From abdd9cd6c8d387a9d95ca1bfcbf473776202b41c Mon Sep 17 00:00:00 2001
From: dietrich ayala <me@burrito.space>
Date: Mon, 10 Aug 2026 23:44:05 +0200
Subject: [PATCH] give the box its own Tangled key, and sync config from the
 working tree
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two gaps, both of which left work stranded.

The box held no key reaching Tangled, only the Storage Box key, so pushing
needed the operator's forwarded agent — which exists only while the operator is
connected. An agent working unattended had no route for its work to leave the
machine. laptop/tangled-key.sh generates a key on the laptop, escrows it as
tangled-key, verifies the readback, and only then installs it at
~/.ssh/tangled_ed25519 mode 0600: the same order as the Storage Box key, and for
the same reason, so a rebuild reproduces the key from the vault instead of
needing its public half registered by hand again. Registering that public half
is the one step no script here can do — there is no API — so the run ends by
deferring it with the text to paste.

A key that exists but was never registered fails exactly like a missing one, so
verify.sh asserts the push path rather than the file. That assertion is no
longer skippable, and it forces IdentityAgent=none: with an agent forwarded it
would otherwise pass on the operator's identity while the box's own key was
missing, proving the opposite of what it claims. Exactly one assertion may now
SKIP. server/lib/45-ssh-config.sh names the key and matches tangled.sh as well
as tangled.org, since remotes across the projects here are written both ways.

The global agent configuration reached the box only through a full provisioning
run, via `git archive HEAD`, so the box ran the last committed state and a dirty
tree was refused outright. laptop/sync-config.sh ships the working tree instead.
Its file list comes from `git ls-files --cached --others --exclude-standard`
rather than the filesystem, which is load-bearing rather than tidy: ~/.claude is
deny-by-default gitignored, so the payload is about 2 MB where the directory is
over a gigabyte of session transcripts, and settings.local.json — ignored
because it can hold credentials captured from an approved command line — stays
out of it.

The staging directory is replaced rather than overlaid, because neither `git
archive | tar -x` nor an --files-from rsync removes anything, so a file deleted
from the repository lived on the box forever.

SYNC_OVERWRITE=1 is passed only by that script. deliver_rendered() defers on any
difference, which is right for a provisioning run but would mean an explicit
sync defers forever and never works twice (standing rule 18). The box's own
state belongs in settings.local.json, which nothing there touches, so only the
delivered artifact is replaced, and only after a backup.

flit_remote_env() moves to lib/common.sh: two callers now run the same
server-side script, and a second hand-written copy of that assignment list is
the drift §13.2 keeps counting.
---
 bootstrap.sh                   |  51 +++++++------
 laptop/sync-config.sh          | 118 ++++++++++++++++++++++++++++++
 laptop/tangled-key.sh          | 128 +++++++++++++++++++++++++++++++++
 lib/common.sh                  |  30 ++++++++
 server/lib/22-claude-config.sh |  19 ++++-
 server/lib/45-ssh-config.sh    |  32 +++++++--
 verify.sh                      |  35 +++++----
 7 files changed, 366 insertions(+), 47 deletions(-)
 create mode 100755 laptop/sync-config.sh
 create mode 100755 laptop/tangled-key.sh

diff --git a/bootstrap.sh b/bootstrap.sh
index 11322e1..9a5f470 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -101,31 +101,9 @@ remote() { ssh "${SSH_OPTS[@]}" "$FLIT_USER@$HOST" "$@"; }
 FLIT_LAPTOP_HOME=$HOME
 export FLIT_LAPTOP_HOME
 
