feat: add owner-approved SSH digging

[woltspace-jerpint]

Summary

Add Digging, a native Woltspace concept for a home wolt to use the owner's existing SSH access to set up another machine or colony, leave a durable local handoff, and return home.

This is deliberately an intent, discoverability, target-pinning, and audit layer over ordinary OpenSSH. It copies no key, certificate, token, or credential and does not claim to sandbox wolts that share the same Unix user.

User experience

woltspace dig grant newbox my-ssh-alias --wolt n00b
woltspace dig list
woltspace dig connect newbox
woltspace dig connect newbox -- woltspace status --json
woltspace dig revoke newbox

The bundled digging skill makes the intended interface conversational: “n00b, dig into newbox and set it up.” A wolt prefers woltspace dig over raw SSH, creates its own pointer/grant when the named existing SSH alias is unambiguous, and asks again immediately before the first connection in each task unless the current instruction explicitly waives that confirmation.

Safety boundaries

• Resolve the existing SSH alias with ssh -G at grant time and pin hostname, Unix user, and port.
• Re-resolve before every connection and refuse a changed tuple.
• Invoke SSH without a local shell and require StrictHostKeyChecking=yes.
• Bind use from a live wolt session to the wolt named by the grant.
• Store grants and non-secret connection outcomes in a private atomic local store.
• Never store credentials or remote command bodies.
• Record interrupted/failed connection outcomes.
• Default remote handoff location: .woltspace/bootstrap, relative to the SSH user's home.
• revoke explicitly removes only Woltspace consent, not the Unix account, SSH key, agent, or server-side access.

Scope

Implemented: owner-provisioned SSH Dig v0 and its bundled skill.

Not implemented: Wire authorization, cross-tunnel IWCL, local-user switching, Cloudflare transport, short-lived infrastructure certificates, guest accounts, or live-lodge integration. Those remain documented future directions only.

No remote host was contacted while developing this change.

Verification

• Bundled skill validator: pass
• Focused skill/dig/package-neighbor suite: 128 passed
• Earlier full branch run: 1476 passed, 15 skipped, 16 known unrelated environment/stale failures; zero Dig failures
• Wheel and sdist rebuilt and inspected: Dig code, bundled skill, and Dig docs present
• git diff --check: pass
• Bot author and committer verified across all branch commits

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
woltspace	Ready	Preview	Sep 20, 2026 1:15pm UTC

[woltspace-jerpint]

Added the requested disposable installed-wheel SSH acceptance proof in 6ac02b8.

Run it with:

uv run python test/e2e/dig_ssh_container/run.py

Two consecutive local runs passed. Each run:

• builds the candidate wheel and installs that exact wheel on both the isolated client and disposable target;
• builds a purpose-specific SSH container with a separate colony Unix user/home and temporary public key;
• publishes SSH only on a random 127.0.0.1 host port and asserts the binding;
• uses isolated temporary SSH config, private key, known-hosts, Woltspace root, and client venv;
• pins the generated container host key and keeps strict host-key checking enabled;
• exercises the installed dig grant, resolution pinning, connect, command argument quoting, and installed remote CLI;
• creates a fresh seedling colony file plus .woltspace/bootstrap/dig-handoff.json;
• reconnects and verifies the durable handoff;
• verifies four successful audited connections, private store permissions, and absence of keys/command bodies from audit state;
• revokes the grant and proves a subsequent connection is refused;
• removes the exact disposable container, image, keys, client state, and build artifacts even on failure.

Observed result on both passes:

{
  "ok": true,
  "remote_user": "colony",
  "installed_woltspace": "0.5.6",
  "handoff": {
    "created_colony": "seedling",
    "status": "ready",
    "version": "woltspace.dig-handoff/v0",
    "visitor": "n00b"
  },
  "connections_audited": 4,
  "revoked": true
}

The proof exposed and fixed one real boundary before publication: OpenSSH concatenates remote argv into one shell command, so Dig now applies shlex.join once to preserve argument boundaries. A focused metacharacter test covers it. The fixture also adds an isolated SSH-config override so it never touches the reviewer's normal ~/.ssh/config.

Post-proof checks: bundled skill validator passed; 130 focused skill/dig/package-neighbor tests passed; compileall and git diff --check passed; no disposable container or image remained. No live lodge, macOS Remote Login, clawsmo, LAN/public listener, or external SSH host was touched.

[woltspace-jerpint]

Multi-wolt disposable Dig proof: PASS, with one useful pre-pass refusal and one disclosed test imperfection.

