212f6ed1 — eitri

deploy/server/README.md

Old		New
@@ -48,6 +48,7 @@ node — with state on a local-path PVC and config from a Secret.
48	5. Network (operator):	48	5. Network (operator):
49	- Oracle security list AND vnic-1 host firewall: open 8443/udp, 2222/tcp.	49	- Oracle security list AND vnic-1 host firewall: open 8443/udp, 2222/tcp.
50	- Cloudflare DNS: `console.eitri.sh` proxied to the eitri.sh origin (repoint off the old tailnet record — confirm nothing dev-side still resolves it); `sync.eitri.sh` and `gate.eitri.sh` grey-cloud A records to vnic-1's public IP.	50	- Cloudflare DNS: `console.eitri.sh` proxied to the eitri.sh origin (repoint off the old tailnet record — confirm nothing dev-side still resolves it); `sync.eitri.sh` and `gate.eitri.sh` grey-cloud A records to vnic-1's public IP.
		51	- `api.eitri.sh` (the MCP endpoint): A record to the same origin as console. Proxied works only when the MCP client sends progress tokens — a `vm_create` that stays silent past Cloudflare's ~100s origin timeout gets a 524; if the client under test doesn't, use a grey-cloud record.
51	6. Backups: nightly CronJob writes dated sqlite backups on the PVC; run `backup-pull.sh` from cron on an off-cluster machine — local-path storage does not survive the node, the off-node copy is the DR story.	52	6. Backups: nightly CronJob writes dated sqlite backups on the PVC; run `backup-pull.sh` from cron on an off-cluster machine — local-path storage does not survive the node, the off-node copy is the DR story.
52		53
53	## Rollout	54	## Rollout

deploy/server/certificate.yaml

Old		New
@@ -5,7 +5,7 @@ metadata:
5	namespace: eitri	5	namespace: eitri
6	spec:	6	spec:
7	secretName: console-tls	7	secretName: console-tls
8	dnsNames: [console.eitri.sh]	8	dnsNames: [console.eitri.sh, api.eitri.sh]
9	issuerRef:	9	issuerRef:
10	name: letsencrypt-prod	10	name: letsencrypt-prod
11	kind: ClusterIssuer	11	kind: ClusterIssuer

deploy/server/ingressroute.yaml

Old		New
@@ -10,6 +10,12 @@ spec:
10	kind: Rule	10	kind: Rule
11	services:	11	services:
12	- {name: eitri-server, port: 8080}	12	- {name: eitri-server, port: 8080}
		13	# api.eitri.sh carries ONLY /mcp: routing the whole host would make it a
		14	# second console origin, and OIDC sign-in works at exactly oidc.public_url.
		15	- match: Host(`api.eitri.sh`) && PathPrefix(`/mcp`)
		16	kind: Rule
		17	services:
		18	- {name: eitri-server, port: 8080}
13	tls:	19	tls:
14	secretName: console-tls	20	secretName: console-tls
15	---	21	---
@@ -27,3 +33,9 @@ spec:
27	- name: redirect-https	33	- name: redirect-https
28	services:	34	services:
29	- {name: eitri-server, port: 8080}	35	- {name: eitri-server, port: 8080}
		36	- match: Host(`api.eitri.sh`) && PathPrefix(`/mcp`)
		37	kind: Rule
		38	middlewares:
		39	- name: redirect-https
		40	services:
		41	- {name: eitri-server, port: 8080}

docs/assumptions.md

+**Proven** in code; the posture is deliberate—see the auth answer in
+[faq.md](faq.md). A host whose networks are not equally trusted gets more
+reach than it asked for.
+### eitri holds no signing key for anyone
+A caller lends eitri a credential instead: eitri offers an ephemeral public key,
+the caller's own CA signs it, and eitri authenticates with the certificate until
+it expires. Underpins a caller with nothing but a token reaching its own VMs,
+which is what makes the hosted MCP endpoint usable — without a signing key
+existing on the server to lose.
+**Proven** in code: the keyring is a leaf package with no persistence, every
+validation rule is unit-tested, and the deploy gate refuses a certificate signed
+by a CA the tenant never registered.
+### A delegation lives for the process, and nowhere else
+Delegations are held in memory. A control-plane restart or redeploy drops every
+one of them, and callers delegate again — one `ssh-keygen` and one call, because
+the offered public key is stable per process. Underpins not persisting a
+credential that would otherwise outlive the session that granted it: a restart
+is a revocation, which is the property we want rather than a cost we pay.
+**Proven** in code: nothing writes a delegation to the store, and the refusal a
+caller gets afterwards carries the whole three-step recipe.
+### A delegated certificate's principal is the guest login user
+A guest trusts its tenant's CA set through a bare `TrustedUserCAKeys` line with
+no `AuthorizedPrincipalsFile`, so sshd matches the certificate's principals
+against the account being logged into — `ubuntu`, not the tenant. Underpins
+validating the principal at delegation time rather than letting the mistake
+surface as an opaque authentication failure at the guest.
+**Proven** in code: the refusal names the principal that is missing and the
+`-n` flag that adds it.
+### A guest's SSH host key is generated on its host and never leaves it
+The host generates the key, reports the public half, and the control plane signs
+a certificate for the principal it derives from the VM's row. Underpins the
+claim that eitri holds no guest key: there is nothing to escrow, because nothing
+is ever sent. A host that has reported a key waits for its certificate rather
+than booting a guest clients would refuse.
+**Proven** in code: an integration test drives the round trip over a real sync
+connection, and both the snapshot and the report are marshalled and searched for
+private-key bytes.
+### What eitri signs with is encrypted where it rests
+Every piece of key material the server holds—the fleet's own host CA and gate
+host key, in the data directory—is sealed under a key-encryption key that lives
+in the plane's config and nowhere near the data. A copied database, a nightly
+backup, or a lifted volume therefore yields ciphertext and no signing power.
+Underpins DR: a restore needs the config as well as the data, and the config
+Secret is the key's only home.
+**Proven** in code: sealed on the way out, opened on the way in, and a key file
+that will not open stops the server rather than being regenerated—a fresh host
+CA would invalidate every client's pin and every VM's host certificate at once.
+### A proxied MCP origin carries long calls
+The public-MCP story rests on Cloudflare not cutting a `vm_create` that runs
+for minutes. Underpins serving `/mcp` through an orange-cloud hostname.
+**Proven** 2026-08-07 at stg: progress notifications traversed the proxy at a
+-second cadence (8 events; create returned in 18.5s), and a deliberately
+silent call survived 120 seconds intact — the believed ~100s silent-origin
+cliff did not appear. What the proxy did block was a client signature:
+python-urllib drew Cloudflare error 1010 (browser integrity check) while Go's
+client and any self-naming User-Agent passed. A proxied `/mcp` must exempt
+API user agents — or clients must send their own.

docs/decisions.md

+eitri server cannot mint access to any tenant's guests—the user-auth trust
+root lives with the tenant. Details in [ssh-access.md](ssh-access.md).
+### Delegated credentials, not a CA eitri holds
+A tenant signs an ephemeral key eitri generates, and eitri uses the resulting
+certificate until it expires. Instead of eitri holding a signing key on the
+tenant's behalf, which was the obvious way to let a token-only caller reach a
+guest: it would make the control-plane database worth stealing and give eitri a
+power that never lapses. A certificate does lapse, and a restart drops it.
+Instead of persisting delegations, too — a credential that survives the process
+that was granted it is one nobody remembers granting. The cost is re-delegating
+after a redeploy, which is one `ssh-keygen` against a stable public key.
+Details in [ssh-access.md](ssh-access.md).
+### A guest's host key is generated by its host, and certified by the fleet
+The host generates the keypair and sends up the public half; the control plane
+signs a certificate for the name on the VM's row. Instead of the control plane
+generating the key and shipping the private half down in desired state, which
+put every guest's host key in one database. The host supplies a key and never a
+name, so it cannot obtain a certificate for a VM it does not run. The cost is
+one extra tick before a guest boots, against a create that already waits
+minutes for cloud-init.
+### SSH-CA jump gate, not a mesh
+Guest access is plain OpenSSH through a certificate-verified bastion. Instead

docs/mcp.md

Old		New
@@ -1,9 +1,16 @@
1	# eitri-mcp: Claude ↔ eitri VMs	1	# eitri-mcp: Claude ↔ eitri VMs
2		2
3	`eitri-mcp` (`cmd/eitri-mcp`) is a stdio MCP server that gives Claude ten	3	eitri gives Claude explicit tools for creating and controlling VMs on a fleet,
4	explicit tools for creating and controlling VMs on an eitri fleet. It is an	4	over two transports:
5	API client of the eitri control plane plus SSH—it embeds no control-plane	5
6	or agent code.	6	- Local stdio — `eitri-mcp` (`cmd/eitri-mcp`), a binary you run yourself. It
		7	is an API client of the control plane plus SSH; it embeds no control-plane or
		8	agent code, and it holds its own SSH user CA.
		9	- Remote HTTP — `https://api.eitri.sh/mcp`, served by the control plane
		10	itself. MCP streamable HTTP, authenticated with a personal access token. No
		11	install, no config file, no CA of your own: a PAT is enough.
		12
		13	Both serve the same tools.
7		14
8	## Tools	15	## Tools
9		16
@@ -19,13 +26,17 @@ or agent code.
19	\| `vm_exposures` \| List a VM's published ports, same shape. \|	26	\| `vm_exposures` \| List a VM's published ports, same shape. \|
20	\| `vm_unexpose` \| Stop publishing a guest port (`host_port` disambiguates when one guest port is published twice). \|	27	\| `vm_unexpose` \| Stop publishing a guest port (`host_port` disambiguates when one guest port is published twice). \|
21	\| `vm_destroy` \| Destroy a VM by id or exact name. Explicit-only—never called automatically. \|	28	\| `vm_destroy` \| Destroy a VM by id or exact name. Explicit-only—never called automatically. \|
		29	\| `ca_upload` \| Register your SSH user CA's public key with your tenant, with an optional label. Only the public half is sent. A guest trusts the CA set it was created with, so VMs that already exist will not accept certificates from a CA uploaded now. \|
		30	\| `tenant_info` \| Show this tenant's setup: registered CAs (fingerprint and label), whether a delegation is live and when it expires, and the gate address. Read-only. \|
		31	\| `delegate_begin` \| (remote only) Get the ephemeral public key eitri will authenticate with, the principal your certificate must carry, and the `ssh-keygen` line that signs it. \|
		32	\| `delegate_complete` \| (remote only) Hand back the signed certificate. eitri can then reach your VMs until it expires. \|
22		33
23	Deliberately absent: any host or fleet-level operation (enroll, decommission,	34	Deliberately absent: any host or fleet-level operation (enroll, decommission,
24	power management, image/firmware knobs). The worst case from a confused model	35	power management, image/firmware knobs). The worst case from a confused model
25	is VM churn, never fleet damage—and Claude Code's per-tool permission	36	is VM churn, never fleet damage—and Claude Code's per-tool permission
26	prompts gate every call regardless.	37	prompts gate every call regardless.
27		38
28	## Setup	39	## Setup: local stdio
29		40
30	1. Build the binary:	41	1. Build the binary:
31		42
@@ -74,27 +85,84 @@ prompts gate every call regardless.
74	claude mcp add eitri -- /path/to/repo/bin/eitri-mcp	85	claude mcp add eitri -- /path/to/repo/bin/eitri-mcp
75	```	86	```
76		87
		88	## Setup: remote endpoint
		89
		90	Mint a personal access token in the console Settings page and point an MCP
		91	client at the endpoint with that token as a bearer credential:
		92
		93	```
		94	claude mcp add --transport http eitri https://api.eitri.sh/mcp \
		95	--header "Authorization: Bearer $EITRI_TOKEN"
		96	```
		97
		98	Then delegate access, which is what lets `vm_exec`, `vm_write_file`,
		99	`vm_read_file` and `vm_create`'s boot wait reach a guest. It is two calls and
		100	one `ssh-keygen`:
		101
		102	1. `delegate_begin` returns a public key, the principal (`ubuntu`) and the
		103	exact command to run.
		104	2. Run it. It signs eitri's public key with your CA, on your TTL:
		105
		106	```
		107	ssh-keygen -s ~/.ssh/my-ca -I eitri-delegation -n ubuntu -V +8h eitri-delegation.pub
		108	```
		109
		110	3. `delegate_complete` with the contents of `eitri-delegation-cert.pub`.
		111
		112	eitri holds no signing key at any point. Its half is an ephemeral keypair held
		113	in memory, useless without a certificate it cannot produce for itself. The
		114	certificate chains to a CA your tenant has already registered, so **VMs created
		115	before you delegate accept it too**.
		116
		117	The delegation lives in memory only. A control-plane restart drops it and you
		118	delegate again — the public key is stable, so that is one `ssh-keygen` and one
		119	`delegate_complete`. `GET /api/v1/delegations` reports the expiry; `DELETE`
		120	ends it now.
		121
		122	Delegation requires the tenant to have at least one registered SSH user CA
		123	(`eitri ca upload`), because a certificate signed by a CA your guests do not
		124	trust would be refused by them anyway.
		125
		126	The endpoint answers `POST` only; a `GET` is `405`. There are no sessions—each
		127	call carries its own credential. `vm_create` with the default `wait: true`
		128	blocks for as long as the guest takes to boot, and emits MCP progress
		129	notifications while it waits (for clients that ask for progress).
		130
77	## Access model	131	## Access model
78		132
79	eitri-mcp reaches VMs by name through eitri's SSH-CA jump gate. There is no	133	Both transports reach VMs by name over SSH, with certificates in both
80	injected key and no TOFU. It holds its own user CA (`ca_key_path`,	134	directions and no TOFU anywhere. In both, the user signing key stays with you:
81	load-or-create) and self-registers that CA's public key with its tenant on	135	they differ only in who does the signing and which path the connection takes.
82	first use; eitri never sees the private half. Per connection it signs a	136
83	short-lived user certificate locally (principal `ubuntu`) with that CA. It	137	Local stdio holds its own user CA (`ca_key_path`, load-or-create) and
84	fetches the eitri host CA's public key once via `GET /api/v1/ssh-ca`	138	self-registers that CA's public key with its tenant on first use; eitri never
85	and caches it. To reach a VM, it derives its tenant from the credential	139	sees the private half. Per connection it signs a short-lived user certificate
86	(`/me`, unless `tenant` pins one), dials the gate (the configured `gate`	140	locally (principal `ubuntu`) with that CA, fetches the eitri host CA's public
87	address), authenticates with the user certificate, and opens a tunnel to	141	key once via `GET /api/v1/ssh-ca`, dials the configured gate, and opens a tunnel
88	`<tenant>.<vm>:22`. VMs are addressed by their namespaced connect name,	142	to `<tenant>.<vm>:22`. Host identity is verified on both hops with
89	not IP, so recycled IPs and host-key churn are not a concern. Host identity	143	`ssh.CertChecker` against the host CA: the gate's certificate must carry its
90	is verified on both hops using `ssh.CertChecker` against the eitri host CA:	144	configured domain as principal, and each VM's must carry the VM's connect name.
91	the gate's host certificate must carry its configured domain as principal,	145
92	and each VM's host certificate must carry the VM's connect name. The guest	146	The remote endpoint is delegated a credential instead. eitri generates an
93	trusts the tenant's registered user CAs via `TrustedUserCAKeys`	147	ephemeral ed25519 keypair per tenant, in memory only, and hands you the public
94	(provisioned through vendor-data), so no per-VM `authorized_key` injection	148	half; you sign it with your own CA, on your own TTL and principals, and post the
95	is needed. The PAT authenticates API calls only; SSH traffic uses	149	certificate back. eitri then authenticates as that key-plus-certificate: it
96	the certificate, and the token itself is never surfaced in a tool result or	150	reaches the guest's sshd over the VM host's own sync tunnel and verifies the
97	error.	151	guest's host certificate under `<tenant>.<vm>:22` against the host CA. No
		152	signing key ever exists on the server, the certificate expires, and a restart
		153	drops it.
		154
		155	Because the certificate chains to a CA the tenant already registered, it is
		156	accepted by every guest that trusts that CA — including ones created long
		157	before the delegation. Remote exec without a live delegation is refused with the
		158	three-step recipe rather than a generic authentication failure.
		159
		160	VMs are addressed by their namespaced connect name, not IP, so recycled IPs and
		161	host-key churn are not a concern. The guest trusts the tenant's registered user
		162	CAs via `TrustedUserCAKeys` (provisioned through vendor-data), so no per-VM
		163	`authorized_key` injection is needed. The PAT authenticates API calls only; SSH
		164	traffic uses the certificate, and the token itself is never surfaced in a tool
		165	result or error.
98		166
99	## Semantics	167	## Semantics
100		168
@@ -109,11 +177,8 @@ error.
109	service. The tool descriptions say so, so the model treats publishing as a	177	service. The tool descriptions say so, so the model treats publishing as a
110	deliberate act. DNS, TLS certs and routing remain out of scope—the tools	178	deliberate act. DNS, TLS certs and routing remain out of scope—the tools
111	hand back a host address and a port.	179	hand back a host address and a port.
112	- The claude.ai connector (streamable HTTP transport + auth + ingress) is	180	- The remote endpoint authenticates with a bearer PAT. Browser connectors
113	phase 2 and not built—today's transport is stdio, for Claude Code only.	181	(claude.ai) need OAuth, which the endpoint does not speak.
114	Phase 2's VM access is expected to reuse the same short-lived-certificate
115	flow through the gate, just with gate ingress reachable from claude.ai
116	instead of only from the MCP's host.
117		182
118	> IMPORTANT—"ready" is not "booted." `vm_create`'s `lifecycle=ready`	183	> IMPORTANT—"ready" is not "booted." `vm_create`'s `lifecycle=ready`
119	> means cloud-hypervisor is up and the VM has an allocated IP; it does not	184	> means cloud-hypervisor is up and the VM has an allocated IP; it does not
@@ -128,6 +193,9 @@ error.
128		193
129	## Testing this yourself	194	## Testing this yourself
130		195
131	Unit tests (`internal/mcpserver/*_test.go`) cover the tools against fake API	196	Unit tests (`internal/mcpserver/_test.go`, `internal/server/mcphttp/_test.go`)
132	and SSH seams. End-to-end behaviour against a real VM is exercised by driving	197	cover the tools and the HTTP transport against fake API and SSH seams. The
133	the tools through a VM created on the fleet via `make deploy`.	198	deploy boot-gate (`make deploy`) drives a whole VM life through the remote
		199	endpoint with a bearer PAT: register a CA, `delegate_begin`, sign, refuse a
		200	certificate from an unregistered CA, `delegate_complete`, `vm_create`,
		201	`vm_exec`, `vm_expose`, dial the published port, `vm_destroy`.

docs/openapi.json

@@ @@ -167,6 +167,67 @@ @@
+        ],
+        "type": "object"
+      },
+      "Delegation": {
+        "properties": {
+          "ca_fingerprint": {
+            "type": "string"
+          },
+          "expires_at": {
+            "type": "string"
+          },
+          "key_id": {
+            "type": "string"
+          },
+          "principals": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "public_key": {
+            "type": "string"
+          },
+          "serial": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "ca_fingerprint",
+          "expires_at",
+          "key_id",
+          "principals",
+          "public_key",
+          "serial"
+        ],
+        "type": "object"
+      },
+      "DelegationChallenge": {
+        "properties": {
+          "instructions": {
+            "type": "string"
+          },
+          "principal": {
+            "type": "string"
+          },
+          "public_key": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "instructions",
+          "principal",
+          "public_key"
+        ],
+        "type": "object"
+      },
+      "DelegationRequest": {
+        "properties": {
+          "certificate": {
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "EnrollRequest": {
+        "properties": {
+          "arch": {
@@ @@ -762,6 +823,131 @@ @@
+        "summary": "Newest audit log rows."
+    },
+    "/api/v1/delegations": {
+      "delete": {
+        "responses": {
+          "204": {
+            "description": "success"
+          },
+          "default": {
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "description": "error (plain text)"
+          }
+        },
+        "security": [
+          {
+            "patToken": []
+          }
+        ],
+        "summary": "End the caller tenant's delegation now. eitri drops the certificate and can no longer reach that tenant's VMs."
+      },
+      "get": {
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Delegation"
+                }
+              }
+            },
+            "description": "success"
+          },
+          "default": {
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "description": "error (plain text)"
+          }
+        },
+        "security": [
+          {
+            "patToken": []
+          }
+        ],
+        "summary": "Describe the caller tenant's live delegation, including when it expires. 404 when there is none."
+      },
+      "post": {
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DelegationChallenge"
+                }
+              }
+            },
+            "description": "success"
+          },
+          "default": {
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "description": "error (plain text)"
+          }
+        },
+        "security": [
+          {
+            "patToken": []
+          }
+        ],
+        "summary": "Start a delegation: returns the ephemeral public key eitri will authenticate with, the principal the certificate must carry, and the ssh-keygen command that signs it. The key is stable for the life of the process."
+      },
+      "put": {
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DelegationRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Delegation"
+                }
+              }
+            },
+            "description": "success"
+          },
+          "default": {
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "description": "error (plain text)"
+          }
+        },
+        "security": [
+          {
+            "patToken": []
+          }
+        ],
+        "summary": "Complete a delegation with the certificate your CA signed. The certificate must be a user certificate over the key this delegation issued, signed by a CA registered to your tenant, naming the guest login user as a principal."
+      }
+    },
+    "/api/v1/enroll": {
+      "post": {
+        "requestBody": {

docs/releases.md

@@ @@ -5,6 +5,40 @@ Tarballs and checksums for every release live at @@
+newest. The [quickstart](quickstart.md) takes a release from download to a
+running VM.
+## v0.0.4
+A PAT is enough. Point an LLM client anywhere on the internet at
+`https://api.eitri.sh/mcp` with a personal access token and it gets the whole
+eitri toolset: create a VM, run commands in it, publish a port, hand back the
+address. No local install, no config file, no CA of your own.
+**The MCP endpoint.** eitri-server serves MCP at `/mcp` over streamable HTTP,
+stateless, authenticated with the same bearer token the API takes. One binary,
+one deploy: the tools call the API in-process, so tenant filtering and
+authorization are the API's own, and a caller sees exactly the fleet its token
+can see. The stdio binary is unchanged and still there for local use—both
+transports serve the same tools, from the same code.
+**Delegated access, not a held key.** A token holder has no key to sign with,
+and eitri has none to lend: it holds no signing key for anyone. So the direction
+reverses. eitri generates an ephemeral keypair, in memory only, and hands you
+the public half; you sign it with your own CA on your own TTL (`ssh-keygen -s`)
+and hand the certificate back. eitri authenticates as that key plus that
+certificate until it expires, and holds nothing else. A restart drops the
+delegation and you delegate again. Because the certificate chains to a CA you
+already registered, VMs created before you delegated accept it too.
+**Your guests' host keys stay on your hosts.** A guest's SSH host key is
+generated by the machine that runs it and never leaves it. The host reports the
+public half, the control plane signs a certificate for the name on the VM's
+row, and the guest boots with a key nothing above its host has ever held.
+Opening the database clears every host key escrowed by an earlier release.
+**Progress on the long call.** `vm_create` waits for the guest to boot and
+cloud-init to settle, which can take minutes. It now reports what it is waiting
+for as it waits, so a model watching a ten-minute call sees a VM coming up
+rather than silence.
+## v0.0.3
+macOS hosts. An Apple-silicon Mac joins the fleet as a host and runs Linux

docs/shape.html

Old		New
@@ -392,6 +392,7 @@
392	"internal/names",	392	"internal/names",
393	"internal/random",	393	"internal/random",
394	"internal/server/api/types",	394	"internal/server/api/types",
		395	"internal/server/delegation",
395	"internal/server/hosttoken",	396	"internal/server/hosttoken",
396	"internal/server/hub",	397	"internal/server/hub",
397	"internal/server/registry",	398	"internal/server/registry",
@@ -433,14 +434,17 @@
433	"internal/joinblob",	434	"internal/joinblob",
434	"internal/server/api",	435	"internal/server/api",
435	"internal/server/config",	436	"internal/server/config",
		437	"internal/server/delegation",
436	"internal/server/health",	438	"internal/server/health",
437	"internal/server/hub",	439	"internal/server/hub",
		440	"internal/server/mcphttp",
438	"internal/server/registry",	441	"internal/server/registry",
439	"internal/server/release",	442	"internal/server/release",
440	"internal/server/sshca",	443	"internal/server/sshca",
441	"internal/server/sshgate",	444	"internal/server/sshgate",
442	"internal/server/store",	445	"internal/server/store",
443	"internal/server/syncsvc",	446	"internal/server/syncsvc",
		447	"internal/server/vmssh",
444	"internal/server/web",	448	"internal/server/web",
445	"internal/transport"	449	"internal/transport"
446	]	450	]
@@ -452,6 +456,12 @@
452	"imports": []	456	"imports": []
453	},	457	},
454	{	458	{
		459	"importPath": "internal/server/delegation",
		460	"plane": "control",
		461	"synopsis": "Package delegation holds the credentials a tenant has lent eitri.",
		462	"imports": []
		463	},
		464	{
455	"importPath": "internal/server/health",	465	"importPath": "internal/server/health",
456	"plane": "control",	466	"plane": "control",
457	"synopsis": "Package health serves the eitri-server liveness and readiness probes.",	467	"synopsis": "Package health serves the eitri-server liveness and readiness probes.",
@@ -470,6 +480,17 @@
470	"imports": []	480	"imports": []
471	},	481	},
472	{	482	{
		483	"importPath": "internal/server/mcphttp",
		484	"plane": "control",
		485	"synopsis": "Package mcphttp serves the eitri MCP toolset over HTTP at /mcp.",
		486	"imports": [
		487	"internal/mcpserver",
		488	"internal/server/api",
		489	"internal/server/api/client",
		490	"internal/server/vmssh"
		491	]
		492	},
		493	{
473	"importPath": "internal/server/registry",	494	"importPath": "internal/server/registry",
474	"plane": "control",	495	"plane": "control",
475	"synopsis": "Package registry holds volatile actual state in memory.",	496	"synopsis": "Package registry holds volatile actual state in memory.",
@@ -526,6 +547,12 @@
526	]	547	]
527	},	548	},
528	{	549	{
		550	"importPath": "internal/server/vmssh",
		551	"plane": "control",
		552	"synopsis": "Package vmssh reaches a tenant's VM from inside the control plane: it tunnels to the guest's sshd over the host's live sync connection and authenticates with the credential that tenant has delegated to eitri.",
		553	"imports": []
		554	},
		555	{
529	"importPath": "internal/server/web",	556	"importPath": "internal/server/web",
530	"plane": "control",	557	"plane": "control",
531	"synopsis": "Package web embeds the built SvelteKit single-page app and serves it with SPA-style fallback (unknown paths resolve to index.html for client routing).",	558	"synopsis": "Package web embeds the built SvelteKit single-page app and serves it with SPA-style fallback (unknown paths resolve to index.html for client routing).",

