6dd28880b6fc"
+          "sha256": "30a9dbfbd132f7c333ca515736a7957494bbe2fd4b5860dfff90ba3437bc135d"
         },
         {
           "source": "core/skills/build/SKILL.md",
@@ -91,7 +91,7 @@
         {
           "source": "core/skills/deliver/SKILL.md",
           "destination": ".github/skills/deliver/SKILL.md",
-          "sha256": "f7d4c611358bec5b348df994515d1253b59c72707b3a8f28e846174468c590c2"
+          "sha256": "5e4d64d91e429b636e0fda4094a84dd2f0b09aa7c1f281cbba7d630b67820076"
         },
         {
           "source": "core/skills/work-item-status/SKILL.md",
@@ -126,12 +126,12 @@
         {
           "source": "core/skills/deployment-readiness/SKILL.md",
           "destination": ".github/skills/deployment-readiness/SKILL.md",
-          "sha256": "170e90e1d21050fb1134230f539c41a1ca62193c3d695fda5edee4147d56e929"
+          "sha256": "8b83d06056cbc10c0a9df69d1bb76db62753b52f5d4be9858488e400cd4b836d"
         },
         {
           "source": "core/skills/deploy/SKILL.md",
           "destination": ".github/skills/deploy/SKILL.md",
-          "sha256": "82c05ae910f65efd170ca6d055cce9e6e5035628eba45bcfc8552a2b1619cce2"
+          "sha256": "3ac67207c9cb6870c56313b2c4ce02d15c0756cb092937013f66512d2ec9576a"
         },
         {
           "source": "core/skills/tear-down/SKILL.md",
@@ -196,7 +196,7 @@
         {
           "source": "core/process/INTERACTIVE_SESSION_GUIDE.md",
           "destination": "docs/process/INTERACTIVE_SESSION_GUIDE.md",
-          "sha256": "71e25cd0603eecac2be67a696386fddf718c6da26e10c0ade74429ff68a3ac30"
+          "sha256": "43bb5959fcc71755a76f9c4adcbc24576907db817d9dc0ced4e1607630493843"
         },
         {
           "source": "core/process/COACHING_GUIDE.md",
@@ -376,7 +376,7 @@
         {
           "source": "tools/setup_maintenance/maintenance.py",
           "destination": "tools/project-forge-setup/maintenance.py",
-          "sha256": "55d22445834108d2fb7f2ac8aa4a5c5b0326c01f67e5f305b8284e4f15a0dcd8"
+          "sha256": "15292e1059bc017139a11692346234fe34d98e5745acdfff2197d1232ce57c34"
         },
         {
           "source": "core/process/WORKSTATION_MAINTENANCE.md",
@@ -386,7 +386,7 @@
       ]
     },
     "deployment": {
-      "revision": "97dfcd7152619a434672da5045c0528f41984ced",
+      "revision": "e9ca6e12e5b19f691b25ce0aba758a43c3df2913",
       "distribution": "greenfield-project",
       "files": [
         {
@@ -447,7 +447,7 @@
         {
           "source": "src/project_forge_deployment/box_platform.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/box_platform.py",
-          "sha256": "163c022bbd8ecccadebbebdc8cef8e272fc95dd0dc3cdb35d4e6e10013c91040"
+          "sha256": "a11603daa47e33570732e349f59720811b5fdc2ec26ea04d08896764e089b682"
         },
         {
           "source": "src/project_forge_deployment/box_platform_assets.py",
@@ -457,7 +457,7 @@
         {
           "source": "src/project_forge_deployment/box_platform_remote.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/box_platform_remote.py",
-          "sha256": "65de94ac4b6e980d83ce99ea55b9555aa96959c11808cce8c6ed537b27c15533"
+          "sha256": "18a47000d0755c645d5fe8a950f917331abedc332f3e11b9d6638946843a3f0e"
         },
         {
           "source": "src/project_forge_deployment/cloudflare_api.py",
@@ -482,7 +482,7 @@
         {
           "source": "src/project_forge_deployment/cli.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/cli.py",
-          "sha256": "6b4bb3a23b3df8387f13f544ce02e1d2bee863777de4965044435769c24ab98b"
+          "sha256": "5f22a0fed79fe7dcb12b94f670bda04ea503f5254ccacfd841f03dfedd2ceeb5"
         },
         {
           "source": "src/project_forge_deployment/doctor.py",
@@ -512,7 +512,7 @@
         {
           "source": "src/project_forge_deployment/environment_setup.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/environment_setup.py",
-          "sha256": "47ce6af4ab3b03c441725ec8cc1b356212ef7a1706635fe191affd959b09a5f5"
+          "sha256": "934b6d8f2309128da07ced858ea4b9c56b04c5ff67b6efc5c52d81a10a1a696b"
         },
         {
           "source": "src/project_forge_deployment/errors.py",
@@ -594,6 +594,11 @@
           "destination": "tools/project-forge-deployment/project_forge_deployment/proof_receipt.py",
           "sha256": "9b4bbb559747fc4ee3ba984a050fc6425e532527ae82f9897c73e04d8d0291b6"
         },
+        {
+          "source": "src/project_forge_deployment/proxy_peer.py",
+          "destination": "tools/project-forge-deployment/project_forge_deployment/proxy_peer.py",
+          "sha256": "ae6c8cb26b83ed07765fa4740ce5c68f52cafd2209b4f055887a4457cfb41c03"
+        },
         {
           "source": "src/project_forge_deployment/recovery_scope.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/recovery_scope.py",
@@ -619,6 +624,11 @@
           "destination": "tools/project-forge-deployment/project_forge_deployment/route_registry_remote.py",
           "sha256": "c8f397a09ff9efc904230eeec68aa85bab9c21529e44dd925e5db0f02f406b6f"
         },
+        {
+          "source": "src/project_forge_deployment/safe_diagnostics.py",
+          "destination": "tools/project-forge-deployment/project_forge_deployment/safe_diagnostics.py",
+          "sha256": "58372e220e25fc468be490c8a788e347a1026ccbdff899217cdbe8aecb7c00ce"
+        },
         {
           "source": "src/project_forge_deployment/security.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/security.py",
@@ -647,7 +657,7 @@
         {
           "source": "src/project_forge_deployment/ssh.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/ssh.py",
-          "sha256": "88d59b62f63dc6b7206b6074dd109af4ea7c8f022f506e67f7204f1f06240d26"
+          "sha256": "b45ace8c35e622cb336ade9aeafa7405f96660e1e4faed0303faa4edb24b95c5"
         },
         {
           "source": "src/project_forge_deployment/teardown.py",

package/assets/generated/core/core/process/INTERACTIVE_SESSION_GUIDE.md

@@ -140,3 +140,72 @@ Compound action skills may also define their own bounded authorization. In parti
 If a tool/channel interruption leaves a compound workflow partially complete, a later invocation should inspect current state and resume from the furthest safe point rather than assuming nothing happened or requiring the same routine authorization again.
