security(ssh): require AgentKey proof-of-possession before SSH ingress

[hartsock]

Problem

The v1 SSH subprocess carriage in #77 authenticates an OpenSSH principal and encrypts bytes, but it cannot expose SSH session material that cryptographically binds that principal to the AgentKey signing an agent-mesh envelope. SignedEnvelope::verify() proves envelope integrity and signer authenticity; it does not prove that the current carrier owns that signer identity.

#81 makes authenticated delivery provenance mandatory at the shared Transport / Inbound seam. An SSH ingress must not produce that provenance from a valid envelope alone.

Scope

• Define a fresh challenge signed by the connecting AgentKey.
• Bind the challenge transcript to the intended hub and connection/session, with replay protection and deterministic expiry/cancellation behavior.
• Validate the presented certificate chain and same-user/trust-root policy through fix(bus): require authenticated delivery provenance #81's common admission contract.
• Produce authenticated delivery provenance only after successful proof-of-possession.
• Integrate the established docks.d first-contact, pinning, revocation, and live-session teardown ceremony; do not add TOFU.
• Add hostile relay evidence proving carrier A cannot deliver signer B as B.

Acceptance

• A captured Hello or envelope cannot satisfy the fresh challenge.
• A valid signed envelope without the matching AgentKey proof cannot dispatch.
• Challenges are bound to the intended hub/session and cannot be replayed across hubs or sessions.
• Same-user/trust-root admission flows through fix(bus): require authenticated delivery provenance #81's Inbound provenance seam.
• Revocation prevents new admission and tears down affected live sessions per the established ceremony.
• Real-boundary hostile tests prove carrier/signer mismatch rejection.
• just check and just cov-ci pass.

Out of scope

• Replacing the system OpenSSH client with an in-process SSH stack unless it exposes equivalent authenticated session material without weakening the common contract.
• Authorization based on SignedEnvelope::verify() alone.

Related

• feat(transport): authenticate SSH-carried mesh sessions #77 — v1 SSH carriage primitive; intentionally no production ingress
• security(bus): make authenticated peer provenance mandatory at the Transport/Inbound seam #79 / fix(bus): require authenticated delivery provenance #81 — authenticated delivery provenance contract
• spike(transport): russh dual-role SSH proxy round-trip — operator → airship bastion → newt embedded sshd (cert auth both hops, no-PTY subsystem) #49 — broader dual-role SSH proxy spike