-# flit_remote_env — the FLIT_NAME/FLIT_USER/FLIT_SERVER/FLIT_LAPTOP_HOME
-# assignment list every ssh call that runs on a stripped environment (`sudo`
-# strips it; so does a non-login remote command) must carry explicitly. ONE
-# function rather than five hand-written copies, so a variable added here
-# reaches every call site instead of whichever ones happened to get edited —
-# the failure this exists to prevent (§13.2). Callers append whatever else
-# that particular remote script needs (NO_EXTERNAL_STATE, STORAGEBOX_USER,
-# ...) after this.
-flit_remote_env() {
-  # FLIT_GIT_NAME/FLIT_GIT_EMAIL are identifying (CLAUDE.md), so they live
-  # only in the gitignored local.conf, which phase_2_deliver() excludes from
-  # the rsync push by design — forwarding them here is the only route by
-  # which a value set there reaches the server at all.
-  #
-  # %q, not '%s'. A '%s' format is safe only while no value can contain a
-  # single quote, and FLIT_GIT_NAME breaks that assumption: an apostrophe in a
-  # personal name would close the quoting and hand the remainder of the
-  # assignment list to the far shell as code. %q quotes for a shell to read
-  # back, exists in bash 3.2 as well as 5, and renders an empty value as ''
-  # rather than as nothing — which is what stops an unset FLIT_GIT_EMAIL from
-  # swallowing the word after it.
-  printf "FLIT_NAME=%q FLIT_USER=%q FLIT_SERVER=%q FLIT_LAPTOP_HOME=%q FLIT_IN_DRILL=%q FLIT_GIT_NAME=%q FLIT_GIT_EMAIL=%q" \
-    "$FLIT_NAME" "$FLIT_USER" "$FLIT_SERVER" "$FLIT_LAPTOP_HOME" "${FLIT_IN_DRILL:-}" \
-    "${FLIT_GIT_NAME:-}" "${FLIT_GIT_EMAIL:-}"
-}
+# flit_remote_env() lives in lib/common.sh: laptop/sync-config.sh runs the same
+# server-side script this file does, and a second hand-written copy of the
+# assignment list is exactly the drift §13.2 keeps counting.
 
 # --------------------------------------------------------------- preflight
 
@@ -555,7 +533,28 @@ phase_6_terminal() {
   fi
 }
 
-phase_7_sshconfig()   { log "phase 7: server ssh config"; run_server_lib 45-ssh-config.sh; }
+# The key is installed BEFORE the ssh config that names it, so a run never
+# leaves a config pointing at a path with nothing at it — ssh treats a missing
+# IdentityFile as no identity at all and falls through to "Permission denied
+# (publickey)", which reads like an unregistered key rather than a missing one.
+#
+# Skipped under --no-external-state: registering a key against the Tangled
+# account is state shared with production, and a drill must not touch it. The
+# drill box therefore has no Tangled key, which is why verify.sh's assertion is
+# one the drills are expected to fail on rather than one they assert.
+phase_7_sshconfig() {
+  log "phase 7: server ssh config"
+  if [[ $NO_EXTERNAL_STATE -eq 1 ]]; then
+    info "skipping the Tangled key: --no-external-state"
+  else
+    # EXIT_DEFERRED is success at the script's real job (§5.8), not failure:
+    # the key is installed and only its registration with the Tangled account
+    # is left to the operator, which no script here can do.
+    laptop/tangled-key.sh "$HOST" \
+      || { [[ $? -eq $EXIT_DEFERRED ]] || die "tangled-key.sh failed"; }
+  fi
+  run_server_lib 45-ssh-config.sh
+}
 