 
 `/wait-what` is different. It is a one-turn, read-only communication repair for the immediately preceding explanation. It re-establishes context and clarity, then returns control to the current workflow without silently continuing a pending action or approval gate.
+
+## Operational continuity and bounded retries (PF-03/PF-04)
+
+Use these rules within existing Project Forge skills and repository-defined
+operations. This is **not** a new approval store, model selection policy, or
+background execution system.
+
+### Scope a working authorization before a consequential action
+
+Before a multi-stage or unattended continuation, state a short **reviewed-stage
+envelope** in the already-existing work item/review context:
+
+- Exact Project, named logical environment/target, host identity where relevant,
+  and intended operation(s).
+- Immutable artifact, plan identity and reviewed evidence, including freshness
+  and expiry when the installed capability exposes them.
+- Allowed mechanical continuation and **separate** Production runtime, public
+  route, trust/credential, destructive data, merge, and release boundaries.
+- Remaining secret-input or human decision points and the precise stop conditions.
+
+One currently approved, unchanged reviewed stage authorizes its supported
+routine mechanics; never request a second identical shell phrase or chat
+permission when the installed deterministic command supports scoped execution.
+However, authorization is **not** a standing token: changed target, plan, peer,
+data/backup risk, credential, identity, exposure, trust or other consequence
+reopens the relevant gate. Never infer indefinite authority from elapsed time
+or a prior session. Explain any interactive passphrase/provider action **before**
+the developer leaves an unattended workflow; do not promise unattended
+completion if required local input or a human approval remains.
+
+### Read safe results without losing the failed phase
+
+When the installed Deployment Kit supplies an additive safe
+`diagnosticSummary`, use it only if the **observed installed** schema and
+capability version match the documented contract (currently schema 1,
+`remote-environment-setup` capability 1). Preserve phase, fixed reasonCode,
+proved/failed/blocked/notChecked dimensions, observedAt, mutation, consequence
+and any safe evidence reference. An unknown capability, reason, malformed
+summary or mixed stderr becomes **unclassified**, never green/success.
+Report unsupported or older installed tooling honestly; do not reconstruct the
+same field by parsing private exceptions or create a new runtime prerequisite
+during Bootstrap. A concise summary is not a complete reviewed mutation plan.
+
+### Avoid no-information attempts and context inflation
+
+If the **same** fixed reason code and non-secret exact target/phase/context have
+failed twice with unchanged inputs **and no new evidence**, change the method
+(e.g. inspect a different bounded proof) or stop with the precise missing fact.
+Do not perform a third identical attempt, rerun an unchanged reviewer objective,
+replay a failed login, or repeatedly ask for the same fact. A newly loaded SSH
+agent, changed plan, confirmed host identity, updated installed helper or other
+material new evidence resets the same-phase retry comparison.
+
+Start a continuation with the smallest authoritative repository/state
+checkpoint: current work-item state, exact commit/PR/CI, package/component
+provenance, observed capability and proof freshness, unresolved decision, and
+next safe action. Follow links to deeper current evidence only as needed.
+Do not reload a whole incident transcript, broad skill catalog or all historical
+retries just because context is available. Favor one bounded wait/read of a
+known CI run ID over repeated short polling and large tool output. Use only
+relevant skill and artifact slices; keep full evidence available separately.
+
+Measure improvements with one matched, bounded replay holding the same fault,
+safety obligations and environmental assumptions. Record model/tool rounds,
+operator prompts, elapsed/waiting time and cache-adjusted token volume:
+input tokens minus cache reads plus output tokens, respecting each counter's
+semantics. Candidate >=50% reductions are **targets**, not guaranteed savings.
+Never hide failed checks, truncate material mutation evidence, skip security
+gates, or change model tier automatically to make metrics look better.

package/assets/generated/core/core/skills/deliver/SKILL.md

@@ -185,6 +185,12 @@ Delivery state preserved. Re-run /deliver to resume.
 ```
 
 Do not insert a new write-authorization prompt merely because CI is pending.
+Use the exact known workflow/run ID and one bounded wait/recheck when possible
+rather than repeated short polling, reloading the same CI output, or relaunching
+a Reviewer on an unchanged objective. Treat two unchanged, no-information
+attempts at one phase as a stop/change-method condition. Preserve the PR/commit
+and CI status as a concise authoritative resumption checkpoint. See
+`core/process/INTERACTIVE_SESSION_GUIDE.md` for freshness and context rules.
 
 ### Failed
 

package/assets/generated/core/core/skills/deploy/SKILL.md

@@ -226,8 +226,29 @@ Authorization applies only to the exact environment, resolved classification, pl
 
 **Avoid duplicate terminal approval:** when the Builder has explicitly approved this exact current stage in VS Code Copilot Chat, the assistant may pass the installed Deployment Kit's supported `--yes` flag for **that stage only** instead of making the Builder type the displayed phrase again in Bash/PowerShell. `--yes` is an execution flag, not approval evidence; never use it because the human previously approved a different plan, artifact, target, route, session, or stage. If the installed command lacks the flag, preserve its normal gate. Destructive resets/restores and SSH trust/credential changes are independent consequences and are not authorized by a deployment approval.
 
+Before unattended rollout, identify a concise reviewed-stage envelope:
+exact target, immutable artifact, permitted operations, current plan/proof
+identity and freshness, distinct runtime/route/data/trust boundaries, and any
+remaining local secret or human approval stop. Do not promise to finish
+unattended if those stops remain. Repeat safe mechanics within unchanged
+authority; reopen only for changed evidence or a genuinely new consequence.
+After two unchanged failures with no new evidence, change the method or
+stop instead of repeatedly recreating the same plan. Apply the bounded
+continuation policy in `core/process/INTERACTIVE_SESSION_GUIDE.md`.
+
 A runtime authorization never authorizes the route stage. A route authorization never retroactively authorizes a changed runtime artifact. If the rollout contains both stages, preserve the separate gates even though the Builder reviewed one coherent outcome.
 
+For authenticated public ingress relying on a pinned exact Caddy peer,
+preserve current read-only managed peer evidence (when supported) as a
+separate plan dimension from DNS, route and image readiness. If observed
+Caddy container/network identity or peer IP changed from the reviewed
+application binding, **do not silently update the trusted proxy**, change
+the release image, or continue the public-authentication rollout. Prepare a
+separate app-owned reviewed convergence/health/rollback stage.
+Proxy observation alone neither authorizes runtime writes nor proves live end-to-end
+OIDC/public-origin behavior. Follow the PF-06 producer's immutable identity
+review boundary, or report the installed capability as unavailable.