docs/shape.json

Old		New
@@ -341,6 +341,7 @@
341	"internal/names",	341	"internal/names",
342	"internal/random",	342	"internal/random",
343	"internal/server/api/types",	343	"internal/server/api/types",
		344	"internal/server/delegation",
344	"internal/server/hosttoken",	345	"internal/server/hosttoken",
345	"internal/server/hub",	346	"internal/server/hub",
346	"internal/server/registry",	347	"internal/server/registry",
@@ -382,14 +383,17 @@
382	"internal/joinblob",	383	"internal/joinblob",
383	"internal/server/api",	384	"internal/server/api",
384	"internal/server/config",	385	"internal/server/config",
		386	"internal/server/delegation",
385	"internal/server/health",	387	"internal/server/health",
386	"internal/server/hub",	388	"internal/server/hub",
		389	"internal/server/mcphttp",
387	"internal/server/registry",	390	"internal/server/registry",
388	"internal/server/release",	391	"internal/server/release",
389	"internal/server/sshca",	392	"internal/server/sshca",
390	"internal/server/sshgate",	393	"internal/server/sshgate",
391	"internal/server/store",	394	"internal/server/store",
392	"internal/server/syncsvc",	395	"internal/server/syncsvc",
		396	"internal/server/vmssh",
393	"internal/server/web",	397	"internal/server/web",
394	"internal/transport"	398	"internal/transport"
395	]	399	]
@@ -401,6 +405,12 @@
401	"imports": []	405	"imports": []
402	},	406	},
403	{	407	{
		408	"importPath": "internal/server/delegation",
		409	"plane": "control",
		410	"synopsis": "Package delegation holds the credentials a tenant has lent eitri.",
		411	"imports": []
		412	},
		413	{
404	"importPath": "internal/server/health",	414	"importPath": "internal/server/health",
405	"plane": "control",	415	"plane": "control",
406	"synopsis": "Package health serves the eitri-server liveness and readiness probes.",	416	"synopsis": "Package health serves the eitri-server liveness and readiness probes.",
@@ -419,6 +429,17 @@
419	"imports": []	429	"imports": []
420	},	430	},
421	{	431	{
		432	"importPath": "internal/server/mcphttp",
		433	"plane": "control",
		434	"synopsis": "Package mcphttp serves the eitri MCP toolset over HTTP at /mcp.",
		435	"imports": [
		436	"internal/mcpserver",
		437	"internal/server/api",
		438	"internal/server/api/client",
		439	"internal/server/vmssh"
		440	]
		441	},
		442	{
422	"importPath": "internal/server/registry",	443	"importPath": "internal/server/registry",
423	"plane": "control",	444	"plane": "control",
424	"synopsis": "Package registry holds volatile actual state in memory.",	445	"synopsis": "Package registry holds volatile actual state in memory.",
@@ -475,6 +496,12 @@
475	]	496	]
476	},	497	},
477	{	498	{
		499	"importPath": "internal/server/vmssh",
		500	"plane": "control",
		501	"synopsis": "Package vmssh reaches a tenant's VM from inside the control plane: it tunnels to the guest's sshd over the host's live sync connection and authenticates with the credential that tenant has delegated to eitri.",
		502	"imports": []
		503	},
		504	{
478	"importPath": "internal/server/web",	505	"importPath": "internal/server/web",
479	"plane": "control",	506	"plane": "control",
480	"synopsis": "Package web embeds the built SvelteKit single-page app and serves it with SPA-style fallback (unknown paths resolve to index.html for client routing).",	507	"synopsis": "Package web embeds the built SvelteKit single-page app and serves it with SPA-style fallback (unknown paths resolve to index.html for client routing).",

docs/ssh-access.md

+CAs present at its creation. The gate authorizes each connection against the
+tenant the signing CA was uploaded to.
+## Delegating access to eitri
+A caller holding only a token has no CA and no private key, so it cannot sign
+anything — and eitri holds no signing key for anyone, so it cannot sign on their
+behalf either. Instead, you lend eitri a credential.
+eitri generates an ephemeral keypair for your tenant, in memory only, and hands
+you the public half:
+```sh
+curl -X POST -H "Authorization: Bearer $EITRI_TOKEN" \
+  https://eitri.example.com/api/v1/delegations
+```
+Sign it with your own CA, on your own terms:
+```sh
+printf '%s\n' "<public_key from the response>" > eitri-delegation.pub
+ssh-keygen -s ~/.ssh/eitri-user-ca -I eitri-delegation -n ubuntu -V +8h eitri-delegation.pub
+```
+`-n ubuntu` is not optional. A guest matches the certificate's principals
+against the login user, so a certificate naming anything else is refused by
+every guest. Post the result back:
+```sh
+curl -X PUT -H "Authorization: Bearer $EITRI_TOKEN" \
+  -H 'Content-Type: application/json' \
+  -d "{\"certificate\": \"$(cat eitri-delegation-cert.pub)\"}" \
+  https://eitri.example.com/api/v1/delegations
+```
+eitri now authenticates to your guests as that key plus that certificate, until
+the certificate expires. It holds nothing else. `GET /api/v1/delegations`
+reports the expiry; `DELETE` ends it immediately. So does restarting the
+control plane — a delegation is in memory and nowhere else, which is the point.
+Because the certificate chains to a CA you have already registered, guests
+created **before** you delegated accept it. That is the difference from
+registering a new CA: there is no ordering constraint, because nothing about the
+guest's trust changes.
+This is what makes [the remote MCP endpoint](mcp.md) work with nothing but a
+PAT, where the same two steps are the `delegate_begin` and `delegate_complete`
+tools.
+## One-liner
+```sh

internal/mcpserver/cli.go

Old		New
@@ -1,9 +1,9 @@
1	// cli.go is the eitri-mcp command line: it loads the config, loads (or creates)	1	// cli.go is the eitri-mcp command line: it loads the config, loads (or creates)
2	// a persistent per-client user CA, and serves the MCP tools over stdio. The user	2	// a persistent per-client user CA, and serves the MCP tools over stdio. The user
3	// CA self-registers with the caller's tenant on first gate use (see	3	// CA self-registers with the caller's tenant on first gate use (see
4	// Runner.ensure), so a fresh install needs only a PAT. It lives here rather than	4	// gateDialer.ensure), so a fresh install needs only a PAT. It lives here rather
5	// in cmd/eitri-mcp so it is testable and coverage-gated (arch R14: main packages	5	// than in cmd/eitri-mcp so it is testable and coverage-gated (arch R14: main
6	// are wiring only).	6	// packages are wiring only).
7		7
8	package mcpserver	8	package mcpserver
9		9
@@ -60,34 +60,26 @@ func run(cfgPath string) error {
60	api := &client.Client{BaseURL: cfg.ServerURL, Token: cfg.Token, UserCALabel: caLabel()}	60	api := &client.Client{BaseURL: cfg.ServerURL, Token: cfg.Token, UserCALabel: caLabel()}
61	tools := &Tools{	61	tools := &Tools{
62	API: API{Client: api},	62	API: API{Client: api},
63	Runner: NewRunner(RunnerConfig{	63	Runner: NewRunner(newGateDialer(gateDialerConfig{
64	Gate: cfg.Gate,	64	Gate: cfg.Gate,
65	VMUser: cfg.VMUser,	65	VMUser: cfg.VMUser,
66	API: api,	66	API: api,
67	UserCA: userCA,	67	UserCA: userCA,
68	Tenant: cfg.Tenant,	68	Tenant: cfg.Tenant,
69	}),	69	})),
70	Gate: cfg.Gate,	70	Gate: cfg.Gate,
71	VMUser: cfg.VMUser,	71	VMUser: cfg.VMUser,
72	}	72	}
73		73
74	server := mcp.NewServer(&mcp.Implementation{Name: "eitri", Version: "0.1.0"}, nil)	74	// No Registrar: this install signs with its own CA, so it has nothing to
75	register(server, "vm_create", "Create an eitri VM (persistent). Waits for ready+cloud-init by default.", tools.VMCreate)	75	// ask eitri to hold.
76	register(server, "vm_list", "List all VMs on the eitri fleet.", tools.VMList)	76	server := NewServer(tools, Options{})
77	register(server, "vm_info", "Show one VM's state and how to reach it.", tools.VMInfo)
78	register(server, "vm_exec", "Run a shell command in a VM over SSH; returns stdout/stderr/exit code.", tools.VMExec)
79	register(server, "vm_write_file", "Write content to a file in a VM (parents created).", tools.VMWriteFile)
80	register(server, "vm_read_file", "Read a file from a VM (capped at 1 MiB).", tools.VMReadFile)
81	register(server, "vm_expose", "Publish a VM's guest TCP port on its host and return the address to dial. Omit host_port to allocate one from 30000-32767. WARNING: a published port has NO AUTHENTICATION in front of it — whoever can reach the host on that port reaches the service. Publish only what is meant to be reachable.", tools.VMExpose)
82	register(server, "vm_exposures", "List a VM's published ports, with the address to dial and each listener's state. These ports are unauthenticated.", tools.VMExposures)
83	register(server, "vm_unexpose", "Stop publishing a VM's guest port; the host closes the listener.", tools.VMUnexpose)
84	register(server, "vm_destroy", "Destroy a VM by id or EXACT name. Explicit-only; never called automatically.", tools.VMDestroy)
85		77
86	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)	78	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
87	defer stop()	79	defer stop()
88		80
89	// The user CA registers with the caller's tenant lazily, on the first gate	81	// The user CA registers with the caller's tenant lazily, on the first gate
90	// connection (Runner.ensure), so a control-plane blip at startup can't stop the	82	// connection (gateDialer.ensure), so a control-plane blip at startup can't stop the
91	// server from coming up and serving the non-SSH tools.	83	// server from coming up and serving the non-SSH tools.
92	return server.Run(ctx, &mcp.StdioTransport{})	84	return server.Run(ctx, &mcp.StdioTransport{})
93	}	85	}
@@ -146,19 +138,3 @@ func loadOrCreateCA(path string) (ssh.Signer, error) {
146	}	138	}
147	return signer, nil	139	return signer, nil
148	}	140	}
149
150	// register adapts a Tools method to the SDK. This is the ONLY place that
151	// touches SDK generics; if the SDK's handler signature changes, change it here.
152	//
153	// Note on the hand-off contract: the SDK drops the Out value when the handler
154	// returns a non-nil error — StructuredContent is left unset and only err.Error()
155	// reaches the model (as IsError text content). VMCreate's degraded-path errors
156	// are self-sufficient (they name the VM id+name), so the model can still find
157	// and destroy the VM from the error text.
158	func register[In, Out any](s *mcp.Server, name, desc string, fn func(context.Context, In) (Out, error)) {
159	mcp.AddTool(s, &mcp.Tool{Name: name, Description: desc},
160	func(ctx context.Context, req mcp.CallToolRequest, in In) (mcp.CallToolResult, Out, error) {
161	out, err := fn(ctx, in)
162	return nil, out, err
163	})
164	}

internal/mcpserver/gatedial.go

@@ @@ -0,0 +1,139 @@ @@
+package mcpserver
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+	"github.com/a73x/eitri/internal/gateclient"
+	"github.com/a73x/eitri/internal/server/api/client"
+	"golang.org/x/crypto/ssh"
+)
+// gateAPI is what the gate dialer needs from the control-plane client to
+// prepare credentials before the first connection: derive the caller's tenant
+// (Me), and verify/register this client's user CA (ListUserCAs + the embedded
+// CertAuthority's UploadUserCA). One *client.Client value satisfies it.
+type gateAPI interface {
+	gateclient.CertAuthority
+	Me() (client.Me, error)
+	ListUserCAs(ctx context.Context, tenant string) ([]client.UserCA, error)
+}
+var _ gateAPI = (*client.Client)(nil)
+// gateDialerConfig configures SSH access to VMs through the eitri SSH-CA jump
+// gate. Gate credentials are prepared lazily on first use from API + UserCA +
+// Tenant (see gateDialer.ensure); the Gate/VMUser fields shape the dial itself.
+type gateDialerConfig struct {
+	Gate   string           // gate SSH address "<gate-domain>:<port>" (also the host-cert principal host)
+	VMUser string           // guest login user, e.g. "ubuntu" (matches the cert principal)
+	API    gateAPI          // control-plane client backing tenant derivation, CA registration, host-CA fetch
+	UserCA ssh.Signer       // this client's persistent user CA; signs user certs locally
+	Tenant string           // configured tenant; "" ⇒ derive from the credential via Me()
+	Now    func() time.Time // test seam; nil ⇒ time.Now
+}
+// gateDialer reaches VMs the way a client outside the fleet does: through the
+// SSH-CA jump gate, authenticating with short-lived user certs it self-signs
+// with its own persistent user CA, verifying both hops' host certs against the
+// eitri host CA. Registering that CA with the caller's tenant is a local
+// install's concern and lives here, not in the shared tool layer — the control
+// plane holds its own signing key and needs none of it.
+type gateDialer struct {
+	cfg gateDialerConfig
+	mu   sync.Mutex
+	auth gateclient.Credentials // gate credentials, built once ensure() succeeds; tests may inject
+}
+func newGateDialer(cfg gateDialerConfig) *gateDialer { return &gateDialer{cfg: cfg} }
+var _ VMDialer = (*gateDialer)(nil)
+// ensure prepares gate credentials on first use and caches them in g.auth. It
+// resolves the caller's tenant (the configured one, else derived from the
+// credential via Me()) and makes sure this client's user CA is registered with
+// that tenant so VMs trust the certs it signs. Idempotent across restarts —
+// registration lists the tenant's user CAs and uploads only when its own
+// fingerprint is absent. A failed ensure caches nothing, so the next call
+// retries; its error names the manual fallback (`eitri ca upload`). Never logs or
+// returns key material.
+func (g *gateDialer) ensure(ctx context.Context) error {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.auth != nil {
+		return nil
+	}
+	tenant := g.cfg.Tenant
+	if tenant == "" {
+		// The credential names the tenant; derive it for the connect name, whose
+		// <tenant>.<vmName> form the VM's host cert principal must match.
+		me, err := g.cfg.API.Me()
+		if err != nil {
+			return fmt.Errorf("resolving tenant from credential: %w", err)
+		}
+		if me.Tenant == "" {
+			return errors.New("credential resolves to no tenant")
+		}
+		tenant = me.Tenant
+	}
+	if err := g.registerUserCA(ctx); err != nil {
+		return err
+	}
+	g.auth = gateclient.NewGateAuth(g.cfg.API, g.cfg.UserCA, tenant, g.cfg.Now)
+	return nil
+}
+// registerUserCA idempotently registers this client's user-CA public key with
+// the caller's tenant: it lists the registered CAs and uploads the local pubkey
+// only if its fingerprint is absent. Routing follows the configured tenant — an
+// empty tenant hits the tenant-less endpoints, which operate on the caller's own
+// tenant (the credential names it). Errors name the manual fallback and never
+// carry key material.
+func (g *gateDialer) registerUserCA(ctx context.Context) error {
+	pub := g.cfg.UserCA.PublicKey()
+	fp := ssh.FingerprintSHA256(pub)
+	cas, err := g.cfg.API.ListUserCAs(ctx, g.cfg.Tenant)
+	if err != nil {
+		return fmt.Errorf("checking registered user CAs (run `eitri ca upload` to register manually): %w", err)
+	}
+	for _, ca := range cas {
+		if ca.Fingerprint == fp {
+			return nil
+		}
+	}
+	line := strings.TrimSpace(string(ssh.MarshalAuthorizedKey(pub)))
+	if err := g.cfg.API.UploadUserCA(ctx, g.cfg.Tenant, line); err != nil {
+		return fmt.Errorf("registering user CA (run `eitri ca upload` to register manually): %w", err)
+	}
+	return nil
+}
+// ConnectName returns the gate connect name for vmName — "<tenant>.<vmName>". It
+// prepares gate credentials on first use, since the tenant half of the name may
+// have to be derived from the credential.
+func (g *gateDialer) ConnectName(ctx context.Context, vmName string) (string, error) {
+	if err := g.ensure(ctx); err != nil {
+		return "", err
+	}
+	g.mu.Lock()
+	auth := g.auth
+	g.mu.Unlock()
+	return auth.ConnectName(ctx, vmName)
+}
+// Dial reaches the VM named vmName through the eitri SSH-CA gate. See
+// gateclient.Dial for the two-hop dial logic this delegates to.
+func (g *gateDialer) Dial(ctx context.Context, vmName string) (*ssh.Client, error) {
+	if err := g.ensure(ctx); err != nil {
+		return nil, err
+	}
+	g.mu.Lock()
+	auth := g.auth
+	g.mu.Unlock()
+	return gateclient.Dial(ctx, gateclient.DialConfig{Gate: g.cfg.Gate, VMUser: g.cfg.VMUser, Auth: auth}, vmName)
+}

internal/mcpserver/server.go

@@ @@ -0,0 +1,159 @@ @@
+package mcpserver
+import (
+	"context"
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+)
+// Options selects the tools a transport exposes. The VM tools and ca_upload are
+// common; the two delegation tools are remote-only — a local install holds its
+// own CA and signs locally, so it has nothing to delegate.
+type Options struct {
+	Delegator   Delegator        // non-nil ⇒ expose the delegate tools
+	SchemaCache *mcp.SchemaCache // shared across per-request servers, so re-registering tools costs no reflection
+}
+// Delegator is the two-step exchange by which a caller lends eitri access:
+// eitri offers a public key, the caller's own CA signs it, eitri gets the
+// certificate back.
+type Delegator interface {
+	Begin(ctx context.Context) (BeginResult, error)
+	Complete(ctx context.Context, certificate string) (DelegationResult, error)
+}
+// BeginResult is what the model shows its human. Note is worded for a model
+// that would otherwise try to complete the exchange by itself.
+type BeginResult struct {
+	PublicKey    string `json:"public_key"`
+	Principal    string `json:"principal"`
+	Instructions string `json:"instructions"`
+	Note         string `json:"note"`
+}
+// DelegationResult reports what eitri may now do, and until when.
+type DelegationResult struct {
+	ExpiresAt     string   `json:"expires_at"`
+	CAFingerprint string   `json:"ca_fingerprint"`
+	Principals    []string `json:"principals"`
+	Note          string   `json:"note"`
+}
+// DelegateBeginIn takes no arguments: asking is the whole operation.
+type DelegateBeginIn struct{}
+// DelegateCompleteIn carries the signed certificate. A certificate is public
+// material — see the tool description, which says so, because a model may
+// otherwise refuse to paste something that looks like key material.
+type DelegateCompleteIn struct {
+	Certificate string `json:"certificate" jsonschema:"the contents of the *-cert.pub file your CA produced"`
+}
+// NewServer builds the MCP server for one identity. Both transports go through
+// here, so the tool list cannot drift between them.
+func NewServer(t *Tools, opts Options) *mcp.Server {
+	s := mcp.NewServer(&mcp.Implementation{Name: "eitri", Version: "0.1.0"},
+		&mcp.ServerOptions{SchemaCache: opts.SchemaCache})
+	register(s, "vm_create", "Create an eitri VM (persistent). Waits for ready+cloud-init by default.", t.VMCreate)
+	register(s, "vm_list", "List all VMs on the eitri fleet.", t.VMList)
+	register(s, "vm_info", "Show one VM's state and how to reach it.", t.VMInfo)
+	register(s, "vm_exec", "Run a shell command in a VM over SSH; returns stdout/stderr/exit code.", t.VMExec)
+	register(s, "vm_write_file", "Write content to a file in a VM (parents created).", t.VMWriteFile)
+	register(s, "vm_read_file", "Read a file from a VM (capped at 1 MiB).", t.VMReadFile)
+	register(s, "vm_expose", "Publish a VM's guest TCP port on its host and return the address to dial. Omit host_port to allocate one from 30000-32767. WARNING: a published port has NO AUTHENTICATION in front of it — whoever can reach the host on that port reaches the service. Publish only what is meant to be reachable.", t.VMExpose)
+	register(s, "vm_exposures", "List a VM's published ports, with the address to dial and each listener's state. These ports are unauthenticated.", t.VMExposures)
+	register(s, "vm_unexpose", "Stop publishing a VM's guest port; the host closes the listener.", t.VMUnexpose)
+	register(s, "vm_destroy", "Destroy a VM by id or EXACT name. Explicit-only; never called automatically.", t.VMDestroy)
+	register(s, "ca_upload",
+		"Register your SSH user CA's PUBLIC key with your tenant, so your guests trust certificates it signs. "+
+			"Only the public half is sent — eitri never holds a signing key. "+
+			"IMPORTANT: a guest bakes its trusted CA set when it is created, so VMs that already exist will NOT "+
+			"trust a CA uploaded now; create new VMs after uploading. Do this before vm_create, and before delegating.",
+		t.CAUpload)
+	register(s, "tenant_info",
+		"Show how this tenant is set up: which SSH CAs are registered (fingerprint and label), whether eitri "+
+			"currently holds a delegation and when it expires, and the gate address. Read-only. Call it first "+
+			"when an SSH operation fails, instead of guessing which step was skipped.",
+		t.TenantInfo)
+	if opts.Delegator != nil {
+		dg := opts.Delegator
+		register(s, "delegate_begin",
+			"Ask for the public key your CA is to sign, so eitri can reach your VMs. eitri holds no signing key and "+
+				"cannot sign this itself — that is the point. Show the human the public key and the command, and wait "+
+				"for them to hand back the certificate; do not try to produce it yourself. The key stays the same "+
+				"until the control plane restarts — a delegation is held in memory, so after a restart call this "+
+				"tool again for the new key rather than reusing an old certificate.",
+			func(ctx context.Context, _ DelegateBeginIn) (BeginResult, error) { return dg.Begin(ctx) })
+		register(s, "delegate_complete",
+			"Hand back the certificate your CA signed. Certificates are public material, so passing one as an "+
+				"argument is safe — it is not a key and grants nothing without the key eitri holds in memory. "+
+				"Afterwards eitri can reach your VMs until the certificate expires. Because it chains to a CA your "+
+				"tenant already registered, VMs created before this call accept it too.",
+			func(ctx context.Context, in DelegateCompleteIn) (DelegationResult, error) {
+				return dg.Complete(ctx, in.Certificate)
+			})
+	}
+	return s
+}
+// progressKey carries the per-request progress reporter.
+type progressKey struct{}
+// withProgress returns a context whose long waits report to report. A transport
+// that cannot deliver notifications simply does not install one.
+func withProgress(ctx context.Context, report func(message string)) context.Context {
+	return context.WithValue(ctx, progressKey{}, report)
+}
+// reportProgress tells the caller a long-running tool is still working. It is a
+// no-op when nothing is listening, which is every case but a remote tool call
+// whose client asked for progress.
+//
+// It is not only courtesy: vm_create blocks for up to ten minutes and emits
+// nothing until it finishes, and a proxy in front of the control plane will cut
+// an origin connection that stays silent for a hundred seconds.
+func reportProgress(ctx context.Context, message string) {
+	if report, ok := ctx.Value(progressKey{}).(func(string)); ok && report != nil {
+		report(message)
+	}
+}
+// register adapts a Tools method to the SDK. This is the ONLY place that
+// touches SDK generics; if the SDK's handler signature changes, change it here.
+//
+// Note on the hand-off contract: the SDK drops the Out value when the handler
+// returns a non-nil error — StructuredContent is left unset and only err.Error()
+// reaches the model (as IsError text content). VMCreate's degraded-path errors
+// are self-sufficient (they name the VM id+name), so the model can still find
+// and destroy the VM from the error text.
+func register[In, Out any](s *mcp.Server, name, desc string, fn func(context.Context, In) (Out, error)) {
+	mcp.AddTool(s, &mcp.Tool{Name: name, Description: desc},
+		func(ctx context.Context, req *mcp.CallToolRequest, in In) (*mcp.CallToolResult, Out, error) {
+			out, err := fn(withProgress(ctx, progressReporter(ctx, req)), in)
+			return nil, out, err
+		})
+}
+// progressReporter builds the notifier for one tool call, or nil when the
+// client did not ask for progress. The MCP contract is that progress is
+// reported only against a token the client supplied, so a client that sent none
+// gets none.
+func progressReporter(ctx context.Context, req *mcp.CallToolRequest) func(string) {
+	if req == nil || req.Session == nil || req.Params == nil {
+		return nil
+	}
+	token := req.Params.GetProgressToken()
+	if token == nil {
+		return nil
+	}
+	session := req.Session
+	step := 0.0
+	return func(message string) {
+		step++
+		// Best-effort: a client that has gone away must not fail the operation
+		// it asked for.
+		_ = session.NotifyProgress(ctx, &mcp.ProgressNotificationParams{
+			ProgressToken: token, Message: message, Progress: step,
+		})
+	}
+}