Setup and authority:

• Human explicitly requested that another wolt discover the candidate skill through IWCL, dig into a throwaway colony, and leave bootstrap context.
• Scribe declined the first request because IWCL carried only relayed authority and “durable flag” was ambiguous with persistence. The refusal was accepted without pressure. This is a real product finding: future delegated Dig/Wire work needs inspectable authorization provenance.
• The target was narrowed to a new loopback-only disposable SSH container, an inert note, and exact cleanup. Codexw independently read container/skills/digging/SKILL.md, generated its own ephemeral key, and stopped at the immediate pre-connect gate.
• The human confirmed the exact bounded action in Telegram, then gave standing confirmation only until this test ended. No connection preceded confirmation.

First pass (not counted as wrapper proof): Codexw safely used pinned raw SSH because its installed Woltspace 0.5.6 has no unreleased dig command. It planted/read an inert note and cleaned up. This was reported honestly as skill/SSH evidence only, then a fresh wrapper run was prepared.

Actual candidate-wrapper run:

• Candidate entry point: uv run --project <PR checkout> woltspace dig ...
• Isolated temporary HOME, WOLTSPACE_WOLTS_DIR, WOLTSPACE_WOLT_NAME, WOLTSPACE_WOLT_DIR, WOLTSPACE_DIG_SSH_CONFIG, key, SSH config, known_hosts, and grant store all lived under Codexw’s own wolt directory.
• dig grant resolved the named alias exactly to colony@127.0.0.1:63081; strict pinned ED25519 host-key verification remained enabled.
• Wrapper-only probes returned container hostname 499368d7309a, user colony, and /usr/local/bin/woltspace.
• Wrapper created and read back ~/.woltspace/bootstrap/digging-wrapper.md. Independent target-side inspection confirmed exact content, mode 0600, and owner colony:colony. It states the visitor, bounded wrapper scope, and that no credentials, tunnels, persistent access, or wolt identity were installed.
• Final Dig audit reported connect_count: 7, last_exit_code: 0. Six intended operations plus one disclosed failed note-create quoting attempt; the failed invocation wrote nothing and did not expand scope, but remained counted by the audit.
• dig revoke returned { "ok": true, "revoked": true, "name": "codexw-dig-proof" }; final dig list returned no grants.
• Codexw deleted the entire disposable client tree and fresh private/public key. n00b independently verified the seven accepted-key sessions matched the fresh key, then stopped/removed the container, removed the image, and trashed the build context. No disposable container/image remains.

This passes the requested cross-wolt product story at PR scope: sparse IWCL mission → independent skill discovery → explicit human gate → real candidate woltspace dig grant/connect/audit/revoke → inert remote bootstrap handoff → complete teardown. It does not claim Wire-carried authority, public networking, tunnels, live-colony access, or cross-tunnel IWCL.

[woltspace-jerpint]

Independent hostile review by Codexw of exact HEAD 6ac02b82008c436948122d37ad8e865f06c53a97: SCOPED PASS for SSH Dig v0 and its disposable loopback proof.

Reviewed:

• complete base-to-head diff and scope;
• destination/argument validation and shell-free ssh -G resolution;
• exact hostname/user/port re-resolution before connect;
• forced StrictHostKeyChecking=yes, isolated SSH-config override, and shlex.join remote-command quoting;
• owner-scoped locked private grant store, audit behavior, secret/command-body exclusion, and honest revoke boundary;
• relative/traversal-safe bootstrap path;
• Docker fixture loopback binding, generated disposable identity/state, separate remote home, handoff read-back, refusal after revoke, and finally cleanup;
• packaged skill/docs claims and the absence of Wire, live-agent, or public-network authority.

Static evidence: git diff --check, compileall, and clean-tree checks passed. Codexw could not independently rerun pytest because that reviewer checkout's .venv lacks pytest; this was reported as an environment limitation, not hidden or treated as a test pass. The author-side focused suites, repeated installed-wheel Docker E2E, cross-wolt wrapper proof, and GitHub Python 3.11/3.13/package checks are separately green.

No blocker found. Deferrable hardening outside this v0 gate: directory fsync after grant-store replace, no-follow/atomic-temp protections against same-UID store tampering, and more explicit constraint/recording of advanced SSH configuration such as ProxyJump/ProxyCommand. Existing docs already state that same-UID and underlying SSH authority are not sandboxed by the local grant.

This review does not approve future Wire Dig, Cloudflare, cross-colony IWCL, guest accounts, deployment, release, or broader agent integration. GitHub formal approval/merge authority remains with an eligible human reviewer.