+
 ## 9. Preview and execute only the approved contract
 
 Before mutation, show concise non-secret evidence such as exact environment, purpose, placement, target/provider when applicable, proof freshness, immutable application artifact, persistence/migration, exposure/route, application isolation state/fingerprint when exposed, shared failure-domain note when relevant, planned stages, endpoint state at each stage, and the exact required authorization phrase for the next consequence only.

package/assets/generated/core/core/skills/deployment-readiness/SKILL.md

@@ -202,6 +202,43 @@ Invoking `/deployment-readiness <environment>` or directly asking to check readi
 
 When the installed Deployment Kit supports `target agent-session`, run supported remote checks via `target agent-session <target> -- <normal Deployment Kit command>` rather than copying `SSH_AUTH_SOCK` paths into each command. For existing Project-owned Python readiness scripts that use the same verified target, use the installed `target agent-run <target> -- <exact reviewed local executable and argv>` to inherit this SSH context without shell evaluation; do not invent script arguments or bypass their gates. This prepares only local SSH authentication (WSL/Linux stable private agent; macOS existing SSH agent or private fallback; native Windows OpenSSH agent service). It must not start or configure a Windows system service, enroll trust, skip an SSH passphrase, or authorize any remote write. If the key needs interactive local input, hand the exact non-secret command to the developer-owned terminal once and resume validation afterward. For older installed kits, use their supported SSH workflow and report the update opportunity rather than fabricating a command.
 
+### Safe diagnostic continuation and no-progress bound
+
+When the installed Deployment Kit exposes a recognized v1 `diagnosticSummary`,
+read the fixed reasonCode, failure phase, independently proved/blocked/notChecked
+dimensions, observedAt and mutation status **without** losing unrelated good
+readiness evidence. Continue using the existing exact-target read-only
+authorization. If schema/capability versions are unknown or no usable reason
+is present, state that diagnosis is unclassified, not successful.
+For `local-signing-unproven`, use the supported configured
+`target agent-session` before investigating remote policy; a server's
+preliminary key acceptance does not prove that the client signed. Older
+installed kits may lack these fields: do not invent them.
+
+Use the bounded retry and evidence-freshness policy in
+`core/process/INTERACTIVE_SESSION_GUIDE.md`: after two unchanged,
+no-information attempts at the same phase, change the diagnostic method or
+report the exact evidence gap. Do not replay CI/reviewers or request the
+same unchanged read authorization.
+
+### Exact authenticated-origin peer convergence (PF-06)
+
+For an application whose approved public-origin policy pins the managed Caddy
+peer, use the **installed** Deployment Kit's read-only
+`platform peer-inspect <target> --configured-peer <ip> --previous-container-id <full-id> --previous-network-id <full-id> --json`
+when supported and the application's previously reviewed identity evidence
+exists. Preserve the exact named target and classify a mismatch as a
+**review-required stop**. A missing previous full identity is
+`needs-reviewed-identity-baseline`, not established trust. Do not resolve a
+missing baseline by assuming current Docker identity is implicitly approved.
+
+This observation is not a token/certificate proving Caddy authenticity, not
+permission to rewrite the application-configured peer, and not proof of
+Cloudflare forwarding or of application middleware enforcement. Never trust
+a Docker subnet or allow all LAN peers as a workaround. If the installed Kit
+does not support this inspection, report the capability gap rather than
+inventing a new script or changing Production.
+
 #### Real application isolation preflight
 
 For a supported remote application deployment, prefer the repository-distributed launcher:

package/assets/generated/core/core/skills/setup/SKILL.md

@@ -403,7 +403,24 @@ For fingerprint input, show the expected public form such as `SHA256:<fingerprin
 
 If a local key/agent operation requires a passphrase or another terminal-owned secret prompt, follow the interactive-terminal handoff contract: collect any distinct bounded authorization once, then immediately provide the exact standalone copyable command, correct machine/working directory, expected local prompt, and the non-secret completion evidence to report. Do not ask for the passphrase through chat or ask a second ceremonial question merely to repeat the same authorized command.
 
-If client-side evidence shows that the configured key reached the server but access is still rejected, stop reinstalling the same key. Route to a trusted target console or already-authorized administrative session to inspect effective account/source policy. Do not guess that `AllowUsers`, `AllowGroups`, PAM, or another server rule is the exact cause until server-side evidence establishes it.
+**SSH signing proof matters:** a preliminary `Server accepts key` message
+means the public key was eligible, **not** that local signing finished or the
+remote account rejected an authenticated user. If the selected agent is absent
+or signing is unproven (the fixed diagnostic code is `local-signing-unproven`),
+try the already-supported exact-target
+`target agent-session` in a trusted local terminal (only with the required
+bounded local authority), then retry the unchanged read-only check once.
+If client signature evidence exists but SSH is still rejected, report remote
+authentication failure without claiming a particular account policy. Inspect
+server account/source policy from a trusted console only when the evidence
+actually justifies that branch. Do not repeatedly reinstall a key, weaken
+trust, turn on password authentication or invent a server configuration fix.
+
+Use recognized installed v1 `diagnosticSummary` fields and the bounded
+continuation/no-progress policy in `core/process/INTERACTIVE_SESSION_GUIDE.md`
+when available; older Kit output remains an explicitly limited capability.
+Keep independent readiness evidence and do not reflect arbitrary exceptions
+or secret-bearing stderr to Chat.
 
 ### One bounded trusted-console diagnostic bundle
 

package/assets/generated/core/tools/setup_maintenance/maintenance.py

@@ -2,13 +2,18 @@
 """Project Forge catalog-bound workstation updates. Status/preview never mutate."""
 from __future__ import annotations
 import argparse
+from contextlib import ExitStack
 import datetime as dt
 import hashlib
 import json
+import os
 import re
+import secrets
 import shutil
+import stat
 import subprocess
 import sys
+import tempfile
 from pathlib import Path
 
 TOOL_ID = re.compile(r"^[a-z0-9][a-z0-9-]*$")
@@ -125,6 +130,160 @@ def make_plan(root: Path, selected: list[str]) -> dict:
     return {"plan": plan, "sha256": digest}
 
 
+def _marker_payload() -> str:
+    return json.dumps({"checkedAtUtc": dt.datetime.now(dt.timezone.utc).isoformat()}) + "\n"
+
+
+def _marker_read_value(handle) -> str | None:
+    value = json.load(handle)
+    if not isinstance(value, dict):
+        raise ValueError("expected object in setup maintenance marker")
+    return value.get("checkedAtUtc")
+
+
+def _posix_marker_check(root: Path, record: bool) -> str | None:
+    """Use directory handles and O_NOFOLLOW throughout: no path-based write races."""