internal/mcpserver/server_test.go

@@ @@ -0,0 +1,197 @@ @@
+package mcpserver
+import (
+	"context"
+	"errors"
+	"testing"
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+// commonTools is the toolset both transports expose, in the order NewServer
+// registers it. A change here is a change to the published contract.
+var commonTools = []string{
+	"vm_create", "vm_list", "vm_info", "vm_exec", "vm_write_file",
+	"vm_read_file", "vm_expose", "vm_exposures", "vm_unexpose", "vm_destroy",
+	"ca_upload", "tenant_info",
+}
+// toolNames connects an in-memory client to s and lists what it advertises.
+func toolNames(t *testing.T, s *mcp.Server) []string {
+	t.Helper()
+	ctx := t.Context()
+	serverTr, clientTr := mcp.NewInMemoryTransports()
+	ss, err := s.Connect(ctx, serverTr, nil)
+	require.NoError(t, err)
+	defer ss.Close()
+	cs, err := mcp.NewClient(&mcp.Implementation{Name: "test", Version: "0"}, nil).Connect(ctx, clientTr, nil)
+	require.NoError(t, err)
+	defer cs.Close()
+	res, err := cs.ListTools(ctx, nil)
+	require.NoError(t, err)
+	names := make([]string, 0, len(res.Tools))
+	for _, tool := range res.Tools {
+		names = append(names, tool.Name)
+	}
+	return names
+}
+// fakeDelegator stands in for the control plane's delegation endpoints.
+type fakeDelegator struct {
+	begin    BeginResult
+	complete DelegationResult
+	err      error
+	beganN   int
+	gotCert  string
+}
+func (f *fakeDelegator) Begin(context.Context) (BeginResult, error) {
+	f.beganN++
+	return f.begin, f.err
+}
+func (f *fakeDelegator) Complete(_ context.Context, certificate string) (DelegationResult, error) {
+	f.gotCert = certificate
+	return f.complete, f.err
+}
+// connect wires an in-memory client to s.
+func connect(t *testing.T, s *mcp.Server) *mcp.ClientSession {
+	t.Helper()
+	ctx := t.Context()
+	serverTr, clientTr := mcp.NewInMemoryTransports()
+	ss, err := s.Connect(ctx, serverTr, nil)
+	require.NoError(t, err)
+	t.Cleanup(func() { ss.Close() })
+	cs, err := mcp.NewClient(&mcp.Implementation{Name: "test", Version: "0"}, nil).Connect(ctx, clientTr, nil)
+	require.NoError(t, err)
+	t.Cleanup(func() { cs.Close() })
+	return cs
+}
+// describe returns one tool's advertised description.
+func describe(t *testing.T, cs *mcp.ClientSession, name string) string {
+	t.Helper()
+	res, err := cs.ListTools(t.Context(), nil)
+	require.NoError(t, err)
+	for _, tool := range res.Tools {
+		if tool.Name == name {
+			return tool.Description
+		}
+	}
+	return ""
+}
+// TestNewServerExposesTheCommonTools: a local stdio install gets the VM tools
+// and ca_upload, and nothing else — it holds its own CA and signs locally, so
+// it has nothing to delegate.
+func TestNewServerExposesTheCommonTools(t *testing.T) {
+	names := toolNames(t, NewServer(&Tools{}, Options{}))
+	assert.ElementsMatch(t, commonTools, names)
+}
+// TestNewServerAddsTheDelegateToolsForARemoteTransport: the two extra tools
+// appear only when a transport can carry the exchange.
+func TestNewServerAddsTheDelegateToolsForARemoteTransport(t *testing.T) {
+	names := toolNames(t, NewServer(&Tools{}, Options{Delegator: &fakeDelegator{}}))
+	assert.ElementsMatch(t, append(append([]string{}, commonTools...), "delegate_begin", "delegate_complete"), names)
+}
+// TestDelegateBeginDescriptionStopsAModelSigningItItself: the description is
+// the only thing standing between a model and an hour of trying to produce a
+// certificate eitri deliberately cannot produce.
+func TestDelegateBeginDescriptionStopsAModelSigningItItself(t *testing.T) {
+	desc := describe(t, connect(t, NewServer(&Tools{}, Options{Delegator: &fakeDelegator{}})), "delegate_begin")
+	require.NotEmpty(t, desc)
+	assert.Contains(t, desc, "cannot sign this itself")
+	assert.Contains(t, desc, "Show the human")
+	assert.Contains(t, desc, "wait")
+}
+// TestDelegateCompleteDescriptionSaysACertificateIsPublic: a model may
+// otherwise refuse to paste something that looks like key material.
+func TestDelegateCompleteDescriptionSaysACertificateIsPublic(t *testing.T) {
+	desc := describe(t, connect(t, NewServer(&Tools{}, Options{Delegator: &fakeDelegator{}})), "delegate_complete")
+	require.NotEmpty(t, desc)
+	assert.Contains(t, desc, "public material")
+	assert.Contains(t, desc, "until the certificate expires")
+	assert.Contains(t, desc, "VMs created before this call accept it too")
+}
+// TestDelegateToolsAreWiredToTheDelegator checks both directions: the tools
+// call the thing that does the work, and the certificate passes through
+// unchanged.
+func TestDelegateToolsAreWiredToTheDelegator(t *testing.T) {
+	dg := &fakeDelegator{
+		begin:    BeginResult{PublicKey: "ssh-ed25519 AAAA eitri", Principal: "ubuntu"},
+		complete: DelegationResult{ExpiresAt: "2026-08-08T00:00:00Z", CAFingerprint: "SHA256:abc"},
+	}
+	cs := connect(t, NewServer(&Tools{}, Options{Delegator: dg}))
+	res, err := cs.CallTool(t.Context(), &mcp.CallToolParams{Name: "delegate_begin"})
+	require.NoError(t, err)
+	require.False(t, res.IsError)
+	assert.Equal(t, 1, dg.beganN)
+	assert.Equal(t, "ssh-ed25519 AAAA eitri", res.StructuredContent.(map[string]any)["public_key"])
+	const cert = "ssh-ed25519-cert-v01@openssh.com AAAAdelegation alex@laptop"
+	res, err = cs.CallTool(t.Context(), &mcp.CallToolParams{
+		Name: "delegate_complete", Arguments: map[string]any{"certificate": cert}})
+	require.NoError(t, err)
+	require.False(t, res.IsError)
+	assert.Equal(t, cert, dg.gotCert, "the certificate must reach the control plane byte for byte")
+	assert.Equal(t, "SHA256:abc", res.StructuredContent.(map[string]any)["ca_fingerprint"])
+}
+// TestDelegateFailuresSurfaceAsToolErrors: a refusal reaches the model as an
+// MCP tool error it can read, not a transport failure it cannot.
+func TestDelegateFailuresSurfaceAsToolErrors(t *testing.T) {
+	cs := connect(t, NewServer(&Tools{}, Options{Delegator: &fakeDelegator{err: errors.New("principals are [alex]")}}))
+	res, err := cs.CallTool(t.Context(), &mcp.CallToolParams{Name: "delegate_begin"})
+	require.NoError(t, err)
+	assert.True(t, res.IsError)
+	res, err = cs.CallTool(t.Context(), &mcp.CallToolParams{
+		Name: "delegate_complete", Arguments: map[string]any{"certificate": "x"}})
+	require.NoError(t, err)
+	assert.True(t, res.IsError)
+}
+// TestReportProgressIsANoOpWithoutAListener: the tool layer calls it
+// unconditionally, so the stdio path must not depend on one being installed.
+func TestReportProgressIsANoOpWithoutAListener(t *testing.T) {
+	assert.NotPanics(t, func() { reportProgress(t.Context(), "still working") })
+}
+// TestReportProgressReachesTheListener pins the seam the long waits use.
+func TestReportProgressReachesTheListener(t *testing.T) {
+	var got []string
+	ctx := withProgress(t.Context(), func(m string) { got = append(got, m) })
+	reportProgress(ctx, "creating vm web-1: creating")
+	reportProgress(ctx, "creating vm web-1: ready")
+	assert.Equal(t, []string{"creating vm web-1: creating", "creating vm web-1: ready"}, got)
+}
+// TestProgressReporterIsAbsentWithoutAToken: MCP reports progress only against
+// a token the client supplied, so a client that sent none gets nothing.
+func TestProgressReporterIsAbsentWithoutAToken(t *testing.T) {
+	assert.Nil(t, progressReporter(t.Context(), nil))
+	assert.Nil(t, progressReporter(t.Context(), &mcp.CallToolRequest{}))
+}
+// TestCAUploadDescriptionNamesTheFrozenCASet: a guest bakes its trusted CA set
+// at create, so a model that uploads a CA after creating a VM has done nothing
+// for that VM. The description is where it learns that, before it acts.
+func TestCAUploadDescriptionNamesTheFrozenCASet(t *testing.T) {
+	desc := describe(t, connect(t, NewServer(&Tools{}, Options{})), "ca_upload")
+	require.NotEmpty(t, desc)
+	assert.Contains(t, desc, "PUBLIC")
+	assert.Contains(t, desc, "will NOT")
+	assert.Contains(t, desc, "create new VMs after uploading")
+	assert.Contains(t, desc, "before vm_create")
+}

internal/mcpserver/sshrun.go

Old		New
@@ -9,12 +9,8 @@ import (
9	"io/fs"	9	"io/fs"
10	"os"	10	"os"
11	"path"	11	"path"
12	"strings"
13	"sync"
14	"time"	12	"time"
15		13
16	"github.com/a73x/eitri/internal/gateclient"
17	"github.com/a73x/eitri/internal/server/api/client"
18	"github.com/pkg/sftp"	14	"github.com/pkg/sftp"
19	"golang.org/x/crypto/ssh"	15	"golang.org/x/crypto/ssh"
20	)	16	)
@@ -22,28 +18,17 @@ import (
22	// outputCap bounds captured exec/file bytes returned to the model.	18	// outputCap bounds captured exec/file bytes returned to the model.
23	const outputCap = 1 << 20 // 1 MiB	19	const outputCap = 1 << 20 // 1 MiB
24		20
25	// gateAPI is what the Runner needs from the control-plane client to prepare gate	21	// VMDialer reaches a VM by name and names it the way the caller's world spells
26	// credentials before the first connection: derive the caller's tenant (Me), and	22	// it. It is the one thing that differs between transports: the local stdio
27	// verify/register this client's user CA (ListUserCAs + the embedded	23	// install goes through the eitri SSH-CA jump gate with a certificate it
28	// CertAuthority's UploadUserCA). One *client.Client value satisfies it.	24	// self-signs, while the control plane tunnels over the VM host's own sync
29	type gateAPI interface {	25	// connection with the credential that tenant has delegated to it. Everything
30	gateclient.CertAuthority	26	// above this line — exec, SFTP, output capping — is shared.
31	Me() (client.Me, error)	27	type VMDialer interface {
32	ListUserCAs(ctx context.Context, tenant string) ([]client.UserCA, error)	28	Dial(ctx context.Context, vmName string) (*ssh.Client, error)
33	}	29	// ConnectName maps a bare VM name to the <tenant>.<name> form the gate
34		30	// resolves and the VM's host certificate names.
35	var _ gateAPI = (*client.Client)(nil)	31	ConnectName(ctx context.Context, vmName string) (string, error)
36
37	// RunnerConfig configures SSH access to VMs through the eitri SSH-CA jump gate.
38	// Gate credentials are prepared lazily on first use from API + UserCA + Tenant
39	// (see Runner.ensure); the Gate/VMUser fields shape the dial itself.
40	type RunnerConfig struct {
41	Gate string // gate SSH address "<gate-domain>:<port>" (also the host-cert principal host)
42	VMUser string // guest login user, e.g. "ubuntu" (matches the cert principal)
43	API gateAPI // control-plane client backing tenant derivation, CA registration, host-CA fetch
44	UserCA ssh.Signer // this client's persistent user CA; signs user certs locally
45	Tenant string // configured tenant; "" ⇒ derive from the credential via Me()
46	Now func() time.Time // test seam; nil ⇒ time.Now
47	}	32	}
48		33
49	// ExecResult is a completed remote command.	34	// ExecResult is a completed remote command.
@@ -55,99 +40,27 @@ type ExecResult struct {
55	}	40	}
56		41
57	// Runner executes commands and transfers files on VMs over SSH, reaching each	42	// Runner executes commands and transfers files on VMs over SSH, reaching each
58	// VM by NAME through eitri's SSH-CA jump gate. There is no TOFU/known_hosts:	43	// VM by NAME through its dialer. There is no TOFU/known_hosts anywhere on
59	// both hops are verified against the eitri CA — the gate presents a CA-signed	44	// either path: every host key is a certificate verified against the eitri host
60	// host cert for its own domain, the VM a CA-signed host cert for its	45	// CA, and the client authenticates with a short-lived CA-signed user cert.
61	// <tenant>.<name> connect name — and the client authenticates with a
62	// short-lived CA-signed user cert.
63	type Runner struct {	46	type Runner struct {
64	cfg RunnerConfig	47	dial VMDialer
65
66	mu sync.Mutex
67	auth gateclient.Credentials // gate credentials, built once ensure() succeeds; tests may inject
68	}	48	}
69		49
70	func NewRunner(cfg RunnerConfig) *Runner { return &Runner{cfg: cfg} }	50	func NewRunner(d VMDialer) *Runner { return &Runner{dial: d} }
71
72	// ensure prepares gate credentials on first use and caches them in r.auth. It
73	// resolves the caller's tenant (the configured one, else derived from the
74	// credential via Me()) and makes sure this client's user CA is registered with
75	// that tenant so VMs trust the certs it signs. Idempotent across restarts —
76	// registration lists the tenant's user CAs and uploads only when its own
77	// fingerprint is absent. A failed ensure caches nothing, so the next call
78	// retries; its error names the manual fallback (`eitri ca upload`). Never logs or
79	// returns key material.
80	func (r *Runner) ensure(ctx context.Context) error {
81	r.mu.Lock()
82	defer r.mu.Unlock()
83	if r.auth != nil {
84	return nil
85	}
86	tenant := r.cfg.Tenant
87	if tenant == "" {
88	// The credential names the tenant; derive it for the connect name, whose
89	// <tenant>.<vmName> form the VM's host cert principal must match.
90	me, err := r.cfg.API.Me()
91	if err != nil {
92	return fmt.Errorf("resolving tenant from credential: %w", err)
93	}
94	if me.Tenant == "" {
95	return errors.New("credential resolves to no tenant")
96	}
97	tenant = me.Tenant
98	}
99	if err := r.registerUserCA(ctx); err != nil {
100	return err
101	}
102	r.auth = gateclient.NewGateAuth(r.cfg.API, r.cfg.UserCA, tenant, r.cfg.Now)
103	return nil
104	}
105		51
106	// registerUserCA idempotently registers this client's user-CA public key with	52	// ConnectName returns the connect name for vmName, so the Tools layer can build
107	// the caller's tenant: it lists the registered CAs and uploads the local pubkey	53	// a correct `ssh -J` hint without dialing.
108	// only if its fingerprint is absent. Routing follows the configured tenant — an
109	// empty tenant hits the tenant-less endpoints, which operate on the caller's own
110	// tenant (the credential names it). Errors name the manual fallback and never
111	// carry key material.
112	func (r *Runner) registerUserCA(ctx context.Context) error {
113	pub := r.cfg.UserCA.PublicKey()
114	fp := ssh.FingerprintSHA256(pub)
115	cas, err := r.cfg.API.ListUserCAs(ctx, r.cfg.Tenant)
116	if err != nil {
117	return fmt.Errorf("checking registered user CAs (run `eitri ca upload` to register manually): %w", err)
118	}
119	for _, ca := range cas {
120	if ca.Fingerprint == fp {
121	return nil
122	}
123	}
124	line := strings.TrimSpace(string(ssh.MarshalAuthorizedKey(pub)))
125	if err := r.cfg.API.UploadUserCA(ctx, r.cfg.Tenant, line); err != nil {
126	return fmt.Errorf("registering user CA (run `eitri ca upload` to register manually): %w", err)
127	}
128	return nil
129	}
130
131	// ConnectName returns the gate connect name for vmName — "<tenant>.<vmName>",
132	// the form the gate resolves and the VM's host-cert principal matches. It
133	// prepares gate credentials on first use so the Tools layer can build a correct
134	// `ssh -J` hint without dialing.
135	func (r *Runner) ConnectName(ctx context.Context, vmName string) (string, error) {	54	func (r *Runner) ConnectName(ctx context.Context, vmName string) (string, error) {
136	if err := r.ensure(ctx); err != nil {	55	return r.dial.ConnectName(ctx, vmName)
137	return "", err
138	}
139	r.mu.Lock()
140	auth := r.auth
141	r.mu.Unlock()
142	return auth.ConnectName(ctx, vmName)
143	}	56	}
144		57
145	// Exec runs cmd on the VM named vmName (reached through the gate). A non-zero	58	// Exec runs cmd on the VM named vmName. A non-zero remote exit is NOT an error —
146	// remote exit is NOT an error — it's in ExitCode.	59	// it's in ExitCode.
147	func (r *Runner) Exec(ctx context.Context, vmName, cmd string, timeout time.Duration) (ExecResult, error) {	60	func (r *Runner) Exec(ctx context.Context, vmName, cmd string, timeout time.Duration) (ExecResult, error) {
148	ctx, cancel := context.WithTimeout(ctx, timeout)	61	ctx, cancel := context.WithTimeout(ctx, timeout)
149	defer cancel()	62	defer cancel()
150	client, err := r.dial(ctx, vmName)	63	client, err := r.dial.Dial(ctx, vmName)
151	if err != nil {	64	if err != nil {
152	return ExecResult{}, err	65	return ExecResult{}, err
153	}	66	}
@@ -181,18 +94,6 @@ func (r *Runner) Exec(ctx context.Context, vmName, cmd string, timeout time.Dura
181	return res, nil	94	return res, nil
182	}	95	}
183		96
184	// dial reaches the VM named vmName through the eitri SSH-CA gate. See
185	// gateclient.Dial for the two-hop dial logic this delegates to.
186	func (r Runner) dial(ctx context.Context, vmName string) (ssh.Client, error) {
187	if err := r.ensure(ctx); err != nil {
188	return nil, err
189	}
190	r.mu.Lock()
191	auth := r.auth
192	r.mu.Unlock()
193	return gateclient.Dial(ctx, gateclient.DialConfig{Gate: r.cfg.Gate, VMUser: r.cfg.VMUser, Auth: auth}, vmName)
194	}
195
196	// cappedBuf captures at most outputCap bytes and records truncation.	97	// cappedBuf captures at most outputCap bytes and records truncation.
197	type cappedBuf struct {	98	type cappedBuf struct {
198	buf bytes.Buffer	99	buf bytes.Buffer
@@ -272,11 +173,10 @@ func (r *Runner) ReadFile(ctx context.Context, vmName, remotePath string) (data
272	return buf[:n], false, nil	173	return buf[:n], false, nil
273	}	174	}
274		175
275	// sftp dials the VM named vmName through the gate and wraps the connection in	176	// sftp dials the VM named vmName and wraps the connection in an sftp.Client.
276	// an sftp.Client. The caller must Close both the returned *ssh.Client and	177	// The caller must Close both the returned ssh.Client and sftp.Client.
277	// *sftp.Client.
278	func (r Runner) sftp(ctx context.Context, vmName string) (ssh.Client, *sftp.Client, error) {	178	func (r Runner) sftp(ctx context.Context, vmName string) (ssh.Client, *sftp.Client, error) {
279	client, err := r.dial(ctx, vmName)	179	client, err := r.dial.Dial(ctx, vmName)
280	if err != nil {	180	if err != nil {
281	return nil, nil, err	181	return nil, nil, err
282	}	182	}

internal/mcpserver/sshrun_test.go

internal/mcpserver/tools.go

Old		New
@@ -13,10 +13,11 @@ import (
13	"github.com/a73x/eitri/internal/gateclient"	13	"github.com/a73x/eitri/internal/gateclient"
14	"github.com/a73x/eitri/internal/random"	14	"github.com/a73x/eitri/internal/random"
15	"github.com/a73x/eitri/internal/server/api/client"	15	"github.com/a73x/eitri/internal/server/api/client"
		16	"golang.org/x/crypto/ssh"
16	)	17	)
17		18
18	// api and runner are the two seams Tools composes; API and Runner satisfy	19	// api and Exec are the two seams Tools composes; API and Runner satisfy them,
19	// them, fakes replace them in tests.	20	// fakes replace them in tests.
20	type api interface {	21	type api interface {
21	ListVMs(ctx context.Context) ([]client.VM, error)	22	ListVMs(ctx context.Context) ([]client.VM, error)
22	CreateVM(ctx context.Context, req client.CreateVMRequest) (client.CreateVMResponse, error)	23	CreateVM(ctx context.Context, req client.CreateVMRequest) (client.CreateVMResponse, error)
@@ -26,9 +27,16 @@ type api interface {
26	CreateExposure(ctx context.Context, vmID string, guestPort, hostPort int64) (client.Exposure, error)	27	CreateExposure(ctx context.Context, vmID string, guestPort, hostPort int64) (client.Exposure, error)
27	ListExposures(ctx context.Context, vmID string) ([]client.Exposure, error)	28	ListExposures(ctx context.Context, vmID string) ([]client.Exposure, error)
28	DeleteExposure(ctx context.Context, id string) error	29	DeleteExposure(ctx context.Context, id string) error
		30	RegisterUserCA(ctx context.Context, caLine, label string) error
		31	ListUserCAs(ctx context.Context, tenant string) ([]client.UserCA, error)
		32	Delegation(ctx context.Context) (client.Delegation, error)
29	}	33	}
30		34
31	type runner interface {	35	// Exec is everything the tools do on a VM once something has reached it. It is
		36	// exported because the two transports supply it differently: the stdio binary
		37	// builds a Runner over the jump gate, the control plane one over the sync
		38	// tunnel.
		39	type Exec interface {
32	Exec(ctx context.Context, vmName, cmd string, timeout time.Duration) (ExecResult, error)	40	Exec(ctx context.Context, vmName, cmd string, timeout time.Duration) (ExecResult, error)
33	WriteFile(ctx context.Context, vmName, path string, data []byte, mode fs.FileMode) error	41	WriteFile(ctx context.Context, vmName, path string, data []byte, mode fs.FileMode) error
34	ReadFile(ctx context.Context, vmName, path string) ([]byte, bool, error)	42	ReadFile(ctx context.Context, vmName, path string) ([]byte, bool, error)
@@ -43,6 +51,19 @@ type API struct {
43	*client.Client	51	*client.Client
44	}	52	}
45		53
		54	// RegisterUserCA registers a CA public key with the caller's own tenant. The
		55	// label rides a COPY of the client because it is a per-call choice and the
		56	// client is shared with every other tool in this request; the request itself
		57	// still goes through that same client, so there is one path to the API and one
		58	// place authorization is decided.
		59	func (a API) RegisterUserCA(ctx context.Context, caLine, label string) error {
		60	c := *a.Client
		61	if label != "" {
		62	c.UserCALabel = label
		63	}
		64	return c.UploadUserCA(ctx, "", caLine)
		65	}
		66
46	// FirstOnlineHost returns the first online host — the default placement	67	// FirstOnlineHost returns the first online host — the default placement
47	// target when the caller doesn't name one. Ordering is server-defined;	68	// target when the caller doesn't name one. Ordering is server-defined;
48	// callers must not assume stability across calls.	69	// callers must not assume stability across calls.
@@ -63,14 +84,14 @@ func (a API) FirstOnlineHost(ctx context.Context) (client.Host, error) {
63	// API client must keep satisfying the gate's cert-authority seam.	84	// API client must keep satisfying the gate's cert-authority seam.
64	var (	85	var (
65	_ api = API{}	86	_ api = API{}
66	_ runner = (*Runner)(nil)	87	_ Exec = (*Runner)(nil)
67	_ gateclient.CertAuthority = (*client.Client)(nil)	88	_ gateclient.CertAuthority = (*client.Client)(nil)
68	)	89	)
69		90
70	// Tools implements the ten eitri-mcp tools over the API and SSH seams.	91	// Tools implements the ten eitri VM tools over the API and SSH seams.
71	type Tools struct {	92	type Tools struct {
72	API api	93	API api
73	Runner runner	94	Runner Exec
74	Gate string // gate address, for the ssh command hint only	95	Gate string // gate address, for the ssh command hint only
75	VMUser string	96	VMUser string
76		97
@@ -211,6 +232,7 @@ func (t *Tools) VMCreate(ctx context.Context, in VMCreateIn) (VMCreateOut, error
211	}	232	}
212	}	233	}
213	lastErr = execErr	234	lastErr = execErr
		235	reportProgress(ctx, fmt.Sprintf("vm %s is up at %s; waiting for cloud-init to finish", created.Name, ip))
214	// Stop once we are past the deadline, or the next sleep would carry us	236	// Stop once we are past the deadline, or the next sleep would carry us
215	// past it — no point sleeping only to give up.	237	// past it — no point sleeping only to give up.
216	if !time.Now().Add(t.pollEvery()).Before(deadline) {	238	if !time.Now().Add(t.pollEvery()).Before(deadline) {
@@ -249,6 +271,7 @@ func (t *Tools) waitReady(ctx context.Context, id, name string, deadline time.Ti
249	}	271	}
250	}	272	}
251	}	273	}
		274	reportProgress(ctx, fmt.Sprintf("creating vm %s: %s", name, lifecycleOrUnknown(last)))
252	select {	275	select {
253	case <-ctx.Done():	276	case <-ctx.Done():
254	return "", ctx.Err()	277	return "", ctx.Err()
@@ -261,6 +284,15 @@ func (t *Tools) waitReady(ctx context.Context, id, name string, deadline time.Ti
261	return "", fmt.Errorf("vm %s (%s) not ready after %s (control-plane never listed successfully; last error: %v); it may still come up — check vm_info, do not assume failure", id, name, t.waitTimeout(), lastErr)	284	return "", fmt.Errorf("vm %s (%s) not ready after %s (control-plane never listed successfully; last error: %v); it may still come up — check vm_info, do not assume failure", id, name, t.waitTimeout(), lastErr)
262	}	285	}
263		286
		287	// lifecycleOrUnknown words a lifecycle for a progress message, covering the
		288	// first poll or two where the control plane has not listed the VM yet.
		289	func lifecycleOrUnknown(lifecycle string) string {
		290	if lifecycle == "" {
		291	return "not listed yet"
		292	}
		293	return lifecycle
		294	}
		295
264	// resolveHost turns a caller-named host into the id to place on: an exact match	296	// resolveHost turns a caller-named host into the id to place on: an exact match
265	// on host id or host name, anywhere in the fleet. An offline match is refused	297	// on host id or host name, anywhere in the fleet. An offline match is refused
266	// rather than accepted — nothing would converge the create until that host came	298	// rather than accepted — nothing would converge the create until that host came
@@ -317,6 +349,104 @@ func (t *Tools) sshCommand(ctx context.Context, name string) string {
317	return fmt.Sprintf("ssh -J %s %s@%s", t.Gate, t.VMUser, target)	349	return fmt.Sprintf("ssh -J %s %s@%s", t.Gate, t.VMUser, target)
318	}	350	}
319		351
		352	// ── ca_upload ────────────────────────────────────────────────────────────────
		353
		354	type CAUploadIn struct {
		355	PublicKey string `json:"public_key" jsonschema:"the CA's PUBLIC key as one authorized_keys line, e.g. 'ssh-ed25519 AAAA... alex@laptop'"`
		356	Label string `json:"label,omitempty" jsonschema:"optional label for this CA in the console's list"`
		357	}
		358
		359	type CAUploadOut struct {
		360	Fingerprint string `json:"fingerprint"`
		361	Label string `json:"label,omitempty"`
		362	Note string `json:"note"`
		363	}
		364
		365	// CAUpload registers a tenant's own SSH user CA. Only the public half travels —
		366	// there is nowhere in this call to put a private key, which is the point.
		367	//
		368	// The line is parsed here before it is sent so a malformed key is a tool error
		369	// naming the problem, rather than a 400 the model has to interpret. The
		370	// fingerprint returned is computed from the same bytes, so the caller can see
		371	// which CA it just registered without a second round trip.
		372	func (t *Tools) CAUpload(ctx context.Context, in CAUploadIn) (CAUploadOut, error) {
		373	line := strings.TrimSpace(in.PublicKey)
		374	if line == "" {
		375	return CAUploadOut{}, errors.New("public_key is required: the CA's public key as an authorized_keys line")
		376	}
		377	pub, _, _, _, err := ssh.ParseAuthorizedKey([]byte(line))
		378	if err != nil {
		379	return CAUploadOut{}, fmt.Errorf("that is not an SSH public key line: %w", err)
		380	}
		381	if _, isCert := pub.(*ssh.Certificate); isCert {
		382	return CAUploadOut{}, errors.New("that is a certificate, not a CA public key — upload the CA's own public key (the .pub beside your CA private key)")
		383	}
		384	if err := t.API.RegisterUserCA(ctx, line, in.Label); err != nil {
		385	return CAUploadOut{}, fmt.Errorf("registering the CA with your tenant: %w", err)
		386	}
		387	return CAUploadOut{
		388	Fingerprint: ssh.FingerprintSHA256(pub),
		389	Label: in.Label,
		390	Note: "A guest trusts the CA set it was created with, so VMs created BEFORE this upload will not " +
		391	"accept certificates from this CA — create new ones. VMs created from now on will.",
		392	}, nil
		393	}
		394
		395	// ── tenant_info ──────────────────────────────────────────────────────────────
		396
		397	type TenantInfoIn struct{}
		398
		399	// TenantInfoCA is one registered CA, described rather than reproduced: a
		400	// fingerprint identifies it, and the key itself is not what a caller is asking
		401	// for here.
		402	type TenantInfoCA struct {
		403	Fingerprint string `json:"fingerprint"`
		404	Label string `json:"label,omitempty"`
		405	}
		406
		407	// TenantInfoDelegation is the live delegation, absent when there is none.
		408	type TenantInfoDelegation struct {
		409	KeyID string `json:"key_id,omitempty"`
		410	Principals []string `json:"principals,omitempty"`
		411	ExpiresAt string `json:"expires_at,omitempty"`
		412	}
		413
		414	type TenantInfoOut struct {
		415	CAs []TenantInfoCA `json:"registered_cas"`
		416	// Delegated says whether eitri can currently reach this tenant's VMs. It is
		417	// a field of its own because "no delegation" is the answer a caller most
		418	// often needs, and an absent object is easy to misread as an error.
		419	Delegated bool `json:"delegated"`
		420	Delegation *TenantInfoDelegation `json:"delegation,omitempty"`
		421	Gate string `json:"gate,omitempty"`
		422	}
		423
		424	// TenantInfo answers "what is set up for me right now" in one call: which CAs
		425	// this tenant has registered, whether eitri holds a live delegation and until
		426	// when, and the gate address. Without it a caller learns each of these by
		427	// trying something and reading the failure, which is a slow way to be told
		428	// that a step was skipped.
		429	//
		430	// No delegation is not an error — it is the common state, and it is reported
		431	// as data so a caller can act on it rather than parse a refusal.
		432	func (t *Tools) TenantInfo(ctx context.Context, _ TenantInfoIn) (TenantInfoOut, error) {
		433	cas, err := t.API.ListUserCAs(ctx, "")
		434	if err != nil {
		435	return TenantInfoOut{}, fmt.Errorf("reading this tenant's registered CAs: %w", err)
		436	}
		437	out := TenantInfoOut{CAs: make([]TenantInfoCA, 0, len(cas)), Gate: t.Gate}
		438	for _, ca := range cas {
		439	out.CAs = append(out.CAs, TenantInfoCA{Fingerprint: ca.Fingerprint, Label: ca.Label})
		440	}
		441	// A plane with no delegation, or no gate at all, answers this with a
		442	// non-2xx. Neither is a failure of the question being asked.
		443	if d, derr := t.API.Delegation(ctx); derr == nil {
		444	out.Delegated = true
		445	out.Delegation = &TenantInfoDelegation{KeyID: d.KeyID, Principals: d.Principals, ExpiresAt: d.ExpiresAt}
		446	}
		447	return out, nil
		448	}
		449
320	// ── vm_list / vm_info ────────────────────────────────────────────────────────	450	// ── vm_list / vm_info ────────────────────────────────────────────────────────
321		451
322	type VMListIn struct{}	452	type VMListIn struct{}