 phase_8_alerting() {
   log "phase 8: alerting (laptop half)"
diff --git a/laptop/sync-config.sh b/laptop/sync-config.sh
new file mode 100755
index 0000000..b529578
--- /dev/null
+++ b/laptop/sync-config.sh
@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+# laptop/sync-config.sh — push the WORKING TREE of the global agent
+# configuration to the box, without a full provisioning run.
+#
+#   laptop/sync-config.sh [host]
+#
+# WHY THIS EXISTS: bootstrap.sh phase_2_deliver() moves ~/.claude and
+# ~/misc/chook with `git archive HEAD`, so the box runs whatever was committed
+# at the last provisioning run and drifts behind every edit since — and
+# check_clean() refuses a dirty tree outright, because git archive ships the
+# last commit and silently omits the rest. That guard is correct for an archive
+# and pointless here: this script ships the working tree, so an uncommitted
+# tweak is the case it exists to serve rather than the case it must refuse.
+#
+# WHY THIS IS IN laptop/: it is a push, and the box never fetches its own
+# configuration (§5.1). The direction IS the design.
+
+set -uo pipefail
+cd "$(dirname "$0")/.." || exit 1
+# shellcheck source=lib/common.sh
+source lib/common.sh
+load_laptop_conf
+
+HOST=${1:-$FLIT_SERVER}
+
+# Set here for the same reason bootstrap.sh sets it: flit_remote_env() forwards
+# it, and no server-side default could guess this laptop's home.
+FLIT_LAPTOP_HOME=$HOME
+export FLIT_LAPTOP_HOME
+
+SSH_OPTS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new)
+remote() { ssh "${SSH_OPTS[@]}" "$FLIT_USER@$HOST" "$@"; }
+
+need_cmd rsync
+need_cmd git
+
+# sync_tree <source-repo> <remote-dir> <label>
+#
+# The file list comes from git, not from the filesystem: `git ls-files --cached
+# --others --exclude-standard` is every tracked file plus every untracked one
+# that is not ignored, which is the working tree's version of what `git archive
+# HEAD` would have shipped, plus new files, minus anything ignored. That last
+# part is load-bearing rather than tidy — ~/.claude's .gitignore is deny-by-
+# default with an allowlist, so the payload is about 2 MB while the directory
+# itself is over a gigabyte of session transcripts and caches. A plain rsync of
+# the tree would move all of it, and would move settings.local.json with it,
+# which is ignored precisely because it can hold credentials captured from an
+# approved command line.
+#
+# The remote directory is cleared first. It is staging that only this script
+# writes and only server/lib/22-claude-config.sh reads, so replacing it whole is
+# safe, and it is the only way a file deleted from the repository stops existing
+# on the box — neither `git archive | tar -x` nor an --files-from rsync removes
+# anything, so today a deleted skill lives on the box forever.
+sync_tree() {
+  local src=$1 dir=$2 label=$3
+  [[ -d "$src/.git" ]] || die "$label ($src) is not a git repository"
+
+  local list; list=$(mktemp)
+  # shellcheck disable=SC2064
+  trap "rm -f '$list'" RETURN
+  git -C "$src" ls-files --cached --others --exclude-standard >"$list" \
+    || die "could not list files for $label ($src)"
+  [[ -s "$list" ]] || die "$label ($src) listed no files; refusing to replace ~/$dir with nothing"
+
+  local n; n=$(wc -l <"$list" | tr -d ' ')
+
+  if [[ $PRINT_ONLY -eq 1 ]]; then
+    info "would replace ~/$dir on $HOST with $n files from $label"
+    return 0
+  fi
+
+  remote "rm -rf ~/$dir && mkdir -p ~/$dir" \
+    || die "could not clear ~/$dir on $HOST"
+  rsync -a --files-from="$list" -e "ssh ${SSH_OPTS[*]}" \
+    "$src/" "$FLIT_USER@$HOST:$dir/" \
+    || die "could not sync $label to $HOST:~/$dir"
+  log "synced $n files: $label -> ~/$dir"
+}
+
+log "sync config -> $HOST"
+sync_tree "$HOME/.claude" claude-config "the ~/.claude repository"
+sync_tree "$(cd .. && pwd)/chook" chook "the ~/misc/chook repository"
+
+# Rendering is not repeated here. server/lib/22-claude-config.sh owns the
+# per-machine rewrite of settings.json and chook.toml and the §5.8 contract that
+# refuses to overwrite a destination that differs; a second renderer on this
+# side would be the same content produced two ways, disagreeing the first time
+# one of them changed. Invoked exactly as bootstrap.sh run_server_lib() does,
+# through the shared flit_remote_env().
+if [[ $PRINT_ONLY -eq 1 ]]; then
+  info "would run server/lib/22-claude-config.sh on $HOST"
+  finish 0
+fi
+
+#
+# SYNC_OVERWRITE=1 is what makes this command idempotent rather than
+# single-use. deliver_rendered() defers on any difference, which is right for a
+# bootstrap run — the difference might be something the box meant to keep — but
+# for a command whose whole purpose is making the box match the laptop it would
+# mean every settings change defers forever and has to be applied by hand
+# (standing rule 18). The box's own state lives in settings.local.json, which
+# that script never touches, so what gets replaced is only the delivered
+# artifact, and only after a backup.
+rc=0
+remote "sudo $(flit_remote_env) SYNC_OVERWRITE=1 ~/$FLIT_NAME/server/lib/22-claude-config.sh" || rc=$?
+# EXIT_DEFERRED means the step ran and declined to overwrite something. That is
+# the contract working, not a failure — but it must not be silent, because a
+# config change that stops in ~/claude-config and never reaches ~/.claude leaves
+# the box running the old one while this script reports success. Compared
+# against the constant rather than a literal 3, so the two cannot drift.
+if [[ $rc -eq $EXIT_DEFERRED ]]; then
+  warn "22-claude-config.sh deferred a change on $HOST; see its output above — the box is NOT yet running it"
+elif [[ $rc -ne 0 ]]; then
+  die "22-claude-config.sh failed on $HOST (exit $rc)"
+fi
+
+finish 0
diff --git a/laptop/tangled-key.sh b/laptop/tangled-key.sh
new file mode 100755
index 0000000..2717384
--- /dev/null
+++ b/laptop/tangled-key.sh