+    flags = os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW
+    with ExitStack() as closing:
+        parent = os.open(root, flags)
+        closing.callback(os.close, parent)
+        for name in (".project-forge", "setup-maintenance"):
+            try:
+                child = os.open(name, flags, dir_fd=parent)
+            except FileNotFoundError:
+                if not record:
+                    return None
+                try:
+                    os.mkdir(name, 0o700, dir_fd=parent)
+                except FileExistsError:
+                    pass
+                try:
+                    child = os.open(name, flags, dir_fd=parent)
+                except OSError as error:
+                    raise ValueError(
+                        f"unsafe setup maintenance marker directory: {name} (symlink or non-directory)"
+                    ) from error
+            except OSError as error:
+                raise ValueError(
+                    f"unsafe setup maintenance marker directory: {name} (symlink or non-directory)"
+                ) from error
+            closing.callback(os.close, child)
+            parent = child
+
+        name = "last-check.json"
+        try:
+            info = os.stat(name, dir_fd=parent, follow_symlinks=False)
+        except FileNotFoundError:
+            info = None
+        if info is not None and not stat.S_ISREG(info.st_mode):
+            raise ValueError("unsafe setup maintenance marker file: symlink or non-regular file")
+
+        previous = None
+        if info is not None:
+            # Re-open through the pinned directory handle and check the final
+            # inode too, so a swapped symlink or special file cannot be read.
+            with os.fdopen(
+                os.open(name, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent),
+                "r", encoding="utf-8"
+            ) as handle:
+                if not stat.S_ISREG(os.fstat(handle.fileno()).st_mode):
+                    raise ValueError("unsafe setup maintenance marker file: non-regular file")
+                previous = _marker_read_value(handle)
+
+        if record:
+            # Atomic replacement instead of truncating the existing inode:
+            # neither a symlink nor a hard link can redirect the marker write.
+            temporary = f".last-check-{secrets.token_hex(12)}.tmp"
+            created = False
+            try:
+                fd = os.open(
+                    temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW,
+                    0o600, dir_fd=parent
+                )
+                created = True
+                with os.fdopen(fd, "w", encoding="utf-8") as handle:
+                    handle.write(_marker_payload())
+                    handle.flush()
+                    os.fsync(handle.fileno())
+                os.replace(temporary, name, src_dir_fd=parent, dst_dir_fd=parent)
+                created = False
+            finally:
+                if created:
+                    os.unlink(temporary, dir_fd=parent)
+        return previous
+
+
+def _windows_marker_component(path: Path, *, directory: bool) -> os.stat_result | None:
+    """Refuse symlinks, junctions and other Windows reparse points."""
+    try:
+        info = os.lstat(path)
+    except FileNotFoundError:
+        return None
+    if (
+        stat.S_ISLNK(info.st_mode)
+        or getattr(info, "st_file_attributes", 0)
+        & getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0x400)
+        or (directory and not stat.S_ISDIR(info.st_mode))
+        or (not directory and not stat.S_ISREG(info.st_mode))
+    ):
+        raise ValueError(f"unsafe setup maintenance marker path: symlink, reparse point or unexpected type at {path}")
+    return info
+
+
+def _windows_marker_check(root: Path, record: bool) -> str | None:
+    """Conservative native Windows checks with an atomic final-file replacement.
+
+    Native Windows Python has no POSIX dir_fd/O_NOFOLLOW operations. Check each
+    component for reparse points, retain its identity, and recheck before the
+    final atomic replace. Never use write_text() on the destination.
+    """
+    parent = root
+    identities = []
+    for name in (".project-forge", "setup-maintenance"):
+        parent = parent / name
+        info = _windows_marker_component(parent, directory=True)
+        if info is None:
+            if not record:
+                return None
+            try:
+                parent.mkdir(mode=0o700)
+            except FileExistsError:
+                pass
+            info = _windows_marker_component(parent, directory=True)
+            if info is None:
+                raise ValueError(f"unable to establish safe setup maintenance directory: {parent}")
+        identities.append((parent, info.st_dev, info.st_ino))
+
+    marker = parent / "last-check.json"
+    existing = _windows_marker_component(marker, directory=False)
+    previous = None
+    if existing is not None:
+        with marker.open("r", encoding="utf-8") as handle:
+            previous = _marker_read_value(handle)
+    if record:
+        fd, tmp = tempfile.mkstemp(prefix=".last-check-", suffix=".tmp", dir=parent)
+        try:
+            with os.fdopen(fd, "w", encoding="utf-8") as handle:
+                handle.write(_marker_payload())
+                handle.flush()
+                os.fsync(handle.fileno())
+            for directory, dev, ino in identities:
+                current = _windows_marker_component(directory, directory=True)
+                if current is None or (current.st_dev, current.st_ino) != (dev, ino):
+                    raise ValueError(f"unsafe setup maintenance directory changed before marker replacement: {directory}")
+            _windows_marker_component(marker, directory=False)
+            os.replace(tmp, marker)
+        finally:
+            if os.path.lexists(tmp):
+                os.unlink(tmp)
+    return previous
+
+
+def marker_check(root: Path, *, record: bool) -> str | None:
+    """Read and optionally store a check timestamp only in a safe checkout path."""
+    return _windows_marker_check(root, record) if os.name == "nt" else _posix_marker_check(root, record)
+
+
 def main() -> int:
     parser = argparse.ArgumentParser()
     parser.add_argument("action", choices=["status", "update"])
@@ -144,12 +303,9 @@ def main() -> int:
     try:
         if args.action == "status":
             result = {"platform": platform(), "tools": inventory(root)}
-            marker = root / ".project-forge/setup-maintenance/last-check.json"
-            if marker.is_file():
-                result["previousCheckUtc"] = load(marker).get("checkedAtUtc")
-            if args.record_check:
-                marker.parent.mkdir(parents=True, exist_ok=True)
-                marker.write_text(json.dumps({"checkedAtUtc": dt.datetime.now(dt.timezone.utc).isoformat()}) + "\n", encoding="utf-8")
+            previous = marker_check(root, record=args.record_check)
+            if previous is not None:
+                result["previousCheckUtc"] = previous
             print(json.dumps(result, indent=2))
             return 0
         result = make_plan(root, args.tool)

package/assets/generated/deployment/src/project_forge_deployment/box_platform.py

@@ -101,7 +101,7 @@ def _parse_status(output: str) -> dict[str, Any]:
 
 
 def _run_remote(profile: dict[str, Any], address: str, action: str, *, sudo: bool) -> str:
-    if action not in {"status", "install", "upgrade"}:
+    if action not in {"status", "install", "upgrade", "proxy-peer"}:
         raise DeploymentKitError(f"Unsupported host-platform action: {action}")
     remote_command = "bash -s -- " + shlex.quote(action)
     if sudo:
@@ -130,6 +130,36 @@ def platform_status(name: str) -> dict[str, Any]:
     return status
 
 
+def platform_proxy_peer(
+    name: str,
+    *,
+    configured_peer: str | None = None,
+    previous_container_id: str | None = None,
+    previous_network_id: str | None = None,
+) -> dict[str, Any]:
+    """Read current Caddy peer and produce a no-write app convergence decision.