internal/mcpserver/tools_test.go

@@ @@ -2,13 +2,19 @@ package mcpserver @@
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"strings"
+	"testing"
+	"time"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+	"github.com/a73x/eitri/internal/server/api/client"
@@ @@ -29,6 +35,14 @@ type fakeToolsAPI struct { @@
+	revoked   []string
+	// hosts the fake's fleet reports; nil means the one-host fleet.
+	hosts []client.Host
+	// CAs registered through ca_upload, as (line, label) pairs, plus an error
+	// the registration can be made to fail with.
+	cas   [][2]string
+	caErr error
+	// what tenant_info reads back
+	userCAs    []client.UserCA
+	listCAErr  error
+	delegation *client.Delegation
+// fleet is the fake's host list, defaulted so tests that don't care about
+	f.revoked = append(f.revoked, id)
+	return nil
+func (f *fakeToolsAPI) ListUserCAs(ctx context.Context, tenant string) ([]client.UserCA, error) {
+	return f.userCAs, f.listCAErr
+}
+func (f *fakeToolsAPI) Delegation(ctx context.Context) (client.Delegation, error) {
+	if f.delegation == nil {
+		return client.Delegation{}, errors.New("no live delegation for this tenant")
+	}
+	return *f.delegation, nil
+}
+func (f *fakeToolsAPI) RegisterUserCA(ctx context.Context, caLine, label string) error {
+	if f.caErr != nil {
+		return f.caErr
+	}
+	f.cas = append(f.cas, [2]string{caLine, label})
+	return nil
+}
+type fakeRunner struct {
+	execs []string
@@ @@ -589,3 +619,133 @@ func TestWriteAndReadFileTools(t *testing.T) { @@
+	require.NoError(t, err)
+	assert.Equal(t, "data", rd.Content)
+// ── ca_upload ────────────────────────────────────────────────────────────────
+// caLine is a real ed25519 public key in authorized_keys form.
+func caLine(t *testing.T) string {
+	t.Helper()
+	pub, _, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	sp, err := ssh.NewPublicKey(pub)
+	require.NoError(t, err)
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(sp))) + " alex@laptop"
+}
+// TestCAUploadRegistersThePublicHalf: the line reaches the API unchanged, the
+// label rides with it, and the answer names the CA that was registered and the
+// consequence of having registered it now rather than earlier.
+func TestCAUploadRegistersThePublicHalf(t *testing.T) {
+	api := &fakeToolsAPI{}
+	tools := &Tools{API: api}
+	line := caLine(t)
+	out, err := tools.CAUpload(t.Context(), CAUploadIn{PublicKey: line, Label: "laptop"})
+	require.NoError(t, err)
+	require.Len(t, api.cas, 1)
+	assert.Equal(t, line, api.cas[0][0], "the key must reach the API byte for byte")
+	assert.Equal(t, "laptop", api.cas[0][1])
+	assert.True(t, strings.HasPrefix(out.Fingerprint, "SHA256:"), "got %q", out.Fingerprint)
+	assert.Equal(t, "laptop", out.Label)
+	assert.Contains(t, out.Note, "created BEFORE this upload will not")
+}
+// TestCAUploadRefusesWhatIsNotACAPublicKey: a bad line is a tool error naming
+// the problem, not a 400 the model has to interpret — and a certificate is the
+// mistake worth naming, since it looks like a key and is not one.
+func TestCAUploadRefusesWhatIsNotACAPublicKey(t *testing.T) {
+	api := &fakeToolsAPI{}
+	tools := &Tools{API: api}
+	_, err := tools.CAUpload(t.Context(), CAUploadIn{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "public_key is required")
+	_, err = tools.CAUpload(t.Context(), CAUploadIn{PublicKey: "not a key"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not an SSH public key line")
+	_, err = tools.CAUpload(t.Context(), CAUploadIn{PublicKey: certLine(t)})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "certificate, not a CA public key")
+	assert.Empty(t, api.cas, "nothing reaches the API until the line parses")
+}
+// certLine builds a user certificate, the thing most easily confused for a key.
+func certLine(t *testing.T) string {
+	t.Helper()
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	signer, err := ssh.NewSignerFromSigner(priv)
+	require.NoError(t, err)
+	cert := &ssh.Certificate{Key: signer.PublicKey(), CertType: ssh.UserCert,
+		ValidPrincipals: []string{"ubuntu"}, ValidBefore: ssh.CertTimeInfinity}
+	require.NoError(t, cert.SignCert(rand.Reader, signer))
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(cert)))
+}
+// TestCAUploadSurfacesARefusal: the API's no reaches the model as a tool error.
+func TestCAUploadSurfacesARefusal(t *testing.T) {
+	api := &fakeToolsAPI{caErr: errors.New("forbidden")}
+	tools := &Tools{API: api}
+	_, err := tools.CAUpload(t.Context(), CAUploadIn{PublicKey: caLine(t)})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "registering the CA with your tenant")
+}
+// ── tenant_info ──────────────────────────────────────────────────────────────
+// TestTenantInfoReportsSetupWithoutKeyMaterial: the answer identifies each CA
+// and says whether eitri can currently reach anything — and carries no key.
+func TestTenantInfoReportsSetupWithoutKeyMaterial(t *testing.T) {
+	api := &fakeToolsAPI{
+		userCAs: []client.UserCA{
+			{Fingerprint: "SHA256:aaa", Label: "laptop", PubKey: "ssh-ed25519 AAAASECRETLOOKING alex"},
+		},
+		delegation: &client.Delegation{
+			KeyID: "eitri-delegation", Principals: []string{"ubuntu"}, ExpiresAt: "2026-08-09T00:00:00Z",
+		},
+	}
+	tools := &Tools{API: api, Gate: "gate.eitri.sh:2222"}
+	out, err := tools.TenantInfo(t.Context(), TenantInfoIn{})
+	require.NoError(t, err)
+	require.Len(t, out.CAs, 1)
+	assert.Equal(t, "SHA256:aaa", out.CAs[0].Fingerprint)
+	assert.Equal(t, "laptop", out.CAs[0].Label)
+	assert.True(t, out.Delegated)
+	require.NotNil(t, out.Delegation)
+	assert.Equal(t, []string{"ubuntu"}, out.Delegation.Principals)
+	assert.Equal(t, "2026-08-09T00:00:00Z", out.Delegation.ExpiresAt)
+	assert.Equal(t, "gate.eitri.sh:2222", out.Gate)
+	raw, err := json.Marshal(out)
+	require.NoError(t, err)
+	assert.NotContains(t, string(raw), "AAAASECRETLOOKING", "tenant_info describes CAs, it does not reproduce them")
+}
+// TestTenantInfoReportsNoDelegationAsData: not having delegated is the common
+// state and the thing a caller most needs told, so it is a field rather than an
+// error to parse.
+func TestTenantInfoReportsNoDelegationAsData(t *testing.T) {
+	tools := &Tools{API: &fakeToolsAPI{}}
+	out, err := tools.TenantInfo(t.Context(), TenantInfoIn{})
+	require.NoError(t, err)
+	assert.False(t, out.Delegated)
+	assert.Nil(t, out.Delegation)
+	assert.Empty(t, out.CAs)
+}
+// TestTenantInfoSurfacesAReadFailure: the CA list is the part that must work.
+func TestTenantInfoSurfacesAReadFailure(t *testing.T) {
+	tools := &Tools{API: &fakeToolsAPI{listCAErr: errors.New("unauthorized")}}
+	_, err := tools.TenantInfo(t.Context(), TenantInfoIn{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "reading this tenant's registered CAs")
+}

internal/server/api/api.go

Old		New
@@ -20,6 +20,7 @@ import (
20	"github.com/a73x/eitri/internal/names"	20	"github.com/a73x/eitri/internal/names"
21	"github.com/a73x/eitri/internal/random"	21	"github.com/a73x/eitri/internal/random"
22	"github.com/a73x/eitri/internal/server/api/types"	22	"github.com/a73x/eitri/internal/server/api/types"
		23	"github.com/a73x/eitri/internal/server/delegation"
23	"github.com/a73x/eitri/internal/server/hosttoken"	24	"github.com/a73x/eitri/internal/server/hosttoken"
24	"github.com/a73x/eitri/internal/server/hub"	25	"github.com/a73x/eitri/internal/server/hub"
25	"github.com/a73x/eitri/internal/server/registry"	26	"github.com/a73x/eitri/internal/server/registry"
@@ -83,6 +84,26 @@ type API struct {
83	release ReleaseSource // nil ⇒ release discovery disabled	84	release ReleaseSource // nil ⇒ release discovery disabled
84	upgrader AgentUpgrader // nil until main wires syncsvc (SetAgentUpgrader)	85	upgrader AgentUpgrader // nil until main wires syncsvc (SetAgentUpgrader)
85	auth *authFlow // OIDC sign-in relying party (mounted via AuthHandler, outside /api/)	86	auth *authFlow // OIDC sign-in relying party (mounted via AuthHandler, outside /api/)
		87	// delegations holds the credentials tenants have lent eitri. Nil until main
		88	// wires it, which happens only when the jump gate is on; nil ⇒ the
		89	// delegation routes answer 503.
		90	delegations *delegation.Keyring
		91	}
		92
		93	// URL renders an API path as a full URL a caller can actually dial, using the
		94	// plane's configured public_url. Endpoints named in errors and recipes go
		95	// through here: the REST API and /mcp can live on different hostnames, so a
		96	// bare path sends a caller to guess which one — a guess that costs real time
		97	// when the answer is "not the host you are talking to".
		98	//
		99	// An unconfigured public_url falls back to the bare path, which is still true,
		100	// just less useful.
		101	func (a *API) URL(path string) string {
		102	base := strings.TrimRight(a.cfg.OIDC.PublicURL, "/")
		103	if base == "" {
		104	return path
		105	}
		106	return base + path
86	}	107	}
87		108
88	// SetReleaseSource wires release discovery (nil leaves it disabled).	109	// SetReleaseSource wires release discovery (nil leaves it disabled).
@@ -154,6 +175,12 @@ func (a *API) AuthHandler() http.Handler {
154	return mux	175	return mux
155	}	176	}
156		177
		178	// UserAuth wraps h in the same PAT/session resolution the /api/v1 subtree uses,
		179	// for handlers mounted outside it. /mcp speaks JSON-RPC rather than the REST
		180	// contract, so it lives outside the route table (like /auth/*) — but living
		181	// outside the contract must not mean living outside its authentication.
		182	func (a *API) UserAuth(h http.Handler) http.Handler { return a.userAuth(h) }
		183
157	// StartBackground launches the periodic server-side sweeps: finalizing drained	184	// StartBackground launches the periodic server-side sweeps: finalizing drained
158	// decommissioning hosts, and reaping tombstoned VMs whose host's agent never	185	// decommissioning hosts, and reaping tombstoned VMs whose host's agent never
159	// acked the destroy (abandoned on an offline host). It returns when ctx is	186	// acked the destroy (abandoned on an offline host). It returns when ctx is

internal/server/api/client/client.go

@@ @@ -37,6 +37,9 @@ type ( @@
+	UserCA                 = types.UserCA
+	Exposure               = types.Exposure
+	CreateExposureRequest  = types.CreateExposureRequest
+	DelegationChallenge    = types.DelegationChallenge
+	DelegationRequest      = types.DelegationRequest
+	Delegation             = types.Delegation
+// Client calls the eitri API at BaseURL, authenticating with Token (sent as a
+	var out []UserCA
+	return out, c.do(ctx, http.MethodGet, path, nil, &out)
+// BeginDelegation asks for the public key the caller is to sign, along with the
+// principal it must carry and the command that signs it. The key is eitri's
+// ephemeral half, held in memory only.
+func (c *Client) BeginDelegation(ctx context.Context) (DelegationChallenge, error) {
+	var out DelegationChallenge
+	return out, c.do(ctx, http.MethodPost, "/api/v1/delegations", nil, &out)
+}
+// CompleteDelegation hands back the signed certificate. eitri can then reach
+// the caller's VMs until it expires, and holds nothing else.
+func (c *Client) CompleteDelegation(ctx context.Context, certificate string) (Delegation, error) {
+	var out Delegation
+	return out, c.do(ctx, http.MethodPut, "/api/v1/delegations", DelegationRequest{Certificate: certificate}, &out)
+}
+// Delegation describes the caller tenant's live delegation, so its expiry is
+// never a surprise.
+func (c *Client) Delegation(ctx context.Context) (Delegation, error) {
+	var out Delegation
+	return out, c.do(ctx, http.MethodGet, "/api/v1/delegations", nil, &out)
+}
+// RevokeDelegation ends the delegation now.
+func (c *Client) RevokeDelegation(ctx context.Context) error {
+	return c.do(ctx, http.MethodDelete, "/api/v1/delegations", nil, nil)
+}

internal/server/api/client/client_test.go

@@ @@ -527,3 +527,87 @@ func TestDeleteExposure(t *testing.T) { @@
+		t.Errorf("request = %s %s, want DELETE /api/v1/exposures/x-1", cap.method, cap.path)
+// The four delegation calls are one endpoint distinguished by method, so the
+// method is the thing worth pinning: getting it wrong would silently start or
+// end a delegation instead of reading one.
+func TestDelegationCalls(t *testing.T) {
+	const delegationJSON = `{"public_key":"ssh-ed25519 AAAA eitri","ca_fingerprint":"SHA256:abc",` +
+		`"key_id":"eitri-delegation","serial":"7","principals":["ubuntu"],"expires_at":"2026-08-08T12:00:00Z"}`
+	t.Run("begin", func(t *testing.T) {
+		var cap capture
+		srv := serve(t, &cap, http.StatusOK,
+			`{"public_key":"ssh-ed25519 AAAA eitri","principal":"ubuntu","instructions":"ssh-keygen -s ..."}`)
+		c := &client.Client{BaseURL: srv.URL, Token: "tok"}
+		got, err := c.BeginDelegation(context.Background())
+		if err != nil {
+			t.Fatalf("BeginDelegation: %v", err)
+		}
+		if cap.method != http.MethodPost || cap.path != "/api/v1/delegations" {
+			t.Errorf("request = %s %s, want POST /api/v1/delegations", cap.method, cap.path)
+		}
+		if got.PublicKey != "ssh-ed25519 AAAA eitri" || got.Principal != "ubuntu" {
+			t.Errorf("challenge = %+v", got)
+		}
+		if got.Instructions == "" {
+			t.Error("the caller needs the command, not just the key")
+		}
+	})
+	t.Run("complete", func(t *testing.T) {
+		var cap capture
+		srv := serve(t, &cap, http.StatusOK, delegationJSON)
+		c := &client.Client{BaseURL: srv.URL, Token: "tok"}
+		const cert = "ssh-ed25519-cert-v01@openssh.com AAAAcert alex@laptop"
+		got, err := c.CompleteDelegation(context.Background(), cert)
+		if err != nil {
+			t.Fatalf("CompleteDelegation: %v", err)
+		}
+		if cap.method != http.MethodPut || cap.path != "/api/v1/delegations" {
+			t.Errorf("request = %s %s, want PUT /api/v1/delegations", cap.method, cap.path)
+		}
+		var req types.DelegationRequest
+		if err := json.Unmarshal(cap.body, &req); err != nil {
+			t.Fatalf("request body did not decode as DelegationRequest: %v", err)
+		}
+		if req.Certificate != cert {
+			t.Errorf("certificate = %q, want it passed through unchanged", req.Certificate)
+		}
+		if got.CAFingerprint != "SHA256:abc" || got.ExpiresAt != "2026-08-08T12:00:00Z" {
+			t.Errorf("delegation = %+v", got)
+		}
+	})
+	t.Run("read", func(t *testing.T) {
+		var cap capture
+		srv := serve(t, &cap, http.StatusOK, delegationJSON)
+		c := &client.Client{BaseURL: srv.URL, Token: "tok"}
+		got, err := c.Delegation(context.Background())
+		if err != nil {
+			t.Fatalf("Delegation: %v", err)
+		}
+		if cap.method != http.MethodGet || cap.path != "/api/v1/delegations" {
+			t.Errorf("request = %s %s, want GET /api/v1/delegations", cap.method, cap.path)
+		}
+		if got.Serial != "7" {
+			t.Errorf("serial = %q, want the string form", got.Serial)
+		}
+	})
+	t.Run("revoke", func(t *testing.T) {
+		var cap capture
+		srv := serve(t, &cap, http.StatusNoContent, "")
+		c := &client.Client{BaseURL: srv.URL, Token: "tok"}
+		if err := c.RevokeDelegation(context.Background()); err != nil {
+			t.Fatalf("RevokeDelegation: %v", err)
+		}
+		if cap.method != http.MethodDelete || cap.path != "/api/v1/delegations" {
+			t.Errorf("request = %s %s, want DELETE /api/v1/delegations", cap.method, cap.path)
+		}
+	})
+}

internal/server/api/delegations.go

@@ @@ -0,0 +1,152 @@ @@
+package api
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+	"time"
+	"github.com/a73x/eitri/internal/server/api/types"
+	"github.com/a73x/eitri/internal/server/delegation"
+	"github.com/a73x/eitri/internal/server/sshca"
+	"golang.org/x/crypto/ssh"
+)
+// SetDelegations wires the delegation keyring. Called once at startup when the
+// jump gate is enabled; leaving it nil makes the four routes answer 503, which
+// is the same condition that makes remote exec refuse.
+//
+// The keyring is taken concretely rather than behind an interface: it is a pure
+// leaf package with no I/O, so a test builds a real one, and every rule about
+// what a delegation may be lives inside it rather than being restated here.
+func (a *API) SetDelegations(k *delegation.Keyring) { a.delegations = k }
+// delegationTenant resolves the caller's tenant and refuses when this control
+// plane has no CA to verify anything against.
+func (a *API) delegationTenant(w http.ResponseWriter, r *http.Request) (string, bool) {
+	if a.delegations == nil {
+		http.Error(w, "this control plane has no SSH CA configured", http.StatusServiceUnavailable)
+		return "", false
+	}
+	return a.userCATenant(w, r)
+}
+// handleBeginDelegation returns the public key the caller is to sign, and the
+// command that signs it. eitri holds the private half in memory and nowhere
+// else; a restart drops it and the caller delegates again.
+func (a *API) handleBeginDelegation(w http.ResponseWriter, r *http.Request) {
+	tenant, ok := a.delegationTenant(w, r)
+	if !ok {
+		return
+	}
+	pubLine, err := a.delegations.Begin(tenant)
+	if err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	principal := a.delegations.Principal
+	a.audit(tenant, "delegation.begin", map[string]string{
+		"tenant": tenant, "fingerprint": fingerprintOf(pubLine),
+	})
+	writeJSON(w, http.StatusOK, types.DelegationChallenge{
+		PublicKey: pubLine,
+		Principal: principal,
+		Instructions: fmt.Sprintf(
+			"printf '%%s\\n' '%s' > eitri-delegation.pub && "+
+				"ssh-keygen -s <your-ca-key> -I eitri-delegation -n %s -V +8h eitri-delegation.pub && "+
+				"curl -X PUT -H \"Authorization: Bearer $EITRI_TOKEN\" -H 'Content-Type: application/json' "+
+				"--data \"{\\\"certificate\\\": \\\"$(cat eitri-delegation-cert.pub)\\\"}\" %s",
+			pubLine, principal, a.URL("/api/v1/delegations")),
+	})
+}
+// handleCompleteDelegation accepts the signed certificate. Every rule about
+// what makes a certificate acceptable lives in the delegation package; this
+// hands its refusal straight back, because each one names the fix.
+func (a *API) handleCompleteDelegation(w http.ResponseWriter, r *http.Request) {
+	tenant, ok := a.delegationTenant(w, r)
+	if !ok {
+		return
+	}
+	var req types.DelegationRequest
+	if !decodeJSON(w, r, &req) {
+		return
+	}
+	if req.Certificate == "" {
+		http.Error(w, "certificate is required", http.StatusBadRequest)
+		return
+	}
+	d, err := a.delegations.Complete(tenant, req.Certificate, a.tenantTrusts(tenant))
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	a.audit(tenant, "delegation.complete", map[string]string{
+		"tenant": tenant, "ca_fingerprint": d.CAFingerprint, "key_id": d.KeyID,
+		"serial": strconv.FormatUint(d.Serial, 10), "expires_at": d.ExpiresAt.Format(time.RFC3339),
+	})
+	writeJSON(w, http.StatusOK, delegationResponse(d))
+}
+// handleGetDelegation reports the caller's live delegation, so its expiry is
+// never a surprise. 404 when there is none — including one that has run out,
+// which is the same situation and calls for the same next step.
+func (a *API) handleGetDelegation(w http.ResponseWriter, r *http.Request) {
+	tenant, ok := a.delegationTenant(w, r)
+	if !ok {
+		return
+	}
+	d, live := a.delegations.Status(tenant)
+	if !live {
+		http.Error(w, "no live delegation for this tenant", http.StatusNotFound)
+		return
+	}
+	writeJSON(w, http.StatusOK, delegationResponse(d))
+}
+// handleRevokeDelegation ends the delegation now. Idempotent.
+func (a *API) handleRevokeDelegation(w http.ResponseWriter, r *http.Request) {
+	tenant, ok := a.delegationTenant(w, r)
+	if !ok {
+		return
+	}
+	a.delegations.Revoke(tenant)
+	a.audit(tenant, "delegation.revoke", map[string]string{"tenant": tenant})
+	w.WriteHeader(http.StatusNoContent)
+}
+// tenantTrusts answers "is this a CA this tenant registered?" against the
+// store. A lookup that fails is reported as an error rather than as "not
+// trusted", so a database hiccup never reads as a rejected certificate.
+func (a *API) tenantTrusts(tenant string) func(ssh.PublicKey) (bool, error) {
+	return func(pub ssh.PublicKey) (bool, error) {
+		owner, ok, err := a.st.TenantForUserCA(sshca.AuthorizedKeyLine(pub))
+		if err != nil {
+			return false, err
+		}
+		return ok && owner == tenant, nil
+	}
+}
+func delegationResponse(d delegation.Delegation) types.Delegation {
+	return types.Delegation{
+		PublicKey:     d.PublicKey,
+		CAFingerprint: d.CAFingerprint,
+		KeyID:         d.KeyID,
+		// A string, like every other serial on this API: a uint64 exceeds what
+		// a JSON number survives in a JavaScript client.
+		Serial:     strconv.FormatUint(d.Serial, 10),
+		Principals: d.Principals,
+		ExpiresAt:  d.ExpiresAt.Format(time.RFC3339),
+	}
+}
+// fingerprintOf is best-effort: it names a key in an audit row, and a key that
+// will not parse is not worth failing a request over.
+func fingerprintOf(line string) string {
+	pub, _, _, _, err := ssh.ParseAuthorizedKey([]byte(line))
+	if err != nil {
+		return ""
+	}
+	return ssh.FingerprintSHA256(pub)
+}

