[abruption]

Summary

Operators cannot currently select a separately reviewed SSH configuration when the default configuration is unsuitable. Add --ssh-config ABS_PATH --trust-ssh-config for explicit list, send, doctor, and update --host invocations, without changing default profiles or relaxing the --ssh-opt allowlist.

The paired flags explicitly authorize local configuration commands, including Match exec during ssh -G and dry-run. One invocation-local selection is checked before advisory work or message input and revalidated before every forward SSH subprocess: user/identity metadata, ordinary and bounded handoff dispatch, version probes and remote update verification. Reverse doctor checks retain their own machine's configuration. No selected path is forwarded to a remote command, reply URI or public JSON diagnostic.

• POSIX selection requires a bounded, current-user-owned regular file, protected ancestors, no symlinks/hardlinks, and verified ACL/ownership enforcement. Changed file identity/content refuses subsequent execution without fallback. This is not an immutable snapshot of the file, Includes, executable dependencies, or same-user concurrent changes.
• Selected mode forces strict host-key checking, no key updates/agent forwarding/local-command hook/multiplexing, and batch mode. Explicit host-key pinning retains priority.
• Windows, setup, paired-device, Reply-To and preset combinations are rejected; MCP and environment variables cannot select the file. Opt-out commands retain their existing argv and behavior.
• Preserve complete send evidence and committed update facts when later metadata/verification fails. Configuration setup is charged to the original handoff budget.
• Update four CLI-reference locales and regenerate the standalone runtime.

Refs #312. No release, installation, credentials, known-hosts enrollment or operational configuration changes are included.

Validation

• Python 3.9.6: 45 selected-config and SSH-security tests pass (one Linux-native test skipped on macOS).
• Python 3.13.7: 71 selected-config and handoff/source-streaming tests pass (one skip), with development mode and ResourceWarning-as-error.
• Final complete suite: 1,358 tests pass (20 skipped) on Python 3.13.7 with optional extras, development mode and ResourceWarning-as-error. Generated standalone, four-language manifest and diff checks pass. One Relay asyncio teardown warning was logged during that run; a separate 236-test Relay run passed without reproducing it. Its cause has not been attributed to this change.
• Storage and wiring were independently reviewed by subagents that did not implement them. The full-suite source-streaming failure discovered during validation was reproduced on Python 3.13 and fixed by replacing dataclass module-registration dependence with a plain immutable selection object.
• Tests cover unsafe selection before subprocess/stdin/advisory work, every forward SSH constructor, invocation/reverse-probe isolation, file changes, strict/pinned option ordering, redacted errors and known send/list/update facts.
• Linux CI includes a real ssh -G parse of an owned temporary configuration without a connection, hooks or credentials. Mac acceptance fixtures on the external volume normalize only stated fixture metadata; separate native descriptor coverage verifies that an ignore-ownership volume is refused.
• All 28 checks pass at 21553ccfaf759ef522580b775944decb716cddb2. The automatic cleanup finding was reproduced, fixed and its thread resolved; the added regression verifies directory closure after a file-close failure. CodeQL passes without alert dismissals or rule suppression.

Limits

No authenticated live SSH destination or the original restricted namespace was tested. Transitive Includes and configuration commands remain operator-trusted; ownership checks are not human authorization or a sandbox. Detected changes fail closed, but same-user path reopening races are not eliminated. Existing independent settings and installed runtimes remain untouched.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T11:04:57.109064Z	9e0a1c9	PR opened
🔒 Security Review	✅ Completed 2026-10-22T11:02:03.345687Z	9e0a1c9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9e0a1c9490

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[abruption]

Current-main integration and test-maintenance follow-up

Normal sequential-merge authorization is in effect; no admin/protection bypass is used. #329 merged as e64835e961cd2f82a847cfb4e444130d68dc6d95. This branch incorporates that main normally. Documentation conflicts were resolved to the byte-identical previously checked integration stage; standalone regeneration and 65 documentation tests passed.

Both the first post-merge main CI 39902038002 and this PR's first integrated CI 39902108480 failed two macOS/Python 3.13 watch positive controls. Successful first snapshots were followed by output_unavailable at the end-frame cutoff. The underlying OS scheduling/IPC cause is not established, and local execution of the original two cases passed. The fixed 100 ms finishing reserve includes a 25 ms reap allowance; a strict success assumption after scheduling delay exceeds the remaining write window is not part of the documented contract.

Commit f29877f changes tests only:

• Real TTY/nonblocking descriptor positives now verify bounded actual writer delivery, exact valid snapshot/end frames, unchanged inherited flags and helper reaping without depending on the last 75 ms of a wall-clock watch.
• A controlled 61-sample command test still uses the real command, clock and helper and requires exit 0, complete frames and cleanup; only sample pacing is mocked.
• Deterministic additive-delay cases cover both final-write cutoff before the total deadline and total expiry. They require exit 1, exactly one failed end attempt, no additional history read, no late frame and unchanged history.
• Bounded accumulated reads handle partial OS reads; cleanup does not convert a missed production deadline into success.

No runtime source, deadline, production assertion, security check or expected refusal is weakened. Focused Python 3.9 and 3.13 watch suites pass (35 each); combined watch/CLI/status tests pass (62). Generator/diff checks pass. New exact-head CI is still required before merge; failed historical runs are retained.

Independent noninteractive CLI review: Claude Code 2.1.308 / confirmed claude-opus-5-5, and Codex CLI 0.163.0 / isolated default actual model unexposed. Same immutable input SHA-256 95088c2e7ef85f4a2292377fcc680afe5a0d098531e718a694e1c2b086bd4ca3, both exit 0, hash unchanged, Codex completed with zero command executions. Neither found a required correction. Verified recommendations were subsequently added and regression-tested by Codex; the CLIs did not re-review an identical final tree. This is static review and offline tests, not live agent/ACK or OS-cause proof.