+
+    This is NOT authority to update an application's trusted peer. That
+    requires its own verified plan, meaningful review and runtime write gate.
+    """
+    from .proxy_peer import assess_configured_peer, parse_peer_observation
+
+    profile = load_profile(name)
+    evidence = verify_access(profile)
+    observed = parse_peer_observation(
+        _run_remote(profile, evidence["address"], "proxy-peer", sudo=True)
+    )
+    plan = assess_configured_peer(
+        observed,
+        configured_peer,
+        previous_container_id=previous_container_id,
+        previous_network_id=previous_network_id,
+    )
+    plan["targetName"] = name
+    plan["mutated"] = False
+    return plan
+
+
 def platform_doctor(name: str) -> dict[str, Any]:
     status = platform_status(name)
     next_actions = {

package/assets/generated/deployment/src/project_forge_deployment/box_platform_remote.py

@@ -250,7 +250,31 @@ upgrade_platform() {
     rm -rf "$candidate_dir" "$backup_dir"
 }
 
+# PF-06: read the exact managed Caddy container/network identity.
+# Only selected fields are returned; no Config.Env, mounts or provider secrets.
+# This cannot make an application accept a changed proxy peer.
+proxy_peer_status() {
+    local id name state image network_id networks members
+    id="$(docker inspect --format '{{.Id}}' "$CADDY_CONTAINER" 2>/dev/null)" || {
+        echo "Managed proxy container is missing or unavailable." >&2; exit 31;
+    }
+    name="$(docker inspect --format '{{.Name}}' "$CADDY_CONTAINER" 2>/dev/null)" || exit 31
+    name="${name#/}"
+    state="$(docker inspect --format '{{.State.Status}}' "$CADDY_CONTAINER" 2>/dev/null)" || exit 31
+    image="$(docker inspect --format '{{.Config.Image}}' "$CADDY_CONTAINER" 2>/dev/null)" || exit 31
+    network_id="$(docker network inspect --format '{{.Id}}' "$NETWORK_NAME" 2>/dev/null)" || {
+        echo "Managed proxy network is missing or unavailable." >&2; exit 32;
+    }
+    networks="$(docker inspect --format '{{json .NetworkSettings.Networks}}' "$CADDY_CONTAINER" 2>/dev/null)" || exit 33
+    members="$(docker network inspect --format '{{json .Containers}}' "$NETWORK_NAME" 2>/dev/null)" || exit 33
+    printf 'containerId=%s\ncontainerName=%s\ncontainerState=%s\ncontainerImage=%s\nnetworkId=%s\nnetworks=%s\nmembers=%s\n' \
+        "$id" "$name" "$state" "$image" "$network_id" "$networks" "$members"
+}
+
 case "$ACTION" in
+    proxy-peer)
+        proxy_peer_status
+        ;;
     status)
         status
         ;;

package/assets/generated/deployment/src/project_forge_deployment/cli.py

@@ -12,6 +12,7 @@ from .box_platform import (
     apply_platform_change,
     plan_platform_change,
     platform_doctor,
+    platform_proxy_peer,
     platform_status,
 )
 from .doctor import target_doctor, workstation_doctor
@@ -340,6 +341,15 @@ def build_parser() -> argparse.ArgumentParser:
     )
     platform_doctor_parser.add_argument("name")
     platform_doctor_parser.add_argument("--json", action="store_true")
+    proxy_peer = platform_sub.add_parser(
+        "peer-inspect",
+        help="Read exact managed Caddy peer identity and review required application convergence",
+    )
+    proxy_peer.add_argument("name")
+    proxy_peer.add_argument("--configured-peer", help="Exact peer IP currently trusted by this application")
+    proxy_peer.add_argument("--previous-container-id", help="Previously reviewed Caddy container ID")
+    proxy_peer.add_argument("--previous-network-id", help="Previously reviewed Docker network ID")
+    proxy_peer.add_argument("--json", action="store_true")
     for command in ("install", "upgrade"):
         change = platform_sub.add_parser(
             command,
@@ -486,6 +496,17 @@ def main(argv: list[str] | None = None) -> int:
         if args.group == "platform" and args.command == "doctor":
             _print(platform_doctor(args.name), as_json=args.json)
             return 0
+        if args.group == "platform" and args.command == "peer-inspect":
+            _print(
+                platform_proxy_peer(
+                    args.name,
+                    configured_peer=args.configured_peer,
+                    previous_container_id=args.previous_container_id,
+                    previous_network_id=args.previous_network_id,
+                ),
+                as_json=args.json,
+            )
+            return 0
         if args.group == "platform" and args.command in {"install", "upgrade"}:
             return _platform_change(args)
         raise DeploymentKitError("Unsupported command.")

package/assets/generated/deployment/src/project_forge_deployment/environment_setup.py

@@ -15,6 +15,7 @@ from .environment_probe import plan_environment_proof
 from .errors import DeploymentKitError
 from .profiles import load_profile
 from .proof_receipt import load_environment_proof_receipt
+from .safe_diagnostics import project_setup_summary
 from .ssh import diagnose_access
 
 
@@ -126,6 +127,21 @@ def _access_recovery(status: dict[str, Any]) -> dict[str, Any]:
                 "Do not reinstall keys repeatedly, enable password SSH, widen AllowUsers, or weaken host verification implicitly."
             ),
         }
+    if category == "local-signing-unproven":
+        return {
+            "kind": "local-prerequisite",
+            "action": "use-existing-target-agent-session",
+            "command": (
+                f"project-forge-deploy target agent-session {target} "
+                f"-- environment setup status {target} --json"
+            ),
+            "reason": detail.get("guidance"),
+            "safety": (
+                "Prepare the configured local signer using the existing supported "
+                "agent-session helper in a trusted interactive terminal. "
+                "No remote SSH policy change, new key or trust alteration is authorized."
+            ),
+        }
     if category == "local-signing-failed":
         return {
             "kind": "local-repair",
@@ -362,8 +378,12 @@ def remote_setup_plan(
             "previousProof": receipt,
         }
 
-    return {
+    result = {
         **status,
         "next": next_action,
         "mutated": False,
     }
+    # Additive safe, bounded, versioned projection. Retain the full evidence
+    # in its existing owner; never echo arbitrary remote stderr to summaries.