internal/server/api/delegations_test.go

@@ @@ -0,0 +1,231 @@ @@
+package api
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+	"github.com/a73x/eitri/internal/server/api/types"
+	"github.com/a73x/eitri/internal/server/delegation"
+	"github.com/a73x/eitri/internal/server/store"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+// newDelegationCA stands in for a tenant's own SSH user CA.
+func newDelegationCA(t *testing.T) ssh.Signer {
+	t.Helper()
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	s, err := ssh.NewSignerFromSigner(priv)
+	require.NoError(t, err)
+	return s
+}
+// registerTenantCA registers ca to tenant, the precondition for delegating with
+// it: eitri only accepts a certificate from a CA the tenant's guests trust.
+func registerTenantCA(t *testing.T, st *store.Store, tenant string, ca ssh.Signer) {
+	t.Helper()
+	line := strings.TrimSpace(string(ssh.MarshalAuthorizedKey(ca.PublicKey())))
+	require.NoError(t, st.AddTenantUserCA(tenant, line, "tenant", "mine", "test"))
+}
+// signFor is `ssh-keygen -s`, in code.
+func signFor(t *testing.T, ca ssh.Signer, pubLine, principal string, expiry time.Time) string {
+	t.Helper()
+	pub, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pubLine))
+	require.NoError(t, err)
+	cert := &ssh.Certificate{
+		Key:             pub,
+		Serial:          99,
+		CertType:        ssh.UserCert,
+		KeyId:           "eitri-delegation",
+		ValidPrincipals: []string{principal},
+		ValidAfter:      uint64(time.Now().Add(-time.Minute).Unix()),
+		ValidBefore:     uint64(expiry.Unix()),
+	}
+	require.NoError(t, cert.SignCert(rand.Reader, ca))
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(cert)))
+}
+// withDelegations wires a real keyring onto a test server.
+func withDelegations(a *API) *delegation.Keyring {
+	k := delegation.New(time.Now, "ubuntu")
+	a.SetDelegations(k)
+	return k
+}
+// bodyText reads an error response body.
+func bodyText(t *testing.T, resp *http.Response) string {
+	t.Helper()
+	defer resp.Body.Close()
+	b, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	return string(b)
+}
+func decodeInto(t *testing.T, resp *http.Response, v any) {
+	t.Helper()
+	defer resp.Body.Close()
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(v))
+}
+// TestDelegationRoundTrip is the whole exchange over HTTP: a challenge, a
+// certificate signed elsewhere, and a live delegation eitri could not have
+// created for itself.
+func TestDelegationRoundTrip(t *testing.T) {
+	ts, st, _, _, a := newServer(t)
+	k := withDelegations(a)
+	ca := newDelegationCA(t)
+	registerTenantCA(t, st, testTenant, ca)
+	resp := do(t, "POST", ts.URL+"/api/v1/delegations", testPAT, nil)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	var challenge types.DelegationChallenge
+	decodeInto(t, resp, &challenge)
+	assert.True(t, strings.HasPrefix(challenge.PublicKey, "ssh-ed25519 "))
+	assert.Equal(t, "ubuntu", challenge.Principal)
+	assert.Contains(t, challenge.Instructions, "ssh-keygen -s <your-ca-key>")
+	assert.Contains(t, challenge.Instructions, "-n ubuntu")
+	assert.Contains(t, challenge.Instructions, challenge.PublicKey,
+		"the instructions must carry the key, so a caller need not assemble it")
+	expiry := time.Now().Add(8 * time.Hour).Truncate(time.Second)
+	resp = do(t, "PUT", ts.URL+"/api/v1/delegations", testPAT,
+		map[string]any{"certificate": signFor(t, ca, challenge.PublicKey, "ubuntu", expiry)})
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	var d types.Delegation
+	decodeInto(t, resp, &d)
+	assert.Equal(t, ssh.FingerprintSHA256(ca.PublicKey()), d.CAFingerprint)
+	assert.Equal(t, "99", d.Serial, "a serial is a string on this API, so a JS client keeps every digit")
+	assert.Equal(t, []string{"ubuntu"}, d.Principals)
+	assert.Equal(t, expiry.UTC().Format(time.RFC3339), d.ExpiresAt)
+	_, ok := k.Signer(testTenant)
+	assert.True(t, ok)
+	// GET reports it, so its expiry is never a surprise.
+	resp = do(t, "GET", ts.URL+"/api/v1/delegations", testPAT, nil)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	var got types.Delegation
+	decodeInto(t, resp, &got)
+	assert.Equal(t, d, got)
+	// DELETE ends it now.
+	resp = do(t, "DELETE", ts.URL+"/api/v1/delegations", testPAT, nil)
+	require.Equal(t, http.StatusNoContent, resp.StatusCode)
+	_, ok = k.Signer(testTenant)
+	assert.False(t, ok)
+	resp = do(t, "GET", ts.URL+"/api/v1/delegations", testPAT, nil)
+	assert.Equal(t, http.StatusNotFound, resp.StatusCode)
+}
+// TestBeginIsStableAcrossCalls: re-delegating after an expiry is one signing
+// step, not a new round trip for a key that has not changed.
+func TestBeginIsStableAcrossCalls(t *testing.T) {
+	ts, _, _, _, a := newServer(t)
+	withDelegations(a)
+	var first, second types.DelegationChallenge
+	decodeInto(t, do(t, "POST", ts.URL+"/api/v1/delegations", testPAT, nil), &first)
+	decodeInto(t, do(t, "POST", ts.URL+"/api/v1/delegations", testPAT, nil), &second)
+	assert.Equal(t, first.PublicKey, second.PublicKey)
+}
+// TestCompleteBeforeBeginIsACleanRefusal: there is no key to have signed yet,
+// so whatever was posted is for something else.
+func TestCompleteBeforeBeginIsACleanRefusal(t *testing.T) {
+	ts, st, _, _, a := newServer(t)
+	withDelegations(a)
+	ca := newDelegationCA(t)
+	registerTenantCA(t, st, testTenant, ca)
+	// A certificate over some other key, posted first.
+	other := newDelegationCA(t)
+	otherLine := strings.TrimSpace(string(ssh.MarshalAuthorizedKey(other.PublicKey())))
+	resp := do(t, "PUT", ts.URL+"/api/v1/delegations", testPAT,
+		map[string]any{"certificate": signFor(t, ca, otherLine, "ubuntu", time.Now().Add(time.Hour))})
+	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+	assert.Contains(t, bodyText(t, resp), "current delegation key is")
+}
+// TestCompleteRefusesAnotherTenantsCA: the trust check is scoped to the CAs the
+// CALLER's tenant registered, not to every CA the fleet knows.
+func TestCompleteRefusesAnotherTenantsCA(t *testing.T) {
+	ts, st, _, _, a := newServer(t)
+	withDelegations(a)
+	other, err := st.CreateTenantForIdentity("https://idp", "someone-else", "them@example.com")
+	require.NoError(t, err)
+	theirCA := newDelegationCA(t)
+	registerTenantCA(t, st, other.ID, theirCA)
+	var challenge types.DelegationChallenge
+	decodeInto(t, do(t, "POST", ts.URL+"/api/v1/delegations", testPAT, nil), &challenge)
+	resp := do(t, "PUT", ts.URL+"/api/v1/delegations", testPAT,
+		map[string]any{"certificate": signFor(t, theirCA, challenge.PublicKey, "ubuntu", time.Now().Add(time.Hour))})
+	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+	assert.Contains(t, bodyText(t, resp), "not a CA registered to this tenant")
+}
+// TestCompleteRequiresACertificate: an empty body is a caller error, not a 500.
+func TestCompleteRequiresACertificate(t *testing.T) {
+	ts, _, _, _, a := newServer(t)
+	withDelegations(a)
+	resp := do(t, "PUT", ts.URL+"/api/v1/delegations", testPAT, map[string]any{})
+	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+}
+// TestDelegationRoutesNeedACredential: every one of them acts on the caller's
+// own tenant, so every one of them needs to know who the caller is.
+func TestDelegationRoutesNeedACredential(t *testing.T) {
+	ts, _, _, _, a := newServer(t)
+	withDelegations(a)
+	for _, m := range []string{"POST", "PUT", "GET", "DELETE"} {
+		resp := do(t, m, ts.URL+"/api/v1/delegations", "", nil)
+		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode, m)
+	}
+}
+// TestDelegationRoutesWithoutAGate: with no SSH CA there is nothing to verify a
+// certificate against, and the refusal says which condition it is.
+func TestDelegationRoutesWithoutAGate(t *testing.T) {
+	ts, _, _, _, _ := newServer(t) // no SetDelegations
+	for _, m := range []string{"POST", "PUT", "GET", "DELETE"} {
+		resp := do(t, m, ts.URL+"/api/v1/delegations", testPAT, map[string]any{"certificate": "x"})
+		assert.Equal(t, http.StatusServiceUnavailable, resp.StatusCode, m)
+		assert.Contains(t, bodyText(t, resp), "no SSH CA configured")
+	}
+}
+// TestDelegationIsAudited: the fingerprint, key id, serial and expiry are the
+// record of what eitri was lent. The key itself never appears anywhere.
+func TestDelegationIsAudited(t *testing.T) {
+	ts, st, _, _, a := newServer(t)
+	withDelegations(a)
+	ca := newDelegationCA(t)
+	registerTenantCA(t, st, testTenant, ca)
+	var challenge types.DelegationChallenge
+	decodeInto(t, do(t, "POST", ts.URL+"/api/v1/delegations", testPAT, nil), &challenge)
+	do(t, "PUT", ts.URL+"/api/v1/delegations", testPAT,
+		map[string]any{"certificate": signFor(t, ca, challenge.PublicKey, "ubuntu", time.Now().Add(time.Hour))})
+	do(t, "DELETE", ts.URL+"/api/v1/delegations", testPAT, nil)
+	rows, err := st.ListAudit(testTenant, 50)
+	require.NoError(t, err)
+	var actions []string
+	for _, r := range rows {
+		actions = append(actions, r.Action)
+	}
+	assert.Contains(t, actions, "delegation.begin")
+	assert.Contains(t, actions, "delegation.complete")
+	assert.Contains(t, actions, "delegation.revoke")
+}

internal/server/api/principal.go

Old		New
@@ -33,6 +33,15 @@ func principalFromContext(r *http.Request) Principal {
33	return p	33	return p
34	}	34	}
35		35
		36	// TenantFromContext returns the tenant of the request's authenticated
		37	// principal, or "" if the request never passed UserAuth. It is how a handler
		38	// mounted outside the /api/v1 subtree — /mcp — reads the identity the auth
		39	// middleware resolved.
		40	func TenantFromContext(ctx context.Context) string {
		41	p, _ := ctx.Value(principalKey{}).(Principal)
		42	return p.Tenant
		43	}
		44
36	// mayActAs reports whether p may act on a resource owned by tenant. Strict	45	// mayActAs reports whether p may act on a resource owned by tenant. Strict
37	// scope-equality; an empty tenant on either side never matches (resources always	46	// scope-equality; an empty tenant on either side never matches (resources always
38	// have a tenant; a zero principal must not pair with a malformed resource via	47	// have a tenant; a zero principal must not pair with a malformed resource via

internal/server/api/routes.go

@@ @@ -322,6 +322,51 @@ var routeTable = []Route{ @@
+		Doc:      "List the caller's own tenant's registered SSH user CAs (pubkey, label, fingerprint).",
+		handler:  (*API).handleListUserCAs,
+	},
+	// Delegation: eitri holds an ephemeral keypair per tenant, in memory only.
+	// The caller signs its public half with a CA they have already registered
+	// and posts the certificate back, and eitri authenticates to that tenant's
+	// guests with it until it expires. eitri never holds a signing key, and a
+	// restart drops every delegation. Always the caller's own tenant.
+	{
+		Method:   "POST",
+		Path:     "/api/v1/delegations",
+		Auth:     AuthUser,
+		Kind:     KindJSON,
+		Response: (*types.DelegationChallenge)(nil),
+		Success:  http.StatusOK,
+		Doc:      "Start a delegation: returns the ephemeral public key eitri will authenticate with, the principal the certificate must carry, and the ssh-keygen command that signs it. The key is stable for the life of the process.",
+		handler:  (*API).handleBeginDelegation,
+	},
+	{
+		Method:   "PUT",
+		Path:     "/api/v1/delegations",
+		Auth:     AuthUser,
+		Kind:     KindJSON,
+		Request:  (*types.DelegationRequest)(nil),
+		Response: (*types.Delegation)(nil),
+		Success:  http.StatusOK,
+		Doc:      "Complete a delegation with the certificate your CA signed. The certificate must be a user certificate over the key this delegation issued, signed by a CA registered to your tenant, naming the guest login user as a principal.",
+		handler:  (*API).handleCompleteDelegation,
+	},
+	{
+		Method:   "GET",
+		Path:     "/api/v1/delegations",
+		Auth:     AuthUser,
+		Kind:     KindJSON,
+		Response: (*types.Delegation)(nil),
+		Success:  http.StatusOK,
+		Doc:      "Describe the caller tenant's live delegation, including when it expires. 404 when there is none.",
+		handler:  (*API).handleGetDelegation,
+	},
+	{
+		Method:  "DELETE",
+		Path:    "/api/v1/delegations",
+		Auth:    AuthUser,
+		Kind:    KindJSON,
+		Success: http.StatusNoContent,
+		Doc:     "End the caller tenant's delegation now. eitri drops the certificate and can no longer reach that tenant's VMs.",
+		handler: (*API).handleRevokeDelegation,
+	},
+	// Revoke a minted user cert (by serial or cert line) and list revocations —
+	// enforced at the gate before a cert's short TTL expires. Pure store ops,
+	// available regardless of whether the minter is wired.

internal/server/api/routes_test.go

Old		New
@@ -34,7 +34,7 @@ func exemplarElem(t *testing.T, route Route, role string, v any) reflect.Type {
34	// `required` array for request schemas, so a type serving both roles would	34	// `required` array for request schemas, so a type serving both roles would
35	// get the wrong treatment on one of them).	35	// get the wrong treatment on one of them).
36	func TestRouteTable(t *testing.T) {	36	func TestRouteTable(t *testing.T) {
37	const wantRoutes = 31	37	const wantRoutes = 35
38	if len(routeTable) != wantRoutes {	38	if len(routeTable) != wantRoutes {
39	t.Fatalf("route table has %d entries, want %d — new endpoint? update this pin and cmd/eitri-apispec coverage together", len(routeTable), wantRoutes)	39	t.Fatalf("route table has %d entries, want %d — new endpoint? update this pin and cmd/eitri-apispec coverage together", len(routeTable), wantRoutes)
40	}	40	}

internal/server/api/testdata/delegation-challenge.golden.json

@@ @@ -0,0 +1,5 @@ @@
+{
+  "public_key": "ssh-ed25519 AAAAC3Nza eitri-delegation",
+  "principal": "ubuntu",
+  "instructions": "ssh-keygen -s \u003cyour-ca-key\u003e -I eitri-delegation -n ubuntu -V +8h eitri-delegation.pub"
+}

internal/server/api/testdata/delegation.golden.json

@@ @@ -0,0 +1,10 @@ @@
+{
+  "public_key": "ssh-ed25519 AAAAC3Nza eitri-delegation",
+  "ca_fingerprint": "SHA256:abcdefghijk",
+  "key_id": "eitri-delegation",
+  "serial": "12345678901234567890",
+  "principals": [
+    "ubuntu"
+  ],
+  "expires_at": "2026-08-08T12:00:00Z"
+}

internal/server/api/types/types.go

@@ @@ -297,6 +297,33 @@ type UserCAUploadResponse struct { @@
+	Fingerprint string `json:"fingerprint"`
+// DelegationChallenge answers POST /api/v1/delegations: the public half of the
+// keypair eitri will authenticate with, and the exact command that authorizes
+// it. eitri cannot sign this itself — that is the point.
+type DelegationChallenge struct {
+	PublicKey    string `json:"public_key"`   // authorized_keys line, to be signed
+	Principal    string `json:"principal"`    // the principal the certificate MUST carry
+	Instructions string `json:"instructions"` // the ssh-keygen line, ready to run
+}
+// DelegationRequest posts the signed certificate back. A certificate is public
+// material, so there is nothing sensitive about carrying one in a request body.
+type DelegationRequest struct {
+	Certificate string `json:"certificate"`
+}
+// Delegation describes a live delegation. It is entirely public: eitri's half
+// is an ephemeral key it holds only in memory, and a certificate is not a
+// secret. ExpiresAt is when eitri stops being able to reach anything.
+type Delegation struct {
+	PublicKey     string   `json:"public_key"`
+	CAFingerprint string   `json:"ca_fingerprint"`
+	KeyID         string   `json:"key_id"`
+	Serial        string   `json:"serial"`
+	Principals    []string `json:"principals"`
+	ExpiresAt     string   `json:"expires_at"` // RFC3339
+}
+// UserCA is one entry in GET /api/v1/tenants/{tenant}/user-cas.
+type UserCA struct {
+	Fingerprint string `json:"fingerprint"`

internal/server/api/wire_golden_test.go

Old		New
@@ -210,6 +210,21 @@ func TestWireGolden(t *testing.T) {
210	Fingerprint: "SHA256:abcdefghijk",	210	Fingerprint: "SHA256:abcdefghijk",
211	})	211	})
212		212
		213	goldenCheck(t, "delegation-challenge", types.DelegationChallenge{
		214	PublicKey: "ssh-ed25519 AAAAC3Nza eitri-delegation",
		215	Principal: "ubuntu",
		216	Instructions: "ssh-keygen -s <your-ca-key> -I eitri-delegation -n ubuntu -V +8h eitri-delegation.pub",
		217	})
		218
		219	goldenCheck(t, "delegation", types.Delegation{
		220	PublicKey: "ssh-ed25519 AAAAC3Nza eitri-delegation",
		221	CAFingerprint: "SHA256:abcdefghijk",
		222	KeyID: "eitri-delegation",
		223	Serial: "12345678901234567890",
		224	Principals: []string{"ubuntu"},
		225	ExpiresAt: "2026-08-08T12:00:00Z",
		226	})
		227
213	goldenCheck(t, "user-ca-list", []types.UserCA{{	228	goldenCheck(t, "user-ca-list", []types.UserCA{{
214	Fingerprint: "SHA256:abcdefghijk",	229	Fingerprint: "SHA256:abcdefghijk",
215	Label: "team-alpha-ca",	230	Label: "team-alpha-ca",

internal/server/boot/boot.go

Old		New
@@ -23,8 +23,10 @@ import (
23	"github.com/a73x/eitri/internal/joinblob"	23	"github.com/a73x/eitri/internal/joinblob"
24	"github.com/a73x/eitri/internal/server/api"	24	"github.com/a73x/eitri/internal/server/api"
25	serverconfig "github.com/a73x/eitri/internal/server/config"	25	serverconfig "github.com/a73x/eitri/internal/server/config"
		26	"github.com/a73x/eitri/internal/server/delegation"
26	"github.com/a73x/eitri/internal/server/health"	27	"github.com/a73x/eitri/internal/server/health"
27	"github.com/a73x/eitri/internal/server/hub"	28	"github.com/a73x/eitri/internal/server/hub"
		29	"github.com/a73x/eitri/internal/server/mcphttp"
28	"github.com/a73x/eitri/internal/server/registry"	30	"github.com/a73x/eitri/internal/server/registry"
29	"github.com/a73x/eitri/internal/server/release"	31	"github.com/a73x/eitri/internal/server/release"
30	"github.com/a73x/eitri/internal/server/store"	32	"github.com/a73x/eitri/internal/server/store"
@@ -32,6 +34,7 @@ import (
32	"github.com/a73x/eitri/internal/server/web"	34	"github.com/a73x/eitri/internal/server/web"
33	"github.com/a73x/eitri/internal/transport"	35	"github.com/a73x/eitri/internal/transport"
34	"github.com/quic-go/quic-go"	36	"github.com/quic-go/quic-go"
		37	"golang.org/x/crypto/ssh"
35	)	38	)
36		39
37	// RunCLI dispatches the eitri-server command line (everything after the binary	40	// RunCLI dispatches the eitri-server command line (everything after the binary
@@ -60,7 +63,8 @@ func run(cfgPath string) error {
60		63
61	// The key that seals every piece of key material this server holds, decoded	64	// The key that seals every piece of key material this server holds, decoded
62	// once and handed to each place that seals or opens: the gate's key files	65	// once and handed to each place that seals or opens: the gate's key files
63	// (setupSSHGate). Load has already enforced it.	66	// (setupSSHGate), the API on the way into the store, and vmssh.SealedCAs on
		67	// the way back out to the certificate signer. Load has already enforced it.
64	kek, err := cfg.KEKBytes()	68	kek, err := cfg.KEKBytes()
65	if err != nil {	69	if err != nil {
66	return fmt.Errorf("config: %w", err)	70	return fmt.Errorf("config: %w", err)
@@ -184,6 +188,17 @@ func run(cfgPath string) error {
184	// Certify the host keys guests generate for themselves. No-op when the gate	188	// Certify the host keys guests generate for themselves. No-op when the gate
185	// is off, and then no guest waits for a certificate.	189	// is off, and then no guest waits for a certificate.
186	sshGate.wireSync(svc)	190	sshGate.wireSync(svc)
		191
		192	// The credentials tenants have lent eitri. In memory only, so a restart is a
		193	// revocation; the sweeper keeps the keyring bounded by tenants that are
		194	// actually using it. Wired to the API only when there is a CA to verify
		195	// certificates against — with the gate off the routes answer 503, which is
		196	// the same condition that makes remote exec refuse.
		197	keyring := delegation.New(time.Now, guestLoginUser)
		198	if sshGate != nil {
		199	a.SetDelegations(keyring)
		200	}
		201	go sweepDelegations(context.Background(), keyring)
187	// Console broker: the API bridges browser WebSockets to agent console	202	// Console broker: the API bridges browser WebSockets to agent console
188	// streams over the live sync connections the service tracks.	203	// streams over the live sync connections the service tracks.
189	a.SetConsoleDialer(svc)	204	a.SetConsoleDialer(svc)
@@ -217,6 +232,26 @@ func run(cfgPath string) error {
217	// Sign-in endpoints live OUTSIDE /api/ and its auth middleware: they are how	232	// Sign-in endpoints live OUTSIDE /api/ and its auth middleware: they are how
218	// a browser establishes a session in the first place (spec §2).	233	// a browser establishes a session in the first place (spec §2).
219	root.Handle("/auth/", a.AuthHandler())	234	root.Handle("/auth/", a.AuthHandler())
		235	// The MCP endpoint: the same toolset the stdio binary serves, for a client
		236	// anywhere on the internet holding nothing but a PAT. It speaks JSON-RPC
		237	// rather than the REST contract, so like /auth/* it lives outside the route
		238	// table — but wrapped in the API's own authentication, so a caller reaching
		239	// it is the same authenticated principal /api/v1 would see. Both patterns are
		240	// registered because a client may address it with or without a trailing path.
		241	mcpHandler := a.UserAuth(mcphttp.New(mcphttp.Deps{
		242	Handler: a.Handler(),
		243	Creds: delegatedCreds{keyring: keyring, st: st},
		244	TCP: svc,
		245	Lookup: vmLookup(st),
		246	HostCA: sshGate.hostCAPublicKey(),
		247	Gate: cfg.SSHGateDomain,
		248	VMUser: guestLoginUser,
		249	// The API's own origin, so a refusal names something dialable rather
		250	// than a path on whichever host the caller happens to be talking to.
		251	DelegationsURL: a.URL("/api/v1/delegations"),
		252	}))
		253	root.Handle("/mcp", mcpHandler)
		254	root.Handle("/mcp/", mcpHandler)
220	// Unauthenticated probes (outside /api/, so a load balancer or the deploy	255	// Unauthenticated probes (outside /api/, so a load balancer or the deploy
221	// script needs no token). /livez is process-up; /readyz gates on the	256	// script needs no token). /livez is process-up; /readyz gates on the
222	// dependencies the server needs to actually serve — the DB. The QUIC	257	// dependencies the server needs to actually serve — the DB. The QUIC
@@ -278,6 +313,49 @@ func run(cfgPath string) error {
278	return nil	313	return nil
279	}	314	}
280		315
		316	// delegatedCreds pairs the in-memory keyring with the store, which is the one
		317	// place those two facts meet. It lives here rather than in vmssh so that
		318	// package stays free of the store (R1).
		319	type delegatedCreds struct {
		320	keyring *delegation.Keyring
		321	st *store.Store
		322	}
		323
		324	func (d delegatedCreds) Delegated(tenant string) (ssh.Signer, bool) {
		325	return d.keyring.Signer(tenant)
		326	}
		327
		328	func (d delegatedCreds) TenantHasUserCA(tenant string) (bool, error) {
		329	return d.st.TenantHasUserCA(tenant)
		330	}
		331
		332	// delegationSweepInterval is how often the keyring drops entries nothing is
		333	// using. Nothing depends on it being prompt — an expired delegation stops
		334	// working the moment it expires, whether or not it has been swept — so it is
		335	// slow on purpose.
		336	const delegationSweepInterval = 10 * time.Minute
		337
		338	// sweepDelegations keeps the keyring bounded by ACTIVE tenants rather than by
		339	// every tenant that ever started a delegation.
		340	func sweepDelegations(ctx context.Context, k *delegation.Keyring) {
		341	t := time.NewTicker(delegationSweepInterval)
		342	defer t.Stop()
		343	for {
		344	select {
		345	case <-ctx.Done():
		346	return
		347	case <-t.C:
		348	k.Sweep()
		349	}
		350	}
		351	}
		352
		353	// guestLoginUser is the account a guest is logged into, and therefore the
		354	// principal every user certificate carries: a guest trusts its tenant's CA set
		355	// through a bare TrustedUserCAKeys line, so sshd matches the certificate
		356	// principal against the login user. Stock cloud images name it "ubuntu".
		357	const guestLoginUser = "ubuntu"
		358
281	// defaultImages translates the config's per-architecture guest images into the	359	// defaultImages translates the config's per-architecture guest images into the
282	// API's own type, so the API package does not import the config schema (R1: the	360	// API's own type, so the API package does not import the config schema (R1: the
283	// wiring converts, the leaves stay independent).	361	// wiring converts, the leaves stay independent).

