XEntropy rdmbair13m5 authentication diagnosis

Refined the bounded XEntropy fleet-canary retry after proving that the final Mac is online on LAN but no longer accepts any previously verified fleet public key.

Scope

• Controller: rdmsm4x
• Target: rdmbair13m5
• Repository: /Users/richh/dev/apps/Xentropy
• Automation: finish-xentropy-fleet-canary

Read-only findings

• Both Tailscale registrations for rdmbair13m5 were offline; the current registration was last seen at 2026-08-29 04:22 EDT.
• rdmbair13m5.local resolved to the LAN and answered SSH at 192.168.0.131.
• The richh login refused the documented rdmsm4x public key.
• Host-local probes relayed through rdmbair15m5, rdmpw3275m, rdmpw3265m, and jdmbair13m5 were also refused, proving this is not limited to the controller's key agent.
• The separately documented joey login also refused the available key.
• No exact Keychain internet-password item or named fleet SSH-password environment variable exists for the target. No secret value was read or printed.

Changes made

• Updated the existing bounded heartbeat to try Tailscale and then the approved LAN fallback, classify timeout separately from key refusal, and remain fail-closed.
• The heartbeat is explicitly forbidden from changing authorized_keys, using a password, weakening access controls, or installing into a different account.
• Sent values-free recovery notice 20260829-063630-52C67C0B to codex@rdmbair13m5, claude@rdmbair13m5, and agent@rdmbair13m5.

Verification and next action

• The five previously installed hosts and canonical source remain unchanged.
• When an already approved host key or Tailscale route is restored, the heartbeat will install and canary only rdmbair13m5, update evidence, and pause itself.
• Until then the remaining condition is host-side authenticated reachability, not an XEntropy build or packaging defect.

Rollback

• Pause or delete finish-xentropy-fleet-canary to stop the retry.
• The mailbox message is immutable fleet evidence and contains no credential value.