+    result["diagnosticSummary"] = project_setup_summary(result)
+    return result

package/assets/generated/deployment/src/project_forge_deployment/proxy_peer.py

@@ -0,0 +1,168 @@
+"""Read-only exact Caddy peer observation and reconciliation proposal (PF-06).
+
+No Docker/network/provider writes, no configuration mutation, no trust bypass.
+A completed observation is an input to a separately reviewed application
+convergence plan, never automatic authorization to rewrite trusted peer IPs.
+"""
+
+from __future__ import annotations
+
+import ipaddress
+import json
+import re
+from typing import Any
+
+from .box_platform_assets import CADDY_CONTAINER, CADDY_IMAGE, NETWORK_NAME
+from .errors import DeploymentKitError
+
+_SCHEMA_VERSION = 1
+_HEX_ID = re.compile(r"[0-9a-f]{64}")
+_KEYS = frozenset({
+    "containerId", "containerName", "containerState", "containerImage",
+    "networkId", "networks", "members",
+})
+_MAX_BYTES = 65536
+
+
+def _require_exact_ip(raw: Any) -> str:
+    if not isinstance(raw, str):
+        raise DeploymentKitError("Managed proxy address is not an IPv4 string.")
+    try:
+        address = ipaddress.IPv4Address(raw)
+    except ipaddress.AddressValueError as error:
+        raise DeploymentKitError("Managed proxy address is invalid.") from error
+    if not address.is_private or address.is_unspecified or address.is_loopback or address.is_multicast or address.is_link_local:
+        raise DeploymentKitError("Managed proxy address is not a suitable private-network peer.")
+    return str(address)
+
+
+def parse_peer_observation(stdout: str) -> dict[str, Any]:
+    """Validate an allowlisted remote observation without propagating raw output."""
+    if not isinstance(stdout, str) or len(stdout.encode("utf-8")) > _MAX_BYTES:
+        raise DeploymentKitError("Managed proxy observation exceeds the bounded read-only format.")
+    fields: dict[str, str] = {}
+    for line in stdout.splitlines():
+        if "=" not in line:
+            raise DeploymentKitError("Malformed managed proxy observation.")
+        name, value = line.split("=", 1)
+        if name not in _KEYS or name in fields or not value:
+            raise DeploymentKitError("Unexpected or duplicate managed proxy observation field.")
+        fields[name] = value
+    if set(fields) != _KEYS:
+        raise DeploymentKitError("Managed proxy observation is incomplete.")
+
+    container_id, network_id = fields["containerId"], fields["networkId"]
+    if not _HEX_ID.fullmatch(container_id) or not _HEX_ID.fullmatch(network_id):
+        raise DeploymentKitError("Managed proxy identity is not an exact full Docker identifier.")
+    if fields["containerName"] != CADDY_CONTAINER or fields["containerState"] != "running":
+        raise DeploymentKitError("Expected managed proxy container is not running.")
+    if fields["containerImage"] != CADDY_IMAGE:
+        raise DeploymentKitError("Managed proxy image differs from the pinned Kit image.")
+    try:
+        networks = json.loads(fields["networks"])
+        members = json.loads(fields["members"])
+    except json.JSONDecodeError as error:
+        raise DeploymentKitError("Managed proxy Docker network observation is malformed.") from error
+    if not isinstance(networks, dict) or set(networks) != {NETWORK_NAME}:
+        raise DeploymentKitError("Managed proxy has an unexpected network attachment.")
+    net = networks[NETWORK_NAME]
+    if not isinstance(net, dict) or net.get("NetworkID") != network_id:
+        raise DeploymentKitError("Managed proxy network identity mismatch.")
+    address = _require_exact_ip(net.get("IPAddress"))
+    if not isinstance(members, dict) or container_id not in members:
+        raise DeploymentKitError("Managed proxy is missing from the named network member registry.")
+    member = members[container_id]
+    if not isinstance(member, dict) or member.get("Name") != CADDY_CONTAINER:
+        raise DeploymentKitError("Managed proxy membership does not match its exact identity.")
+    cidr = member.get("IPv4Address")
+    if not isinstance(cidr, str) or cidr.split("/", 1)[0] != address:
+        raise DeploymentKitError("Managed proxy IP disagrees with Docker network membership.")
+    # The network may contain unrelated application peers. Do not trust the
+    # entire network, require its exclusivity, or grant those peers authority.
+    for other_id, other in members.items():
+        if not isinstance(other_id, str) or not _HEX_ID.fullmatch(other_id):
+            raise DeploymentKitError("Managed network member identity is malformed.")
+        if not isinstance(other, dict):
+            raise DeploymentKitError("Managed network member record is malformed.")
+        other_ip = other.get("IPv4Address")
+        if not isinstance(other_ip, str):
+            raise DeploymentKitError("Managed network member address is malformed.")
+        if other_id != container_id and other_ip.split("/", 1)[0] == address:
+            raise DeploymentKitError("Managed proxy address conflicts with another network member.")
+    return {
+        "schemaVersion": _SCHEMA_VERSION,
+        "containerName": CADDY_CONTAINER,
+        "containerId": container_id,
+        "containerImage": CADDY_IMAGE,
+        "networkName": NETWORK_NAME,
+        "networkId": network_id,
+        "peerIp": address,
+        "verifiedBy": "read-only-docker-observation",
+        "mutated": False,
+    }
+
+
+def assess_configured_peer(
+    observation: dict[str, Any],
+    configured_peer: str | None,
+    *,
+    previous_container_id: str | None = None,
+    previous_network_id: str | None = None,
+) -> dict[str, Any]:
+    """Produce a no-write convergence decision requiring separate review."""
+    if not isinstance(observation, dict) or observation.get("schemaVersion") != _SCHEMA_VERSION:
+        raise DeploymentKitError("Managed proxy observation schema is unsupported.")
+    required = {
+        "schemaVersion", "containerName", "containerId", "containerImage",
+        "networkName", "networkId", "peerIp", "verifiedBy", "mutated",
+    }
+    if set(observation) != required or observation.get("mutated") is not False or (
+        observation.get("verifiedBy") != "read-only-docker-observation"
+    ):
+        raise DeploymentKitError("Untrusted managed proxy observation.")
+    for id_value in (observation["containerId"], observation["networkId"]):
+        if not isinstance(id_value, str) or not _HEX_ID.fullmatch(id_value):
+            raise DeploymentKitError("Managed proxy observation lacks exact identity.")
+    observed = _require_exact_ip(observation["peerIp"])
+    if (observation["containerName"] != CADDY_CONTAINER or
+        observation["containerImage"] != CADDY_IMAGE or
+        observation["networkName"] != NETWORK_NAME):
+        raise DeploymentKitError("Managed proxy observation is for a different owned component.")