internal/server/boot/sshgate.go

Old		New
@@ -13,6 +13,7 @@ import (
13	"github.com/a73x/eitri/internal/server/sshgate"	13	"github.com/a73x/eitri/internal/server/sshgate"
14	"github.com/a73x/eitri/internal/server/store"	14	"github.com/a73x/eitri/internal/server/store"
15	"github.com/a73x/eitri/internal/server/syncsvc"	15	"github.com/a73x/eitri/internal/server/syncsvc"
		16	"github.com/a73x/eitri/internal/server/vmssh"
16	"golang.org/x/crypto/ssh"	17	"golang.org/x/crypto/ssh"
17	)	18	)
18		19
@@ -88,6 +89,16 @@ func (s guestHostCertSigner) SignHostCert(pub ssh.PublicKey, principal string) (
88	return string(ssh.MarshalAuthorizedKey(cert)), nil	89	return string(ssh.MarshalAuthorizedKey(cert)), nil
89	}	90	}
90		91
		92	// hostCAPublicKey returns the HOST CA public key that certifies every VM's host
		93	// key, for callers that verify a guest themselves rather than through the gate.
		94	// Nil when the gate is off — there is then no CA, and no VM carries a host cert.
		95	func (g *sshGateSetup) hostCAPublicKey() ssh.PublicKey {
		96	if g == nil {
		97	return nil
		98	}
		99	return g.ca.HostCA().PublicKey()
		100	}
		101
91	// startListener starts the SSH jump gate listener: when enabled, front	102	// startListener starts the SSH jump gate listener: when enabled, front
92	// `ssh -J gate ubuntu@<vm>` with the hardened bastion. It resolves VM names	103	// `ssh -J gate ubuntu@<vm>` with the hardened bastion. It resolves VM names
93	// against the store, tunnels port 22 through the sync connection (svc.OpenTCP),	104	// against the store, tunnels port 22 through the sync connection (svc.OpenTCP),
@@ -161,6 +172,28 @@ func authorizeVM(st *store.Store) sshgate.Authorizer {
161	}	172	}
162	}	173	}
163		174
		175	// vmLookup pairs resolveVM with authorizeVM for callers that reach a VM without
		176	// the gate in front of them — the /mcp handler's server-side SSH. It is the same
		177	// two checks in the same order: resolve the name within the tenant only, then
		178	// re-read the row and require it to still be that tenant's and still be alive.
		179	func vmLookup(st *store.Store) vmssh.VMLookup {
		180	resolve, authorize := resolveVM(st), authorizeVM(st)
		181	return func(tenant, name string) (vmssh.VM, bool) {
		182	hostID, vmID, ok := resolve(tenant, name)
		183	if !ok \|\| !authorize(tenant, vmID) {
		184	return vmssh.VM{}, false
		185	}
		186	// The row is read again for the certificate rather than carried out of
		187	// resolve: authorize has just re-read it, and a VM that lost its row
		188	// between the two is one we must not claim to have verified.
		189	vm, err := st.GetVM(vmID)
		190	if err != nil {
		191	return vmssh.VM{}, false
		192	}
		193	return vmssh.VM{HostID: hostID, VMID: vmID, HostCertified: vm.SSHHostCert != ""}, true
		194	}
		195	}
		196
164	// revokedCert gates every cert auth against the revocation list. Fail-CLOSED	197	// revokedCert gates every cert auth against the revocation list. Fail-CLOSED
165	// for the single connection on a DB error: a store hiccup rejects THAT login	198	// for the single connection on a DB error: a store hiccup rejects THAT login
166	// (returns revoked=true) rather than fail-open (which would let a possibly-	199	// (returns revoked=true) rather than fail-open (which would let a possibly-

internal/server/boot/sshgate_test.go

Old		New
@@ -1,9 +1,11 @@
1	package boot	1	package boot
2		2
3	import (	3	import (
		4	"bytes"
4	"crypto/ed25519"	5	"crypto/ed25519"
5	"testing"	6	"testing"
6		7
		8	"github.com/a73x/eitri/internal/server/seal"
7	"github.com/a73x/eitri/internal/server/sshca"	9	"github.com/a73x/eitri/internal/server/sshca"
8	"github.com/a73x/eitri/internal/server/store"	10	"github.com/a73x/eitri/internal/server/store"
9	"github.com/stretchr/testify/assert"	11	"github.com/stretchr/testify/assert"
@@ -11,6 +13,10 @@ import (
11	"golang.org/x/crypto/ssh"	13	"golang.org/x/crypto/ssh"
12	)	14	)
13		15
		16	// testKEK stands in for the config's key_encryption_key, which the gate's key
		17	// files rest sealed under.
		18	var testKEK = bytes.Repeat([]byte{0x2b}, seal.KEKSize)
		19
14	// newStore opens a fresh store on a temp DB. The gate closures resolve VMs and	20	// newStore opens a fresh store on a temp DB. The gate closures resolve VMs and
15	// tenants against a REAL store — the same one the live gate uses — so these	21	// tenants against a REAL store — the same one the live gate uses — so these
16	// tests exercise the actual SQL, not a mock.	22	// tests exercise the actual SQL, not a mock.
@@ -107,6 +113,58 @@ func TestAuthorizeVM(t *testing.T) {
107	assert.False(t, authorize(tenantA, vm.ID), "a tombstoned VM must be rejected")	113	assert.False(t, authorize(tenantA, vm.ID), "a tombstoned VM must be rejected")
108	}	114	}
109		115
		116	// TestVMLookupAppliesBothChecks pins that the server-side SSH path resolves a
		117	// VM under exactly the gate's rules: within the tenant only, and only while the
		118	// VM is live and still that tenant's.
		119	func TestVMLookupAppliesBothChecks(t *testing.T) {
		120	s := newStore(t)
		121	tenantA, hostA := makeTenantHost(t, s, "sub-a", "alpha@x.com")
		122	tenantB, _ := makeTenantHost(t, s, "sub-b", "beta@x.com")
		123	vm := makeVM(t, s, hostA, "web")
		124
		125	lookup := vmLookup(s)
		126
		127	got, ok := lookup(tenantA, "web")
		128	require.True(t, ok)
		129	assert.Equal(t, hostA.ID, got.HostID)
		130	assert.Equal(t, vm.ID, got.VMID)
		131	assert.False(t, got.HostCertified, "a VM with no host cert reports itself unverifiable")
		132
		133	// Once the control plane has signed the guest's key, it is verifiable.
		134	require.NoError(t, s.RecordVMHostKey(vm.ID, hostA.ID, "ssh-ed25519 AAAApub g", "cert-line"))
		135	got, ok = lookup(tenantA, "web")
		136	require.True(t, ok)
		137	assert.True(t, got.HostCertified)
		138
		139	_, ok = lookup(tenantB, "web")
		140	assert.False(t, ok, "a name must not resolve across tenants")
		141
		142	_, ok = lookup(tenantA, "nope")
		143	assert.False(t, ok, "an unknown name does not resolve")
		144
		145	require.NoError(t, s.TombstoneVM(vm.ID))
		146	_, ok = lookup(tenantA, "web")
		147	assert.False(t, ok, "a tombstoned VM must not resolve")
		148	}
		149
		150	// TestHostCAPublicKeyIsNilWhenTheGateIsOff: with no gate there is no CA, so no
		151	// guest carries a host certificate and there is nothing to verify against.
		152	func TestHostCAPublicKeyIsNilWhenTheGateIsOff(t *testing.T) {
		153	var off *sshGateSetup
		154	assert.Nil(t, off.hostCAPublicKey())
		155	}
		156
		157	// TestHostCAPublicKeyIsTheHostCA pins that the key handed to the server-side
		158	// dialer is the same one clients pin via @cert-authority.
		159	func TestHostCAPublicKeyIsTheHostCA(t *testing.T) {
		160	dir := t.TempDir()
		161	ca, err := sshca.New(dir+"/ca", dir+"/hostkey", testKEK)
		162	require.NoError(t, err)
		163	g := &sshGateSetup{ca: ca}
		164
		165	assert.Equal(t, sshca.AuthorizedKeyLine(g.hostCAPublicKey())+"\n", string(ca.HostCAAuthorizedKey()))
		166	}
		167
110	// TestRevokedCertFailsClosed pins the revocation gate: a known-revoked serial	168	// TestRevokedCertFailsClosed pins the revocation gate: a known-revoked serial
111	// reads revoked, an unknown serial does not, and a store error fails CLOSED	169	// reads revoked, an unknown serial does not, and a store error fails CLOSED
112	// (reports revoked=true) so a DB hiccup rejects THAT login rather than letting a	170	// (reports revoked=true) so a DB hiccup rejects THAT login rather than letting a

internal/server/config/config.go

Old		New
@@ -13,9 +13,8 @@ type Config struct {
13	AdminToken string `json:"admin_token"`	13	AdminToken string `json:"admin_token"`
14	HostSecret string `json:"host_secret"`	14	HostSecret string `json:"host_secret"`
15	// KeyEncryptionKey seals every piece of key material this server holds: the	15	// KeyEncryptionKey seals every piece of key material this server holds: the
16	// host CA and gate host key on disk (ssh_ca_key, ssh_host_key) and each	16	// host CA and gate host key on disk (ssh_ca_key, ssh_host_key). 64 hex
17	// tenant's opt-in managed CA in the database. 64 hex characters (32 bytes,	17	// characters (32 bytes, minted with `openssl rand -hex 32`).
18	// minted with `openssl rand -hex 32`).
19	//	18	//
20	// It lives HERE, in the config, and nowhere near the data it protects — so a	19	// It lives HERE, in the config, and nowhere near the data it protects — so a
21	// copied database, a nightly backup, or a lifted volume carries ciphertext	20	// copied database, a nightly backup, or a lifted volume carries ciphertext

internal/server/config/load.go

Old		New
@@ -63,9 +63,9 @@ func validate(cfg Config) error {
63	return fmt.Errorf("host_secret is required")	63	return fmt.Errorf("host_secret is required")
64	}	64	}
65	// The key that seals this server's key material. Checked at boot rather than	65	// The key that seals this server's key material. Checked at boot rather than
66	// at first use: a plane whose KEK is missing or mistyped can open neither	66	// at first use: a plane whose KEK is missing or mistyped cannot open its own
67	// its own host CA nor the managed CAs it holds, and that is a refusal to	67	// host CA, and that is a refusal to start, not a surprise on some later
68	// start, not a surprise on some later request.	68	// request.
69	if _, err := cfg.KEKBytes(); err != nil {	69	if _, err := cfg.KEKBytes(); err != nil {
70	return err	70	return err
71	}	71	}

internal/server/config/load_test.go

Old		New
@@ -59,9 +59,9 @@ func TestLoadRequiresHostSecret(t *testing.T) {
59	}	59	}
60	}	60	}
61		61
62	// TestLoadValidatesTheKEK: the key that seals every tenant's managed-CA	62	// TestLoadValidatesTheKEK: the key that seals the fleet's own SSH CA is checked
63	// signing key is checked at boot, so a plane that would write keys nothing can	63	// at boot, so a plane that could not open the key material it holds refuses to
64	// read (or fail to read the ones it holds) refuses to start.	64	// start rather than discovering it on some later request.
65	func TestLoadValidatesTheKEK(t *testing.T) {	65	func TestLoadValidatesTheKEK(t *testing.T) {
66	for _, tc := range []struct {	66	for _, tc := range []struct {
67	name, kek string	67	name, kek string

internal/server/delegation/delegation.go

@@ @@ -0,0 +1,268 @@ @@
+// Package delegation holds the credentials a tenant has lent eitri.
+//
+// eitri generates an ephemeral keypair per tenant and keeps it in memory. The
+// tenant signs its public half with their own CA, on their own terms — their
+// TTL, their principals — and posts the certificate back. eitri then
+// authenticates to that tenant's guests as key-plus-certificate until the
+// certificate expires, and holds nothing else. There is no signing key here for
+// anyone: the most privileged thing eitri can possess is a certificate that runs
+// out.
+//
+// Nothing is persisted. A restart is a revocation, which is the point, and the
+// certificate's own expiry is the second bound. Because the delegated
+// certificate chains to a CA the tenant has already registered, guests created
+// long before the delegation accept it — a delegation is a credential, not a
+// change to what a guest trusts.
+//
+// The package is a leaf on purpose: every validation rule lives here, where it
+// can be tested exhaustively and cheaply, and the HTTP and MCP layers above stay
+// dumb.
+package delegation
+import (
+	"bytes"
+	"crypto/ed25519"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+	"golang.org/x/crypto/ssh"
+)
+// Keyring holds one ephemeral keypair per tenant and, once delegated, the
+// certificate that makes it usable.
+type Keyring struct {
+	// Now is the clock every validity decision is made against. Injected so the
+	// expiry rules are testable without sleeping.
+	Now func() time.Time
+	// Principal is the guest login user every delegated certificate must name.
+	// A guest trusts its tenant's CA set through a bare TrustedUserCAKeys line
+	// with no AuthorizedPrincipalsFile, so sshd matches the certificate's
+	// principals against the user being logged in as — not against the tenant.
+	Principal string
+	mu      sync.Mutex
+	tenants map[string]*entry
+}
+type entry struct {
+	key        ssh.Signer // ephemeral, generated once per tenant per process
+	cert       *ssh.Certificate
+	certSigner ssh.Signer
+}
+// Delegation is the public description of a live delegation. Every field is
+// public material: eitri's half is a key it holds only in memory, and a
+// certificate is not a secret.
+type Delegation struct {
+	PublicKey     string    // the ephemeral public key, authorized_keys form
+	CAFingerprint string    // SHA256 fingerprint of the CA that signed
+	KeyID         string    // the certificate's key id, as the signer set it
+	Serial        uint64    // the certificate's serial, for revocation
+	Principals    []string  // the certificate's principals
+	ExpiresAt     time.Time // when eitri stops being able to reach anything
+}
+// New builds an empty keyring. principal is the guest login user delegated
+// certificates must name.
+func New(now func() time.Time, principal string) *Keyring {
+	if now == nil {
+		now = time.Now
+	}
+	return &Keyring{Now: now, Principal: principal, tenants: map[string]*entry{}}
+}
+// Begin returns the public key this tenant is to sign, generating the keypair
+// on first call and returning the SAME key every time afterwards.
+//
+// Stable-per-process is deliberate. Re-delegating after an expiry is then one
+// ssh-keygen and one Complete, with no round trip to re-fetch a key that has
+// not changed — but only within one process: a restart generates a new key,
+// which is what Complete's wrong-key refusal names. The public key is not a
+// secret in any sense that matters: it is useless without a certificate, and
+// eitri cannot make itself one.
+func (k *Keyring) Begin(tenant string) (string, error) {
+	k.mu.Lock()
+	defer k.mu.Unlock()
+	e, err := k.entryLocked(tenant)
+	if err != nil {
+		return "", err
+	}
+	return authorizedLine(e.key.PublicKey()), nil
+}
+// Complete accepts the certificate a tenant signed over this tenant's ephemeral
+// key, and puts it to work.
+//
+// trusted reports whether a public key is a CA THIS TENANT has registered. It
+// is a callback so the package stays free of the store; boot supplies the real
+// lookup. Every refusal below says what to do next, because every one of them
+// is a mistake a caller can fix — and an unexplained refusal here resurfaces
+// three tool calls later as an unexplained SSH failure.
+func (k *Keyring) Complete(tenant, certLine string, trusted func(ssh.PublicKey) (bool, error)) (Delegation, error) {
+	k.mu.Lock()
+	defer k.mu.Unlock()
+	e, err := k.entryLocked(tenant)
+	if err != nil {
+		return Delegation{}, err
+	}
+	pub, _, _, _, err := ssh.ParseAuthorizedKey([]byte(certLine))
+	if err != nil {
+		return Delegation{}, errors.New("that is not an SSH certificate — paste the whole contents of the " +
+			"*-cert.pub file ssh-keygen wrote, on one line")
+	}
+	cert, ok := pub.(*ssh.Certificate)
+	if !ok {
+		return Delegation{}, errors.New("that is a public key, not a certificate — sign it with your own CA " +
+			"(`ssh-keygen -s <your-ca> -I eitri-delegation -n " + k.Principal + " -V +8h <file>.pub`) and send the " +
+			"*-cert.pub it writes")
+	}
+	if cert.CertType != ssh.UserCert {
+		return Delegation{}, errors.New("that is a HOST certificate; eitri authenticates as a user, so it needs a " +
+			"user certificate — sign without `-h`")
+	}
+	if !bytes.Equal(cert.Key.Marshal(), e.key.PublicKey().Marshal()) {
+		// Name the key that IS current. The usual cause is a certificate signed
+		// over a key from before a restart, and without the fingerprint to
+		// compare against there is nothing in the refusal to act on.
+		return Delegation{}, fmt.Errorf("that certificate is over %s, but this tenant's current delegation key is "+
+			"%s — the key changes when the control plane restarts. Call delegate_begin again and sign the key it "+
+			"returns", ssh.FingerprintSHA256(cert.Key), ssh.FingerprintSHA256(e.key.PublicKey()))
+	}
+	ok, err = trusted(cert.SignatureKey)
+	if err != nil {
+		return Delegation{}, errors.New("checking which CA signed that certificate failed")
+	}
+	if !ok {
+		return Delegation{}, fmt.Errorf("that certificate was signed by %s, which is not a CA registered to this "+
+			"tenant — your guests would refuse it too. Register that CA (`eitri ca upload`) or sign with one you "+
+			"have already registered", ssh.FingerprintSHA256(cert.SignatureKey))
+	}
+	// Principals are checked ahead of the full verification so the error can
+	// name the fix. It is the single most likely mistake, and as a bare
+	// "certificate rejected" it is close to undiagnosable.
+	if !slices.Contains(cert.ValidPrincipals, k.Principal) {
+		return Delegation{}, fmt.Errorf("that certificate's principals are [%s]; a guest matches the principal "+
+			"against the login user, so it must include %q — re-sign with `-n %s`",
+			strings.Join(cert.ValidPrincipals, " "), k.Principal, k.Principal)
+	}
+	// One call does the signature, the principal and the validity window, all
+	// against this keyring's clock.
+	checker := &ssh.CertChecker{
+		IsUserAuthority: func(auth ssh.PublicKey) bool {
+			return bytes.Equal(auth.Marshal(), cert.SignatureKey.Marshal())
+		},
+		Clock: k.Now,
+	}
+	if err := checker.CheckCert(k.Principal, cert); err != nil {
+		return Delegation{}, fmt.Errorf("that certificate is not usable: %w", err)
+	}
+	signer, err := ssh.NewCertSigner(cert, e.key)
+	if err != nil {
+		return Delegation{}, fmt.Errorf("that certificate does not pair with the key: %w", err)
+	}
+	e.cert = cert
+	e.certSigner = signer
+	return describe(e), nil
+}
+// Signer returns the credential eitri may authenticate to this tenant's guests
+// with, or false when there is none. An expired delegation is dropped here
+// rather than reported, so it is indistinguishable from never having existed —
+// which is what the caller needs to be told to do about it either way.
+func (k *Keyring) Signer(tenant string) (ssh.Signer, bool) {
+	k.mu.Lock()
+	defer k.mu.Unlock()
+	e, ok := k.tenants[tenant]
+	if !ok || e.cert == nil {
+		return nil, false
+	}
+	if k.expiredLocked(e) {
+		e.cert, e.certSigner = nil, nil
+		return nil, false
+	}
+	return e.certSigner, true
+}
+// Status describes this tenant's live delegation, if any.
+func (k *Keyring) Status(tenant string) (Delegation, bool) {
+	k.mu.Lock()
+	defer k.mu.Unlock()
+	e, ok := k.tenants[tenant]
+	if !ok || e.cert == nil || k.expiredLocked(e) {
+		return Delegation{}, false
+	}
+	return describe(e), true
+}
+// Revoke drops this tenant's delegation immediately. The ephemeral key stays,
+// so a later Begin returns the same public key and re-delegating is one signing
+// step.
+func (k *Keyring) Revoke(tenant string) {
+	k.mu.Lock()
+	defer k.mu.Unlock()
+	if e, ok := k.tenants[tenant]; ok {
+		e.cert, e.certSigner = nil, nil
+	}
+}
+// Sweep drops every entry that is not doing anything: no certificate, or an
+// expired one. It bounds the keyring by ACTIVE tenants rather than by every
+// tenant that ever called Begin. An entry with no certificate survives until
+// the next sweep — it is one keypair, around a hundred bytes — so a caller who
+// takes a few minutes between Begin and Complete is not raced.
+func (k *Keyring) Sweep() {
+	k.mu.Lock()
+	defer k.mu.Unlock()
+	for tenant, e := range k.tenants {
+		if e.cert == nil || k.expiredLocked(e) {
+			delete(k.tenants, tenant)
+		}
+	}
+}
+// entryLocked returns this tenant's entry, generating its keypair on first use.
+func (k *Keyring) entryLocked(tenant string) (*entry, error) {
+	if e, ok := k.tenants[tenant]; ok {
+		return e, nil
+	}
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, fmt.Errorf("generate delegation key: %w", err)
+	}
+	signer, err := ssh.NewSignerFromSigner(priv)
+	if err != nil {
+		return nil, fmt.Errorf("delegation signer: %w", err)
+	}
+	e := &entry{key: signer}
+	k.tenants[tenant] = e
+	return e, nil
+}
+func (k *Keyring) expiredLocked(e *entry) bool {
+	return !k.Now().Before(time.Unix(int64(e.cert.ValidBefore), 0)) //nolint:gosec // ValidBefore is a unix time
+}
+func describe(e *entry) Delegation {
+	return Delegation{
+		PublicKey:     authorizedLine(e.key.PublicKey()),
+		CAFingerprint: ssh.FingerprintSHA256(e.cert.SignatureKey),
+		KeyID:         e.cert.KeyId,
+		Serial:        e.cert.Serial,
+		Principals:    slices.Clone(e.cert.ValidPrincipals),
+		ExpiresAt:     time.Unix(int64(e.cert.ValidBefore), 0).UTC(), //nolint:gosec // ValidBefore is a unix time
+	}
+}
+func authorizedLine(pub ssh.PublicKey) string {
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(pub)))
+}

