rdmbair15m5-changelog-20260823-0420-inbound-ssh-and-agent-alignment

Repaired the one missing direct inbound SSH authorization on jdmbair13m5, verified the sixth Mac's bidirectional richh SSH paths, reconciled the canonical fleet document without losing newer peer edits, and aligned the managed Claude/Codex/Gemini fleet pointer across all six Macs.

Scope

• Session host: rdmbair15m5 (richh), America/New_York.
• SSH target: jdmbair13m5 (richh, UID 502 by design).
• Fleet peers verified: rdmsm4x, rdmbair13m5, rdmbair15m5, rdmpw3265m, and rdmpw3275m.
• Canonical documentation host: rdmsm4x.
• No private key, password, credential, provider auth store, cookie, native task/session/history database, account/UID/Secure Token, SSH access group, Remote Login setting, Tailscale setting, firewall rule, or live Git checkout was changed or copied.

Root cause

Port 22, Remote Login, LAN/Tailscale routing, and the pinned jdmbair13m5 server host key were healthy. Direct ssh -vv from rdmbair15m5 offered ED25519 fingerprint SHA256:JGCIHmjOi+WDA5hSe/hXRz5a9Azawgv7HkRWKw2EIyM, but jdmbair13m5 rejected it. The target's /Users/richh/.ssh/authorized_keys had five entries and was missing exactly that public key.

The earlier catch-up evidence had counted six keys on rdmbair15m5 itself; it did not prove that jdmbair13m5 authorized rdmbair15m5. The direct source-to-target probe exposed the distinction.

Changes

SSH authorization

• Added only the missing rdmbair15m5 ED25519 public key to jdmbair13m5:/Users/richh/.ssh/authorized_keys after pinning:
  • target server fingerprint: SHA256:OXqHs7H9D9EPqHjZSjAiTimSYJ/k+NTx9fuVPMOYKoM
  • incoming client fingerprint: SHA256:JGCIHmjOi+WDA5hSe/hXRz5a9Azawgv7HkRWKw2EIyM
• Key count changed from 5 to 6.
• Ownership and mode remain richh:staff and 0600.
• Pre-change backup: jdmbair13m5:/Users/richh/.ssh/backups/inbound-ssh-20260823-035406/authorized_keys.pre.
• Pre-change SHA-256: fb0232e7aeaf2d663be763851c0fccff9b59080ee31f998eff280afd5c33af05.
• Post-change SHA-256: 982e91a2642091568fd1b2928ae575deebd858589b3ba774ddf9f06d2f3ab233.

Canonical onboarding records on rdmsm4x

• Updated /Users/richh/dev/fleet/hosts/jdmbair13m5-onboarding/ISSUES.md.
  • Current SHA-256: 1a1d0c2587d9600418d7ec4533e840a5286886f4d206796b387d0a76c4d924fd.
  • Backup: ISSUES.md.bak.20260823-0401-inbound-ssh.
• Updated /Users/richh/dev/fleet/hosts/jdmbair13m5-onboarding/SESSION-STATE.md.
  • Current SHA-256: 6a34062c58c78b222256d64007612216dd25f4f72d1058a23b628ae65e060608.
  • Backup: SESSION-STATE.md.bak.20260823-0401-inbound-ssh.
• Closed the stale DNS propagation issue after both the local resolver and Cloudflare 1.1.1.1 returned A record 100.86.185.90; the separate AAAA parity question remains open.

Canonical fleet and project records on rdmsm4x

• Updated /Users/richh/dev/fleet/maintenance/FLEET.md to a provenance-preserving superset.
  • Final SHA-256: 0204fdb271f8e20e510391ab8e0eb2a94396bce5081024a39fcab6df922b7f4b.
  • Original canonical backup: FLEET.md.bak.20260823-0412-inbound-ssh (SHA-256 ff50164359f29939b44ae959b125168c46292fec8241e0a2f0b5edd7272447f4).
  • Intermediate pre-superset backup: FLEET.md.bak.20260823-0415-pre-superset (SHA-256 f56e3e381e0679e3dd717130b2acedad0748f271066e9453026198f1ab95b0c5).
  • Reconciled newer distributed hash e21e18f44923464c1cfe6b19a1ebb5b3e27dfb334570be84718db8d2819799e3, preserving its corrected Claude-project-memory path and sixth-host Antigravity row.
• Updated /Users/richh/dev/fleet/maintenance/FLEET-POINTER.md.
  • Current SHA-256: 5034a2f7449f7fd7b5e8b23014062cdf1f562b96c963e9618caf38155e9b4570.
  • Backup: FLEET-POINTER.md.bak.20260823-0417-inbound-ssh (SHA-256 9770d7d96374fc2f0dc1aad99a659a07c71a9e4a6b4254b9b422f575adac6524).
• Updated /Users/richh/Library/Mobile Documents/com~apple~CloudDocs/Codex/projects/AGENTS.md principles/PROJECTS.md.
  • Current SHA-256: feecdf339bcd8d519e7fc6c2cded9c286ee47c3b4d6e120ddf339726da44bc1a.
  • Backup: PROJECTS.md.bak.20260823-0412-inbound-ssh.

Six-host distribution

• Ran the maintained canonical script /Users/richh/dev/fleet/maintenance/scripts/sync_fleet_knowledge.zsh from rdmsm4x, first with --dry-run, then applied, then reran for idempotence.
• /Users/richh/.agent-coordination/FLEET.md now has SHA-256 0204fdb271f8e20e510391ab8e0eb2a94396bce5081024a39fcab6df922b7f4b on all six Macs.
• Each host has /Users/richh/.agent-coordination/FLEET.md.bak.20260823-0412-inbound-ssh preserving its exact prior variant:
  • rdmsm4x, rdmbair13m5, rdmbair15m5, rdmpw3265m: SHA-256 e21e18f44923464c1cfe6b19a1ebb5b3e27dfb334570be84718db8d2819799e3.
  • rdmpw3275m, jdmbair13m5: SHA-256 ff50164359f29939b44ae959b125168c46292fec8241e0a2f0b5edd7272447f4.
• Updated only the delimited mac-fleet-knowledge managed block in all six copies of:
  • /Users/richh/.claude/CLAUDE.md
  • /Users/richh/.codex/AGENTS.md
  • /Users/richh/.gemini/GEMINI.md
• The injector source was inspected: it preserves content outside the begin/end markers. The final idempotence run reported all 24 outputs unchanged: six fleet documents plus 18 managed context blocks.
• Fresh exact pre-pointer backups exist for all six Claude context files at /Users/richh/.claude/CLAUDE.md.bak.20260823-0417-inbound-ssh-pointer (SHA-256 3e973bee64d7b0e6ca5f9f7c0d3da6e7edd107dca4bff128f77d73c956cc2997). Existing earlier Codex/Gemini backups were retained; exact managed-block rollback is also available by reinjecting the backed-up old FLEET-POINTER.md.

Verification evidence

• Direct rdmbair15m5 -> jdmbair13m5 public-key authentication succeeds with exit 0 by:
  • jdmbair13m5.ts.dataroo.net
  • jdmbair13m5.local
  • 100.86.185.90
• Fresh matrix from the actual source hosts:
  • all five established peers reach jdmbair13m5 and the destination reports jdmbair13m5;
  • jdmbair13m5 reaches all five peers and each destination reports its own expected hostname;
  • aggregate result: matrix_failures=0, command exit 0.
• ~/.agent-coordination/agent_msg.zsh sync completed with exit 0 and reported sync: jdmbair13m5 ok.
• All six Claude settings files report the same coordination values, including remoteControlAtStartup=true, crossSessionInbound=accept, notifications enabled, model opus[1m], and 60-second question/dialog limits.
• All six Codex configs contain [shell_environment_policy.set] AGENT_LLM = "codex". Non-CLI or already-running harnesses may still need explicit AGENT_LLM=codex when invoking the mailbox; corrected-identity messages were sent that way.

Provider/runtime audit

• Codex 0.149.0 is installed on all six Macs.
• Codex reports Logged in using ChatGPT on five Macs; jdmbair13m5 reports Not logged in and requires an interactive owner login. No auth data was copied.
• Claude Code 2.1.241 is installed on all six Macs.
• Claude reports Max-plan login on rdmbair13m5, rdmbair15m5, and jdmbair13m5; both Intel Macs report not logged in.
• On rdmsm4x, the Homebrew Claude binary is validly signed by Anthropic and byte-identical to the working canary (1495eb7c42d3b4451f5f1cd38b6d498d22a4a38c802bc2be5c1cf1795e64820d) but still carries its Homebrew quarantine marker and stalls at dyld before Claude main. Auth status is therefore unknown, not logged out. Gatekeeper was not disabled and quarantine metadata was not removed. Four older peer-owned hung claude --version processes were preserved; only this session's exact diagnostic process pair was terminated.

Coordination

• Check-in: /Users/richh/.agent-coordination/checkins/codex-rdmbair15m5-inbound-ssh-jdmbair13m5-20260823.json.
• Initial Claude request: 20260823-034611-C389C302.
• Corrected-identity verified request to claude@rdmsm4x: 20260823-041501-914785A7.
• FLEET superset notice to codex@rdmbair13m5: 20260823-041501-1886241D.
• The prior shared-document owner explicitly released FLEET.md and PROJECTS.md before those files entered this lease.
• Mailbox delivery to rdmsm4x is verified, but Claude has not acknowledged or independently reviewed the repair as of 2026-08-23 04:24 EDT. This remains distinct from the completed command-based verification.

Persistence

• Local Markdown archive: /Users/richh/dev/LLM/Claude/changelogs/rdmbair15m5-changelog-20260823-0420-inbound-ssh-and-agent-alignment.md.
• Canonical Markdown archive: the same relative path on rdmsm4x.
• The current notes_changelog.zsh v2 helper filed an additional centralized iCloud Notes copy in llmlog under its normalized title. That additive copy was preserved.
• The operating rule's required iCloud Notes record was added separately and verified exactly once:
  • folder: rdmbair15m5
  • title: rdmbair15m5-changelog-20260823-0420-inbound-ssh-and-agent-alignment
  • verification: folder_count=1 note_count=1, with a populated body; a post-update recheck succeeded.

Undo

1. To undo only the SSH authorization, on the cryptographically pinned jdmbair13m5 restore /Users/richh/.ssh/backups/inbound-ssh-20260823-035406/authorized_keys.pre to /Users/richh/.ssh/authorized_keys, retain owner richh:staff and mode 0600, and rerun the direct matrix. This intentionally reintroduces the original rdmbair15m5 access failure.
2. To undo canonical onboarding documentation, restore the two *.bak.20260823-0401-inbound-ssh files beside ISSUES.md and SESSION-STATE.md.
3. To undo canonical fleet/project documentation, restore the named backups beside FLEET.md, FLEET-POINTER.md, and PROJECTS.md, then run sync_fleet_knowledge.zsh --dry-run and the actual sync from rdmsm4x.
4. To undo a single host's distributed fleet document, restore that host's /Users/richh/.agent-coordination/FLEET.md.bak.20260823-0412-inbound-ssh and verify its recorded pre-hash.
5. To restore the immediately preceding Claude context files, copy back /Users/richh/.claude/CLAUDE.md.bak.20260823-0417-inbound-ssh-pointer. To restore only the prior managed block in any harness, run the canonical _inject_block.py against that file using the backed-up old FLEET-POINTER.md and the existing begin/end markers.

Outstanding owner actions

• On the rdmsm4x Aqua desktop, launch/approve the Homebrew Claude Code binary once, then rerun claude --version and the sanitized claude auth status --json check. Do not clear quarantine headlessly.
• If Codex should run natively on jdmbair13m5, complete codex login interactively on that Mac. Do not copy auth.json or any session database from another host.
• If Claude Code is needed natively on the two Intel Macs, complete separate interactive logins there.
• The jdmbair13m5 Apple ID/iCloud choice and optional DNS AAAA parity remain separate owner decisions.