+
+    if configured_peer is not None:
+        configured_peer = _require_exact_ip(configured_peer)
+    for prior in (previous_container_id, previous_network_id):
+        if prior is not None and (not isinstance(prior, str) or not _HEX_ID.fullmatch(prior)):
+            raise DeploymentKitError("Prior peer identity must be the exact reviewed Docker ID.")
+    changed = (
+        (configured_peer is not None and configured_peer != observed) or
+        (previous_container_id is not None and previous_container_id != observation["containerId"]) or
+        (previous_network_id is not None and previous_network_id != observation["networkId"])
+    )
+    state = (
+        "requires-reviewed-convergence" if changed
+        else "needs-explicit-initial-binding" if configured_peer is None
+        else "needs-reviewed-identity-baseline" if (
+            previous_container_id is None or previous_network_id is None
+        )
+        else "observed-match"
+    )
+    return {
+        **observation,
+        "state": state,
+        "configuredPeerIp": configured_peer,
+        "nextAction": (
+            "review-peer-and-application-configuration" if changed
+            else "review-initial-peer-binding" if configured_peer is None
+            else "record-reviewed-peer-identities" if state == "needs-reviewed-identity-baseline"
+            else "retain-reviewed-peer-binding"
+        ),
+        "requiresAuthorization": state != "observed-match",
+        "doesNotProve": [
+            "application trust middleware enforcement",
+            "live public-origin request contract",
+            "exclusive Docker network ownership",
+            "future Docker address stability",
+        ],
+        "mutated": False,
+    }

package/assets/generated/deployment/src/project_forge_deployment/safe_diagnostics.py

@@ -0,0 +1,172 @@
+"""Small, fixed-field, secret-free diagnostic summaries for exact-target setup.
+
+This is an additive v1 projection. Full reviewed plans and evidence stay in
+their canonical storage. Never reflect arbitrary stderr, provider responses,
+host exception text, paths, URLs or untrusted string fields into this summary.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+import json
+import re
+from typing import Any
+
+DIAGNOSTIC_SCHEMA = 1
+CAPABILITY = "remote-environment-setup"
+CAPABILITY_VERSION = 1
+SUMMARY_MAX_BYTES = 8192
+
+_PHASES = (
+    "workspace",
+    "targetDefinition",
+    "targetAccess",
+    "hostPlatform",
+    "deploymentPath",
+    "application",
+)
+_ALLOWED_CODES = frozenset({
+    "missing-identity",
+    "missing-trust",
+    "local-security-or-trust-invalid",
+    "name-resolution-failed",
+    "transport-failed",
+    "host-identity-rejected",
+    "local-signing-failed",
+    "local-signing-unproven",
+    "remote-authentication-rejected",
+    "remote-account-policy-rejected",  # legacy consumers; not inferred from key offer
+    "authentication-rejected",
+    "ssh-verification-failed",
+    "unclassified-failure",
+})
+_ALLOWED_ACTIONS = frozenset({
+    "remote-environment-ready",
+    "configure-target-profile",
+    "create-or-select-key",
+    "verify-and-enroll-host-trust",
+    "set-verified-address",
+    "repair-target-profile",
+    "inspect-remote-account-access-policy",
+    "repair-local-key-signing",
+    "use-existing-target-agent-session",
+    "reverify-host-identity",
+    "repair-target-address-or-network-path",
+    "diagnose-target-access",
+    "install-host-platform",
+    "upgrade-host-platform",
+    "inspect-host-platform",
+    "plan-deployment-path-proof",
+    "review-deployment-path-proof",
+    "resolve-environment-isolation-collision",
+})
+_ACTION_KIND = frozenset({
+    "complete",
+    "read-only",
+    "local-prerequisite",
+    "local-repair",
+    "operator-action-required",
+    "human-verification",
+    "missing-facts",
+    "blocked",
+    "write-gated",
+    "proof-context-required",
+})
+
+
+def _safe_target(value: object) -> str:
+    # A selected local *logical name* only; never include hostnames, IPs,
+    # filesystem paths, URLs or provider identifiers by default.
+    if (not isinstance(value, str) or "." in value or
+            re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_-]{0,63}", value) is None):
+        return "unknown-target"
+    return value
+
+
+def _dimension_state(value: str) -> str:
+    if value in {"ready", "proven"}:
+        return "proved"
+    if value in {"not-proven", "not-part-of-setup"}:
+        return "notChecked"
+    if value.startswith("blocked") or value == "needs-profile":
+        return "blocked"
+    return "failed"
+
+
+def project_setup_summary(
+    result: dict[str, Any], *, observed_at: datetime | None = None
+) -> dict[str, Any]:
+    """Return an allowlisted, byte-bounded projection of remote setup evidence.
+
+    Unknown states or reasons must not be reported as success. No arbitrary
+    nested data, messages or paths are copied from the untrusted input.
+    """
+    stamp = observed_at if observed_at is not None else datetime.now(timezone.utc)
+    if stamp.tzinfo is None or stamp.utcoffset() is None:
+        raise ValueError("Observed time must include a timezone.")
+    phases = result.get("phases")
+    if not isinstance(phases, dict):
+        phases = {}
+    dimensions: dict[str, list[str]] = {
+        "proved": [], "failed": [], "blocked": [], "notChecked": []
+    }
+    for key in _PHASES:
+        phase = phases.get(key)
+        state = phase.get("state") if isinstance(phase, dict) else None
+        category = _dimension_state(state) if isinstance(state, str) else "notChecked"
+        dimensions[category].append(key)
+
+    next_action = result.get("next")
+    if not isinstance(next_action, dict):
+        next_action = {}
+    action = next_action.get("action")
+    action = action if isinstance(action, str) and action in _ALLOWED_ACTIONS else "unclassified-failure"
+    kind = next_action.get("kind")
+    kind = kind if isinstance(kind, str) and kind in _ACTION_KIND else "blocked"
+    # A malformed/mixed producer cannot turn failed or missing prerequisite
+    # observations into a success-shaped summary. Application is intentionally
+    # not part of foundational environment proof.
+    if action == "remote-environment-ready" and any(
+        key not in dimensions["proved"] for key in _PHASES[:-1]
+    ):
+        action = "unclassified-failure"
+        kind = "blocked"
+    elif action == "unclassified-failure":
+        kind = "blocked"
+    target_access = phases.get("targetAccess", {})
+    detail = target_access.get("detail") if isinstance(target_access, dict) else None
+    failure_code = detail.get("failureCategory") if isinstance(detail, dict) else None
+    reason_code = failure_code if isinstance(failure_code, str) and failure_code in _ALLOWED_CODES else action
+    phase = result.get("currentPhase")
+    phase = phase if isinstance(phase, str) and phase in _PHASES else "unknown"
+    # Caller-reported mutation cannot be silently represented as read-only.