internal/server/delegation/delegation_test.go

@@ @@ -0,0 +1,369 @@ @@
+package delegation
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+var now = time.Unix(1_800_000_000, 0).UTC()
+func fixedNow() time.Time { return now }
+// newCA returns a signer standing in for a tenant's own SSH user CA.
+func newCA(t *testing.T) ssh.Signer {
+	t.Helper()
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	s, err := ssh.NewSignerFromSigner(priv)
+	require.NoError(t, err)
+	return s
+}
+// trusts builds the trust callback for a fixed set of registered CAs.
+func trusts(cas ...ssh.Signer) func(ssh.PublicKey) (bool, error) {
+	return func(k ssh.PublicKey) (bool, error) {
+		for _, ca := range cas {
+			if string(ca.PublicKey().Marshal()) == string(k.Marshal()) {
+				return true, nil
+			}
+		}
+		return false, nil
+	}
+}
+type certOpts struct {
+	certType    uint32
+	principals  []string
+	validAfter  time.Time
+	validBefore time.Time
+	key         ssh.PublicKey // defaults to the pubLine argument
+}
+// sign builds the certificate a tenant would produce with `ssh-keygen -s`.
+func sign(t *testing.T, ca ssh.Signer, pubLine string, o certOpts) string {
+	t.Helper()
+	key := o.key
+	if key == nil {
+		parsed, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pubLine))
+		require.NoError(t, err)
+		key = parsed
+	}
+	if o.certType == 0 {
+		o.certType = ssh.UserCert
+	}
+	if o.principals == nil {
+		o.principals = []string{"ubuntu"}
+	}
+	if o.validAfter.IsZero() {
+		o.validAfter = now.Add(-time.Minute)
+	}
+	if o.validBefore.IsZero() {
+		o.validBefore = now.Add(8 * time.Hour)
+	}
+	cert := &ssh.Certificate{
+		Key:             key,
+		Serial:          42,
+		CertType:        o.certType,
+		KeyId:           "eitri-delegation",
+		ValidPrincipals: o.principals,
+		ValidAfter:      uint64(o.validAfter.Unix()),
+		ValidBefore:     uint64(o.validBefore.Unix()),
+		Permissions: ssh.Permissions{Extensions: map[string]string{
+			"permit-pty": "", "permit-port-forwarding": "",
+		}},
+	}
+	require.NoError(t, cert.SignCert(rand.Reader, ca))
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(cert)))
+}
+// delegate runs the whole happy path and returns the keyring, the CA and the
+// resulting description.
+func delegate(t *testing.T) (*Keyring, ssh.Signer, Delegation) {
+	t.Helper()
+	k := New(fixedNow, "ubuntu")
+	ca := newCA(t)
+	pub, err := k.Begin("acme")
+	require.NoError(t, err)
+	d, err := k.Complete("acme", sign(t, ca, pub, certOpts{}), trusts(ca))
+	require.NoError(t, err)
+	return k, ca, d
+}
+func TestBeginIsStableAndPerTenant(t *testing.T) {
+	k := New(fixedNow, "ubuntu")
+	a1, err := k.Begin("acme")
+	require.NoError(t, err)
+	a2, err := k.Begin("acme")
+	require.NoError(t, err)
+	assert.Equal(t, a1, a2, "re-delegating must not need a new key")
+	b, err := k.Begin("other")
+	require.NoError(t, err)
+	assert.NotEqual(t, a1, b, "one tenant's delegation must never be usable as another's")
+	assert.True(t, strings.HasPrefix(a1, "ssh-ed25519 "), "got %q", a1)
+}
+func TestCompleteAcceptsAWellFormedCertificate(t *testing.T) {
+	k, ca, d := delegate(t)
+	assert.Equal(t, ssh.FingerprintSHA256(ca.PublicKey()), d.CAFingerprint)
+	assert.Equal(t, "eitri-delegation", d.KeyID)
+	assert.Equal(t, uint64(42), d.Serial)
+	assert.Equal(t, []string{"ubuntu"}, d.Principals)
+	assert.Equal(t, now.Add(8*time.Hour), d.ExpiresAt)
+	signer, ok := k.Signer("acme")
+	require.True(t, ok)
+	cert, ok := signer.PublicKey().(*ssh.Certificate)
+	require.True(t, ok, "eitri must authenticate as key-plus-certificate")
+	assert.Equal(t, d.PublicKey, strings.TrimSpace(string(ssh.MarshalAuthorizedKey(cert.Key))))
+}
+func TestCompleteRefusals(t *testing.T) {
+	ca := newCA(t)
+	stranger := newCA(t)
+	otherTenantCA := newCA(t)
+	cases := []struct {
+		name string
+		// cert builds the line to post, given the tenant's own public key.
+		cert func(t *testing.T, pub string) string
+		// trust is the tenant's registered CA set.
+		trust    func(ssh.PublicKey) (bool, error)
+		contains string
+	}{
+		{
+			name:     "a bare public key",
+			cert:     func(t *testing.T, pub string) string { return pub },
+			trust:    trusts(ca),
+			contains: "public key, not a certificate",
+		},
+		{
+			name:     "garbage bytes",
+			cert:     func(t *testing.T, _ string) string { return "not a key at all" },
+			trust:    trusts(ca),
+			contains: "not an SSH certificate",
+		},
+		{
+			name: "a host certificate",
+			cert: func(t *testing.T, pub string) string {
+				return sign(t, ca, pub, certOpts{certType: ssh.HostCert})
+			},
+			trust:    trusts(ca),
+			contains: "HOST certificate",
+		},
+		{
+			name: "a certificate for somebody else's key",
+			cert: func(t *testing.T, _ string) string {
+				return sign(t, ca, "", certOpts{key: newCA(t).PublicKey()})
+			},
+			trust:    trusts(ca),
+			contains: "current delegation key is",
+		},
+		{
+			name: "a certificate over a key from before a restart",
+			cert: func(t *testing.T, _ string) string {
+				return sign(t, ca, "", certOpts{key: newCA(t).PublicKey()})
+			},
+			trust: trusts(ca),
+			// The remedy, not just the diagnosis: the key changed underneath
+			// the caller and only delegate_begin hands out the new one.
+			contains: "Call delegate_begin again",
+		},
+		{
+			name:     "a certificate from an unregistered CA",
+			cert:     func(t *testing.T, pub string) string { return sign(t, stranger, pub, certOpts{}) },
+			trust:    trusts(ca),
+			contains: "not a CA registered to this tenant",
+		},
+		{
+			name:     "a certificate from ANOTHER tenant's registered CA",
+			cert:     func(t *testing.T, pub string) string { return sign(t, otherTenantCA, pub, certOpts{}) },
+			trust:    trusts(ca), // this tenant's set; the other tenant's CA is not in it
+			contains: "not a CA registered to this tenant",
+		},
+		{
+			name: "principals that omit the login user",
+			cert: func(t *testing.T, pub string) string {
+				return sign(t, ca, pub, certOpts{principals: []string{"alex"}})
+			},
+			trust:    trusts(ca),
+			contains: "must include \"ubuntu\"",
+		},
+		{
+			name: "an already-expired certificate",
+			cert: func(t *testing.T, pub string) string {
+				return sign(t, ca, pub, certOpts{
+					validAfter:  now.Add(-2 * time.Hour),
+					validBefore: now.Add(-time.Hour),
+				})
+			},
+			trust:    trusts(ca),
+			contains: "not usable",
+		},
+		{
+			name: "a not-yet-valid certificate",
+			cert: func(t *testing.T, pub string) string {
+				return sign(t, ca, pub, certOpts{
+					validAfter:  now.Add(time.Hour),
+					validBefore: now.Add(2 * time.Hour),
+				})
+			},
+			trust:    trusts(ca),
+			contains: "not usable",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			k := New(fixedNow, "ubuntu")
+			pub, err := k.Begin("acme")
+			require.NoError(t, err)
+			_, err = k.Complete("acme", tc.cert(t, pub), tc.trust)
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tc.contains)
+			_, ok := k.Signer("acme")
+			assert.False(t, ok, "a refused certificate must leave eitri with nothing")
+		})
+	}
+}
+func TestCompleteReportsATrustLookupFailure(t *testing.T) {
+	k := New(fixedNow, "ubuntu")
+	ca := newCA(t)
+	pub, err := k.Begin("acme")
+	require.NoError(t, err)
+	_, err = k.Complete("acme", sign(t, ca, pub, certOpts{}), func(ssh.PublicKey) (bool, error) {
+		return false, assert.AnError
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "checking which CA signed")
+}
+func TestARefusalNamesTheCommandThatFixesIt(t *testing.T) {
+	k := New(fixedNow, "ubuntu")
+	pub, err := k.Begin("acme")
+	require.NoError(t, err)
+	_, err = k.Complete("acme", pub, trusts())
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "ssh-keygen -s", "a refusal must say what to run next")
+	assert.Contains(t, err.Error(), "-n ubuntu")
+}
+func TestSignerStopsAtExpiry(t *testing.T) {
+	k := New(fixedNow, "ubuntu")
+	ca := newCA(t)
+	pub, err := k.Begin("acme")
+	require.NoError(t, err)
+	_, err = k.Complete("acme", sign(t, ca, pub, certOpts{validBefore: now.Add(time.Hour)}), trusts(ca))
+	require.NoError(t, err)
+	_, ok := k.Signer("acme")
+	require.True(t, ok)
+	clock := now
+	k.Now = func() time.Time { return clock }
+	clock = now.Add(59 * time.Minute)
+	_, ok = k.Signer("acme")
+	assert.True(t, ok, "still inside the window")
+	clock = now.Add(time.Hour)
+	_, ok = k.Signer("acme")
+	assert.False(t, ok, "eitri must lose access the moment the certificate does")
+	_, ok = k.Status("acme")
+	assert.False(t, ok)
+}
+func TestSignerAndStatusAreAbsentBeforeAnyDelegation(t *testing.T) {
+	k := New(fixedNow, "ubuntu")
+	_, ok := k.Signer("acme")
+	assert.False(t, ok)
+	_, ok = k.Status("acme")
+	assert.False(t, ok)
+	// Even after Begin: a key with no certificate is not access.
+	_, err := k.Begin("acme")
+	require.NoError(t, err)
+	_, ok = k.Signer("acme")
+	assert.False(t, ok)
+}
+func TestRevokeIsImmediateAndKeepsTheKey(t *testing.T) {
+	k, ca, d := delegate(t)
+	k.Revoke("acme")
+	_, ok := k.Signer("acme")
+	assert.False(t, ok)
+	// The same key comes back, so re-delegating is one signing step.
+	pub, err := k.Begin("acme")
+	require.NoError(t, err)
+	assert.Equal(t, d.PublicKey, pub)
+	_, err = k.Complete("acme", sign(t, ca, pub, certOpts{}), trusts(ca))
+	require.NoError(t, err)
+	_, ok = k.Signer("acme")
+	assert.True(t, ok)
+}
+func TestSweepDropsWhatIsNotBeingUsed(t *testing.T) {
+	clock := now
+	k := New(func() time.Time { return clock }, "ubuntu")
+	ca := newCA(t)
+	live, err := k.Begin("live")
+	require.NoError(t, err)
+	_, err = k.Complete("live", sign(t, ca, live, certOpts{validBefore: now.Add(8 * time.Hour)}), trusts(ca))
+	require.NoError(t, err)
+	dead, err := k.Begin("dead")
+	require.NoError(t, err)
+	_, err = k.Complete("dead", sign(t, ca, dead, certOpts{validBefore: now.Add(time.Hour)}), trusts(ca))
+	require.NoError(t, err)
+	_, err = k.Begin("never-finished")
+	require.NoError(t, err)
+	clock = now.Add(2 * time.Hour)
+	k.Sweep()
+	k.mu.Lock()
+	_, hasLive := k.tenants["live"]
+	_, hasDead := k.tenants["dead"]
+	_, hasPending := k.tenants["never-finished"]
+	k.mu.Unlock()
+	assert.True(t, hasLive)
+	assert.False(t, hasDead, "an expired delegation is dead weight")
+	assert.False(t, hasPending, "a keyring is bounded by active tenants")
+}
+func TestConcurrentUseIsSafe(t *testing.T) {
+	k := New(fixedNow, "ubuntu")
+	ca := newCA(t)
+	var wg sync.WaitGroup
+	for i := range 8 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			tenant := []string{"a", "b"}[i%2]
+			pub, err := k.Begin(tenant)
+			assert.NoError(t, err)
+			_, _ = k.Complete(tenant, sign(t, ca, pub, certOpts{}), trusts(ca))
+			k.Signer(tenant)
+			k.Status(tenant)
+			k.Sweep()
+		}()
+	}
+	wg.Wait()
+}

internal/server/mcphttp/inproc.go

@@ @@ -0,0 +1,58 @@ @@
+package mcphttp
+import (
+	"bytes"
+	"io"
+	"net/http"
+)
+// inproc dispatches a client request into the server's own handler. The caller's
+// PAT rides the Authorization header exactly as a remote client's would, so the
+// request re-authenticates through the same middleware and lands on the same
+// Principal — there is no second authorization path to keep in step with the
+// first, and no socket in between.
+type inproc struct{ h http.Handler }
+func (t inproc) RoundTrip(r *http.Request) (*http.Response, error) {
+	rec := &recorder{header: http.Header{}, status: http.StatusOK}
+	t.h.ServeHTTP(rec, r)
+	resp := &http.Response{
+		StatusCode:    rec.status,
+		Status:        http.StatusText(rec.status),
+		Header:        rec.header,
+		Body:          io.NopCloser(bytes.NewReader(rec.body.Bytes())),
+		ContentLength: int64(rec.body.Len()),
+		Request:       r,
+		Proto:         "HTTP/1.1",
+		ProtoMajor:    1,
+		ProtoMinor:    1,
+	}
+	return resp, nil
+}
+// recorder is the minimal http.ResponseWriter the in-process round trip needs.
+// It is written out by hand rather than importing net/http/httptest, which is a
+// testing package and has no business in a serving path.
+type recorder struct {
+	header      http.Header
+	body        bytes.Buffer
+	status      int
+	wroteHeader bool
+}
+func (r *recorder) Header() http.Header { return r.header }
+func (r *recorder) Write(p []byte) (int, error) {
+	if !r.wroteHeader {
+		r.WriteHeader(http.StatusOK)
+	}
+	return r.body.Write(p)
+}
+func (r *recorder) WriteHeader(status int) {
+	if r.wroteHeader {
+		return
+	}
+	r.wroteHeader = true
+	r.status = status
+}

internal/server/mcphttp/mcphttp.go

@@ @@ -0,0 +1,124 @@ @@
+// Package mcphttp serves the eitri MCP toolset over HTTP at /mcp. The transport
+// is MCP streamable HTTP, stateless: one JSON-RPC message per POST, no session
+// state, nothing server-initiated except progress on a call in flight. Identity
+// is per request — the bearer PAT the auth middleware already resolved — so a
+// server is built per request, bound to that caller, and the tools it exposes
+// are the same ones the stdio binary exposes.
+//
+// A PAT is the whole credential. The tools call the API in-process through the
+// same client every other consumer uses, so tenant filtering and authorization
+// are the API's, unduplicated; SSH reaches VMs over the host's sync tunnel with
+// the credential that tenant has delegated to eitri.
+package mcphttp
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strings"
+	"github.com/a73x/eitri/internal/mcpserver"
+	"github.com/a73x/eitri/internal/server/api"
+	"github.com/a73x/eitri/internal/server/api/client"
+	"github.com/a73x/eitri/internal/server/vmssh"
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+	"golang.org/x/crypto/ssh"
+)
+// inprocBaseURL is the host the in-process client addresses. Nothing resolves
+// it: the request never leaves the process, and the API's own mux answers.
+const inprocBaseURL = "http://eitri.internal"
+// Deps is everything /mcp needs from the rest of the control plane.
+type Deps struct {
+	Handler http.Handler      // the API's own mux, for the in-process client
+	Creds   vmssh.Credentials // what a tenant has delegated, and whether it has any CA at all
+	TCP     vmssh.TCPDialer
+	Lookup  vmssh.VMLookup
+	HostCA  ssh.PublicKey // nil ⇒ no jump gate ⇒ remote exec refused with a clear reason
+	Gate    string        // gate address, for the ssh_command hint only
+	VMUser  string        // guest login user, and the certificate principal
+	// DelegationsURL is the full URL a caller POSTs to start a delegation. The
+	// REST API and /mcp can be served on different hostnames, so the refusal
+	// that carries this must not leave the caller to guess which.
+	DelegationsURL string
+}
+// New returns the /mcp handler. The API mux and the schema cache are built once
+// and shared by every request; everything identity-bearing is built per request.
+func New(d Deps) http.Handler {
+	transport := &http.Client{Transport: inproc{h: d.Handler}}
+	cache := mcp.NewSchemaCache()
+	return mcp.NewStreamableHTTPHandler(func(r *http.Request) *mcp.Server {
+		return serverFor(d, transport, cache, r)
+	}, &mcp.StreamableHTTPOptions{Stateless: true})
+}
+// serverFor builds the MCP server for one authenticated caller. The tenant comes
+// from the principal the auth middleware resolved; the PAT is passed straight
+// back down so the in-process API calls re-authenticate as that same caller.
+func serverFor(d Deps, transport *http.Client, cache *mcp.SchemaCache, r *http.Request) *mcp.Server {
+	tenant := api.TenantFromContext(r.Context())
+	pat := bearer(r)
+	c := &client.Client{BaseURL: inprocBaseURL, Token: pat, HTTP: transport}
+	tools := &mcpserver.Tools{
+		API: mcpserver.API{Client: c},
+		Runner: mcpserver.NewRunner(&vmssh.Dialer{
+			Tenant:         tenant,
+			VMUser:         d.VMUser,
+			TCP:            d.TCP,
+			Lookup:         d.Lookup,
+			Creds:          d.Creds,
+			HostCA:         d.HostCA,
+			DelegationsURL: d.DelegationsURL,
+		}),
+		Gate:   d.Gate,
+		VMUser: d.VMUser,
+	}
+	return mcpserver.NewServer(tools, mcpserver.Options{
+		Delegator:   delegator{c: c},
+		SchemaCache: cache,
+	})
+}
+// bearer returns the request's bearer token. A request that reached here passed
+// the auth middleware, so a non-empty Authorization header is the PAT; a console
+// session cookie instead leaves this empty, and the in-process API calls then
+// fail as unauthenticated rather than silently borrowing someone's identity.
+func bearer(r *http.Request) string {
+	tok, _ := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
+	return tok
+}
+// delegator backs the two delegate tools with the delegation endpoints, and
+// words what the model should do next at each step. Authorization stays the
+// API's: these go through the same in-process client every other tool uses.
+type delegator struct{ c *client.Client }
+func (dg delegator) Begin(ctx context.Context) (mcpserver.BeginResult, error) {
+	ch, err := dg.c.BeginDelegation(ctx)
+	if err != nil {
+		return mcpserver.BeginResult{}, fmt.Errorf("starting a delegation: %w", err)
+	}
+	return mcpserver.BeginResult{
+		PublicKey:    ch.PublicKey,
+		Principal:    ch.Principal,
+		Instructions: ch.Instructions,
+		Note: "eitri cannot sign this itself — it holds no CA. Show the human the public key and the command, " +
+			"wait for them to run it, and pass the resulting *-cert.pub to delegate_complete.",
+	}, nil
+}
+func (dg delegator) Complete(ctx context.Context, certificate string) (mcpserver.DelegationResult, error) {
+	d, err := dg.c.CompleteDelegation(ctx, certificate)
+	if err != nil {
+		return mcpserver.DelegationResult{}, fmt.Errorf("completing the delegation: %w", err)
+	}
+	return mcpserver.DelegationResult{
+		ExpiresAt:     d.ExpiresAt,
+		CAFingerprint: d.CAFingerprint,
+		Principals:    d.Principals,
+		Note: "eitri can now reach your VMs until " + d.ExpiresAt + ". It holds no signing key — only this " +
+			"certificate, in memory. If the control plane restarts, delegate again.",
+	}, nil
+}