@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+# laptop/tangled-key.sh — the box's own key for pushing to Tangled (§7.2).
+#
+# WHY THIS IS NOT IN server/lib/: escrow WRITES need the operator's
+# authenticated pass-cli session, and the server holds only the read-only
+# access token (§7.1, §7.3). Same reason laptop/backup-credentials.sh is here,
+# and the same order for the same reason: generate on the laptop, escrow,
+# verify the readback, and only then push. Generating on the box would leave a
+# window where the only copy lives on the machine it authorises.
+#
+#   laptop/tangled-key.sh [--replace] <host>
+#
+# --replace rotates a key that already has a value. Without it an existing
+# escrowed key is reused, which is what makes a rebuild reproduce the box
+# rather than mint a second key the account has never seen.
+#
+# WHAT THIS DELIBERATELY CANNOT DO: register the public half with Tangled.
+# There is no API for it, so the run ends by deferring that one step to the
+# operator with the exact key text to paste. Until it is done the key exists
+# and authenticates as nobody, which is why verify.sh asserts the push path
+# rather than the key file's existence — a key present but unregistered fails
+# in exactly the way a missing key does, and only the push tells them apart.
+
+set -uo pipefail
+cd "$(dirname "$0")/.." || exit 1
+# shellcheck source=lib/common.sh
+source lib/common.sh
+
+REPLACE=0
+HOST=""
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --replace) REPLACE=1; shift ;;
+    *) HOST=$1; shift ;;
+  esac
+done
+HOST=${HOST:?usage: tangled-key.sh [--replace] <host>}
+
+remote() { ssh -o BatchMode=yes "$FLIT_USER@$HOST" "$@"; }
+
+# §6.2: escrow WRITES need the operator's session, not the read-only token.
+# Checked before anything is generated, so a run cannot mint a key it would
+# then be unable to store.
+if [[ $PRINT_ONLY -eq 0 ]]; then
+  vault_session_ok \
+    || die "no authenticated pass-cli session; escrow (§6.2) cannot write. Run 'pass-cli login' first."
+fi
+
+KEY_ITEM=tangled-key
+DEST=.ssh/tangled_ed25519
+
+# ONE working directory and ONE trap. A second `trap ... EXIT` later in the
+# script would replace this one rather than add to it, silently leaking
+# whichever directory the earlier trap named — with private key material in it.
+WORKDIR=$(mktemp -d)
+trap 'rm -rf "${WORKDIR:-}"' EXIT
+chmod 700 "$WORKDIR"
+
+# The comment carries the date of generation, matching
+# laptop/backup-credentials.sh storagebox_key_comment(): a rotation adds a key
+# rather than replacing one, so the account can hold several and the date is
+# what tells the operator which is which in Tangled's key list.
+key_comment() { printf '%s box %s\n' "$FLIT_NAME" "$(date -u +%Y-%m-%d)"; }
+
+EXISTING=$(vault_get "$KEY_ITEM" 2>/dev/null || true)
+
+if [[ -n "$EXISTING" && $REPLACE -eq 0 ]]; then
+  info "reusing the escrowed $KEY_ITEM; --replace rotates it"
+  PRIVATE=$EXISTING
+elif [[ $PRINT_ONLY -eq 1 ]]; then
+  info "plan: generate an ed25519 key, escrow it as $KEY_ITEM, install it at ~/$DEST on $HOST"
+  finish 0
+else
+  ssh-keygen -t ed25519 -N '' -C "$(key_comment)" -f "$WORKDIR/tangled_ed25519" >/dev/null \
+    || die "ssh-keygen failed"
+  PRIVATE=$(cat "$WORKDIR/tangled_ed25519")
+
+  vault_put "$KEY_ITEM" "$PRIVATE" || die "could not escrow $KEY_ITEM"
+  # Readback before proceeding, the §6.2 pattern: an escrow that silently
+  # stored nothing is indistinguishable from one that worked until the day a
+  # rebuild needs it.
+  READBACK=$(vault_get "$KEY_ITEM" || true)
+  [[ "$READBACK" == "$PRIVATE" ]] \
+    || die "escrowed $KEY_ITEM did not read back byte for byte; refusing to continue"
+  info "escrowed $KEY_ITEM and verified the readback"
+fi
+
+[[ -n "$PRIVATE" ]] || die "no key material for $KEY_ITEM"
+
+if [[ $PRINT_ONLY -eq 1 ]]; then
+  info "plan: install the escrowed $KEY_ITEM at ~/$DEST on $HOST"
+  finish 0
+fi
+
+# Never as a command-line argument: an argv entry sits in the process table for
+# as long as the command runs. Same shape backup-credentials.sh uses for the
+# Storage Box key.
+remote "install -d -m700 ~/.ssh" || die "cannot create ~/.ssh on $HOST"
+printf '%s\n' "$PRIVATE" | remote "install -m600 /dev/stdin ~/$DEST" \
+  || die "could not install the key at ~/$DEST on $HOST"
+info "installed ~/$DEST on $HOST (mode 0600)"
+
+# The public half is derived from the private one rather than carried
+# alongside it, so the two cannot disagree — a rebuild reads only the private
+# key out of the vault.
+#
+# Via a real file, not a pipe: ssh-keygen -y stats its -f argument and rejects
+# /dev/stdin, so the obvious pipeline fails with an error that names nothing
+# useful. The file is created 0600 BEFORE the key is written into it — created
+# then chmodded would leave the material world-readable for the width of that
+# window, on the laptop, which is the one machine holding every key here.
+(umask 077; printf '%s\n' "$PRIVATE" >"$WORKDIR/derive")
+PUBLIC=$(ssh-keygen -y -f "$WORKDIR/derive") \
+  || die "could not derive the public half of $KEY_ITEM"
+
+# Is the key already authorised? A key that exists but was never registered
+# fails exactly like a missing one, so this asks the service rather than the
+# filesystem. ControlPath=none because ssh multiplexing would answer from an
+# existing connection and make a lockout look like a pass.
+if remote "ssh -o BatchMode=yes -o ControlPath=none -o StrictHostKeyChecking=accept-new -T git@tangled.org" >/dev/null 2>&1; then
+  info "the box authenticates to Tangled with its own key"
+else
+  defer "Tangled account keys" \
+    "the box holds its key but Tangled does not yet accept it; add the public half to the account's ssh keys, after which the box can push with no forwarded agent" \
+    "$PUBLIC"
+fi
+
+finish 0
diff --git a/lib/common.sh b/lib/common.sh
index 91cb582..e114e34 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -437,6 +437,36 @@ load_laptop_conf() {
   source local.conf
 }
 