+    # This shape is not an authorization token or operation receipt.
+    mutated = result.get("mutated")
+    mutation = "none" if mutated is False else "unknown" if mutated is None else "occurred"
+
+    summary = {
+        "schemaVersion": DIAGNOSTIC_SCHEMA,
+        "capability": CAPABILITY,
+        "capabilityVersion": CAPABILITY_VERSION,
+        "target": _safe_target(result.get("targetName")),
+        "observedAt": stamp.astimezone(timezone.utc).isoformat().replace("+00:00", "Z"),
+        "phase": phase,
+        "reasonCode": reason_code,
+        "dimensions": dimensions,
+        "mutation": mutation,
+        "nextAction": {
+            "code": action,
+            "kind": kind,
+            "consequence": (
+                "write-approval-required" if kind == "write-gated"
+                else "human-verification-required" if kind in {"human-verification", "operator-action-required"}
+                else "no-mutation"
+            ),
+        },
+        "evidenceRef": None,
+    }
+    serialized = json.dumps(summary, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    if len(serialized) > SUMMARY_MAX_BYTES:
+        # Never truncate failed/blocked dimensions to meet the bound.
+        raise ValueError("Diagnostic summary exceeded the fixed v1 bound.")
+    return summary

package/assets/generated/deployment/src/project_forge_deployment/ssh.py

@@ -10,7 +10,7 @@ from pathlib import Path
 from typing import Any
 
 from .errors import DeploymentKitError
-from .keys import key_fingerprint
+from .keys import agent_status, key_fingerprint
 from .security import check_ssh_material_security, validate_target_trust_file
 
 
@@ -195,7 +195,19 @@ def _tcp_probe(profile: dict[str, Any], address: str) -> dict[str, Any]:
         }
 
 
-def _classify_failure(text: str, *, auth: dict[str, Any], offered: bool, accepted: bool) -> str:
+def _classify_failure(
+    text: str,
+    *,
+    auth: dict[str, Any],
+    offered: bool,
+    accepted: bool,
+    signer_loaded: bool | None = None,
+) -> str:
+    """Classify only what the SSH evidence proves.
+
+    ``Server accepts key`` is a preliminary public-key handshake, not
+    proof of client signing or of a completed authenticated session.
+    """
     lower = text.lower()
     if "remote host identification has changed" in lower or "host key verification failed" in lower:
         return "host-identity-rejected"
@@ -213,9 +225,21 @@ def _classify_failure(text: str, *, auth: dict[str, Any], offered: bool, accepte
         return "transport-failed"
     if "permission denied" in lower:
         if accepted:
-            return "remote-account-policy-rejected"
-        if offered or auth.get("publicKeySupported"):
+            # No signer proof means neither a remote account-policy refusal
+            # nor a verified credential rejection can be asserted.
+            if "sign_and_send_pubkey: signing using" in lower:
+                # A signer (agent or directly usable key) did sign, but
+                # the remote side still refused authentication.
+                return "remote-authentication-rejected"
+            # Merely observing a loaded agent is not proof that this key signed.
+            return "local-signing-unproven"
+        if offered:
+            # The server has enough evidence to refuse the offered key.
             return "remote-authentication-rejected"
+        if auth.get("publicKeySupported") and signer_loaded is False:
+            # A publickey-capable server does not establish that this
+            # workstation could offer/sign the configured identity.
+            return "local-signing-unproven"
         return "authentication-rejected"
     return "ssh-verification-failed"
 
@@ -266,6 +290,7 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
         }
 
     fingerprint = key_fingerprint(identity)
+    local_signer: dict[str, Any] = {"state": "not-checked", "loaded": False}
     attempts: list[dict[str, Any]] = []
     for address in addresses:
         tcp = _tcp_probe(profile, address)
@@ -273,6 +298,19 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
             attempts.append({"address": address, "tcp": tcp, "state": "transport-failed"})
             continue
 
+        # Only examine the local agent when transport actually reached the
+        # selected target. This remains a read-only observation: do not start
+        # an agent, request a passphrase, or alter SSH trust during diagnosis.
+        if local_signer["state"] == "not-checked":
+            try:
+                agent = agent_status(profile)
+                local_signer = {
+                    "state": agent["state"],
+                    "loaded": agent["loaded"],
+                }
+            except (DeploymentKitError, OSError, KeyError):
+                local_signer = {"state": "not-verified", "loaded": False}
+
         auth = probe_authentication_methods(profile, address)
         result = _completed(ssh_args(profile, address, verbose=True))
         text = "\n".join(part for part in (result.stderr, result.stdout) if part)
@@ -284,6 +322,7 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
                 "state": "verified",
                 "address": address,
                 "identityFingerprint": fingerprint,
+                "localSigner": local_signer,
                 "authentication": auth,
                 "offeredConfiguredIdentity": offered,
                 "serverAcceptedConfiguredIdentity": accepted,
@@ -296,6 +335,7 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
                 "tcp": tcp,
                 "authentication": auth,
                 "identityFingerprint": fingerprint,
+                "localSigner": local_signer,
                 "offeredConfiguredIdentity": offered,
                 "serverAcceptedConfiguredIdentity": accepted,
                 "returnCode": result.returncode,
@@ -304,6 +344,7 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
                     auth=auth,
                     offered=offered,
                     accepted=accepted,
+                    signer_loaded=local_signer["loaded"],
                 ),
             }
         )
@@ -312,6 +353,7 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
     for candidate in (
         "host-identity-rejected",
         "local-signing-failed",
+        "local-signing-unproven",
         "remote-account-policy-rejected",
         "remote-authentication-rejected",
         "authentication-rejected",
@@ -325,6 +367,11 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
         "transport-failed": "Verify the configured address/port and network path; do not scan or silently switch targets.",
         "host-identity-rejected": "Re-verify host identity independently before any trust rotation.",
         "local-signing-failed": "Repair local key/passphrase/agent use; do not weaken remote authentication policy.",
+        "local-signing-unproven": (
+            "The server accepted a public key offer, but completed client signing "
+            "was not established. Reuse the exact target's supported local SSH agent-session "
+            "before investigating remote account policy. Do not weaken host trust."
+        ),
         "remote-authentication-rejected": (
             "The configured public-key path reached the server but authentication was rejected. "
             "Verify authorized_keys and remote account/source access policy from a trusted console or already-authorized session."
@@ -342,6 +389,7 @@ def diagnose_access(profile: dict[str, Any]) -> dict[str, Any]:
         "state": "failed",
         "failureCategory": category,
         "identityFingerprint": fingerprint,
+        "localSigner": local_signer,
         "attempts": attempts,
         "guidance": guidance,
         "mutated": False,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.25.0",
+  "version": "4.26.1",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {