Acceptance 0002: ssh gateway, per-user OAuth, atirc agent over ssh

Proves ssh <handle>@socialweb.computer atirc agent run <name> rents a market VM as that user, starts an atirc agent in it as <name>.<handle>, and on session end revokes the token before the contract is released.

• Gateway: Go SshServer + one per-user Requester per signed-in DID (requester-<stamp(did)>)
• Port 22 on socialweb.computer = Go ssh gateway (legacy deno gateway disabled, kept for rollback)
• Web half: https://ssh.socialweb.computer (sign-in + /keys)
• Last pass: rc152, 2026-11-01 (owner account, port 22); rc154 restart check 2026-11-01

sequenceDiagram
  participant U as user ssh client
  participant G as ssh gateway (SshServer)
  participant R as per-user Requester (user's OAuth session)
  participant B as bidder (local / hat-9 / hat-7)
  participant V as guest VM
  participant A as atirc (irc.fedfork.com)
  U->>G: ssh <handle>@socialweb.computer atirc agent run <name>
  G->>G: key claim check (one getRecord, stable rkey)
  G->>R: bus resolve requester of account DID
  R->>B: RFP (policy: requester-tangled-vouch)
  B-->>R: bid (policy: bidder-tangled-vouch) -> accept -> receipt
  R->>A: chat.atirc.mint <name>.<handle> leased {receipt, vm.terminated}
  R->>V: guest session (iroh), run `atirc agent run` as guest user <name>
  V->>A: nick <name> joins channel
  U--xG: disconnect / session cap
  R->>A: chat.atirc.revoke <name>.<handle>
  R->>B: release -> vm.terminated

Preconditions

Vouch pairs used on prod (public test accounts): bob -> john, john -> bob, bob -> hat, hat -> bob, john -> hat.

Check a vouch (goat or any getRecord client):

OP=<bidder operator DID>; REQ=<requester DID>
goat get "at://$OP/sh.tangled.graph.vouch/$REQ" | jq -r .kind     # vouch
goat get "at://$REQ/sh.tangled.graph.vouch/$OP" | jq -r .kind     # vouch

Steps

1. Announce on atirc: linux-kcp -> all: ssh gateway test as <handle> now; watchers: where does it land?

2. New host key once after the deno -> Go switch: ssh-keygen -R socialweb.computer

3. Transient run (VM lives for the command):

   ssh <handle>@socialweb.computer atirc agent run <name>
   

4. Held run (session name pinned, survives a gateway restart until expiry):

   ssh -o SetEnv=LC_SESSION=<session-name> <handle>@socialweb.computer atirc agent run <name>
   

   Other session env: LC_VM_NAME (DNS label), LC_POLICY / LC_POLICY_ARGS (none/off refused: a policy always runs), LC_KEEP_VM.

5. Side port (staging a new gateway build before it owns 22): ssh -p 2222 <handle>@socialweb.computer ...

6. Wait for the nick <name> to join the owner channel; address it once (<name>: say hi), see one reply.

7. Disconnect (Ctrl-C / close) or let the session cap end it.

Expected observations

Gateway core log (gw ssh: lines on atirc from the gateway agent), in order:

• Session start -> agent nick on channel: ~60-70 s (hat run rc151: mint 23:21:34 -> JOIN 23:22:02)
• Disconnect -> Released: ~2-4 s
• atirc side (revocations.ndjson): revoke entry before contract Released
• Bidder side: vm.terminated pinned; ssh-path records may carry no request field (see 0008)

Gateway restart check (rollout):

• SshServer ssh-server phase=Ready, SshGateway app phase=Ready comps=4/4
• per-user MarketIdentity owner-<hash> phase=Ready ready=SignedIn for every signed-in user
• SshServer + requester restarts = 0 (rc154: requester_signer_key_waits_for_vault, sshserver_waits_for_vault -> sshserver_vault_ready -> signer_key_bound)

Pass criteria

• VM rented as the ssh user (ComputeContract owner DID = user DID), not a shared requester
• <name>.<handle> minted leased, agent runs as guest user <name> (not root), joins and replies
• On disconnect / cap: revoke strictly before Released; zero live tokens for the user afterwards
• Winning host empty after release (watcher line)
• Unvouched DID or missing key claim: refused, no RFP

Cleanup

• Nothing if the session ended. A held LC_SESSION session: reconnect with the same name and exit, or wait for expiry
• Leftover VM: bidder-side termination (0007)
• Plain (unleased) test token left: revoke it (atirc revoke with the parent token) or ask atirc-dev for the manual revocation path

Known pitfalls