+# flit_remote_env — the assignment list every ssh call that runs on a stripped
+# environment (`sudo` strips it; so does a non-login remote command) must carry
+# explicitly. ONE function rather than a copy per caller, so a variable added
+# here reaches every call site instead of whichever ones happened to get edited
+# — the failure this exists to prevent (§13.2). It lives here rather than in
+# bootstrap.sh because laptop/sync-config.sh runs the same server-side script
+# and needs the identical list. Callers append whatever else that particular
+# remote script needs (NO_EXTERNAL_STATE, STORAGEBOX_USER, ...) after this.
+#
+# FLIT_GIT_NAME/FLIT_GIT_EMAIL are identifying (CLAUDE.md), so they live only in
+# the gitignored local.conf, which is excluded from the rsync push by design —
+# forwarding them here is the only route by which a value set there reaches the
+# server at all.
+#
+# %q, not '%s'. A '%s' format is safe only while no value can contain a single
+# quote, and FLIT_GIT_NAME breaks that assumption: an apostrophe in a personal
+# name would close the quoting and hand the remainder of the assignment list to
+# the far shell as code. %q quotes for a shell to read back, exists in bash 3.2
+# as well as 5, and renders an empty value as '' rather than as nothing — which
+# is what stops an unset FLIT_GIT_EMAIL from swallowing the word after it.
+#
+# FLIT_LAPTOP_HOME has no committed default and is set by the caller before the
+# first remote invocation; defaulted to empty here so sourcing this file under
+# `set -u` on the server, where it is meaningless, cannot abort.
+flit_remote_env() {
+  printf "FLIT_NAME=%q FLIT_USER=%q FLIT_SERVER=%q FLIT_LAPTOP_HOME=%q FLIT_IN_DRILL=%q FLIT_GIT_NAME=%q FLIT_GIT_EMAIL=%q" \
+    "$FLIT_NAME" "$FLIT_USER" "$FLIT_SERVER" "${FLIT_LAPTOP_HOME:-}" "${FLIT_IN_DRILL:-}" \
+    "${FLIT_GIT_NAME:-}" "${FLIT_GIT_EMAIL:-}"
+}
+
 # ------------------------------------------------------------ operator ssh key
 # LAPTOP ONLY: both functions below call `hcloud` (ensure_operator_key()) or
 # `ssh-add`/`ssh-keygen` (resolve_operator_key()), none of which exist on the
diff --git a/server/lib/22-claude-config.sh b/server/lib/22-claude-config.sh
index f196ae0..ac0a253 100755
--- a/server/lib/22-claude-config.sh
+++ b/server/lib/22-claude-config.sh
@@ -25,7 +25,8 @@ if [[ $(id -un) != "$U" ]]; then
   # carry the rest of the environment across this re-exec, and OLD_HOME below
   # needs FLIT_LAPTOP_HOME to still be set once running as the operator.
   exec sudo -u "$U" -H PRINT_ONLY="${PRINT_ONLY:-0}" DEFERRALS="${DEFERRALS:-}" \
-       FLIT_USER="$U" FLIT_LAPTOP_HOME="${FLIT_LAPTOP_HOME:-}" bash "$0" "$@"
+       FLIT_USER="$U" FLIT_LAPTOP_HOME="${FLIT_LAPTOP_HOME:-}" \
+       SYNC_OVERWRITE="${SYNC_OVERWRITE:-0}" bash "$0" "$@"
 fi
 
 SRC="$H/claude-config"
@@ -95,6 +96,22 @@ deliver_rendered() {
     fi
     if [[ $same -eq 1 ]]; then
       info "already satisfied: $dst matches the rendered config"
+    elif [[ ${SYNC_OVERWRITE:-0} -eq 1 ]]; then
+      # Set only by laptop/sync-config.sh, never by a bootstrap run. Deferring
+      # is right when the difference might be something the box meant to keep;
+      # it is wrong for a command whose entire purpose is "make the box match
+      # the laptop", where a permanent deferral means the tool never works
+      # twice (standing rule 18). The box's own state belongs in
+      # settings.local.json, which nothing here touches — so what is replaced
+      # is only ever the delivered artifact.
+      #
+      # Backed up first regardless: §1 success criterion 8 says no script
+      # destroys an existing config file, and "the operator asked for it" does
+      # not exempt this one.
+      cp -p "$dst" "${dst}.${FLIT_NAME}.$(date +%Y%m%d%H%M%S).bak" \
+        || die "could not back up $dst before replacing it"
+      cat "$tmp" >"$dst"
+      log "replaced $dst from the rendered delivery (previous content backed up)"
     else
       defer "$dst" "$reason" "$(cat "$tmp")"
     fi
diff --git a/server/lib/45-ssh-config.sh b/server/lib/45-ssh-config.sh
index ca3abf6..fce1a3a 100755
--- a/server/lib/45-ssh-config.sh
+++ b/server/lib/45-ssh-config.sh
@@ -20,8 +20,22 @@ fi
 install -d -m700 "$H/.ssh"
 
 # AddressFamily inet is per Tangled's documented configuration — they have
-# IPv6 trouble and this box has IPv6. No IdentityFile: there is no key here by
-# design; keys arrive from the operator's forwarded agent (§7.2).
+# IPv6 trouble and this box has IPv6.
+#
+# IdentityFile names a key that lives HERE, which reverses the earlier design
+# of carrying no key and relying on the operator's forwarded agent. A forwarded
+# agent exists only while the operator is connected, so an agent working
+# unattended had no route for its work to leave the box — the reason the key
+# now exists (laptop/tangled-key.sh installs it, escrowed from the vault).
+# IdentitiesOnly yes so ssh offers this key and nothing else: with an agent
+# forwarded as well, ssh would otherwise offer the agent's keys first and the
+# assertion would pass on the operator's identity while the box's own key was
+# missing or unregistered — a check that proves the wrong thing.
+#
+# Both host names, because a remote may be written either way:
+# `git@tangled.org:...` and `git@tangled.sh:...` both occur across the
+# projects on this box, and a block naming one silently fails to match the
+# other.
 #
 # StrictHostKeyChecking accept-new for the same reason the Storage Box path
 # uses it (laptop/backup-credentials.sh): tangled.org has never been connected
@@ -35,10 +49,18 @@ install -d -m700 "$H/.ssh"
 # SSH takes the FIRST value obtained for each keyword, so this must go at the
 # TOP of the file. Appended below an existing `Host *` it is silently ignored,
 # and git push fails with no useful error.
-cfg_apply "$H/.ssh/config" prepend "$(cat <<'EOF2'
-Host tangled.org
-    Hostname tangled.org
+# The heredoc is UNQUOTED so $H expands into IdentityFile — ssh does not expand
+# ~ or a shell variable in that setting, so the path has to be absolute and
+# baked in here. Any future line added to this block is therefore subject to
+# expansion too; a literal $ in one needs escaping.
+#
+# No Hostname line: both Host patterns are the real hostnames, which is what
+# ssh already uses when Hostname is absent.
+cfg_apply "$H/.ssh/config" prepend "$(cat <<EOF2
+Host tangled.org tangled.sh
     User git
+    IdentityFile $H/.ssh/tangled_ed25519
+    IdentitiesOnly yes
     AddressFamily inet
     StrictHostKeyChecking accept-new
 EOF2
diff --git a/verify.sh b/verify.sh
index ccacd16..cb0cd41 100755
--- a/verify.sh
+++ b/verify.sh
@@ -5,7 +5,7 @@
 # user-scoped, and as root it would read root's configuration and report
 # confidently on the wrong user.
 #
-# Reports PASS / FAIL / SKIP. Only two assertions may SKIP; every other one
+# Reports PASS / FAIL / SKIP. Only one assertion may SKIP; every other one
 # that cannot run is a FAIL. A run that skipped everything must NOT look
 # healthy — that is the cheapest possible way to disable this whole layer.
 
@@ -39,7 +39,7 @@ declare -a FAILED=() SKIPPED=()
 
 pass() { printf '  PASS  %s\n' "$1"; P=$((P+1)); }
 fail() { printf '  FAIL  %s — %s\n' "$1" "${2:-}"; F=$((F+1)); FAILED+=("$1"); }
-# skip() is deliberately available to only two call sites (see §5.3).
+# skip() is deliberately available to only one call site (see §5.3).
 skip() { printf '  SKIP  %s — %s\n' "$1" "${2:-}"; S=$((S+1)); SKIPPED+=("$1"); }
 
 # check <name> <expected> <command...> — non-skippable by construction:
@@ -189,13 +189,17 @@ else
   done
 fi
 
-echo "=== git push (§7.2) — SKIPPABLE ==="
-# Requires the operator's forwarded agent, absent in timer runs and drills.
-if [[ -z "${SSH_AUTH_SOCK:-}" ]]; then
-  skip "tangled push works" "no forwarded SSH agent (normal in timer runs and drills)"
-else
-  check_true "tangled push works" ssh -o BatchMode=yes -T git@tangled.org
-fi
+echo "=== git push (§7.2) ==="
+# No longer skippable. The box has its own key (laptop/tangled-key.sh), so this
+# no longer depends on the operator's forwarded agent being present, which is
+# what made it skip in every timer run and drill.
+check "tangled key mode 0600" "600" stat -c %a "$HOME/.ssh/tangled_ed25519"
+# IdentityAgent=none, not merely BatchMode: with an agent forwarded, ssh offers
+# the agent's keys as well, and this would pass on the operator's identity while
+# the box's own key was missing or unregistered — proving the opposite of what
+# it claims. Forcing the agent out is what makes the assertion about THIS box.
+check_true "tangled push works with the box's own key" \
+  ssh -o BatchMode=yes -o IdentityAgent=none -o ControlPath=none -T git@tangled.org
 
 # ---------------------------------------------------------------- reporting
 echo
@@ -203,14 +207,15 @@ echo "PASS=$P FAIL=$F SKIP=$S"
 (( ${#FAILED[@]}  )) && printf 'failed: %s\n' "${FAILED[*]}"
 (( ${#SKIPPED[@]} )) && printf 'skipped: %s\n' "${SKIPPED[*]}"
 
-# The floor: only the two assertions above may skip. If we somehow skipped
-# more, or evaluated almost nothing, this run proves nothing and must not
-# ping success.
-if (( S > 2 )); then
-  echo "ABORT: $S assertions skipped, but only 2 are skippable (§5.3)" >&2
+# The floor: only the backup-escrow assertion above may skip (§6.2) — the
+# Tangled push now runs on the box's own key, not a forwarded agent, so it is
+# unconditional like everything else. Skipping more, or evaluating almost
+# nothing, means this run proves nothing and must not ping success.
+if (( S > 1 )); then
+  echo "ABORT: $S assertions skipped, but only 1 is skippable (§5.3)" >&2
   exit 1
 fi
-if (( P < 10 )); then
+if (( P < 11 )); then
   echo "ABORT: only $P assertions evaluated; verify.sh is not doing its job" >&2
   exit 1
 fi
-- 
2.51.2