internal/server/mcphttp/mcphttp_test.go

@@ @@ -0,0 +1,559 @@ @@
+package mcphttp
+import (
+	"bytes"
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+	"github.com/a73x/eitri/internal/server/api"
+	"github.com/a73x/eitri/internal/server/api/types"
+	"github.com/a73x/eitri/internal/server/delegation"
+	"github.com/a73x/eitri/internal/server/hub"
+	"github.com/a73x/eitri/internal/server/registry"
+	"github.com/a73x/eitri/internal/server/store"
+	"github.com/a73x/eitri/internal/server/vmssh"
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+// fixture is a control plane with two tenants, each holding a PAT, fronted by
+// the same root mux the server binary builds: /api/ and /mcp behind one
+// authentication.
+type fixture struct {
+	ts      *httptest.Server
+	st      *store.Store
+	tenantA string
+	patA    string
+	tenantB string
+	patB    string
+	keyring *delegation.Keyring
+}
+// testCreds is the pairing boot makes: the in-memory keyring plus the store.
+type testCreds struct {
+	k  *delegation.Keyring
+	st *store.Store
+}
+func (c testCreds) Delegated(tenant string) (ssh.Signer, bool)  { return c.k.Signer(tenant) }
+func (c testCreds) TenantHasUserCA(tenant string) (bool, error) { return c.st.TenantHasUserCA(tenant) }
+func newFixture(t *testing.T) fixture {
+	t.Helper()
+	st, err := store.Open(t.TempDir()+"/db", "10.77.0.0/16")
+	require.NoError(t, err)
+	t.Cleanup(func() { st.Close() })
+	a := api.New(api.Config{
+		HostSecret:       []byte("hostsecret"),
+		AdvertiseHTTP:    "http://127.0.0.1:8080",
+		AdvertiseQUIC:    "127.0.0.1:8443",
+		ServerCertSHA256: strings.Repeat("c", 64),
+	}, st, registry.New(time.Now), hub.New())
+	t.Cleanup(a.Close)
+	f := fixture{st: st}
+	f.tenantA, f.patA = newTenant(t, st, "alpha")
+	f.tenantB, f.patB = newTenant(t, st, "beta")
+	// A host CA stands in for a configured jump gate, so the exec path gets past
+	// "no CA configured" and reaches the tenant's own CA situation.
+	_, hostCAPriv, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	hostCA, err := ssh.NewSignerFromSigner(hostCAPriv)
+	require.NoError(t, err)
+	// The delegation keyring the control plane wires: shared between the API
+	// (which fills it) and the exec path (which reads it), exactly as in boot.
+	f.keyring = delegation.New(time.Now, "ubuntu")
+	a.SetDelegations(f.keyring)
+	root := http.NewServeMux()
+	root.Handle("/api/", a.Handler())
+	mcpHandler := a.UserAuth(New(Deps{
+		Handler: a.Handler(), Creds: testCreds{k: f.keyring, st: st}, VMUser: "ubuntu", HostCA: hostCA.PublicKey(),
+		Lookup: func(string, string) (vmssh.VM, bool) { return vmssh.VM{}, false },
+	}))
+	root.Handle("/mcp", mcpHandler)
+	root.Handle("/mcp/", mcpHandler)
+	f.ts = httptest.NewServer(root)
+	t.Cleanup(f.ts.Close)
+	return f
+}
+func newTenant(t *testing.T, st *store.Store, handle string) (string, string) {
+	t.Helper()
+	tn, err := st.CreateTenantForIdentity("https://issuer.example", "sub-"+handle, handle+"@example.com")
+	require.NoError(t, err)
+	pat, _, err := st.CreateAPIToken(tn.ID, handle, 0)
+	require.NoError(t, err)
+	return tn.ID, pat
+}
+// seedVM gives a tenant one host and one ready VM, so vm_list has something to
+// filter and the exec tools get as far as trying to reach a guest.
+func seedVM(t *testing.T, st *store.Store, tenant, hostName, vmName string) {
+	t.Helper()
+	tok, err := st.CreateEnrollmentToken(tenant)
+	require.NoError(t, err)
+	h, err := st.RedeemEnrollmentToken(tok, store.EnrollFacts{
+		Name: hostName, OS: "linux", Arch: "amd64", Provisioner: "cloudhv"})
+	require.NoError(t, err)
+	require.NoError(t, st.CreateVM(store.VM{
+		ID: vmName + "-id", HostID: h.ID, Name: vmName,
+		ImageURL: "https://images.example/x.img", ImageSHA256: strings.Repeat("a", 64),
+		VCPUs: 1, MemMB: 512, DiskGB: 5, PowerState: "running"}))
+	_, err = st.RecordVMStatus(vmName+"-id", "ready", "", "10.77.0.5")
+	require.NoError(t, err)
+}
+// connect opens a real MCP client against /mcp with pat as the bearer token.
+func connect(t *testing.T, f fixture, pat string) *mcp.ClientSession {
+	t.Helper()
+	tr := &mcp.StreamableClientTransport{
+		Endpoint:   f.ts.URL + "/mcp",
+		HTTPClient: &http.Client{Transport: bearerTransport{pat: pat}},
+	}
+	cs, err := mcp.NewClient(&mcp.Implementation{Name: "test", Version: "0"}, nil).Connect(t.Context(), tr, nil)
+	require.NoError(t, err)
+	t.Cleanup(func() { cs.Close() })
+	return cs
+}
+// bearerTransport attaches the PAT the way a remote MCP client would.
+type bearerTransport struct{ pat string }
+func (b bearerTransport) RoundTrip(r *http.Request) (*http.Response, error) {
+	if b.pat != "" {
+		r.Header.Set("Authorization", "Bearer "+b.pat)
+	}
+	return http.DefaultTransport.RoundTrip(r)
+}
+// post sends a raw JSON-RPC body, for the cases an MCP client cannot express
+// (no credential, a bad one, the wrong method).
+func post(t *testing.T, f fixture, method, pat, body string) *http.Response {
+	t.Helper()
+	req, err := http.NewRequest(method, f.ts.URL+"/mcp", strings.NewReader(body))
+	require.NoError(t, err)
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "application/json, text/event-stream")
+	if pat != "" {
+		req.Header.Set("Authorization", "Bearer "+pat)
+	}
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	t.Cleanup(func() { resp.Body.Close() })
+	return resp
+}
+const initBody = `{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"0"}}}`
+// ── tests ────────────────────────────────────────────────────────────────────
+// TestMCPRequiresACredential: the endpoint lives outside the REST route table
+// but not outside its authentication.
+func TestMCPRequiresACredential(t *testing.T) {
+	f := newFixture(t)
+	assert.Equal(t, http.StatusUnauthorized, post(t, f, "POST", "", initBody).StatusCode)
+}
+// TestMCPRejectsABadPAT: an invalid token is indistinguishable from none.
+func TestMCPRejectsABadPAT(t *testing.T) {
+	f := newFixture(t)
+	assert.Equal(t, http.StatusUnauthorized, post(t, f, "POST", "eitri_pat_notreal", initBody).StatusCode)
+}
+// TestMCPGetIsNotAllowed: stateless streamable HTTP has no server-initiated
+// stream to open, so a GET is answered 405 rather than hanging.
+func TestMCPGetIsNotAllowed(t *testing.T) {
+	f := newFixture(t)
+	resp := post(t, f, "GET", f.patA, "")
+	assert.Equal(t, http.StatusMethodNotAllowed, resp.StatusCode)
+}
+// TestMCPExposesTheFullToolset: a remote caller gets the ten VM tools plus the
+// two delegation tools, which is what makes a bare PAT enough.
+func TestMCPExposesTheFullToolset(t *testing.T) {
+	f := newFixture(t)
+	cs := connect(t, f, f.patA)
+	res, err := cs.ListTools(t.Context(), nil)
+	require.NoError(t, err)
+	names := make([]string, 0, len(res.Tools))
+	for _, tool := range res.Tools {
+		names = append(names, tool.Name)
+	}
+	assert.Len(t, names, 14)
+	assert.Contains(t, names, "delegate_begin")
+	assert.Contains(t, names, "delegate_complete")
+	assert.Contains(t, names, "ca_upload")
+	assert.Contains(t, names, "tenant_info")
+	assert.Contains(t, names, "vm_exec")
+}
+// TestVMListIsTenantIsolated is the property the whole per-request-identity
+// design exists for: two PATs, two tenants, and neither sees the other's VMs.
+func TestVMListIsTenantIsolated(t *testing.T) {
+	f := newFixture(t)
+	seedVM(t, f.st, f.tenantA, "host-alpha", "alpha-vm")
+	seedVM(t, f.st, f.tenantB, "host-beta", "beta-vm")
+	assert.Equal(t, []string{"alpha-vm"}, listVMNames(t, connect(t, f, f.patA)))
+	assert.Equal(t, []string{"beta-vm"}, listVMNames(t, connect(t, f, f.patB)))
+}
+func listVMNames(t *testing.T, cs *mcp.ClientSession) []string {
+	t.Helper()
+	res, err := cs.CallTool(t.Context(), &mcp.CallToolParams{Name: "vm_list"})
+	require.NoError(t, err)
+	require.False(t, res.IsError, "vm_list failed: %+v", res.Content)
+	var out struct {
+		VMs []types.VM `json:"vms"`
+	}
+	raw, err := json.Marshal(res.StructuredContent)
+	require.NoError(t, err)
+	require.NoError(t, json.Unmarshal(raw, &out))
+	names := make([]string, 0, len(out.VMs))
+	for _, vm := range out.VMs {
+		names = append(names, vm.Name)
+	}
+	return names
+}
+// TestDelegationRoundTripThroughTheTransport drives the whole exchange the way
+// a model would: ask for a key, sign it out of band with the tenant's own CA,
+// hand the certificate back, and find eitri holding a credential it could not
+// have made for itself.
+func TestDelegationRoundTripThroughTheTransport(t *testing.T) {
+	f := newFixture(t)
+	ca := registerCA(t, f, f.patA)
+	cs := connect(t, f, f.patA)
+	begin := callBegin(t, cs)
+	require.NotEmpty(t, begin.PublicKey)
+	assert.Equal(t, "ubuntu", begin.Principal)
+	assert.Contains(t, begin.Instructions, "ssh-keygen -s")
+	assert.Contains(t, begin.Note, "cannot sign this itself")
+	done := callComplete(t, cs, signDelegation(t, ca, begin.PublicKey, "ubuntu", time.Now().Add(time.Hour)))
+	assert.Equal(t, ssh.FingerprintSHA256(ca.PublicKey()), done.CAFingerprint)
+	assert.Equal(t, []string{"ubuntu"}, done.Principals)
+	assert.Contains(t, done.Note, "It holds no signing key")
+	// eitri can now authenticate as this tenant — and only as this tenant.
+	_, ok := f.keyring.Signer(f.tenantA)
+	assert.True(t, ok)
+	_, ok = f.keyring.Signer(f.tenantB)
+	assert.False(t, ok, "one tenant's delegation is nobody else's")
+}
+// TestDelegateCompleteRefusesAnUnregisteredCA is the live proof that the trust
+// check is wired to the tenant's real CA set, and that its refusal says so.
+func TestDelegateCompleteRefusesAnUnregisteredCA(t *testing.T) {
+	f := newFixture(t)
+	registerCA(t, f, f.patA)
+	cs := connect(t, f, f.patA)
+	begin := callBegin(t, cs)
+	stranger := newCA(t)
+	res, err := cs.CallTool(t.Context(), &mcp.CallToolParams{
+		Name: "delegate_complete",
+		Arguments: map[string]any{
+			"certificate": signDelegation(t, stranger, begin.PublicKey, "ubuntu", time.Now().Add(time.Hour)),
+		},
+	})
+	require.NoError(t, err)
+	require.True(t, res.IsError)
+	assert.Contains(t, toolErrorText(res), "not a CA registered to this tenant")
+	_, ok := f.keyring.Signer(f.tenantA)
+	assert.False(t, ok, "a refused certificate must leave eitri with nothing")
+}
+// TestDelegateCompleteRefusesTheWrongPrincipal: the most likely user mistake
+// has to be caught here, or it resurfaces as an opaque SSH failure later.
+func TestDelegateCompleteRefusesTheWrongPrincipal(t *testing.T) {
+	f := newFixture(t)
+	ca := registerCA(t, f, f.patA)
+	cs := connect(t, f, f.patA)
+	begin := callBegin(t, cs)
+	res, err := cs.CallTool(t.Context(), &mcp.CallToolParams{
+		Name: "delegate_complete",
+		Arguments: map[string]any{
+			"certificate": signDelegation(t, ca, begin.PublicKey, "alex", time.Now().Add(time.Hour)),
+		},
+	})
+	require.NoError(t, err)
+	require.True(t, res.IsError)
+	assert.Contains(t, toolErrorText(res), `must include "ubuntu"`)
+}
+// newCA returns a signer standing in for someone's own SSH user CA.
+func newCA(t *testing.T) ssh.Signer {
+	t.Helper()
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	s, err := ssh.NewSignerFromSigner(priv)
+	require.NoError(t, err)
+	return s
+}
+// registerCA uploads a CA to the caller's tenant through the real endpoint,
+// which is what makes a delegation signed by it acceptable.
+func registerCA(t *testing.T, f fixture, pat string) ssh.Signer {
+	t.Helper()
+	ca := newCA(t)
+	body, err := json.Marshal(types.UserCARequest{
+		PublicKey: string(ssh.MarshalAuthorizedKey(ca.PublicKey())), Label: "mine"})
+	require.NoError(t, err)
+	req, err := http.NewRequest(http.MethodPost, f.ts.URL+"/api/v1/user-cas", bytes.NewReader(body))
+	require.NoError(t, err)
+	req.Header.Set("Authorization", "Bearer "+pat)
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusCreated, resp.StatusCode)
+	return ca
+}
+// signDelegation is what the human runs: `ssh-keygen -s`, in code.
+func signDelegation(t *testing.T, ca ssh.Signer, pubLine, principal string, expiry time.Time) string {
+	t.Helper()
+	pub, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pubLine))
+	require.NoError(t, err)
+	cert := &ssh.Certificate{
+		Key:             pub,
+		Serial:          7,
+		CertType:        ssh.UserCert,
+		KeyId:           "eitri-delegation",
+		ValidPrincipals: []string{principal},
+		ValidAfter:      uint64(time.Now().Add(-time.Minute).Unix()),
+		ValidBefore:     uint64(expiry.Unix()),
+	}
+	require.NoError(t, cert.SignCert(rand.Reader, ca))
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(cert)))
+}
+type beginOut struct {
+	PublicKey    string `json:"public_key"`
+	Principal    string `json:"principal"`
+	Instructions string `json:"instructions"`
+	Note         string `json:"note"`
+}
+type delegationOut struct {
+	ExpiresAt     string   `json:"expires_at"`
+	CAFingerprint string   `json:"ca_fingerprint"`
+	Principals    []string `json:"principals"`
+	Note          string   `json:"note"`
+}
+func callBegin(t *testing.T, cs *mcp.ClientSession) beginOut {
+	t.Helper()
+	var out beginOut
+	callToolInto(t, cs, &mcp.CallToolParams{Name: "delegate_begin"}, &out)
+	return out
+}
+func callComplete(t *testing.T, cs *mcp.ClientSession, cert string) delegationOut {
+	t.Helper()
+	var out delegationOut
+	callToolInto(t, cs, &mcp.CallToolParams{
+		Name: "delegate_complete", Arguments: map[string]any{"certificate": cert}}, &out)
+	return out
+}
+func callToolInto(t *testing.T, cs *mcp.ClientSession, params *mcp.CallToolParams, into any) {
+	t.Helper()
+	res, err := cs.CallTool(t.Context(), params)
+	require.NoError(t, err)
+	require.False(t, res.IsError, "%s failed: %+v", params.Name, res.Content)
+	raw, err := json.Marshal(res.StructuredContent)
+	require.NoError(t, err)
+	require.NoError(t, json.Unmarshal(raw, into))
+}
+// TestExecWithoutADelegationRefusesInWords: a tool failure comes back as an MCP
+// error the model can read and act on, not a 500 — and eitri cannot get access
+// by itself, so the message has to be a request with a recipe in it.
+func TestExecWithoutADelegationRefusesInWords(t *testing.T) {
+	f := newFixture(t)
+	seedVM(t, f.st, f.tenantA, "host-alpha", "alpha-vm")
+	cs := connect(t, f, f.patA)
+	res, err := cs.CallTool(t.Context(), &mcp.CallToolParams{
+		Name:      "vm_exec",
+		Arguments: map[string]any{"vm": "alpha-vm", "command": "true"},
+	})
+	require.NoError(t, err, "a refused tool must not fail the transport")
+	require.True(t, res.IsError)
+	assert.Contains(t, toolErrorText(res), "no live SSH delegation")
+	assert.Contains(t, toolErrorText(res), "delegate_begin")
+}
+// TestExecWithoutAJumpGateSaysSo: on a control plane with no SSH CA at all,
+// guests carry no host certificate and remote exec cannot be made safe. The
+// refusal names that, rather than sending the caller off to delegate.
+func TestExecWithoutAJumpGateSaysSo(t *testing.T) {
+	st, err := store.Open(t.TempDir()+"/db", "10.77.0.0/16")
+	require.NoError(t, err)
+	t.Cleanup(func() { st.Close() })
+	a := api.New(api.Config{HostSecret: []byte("hostsecret"), ServerCertSHA256: strings.Repeat("c", 64)},
+		st, registry.New(time.Now), hub.New())
+	t.Cleanup(a.Close)
+	tenant, pat := newTenant(t, st, "alpha")
+	seedVM(t, st, tenant, "host-alpha", "alpha-vm")
+	root := http.NewServeMux()
+	root.Handle("/api/", a.Handler())
+	root.Handle("/mcp", a.UserAuth(New(Deps{
+		Handler: a.Handler(), Creds: testCreds{k: delegation.New(time.Now, "ubuntu"), st: st}, VMUser: "ubuntu"})))
+	ts := httptest.NewServer(root)
+	t.Cleanup(ts.Close)
+	cs := connect(t, fixture{ts: ts}, pat)
+	res, err := cs.CallTool(t.Context(), &mcp.CallToolParams{
+		Name:      "vm_exec",
+		Arguments: map[string]any{"vm": "alpha-vm", "command": "true"},
+	})
+	require.NoError(t, err)
+	require.True(t, res.IsError)
+	assert.Contains(t, toolErrorText(res), "no SSH CA configured")
+}
+// TestToolErrorsNeverEchoTheCredential: the PAT rides every request, so it must
+// never come back out in a message a model will repeat.
+func TestToolErrorsNeverEchoTheCredential(t *testing.T) {
+	f := newFixture(t)
+	cs := connect(t, f, f.patA)
+	res, err := cs.CallTool(t.Context(), &mcp.CallToolParams{
+		Name:      "vm_exec",
+		Arguments: map[string]any{"vm": "nonexistent", "command": "true"},
+	})
+	require.NoError(t, err)
+	require.True(t, res.IsError)
+	assert.NotContains(t, toolErrorText(res), f.patA)
+}
+func toolErrorText(res *mcp.CallToolResult) string {
+	var b strings.Builder
+	for _, c := range res.Content {
+		if tc, ok := c.(*mcp.TextContent); ok {
+			b.WriteString(tc.Text)
+		}
+	}
+	return b.String()
+}
+// TestInprocPassesTheCallersIdentity pins the in-process transport's contract:
+// it re-enters the API's own handler carrying the request unchanged, so the
+// answer is the one a remote client with that PAT would get.
+func TestInprocPassesTheCallersIdentity(t *testing.T) {
+	var gotAuth string
+	tr := inproc{h: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusTeapot)
+		w.Write([]byte(`{"ok":true}`))
+	})}
+	req, err := http.NewRequestWithContext(context.Background(), "GET", "http://eitri.internal/api/v1/me", nil)
+	require.NoError(t, err)
+	req.Header.Set("Authorization", "Bearer eitri_pat_x")
+	resp, err := tr.RoundTrip(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, "Bearer eitri_pat_x", gotAuth)
+	assert.Equal(t, http.StatusTeapot, resp.StatusCode)
+	assert.Equal(t, "application/json", resp.Header.Get("Content-Type"))
+	assert.Equal(t, int64(len(`{"ok":true}`)), resp.ContentLength)
+}
+// TestInprocDefaultsToOK covers the handler that writes a body without ever
+// naming a status.
+func TestInprocDefaultsToOK(t *testing.T) {
+	tr := inproc{h: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Write([]byte("hi"))
+	})}
+	req, err := http.NewRequest("GET", "http://eitri.internal/x", nil)
+	require.NoError(t, err)
+	resp, err := tr.RoundTrip(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+}
+// TestCAUploadRegistersWithTheCallersOwnTenant drives the tool end to end
+// through the transport and out into the store: the CA lands on the tenant the
+// PAT names, with its label, and on nobody else's. Registering a CA is the
+// first step of the journey a bare token has to make, so it has to work with
+// nothing but that token.
+func TestCAUploadRegistersWithTheCallersOwnTenant(t *testing.T) {
+	f := newFixture(t)
+	ca := newCA(t)
+	line := strings.TrimSpace(string(ssh.MarshalAuthorizedKey(ca.PublicKey())))
+	var out struct {
+		Fingerprint string `json:"fingerprint"`
+		Label       string `json:"label"`
+		Note        string `json:"note"`
+	}
+	callToolInto(t, connect(t, f, f.patA), &mcp.CallToolParams{
+		Name:      "ca_upload",
+		Arguments: map[string]any{"public_key": line, "label": "from-mcp"},
+	}, &out)
+	assert.Equal(t, ssh.FingerprintSHA256(ca.PublicKey()), out.Fingerprint)
+	assert.Equal(t, "from-mcp", out.Label)
+	cas, err := f.st.ListTenantUserCAs(f.tenantA)
+	require.NoError(t, err)
+	require.Len(t, cas, 1)
+	assert.Equal(t, line, cas[0].Pubkey)
+	assert.Equal(t, "from-mcp", cas[0].Label)
+	other, err := f.st.ListTenantUserCAs(f.tenantB)
+	require.NoError(t, err)
+	assert.Empty(t, other, "a CA belongs to the tenant whose token uploaded it")
+}
+// TestCAUploadThenDelegateIsTheWholeJourney: upload a CA with a bare PAT, then
+// delegate against it. The second step only works because the first registered
+// the CA the delegation is signed by — which is the point of having both tools.
+func TestCAUploadThenDelegateIsTheWholeJourney(t *testing.T) {
+	f := newFixture(t)
+	ca := newCA(t)
+	cs := connect(t, f, f.patA)
+	var uploaded struct {
+		Fingerprint string `json:"fingerprint"`
+	}
+	callToolInto(t, cs, &mcp.CallToolParams{
+		Name:      "ca_upload",
+		Arguments: map[string]any{"public_key": strings.TrimSpace(string(ssh.MarshalAuthorizedKey(ca.PublicKey())))},
+	}, &uploaded)
+	begin := callBegin(t, cs)
+	done := callComplete(t, cs, signDelegation(t, ca, begin.PublicKey, "ubuntu", time.Now().Add(time.Hour)))
+	assert.Equal(t, uploaded.Fingerprint, done.CAFingerprint,
+		"the delegation must chain to the CA the same session just uploaded")
+	_, ok := f.keyring.Signer(f.tenantA)
+	assert.True(t, ok)
+}

internal/server/seal/seal.go

Old		New
@@ -1,9 +1,8 @@
1	// Package seal encrypts the key material eitri holds, so that what rests on	1	// Package seal encrypts the key material eitri holds, so that what rests on
2	// disk is not what signs. One key-encryption key — the server's	2	// disk is not what signs. One key-encryption key — the server's
3	// key_encryption_key, which lives in its config and nowhere else — protects	3	// key_encryption_key, which lives in its config and nowhere else — protects
4	// every piece: the host CA and gate host key in the data directory, and each	4	// every piece: the fleet's host CA and gate host key, in the data directory. A
5	// tenant's opt-in managed CA in the database. A stolen database, a copied	5	// copied backup or a lifted PVC yields ciphertext and nothing signable.
6	// backup, or a lifted PVC yields ciphertext and nothing signable.
7	//	6	//
8	// The package is pure: bytes in, bytes out, no files and no store. Where each	7	// The package is pure: bytes in, bytes out, no files and no store. Where each
9	// sealed thing lives is its own package's business.	8	// sealed thing lives is its own package's business.

internal/server/vmssh/vmssh.go

@@ @@ -0,0 +1,220 @@ @@
+// Package vmssh reaches a tenant's VM from inside the control plane: it tunnels
+// to the guest's sshd over the host's live sync connection and authenticates
+// with the credential that tenant has delegated to eitri. It is the server-side
+// half of the MCP exec seam; the client-side half goes through the jump gate.
+//
+// Taking the tunnel rather than the gate is one hop fewer and the same crypto:
+// the guest's host certificate is verified under its <tenant>.<name> principal
+// against the host CA, exactly as a client dialing through the gate verifies it.
+// It also avoids the server having to resolve and dial its own public gate
+// domain, which is unreachable from inside a pod whenever that name points at an
+// external address, and absent entirely when the gate is off.
+//
+// Gate-side certificate revocation is deliberately not consulted here. It does
+// not need to be: these certificates live minutes, are used by the process that
+// minted them, and are never handed to anyone.
+package vmssh
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"strings"
+	"time"
+	"golang.org/x/crypto/ssh"
+)
+// TCPDialer opens a byte pipe to vmID:port on hostID. *syncsvc.Service satisfies
+// it — the same seam the jump gate itself is built on.
+type TCPDialer interface {
+	OpenTCP(ctx context.Context, hostID, vmID string, port uint32) (io.ReadWriteCloser, error)
+}
+// VM is what a name resolves to: where the guest runs, and whether anything
+// could verify it on arrival.
+type VM struct {
+	HostID, VMID string
+	// HostCertified reports that the control plane has signed this guest's host
+	// key. A guest created by an agent that predates the key exchange has no
+	// certificate and can never acquire one without being recreated, so this is
+	// a permanent property of that VM rather than a race to wait out.
+	HostCertified bool
+}
+// VMLookup resolves a bare VM name WITHIN tenant and re-checks ownership. It
+// mirrors the gate's resolve+authorize pair: a name never resolves across
+// tenants, and a tombstoned or foreign VM is indistinguishable from a missing
+// one.
+type VMLookup func(tenant, name string) (VM, bool)
+// Credentials answers what eitri may authenticate as, for one tenant, right
+// now. The two questions are separate because the answers call for different
+// words: a tenant with a live delegation and one that has never registered a CA
+// at all are told different things to do next.
+type Credentials interface {
+	// Delegated returns this tenant's live delegated credential, or false when
+	// there is none — including one that has expired, which is the same
+	// situation and calls for the same next step.
+	Delegated(tenant string) (ssh.Signer, bool)
+	// TenantHasUserCA reports whether the tenant has registered any CA at all.
+	// Without one there is nothing a delegated certificate could chain to.
+	TenantHasUserCA(tenant string) (bool, error)
+}
+// Dialer reaches one tenant's VMs. It implements the MCP exec seam's VMDialer.
+type Dialer struct {
+	Tenant string
+	VMUser string // guest login user, and therefore the certificate principal
+	TCP    TCPDialer
+	Lookup VMLookup
+	Creds  Credentials
+	// HostCA verifies each guest's host certificate. Nil means this control
+	// plane has no SSH CA at all (the jump gate is off), so VMs carry no host
+	// certificate and there is nothing to verify against.
+	HostCA ssh.PublicKey
+	// DelegationsURL is where a caller POSTs to start a delegation, as a full
+	// URL. The refusal below is the only instruction most callers get, and the
+	// REST API does not necessarily live on the host they are talking to.
+	DelegationsURL string
+}
+// ConnectName returns the VM's <tenant>.<name> connect name — the form the gate
+// resolves and the VM's host certificate names.
+func (d *Dialer) ConnectName(_ context.Context, vmName string) (string, error) {
+	return d.Tenant + "." + vmName, nil
+}
+// Dial opens an authenticated SSH connection to the VM named vmName. The caller
+// must Close the returned client.
+func (d *Dialer) Dial(ctx context.Context, vmName string) (*ssh.Client, error) {
+	if d.HostCA == nil {
+		return nil, errors.New("remote exec is unavailable: this control plane has no SSH CA configured")
+	}
+	signer, err := d.signer()
+	if err != nil {
+		return nil, err
+	}
+	vm, ok := d.Lookup(d.Tenant, vmName)
+	if !ok {
+		return nil, fmt.Errorf("no VM named %q", vmName)
+	}
+	// Refuse before dialing. This guest has no host certificate and cannot be
+	// issued one — its key was never reported — so the handshake would fail on
+	// an unverifiable host key, which reads as a crypto problem rather than the
+	// lifecycle one it is.
+	if !vm.HostCertified {
+		return nil, fmt.Errorf("vm %s predates certified host keys: it was created by an agent older than the "+
+			"host-key exchange, so nothing can verify it. Upgrade that host's agent, then recreate the VM", vmName)
+	}
+	pipe, err := d.TCP.OpenTCP(ctx, vm.HostID, vm.VMID, 22)
+	if err != nil {
+		return nil, fmt.Errorf("vm %s unreachable: %w", vmName, err)
+	}
+	// The address is both the tunnel's far end and the name the guest's host
+	// certificate is checked under — its principal is exactly this.
+	addr := d.Tenant + "." + vmName + ":22"
+	checker := &ssh.CertChecker{
+		IsHostAuthority: func(auth ssh.PublicKey, _ string) bool {
+			return keyEquals(auth, d.HostCA)
+		},
+	}
+	conf := &ssh.ClientConfig{
+		User:            d.VMUser,
+		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
+		HostKeyCallback: checker.CheckHostKey,
+		Timeout:         15 * time.Second,
+	}
+	nc, chans, reqs, err := ssh.NewClientConn(pipeConn{pipe}, addr, conf)
+	if err != nil {
+		pipe.Close()
+		return nil, handshakeError(vmName, err)
+	}
+	return ssh.NewClient(nc, chans, reqs), nil
+}
+// signer returns the credential this tenant has delegated, or explains how to
+// delegate one. The wording is the feature: eitri cannot obtain access on its
+// own, so a refusal here is a request, and it has to be one a caller can act on
+// without reading the docs.
+func (d *Dialer) signer() (ssh.Signer, error) {
+	if signer, ok := d.Creds.Delegated(d.Tenant); ok {
+		return signer, nil
+	}
+	var prefix string
+	has, err := d.Creds.TenantHasUserCA(d.Tenant)
+	if err != nil {
+		return nil, errors.New("looking up this tenant's SSH CAs failed")
+	}
+	if !has {
+		prefix = "this tenant has no registered SSH user CA at all — upload one first (`eitri ca upload`), " +
+			"or your guests will trust nothing you sign.\n\n"
+	}
+	// ST1005 wants a one-line lowercase fragment. This message is the feature:
+	// eitri cannot obtain access on its own, so the refusal IS the request, and
+	// it has to carry the whole recipe or the caller is left guessing.
+	//nolint:staticcheck // deliberately multi-line, caller-facing prose
+	return nil, fmt.Errorf(`%sno live SSH delegation for tenant %q.
+eitri holds no signing key — you delegate access to it, and it expires.
+. call delegate_begin (or POST %s) for a public key
+. sign it with your own CA:
+       ssh-keygen -s <your-ca> -I eitri-delegation -n %s -V +8h eitri-delegation.pub
+. return eitri-delegation-cert.pub via delegate_complete
+A delegation lives in memory only: a control-plane restart drops it, and you
+delegate again.`, prefix, d.Tenant, d.delegationsURL(), d.VMUser)
+}
+// delegationsURL is the configured endpoint, or the bare path when a plane has
+// not been told its own public URL. Never empty, so the recipe always reads.
+func (d *Dialer) delegationsURL() string {
+	if d.DelegationsURL == "" {
+		return "/api/v1/delegations"
+	}
+	return d.DelegationsURL
+}
+// handshakeError names the one failure a caller can do something about. A guest
+// bakes its CA set at create, so a delegation signed by a CA registered after
+// that VM was made is refused by it — which reaches us as an ordinary
+// authentication failure and would otherwise read as a mystery.
+func handshakeError(vmName string, err error) error {
+	if strings.Contains(err.Error(), "unable to authenticate") {
+		return fmt.Errorf("vm %s refused eitri's certificate: it trusts the CA set it was created with, and that "+
+			"set does not include the CA you delegated with. Delegate with a CA this VM trusts, or create a new VM", vmName)
+	}
+	return fmt.Errorf("vm %s ssh handshake: %w", vmName, err)
+}
+// keyEquals compares two SSH public keys by their wire encodings.
+func keyEquals(a, b ssh.PublicKey) bool {
+	return a != nil && b != nil && string(a.Marshal()) == string(b.Marshal())
+}
+// pipeConn adapts the tunnel's byte pipe to the net.Conn that ssh.NewClientConn
+// requires. The addresses are stubs — the SSH client only ever reports them —
+// and the deadline methods refuse rather than lying: the client sets none of
+// them, and a silent no-op deadline would be a trap for the next caller.
+type pipeConn struct{ rwc io.ReadWriteCloser }
+func (c pipeConn) Read(p []byte) (int, error)  { return c.rwc.Read(p) }
+func (c pipeConn) Write(p []byte) (int, error) { return c.rwc.Write(p) }
+func (c pipeConn) Close() error                { return c.rwc.Close() }
+func (c pipeConn) LocalAddr() net.Addr         { return tunnelAddr{} }
+func (c pipeConn) RemoteAddr() net.Addr        { return tunnelAddr{} }
+func (c pipeConn) SetDeadline(time.Time) error      { return errors.ErrUnsupported }
+func (c pipeConn) SetReadDeadline(time.Time) error  { return errors.ErrUnsupported }
+func (c pipeConn) SetWriteDeadline(time.Time) error { return errors.ErrUnsupported }
+// tunnelAddr names the sync tunnel in the two places net.Conn insists on an
+// address. There is no socket underneath, so there is no address to report.
+type tunnelAddr struct{}
+func (tunnelAddr) Network() string { return "eitri-sync" }
+func (tunnelAddr) String() string  { return "tunnel" }

internal/server/vmssh/vmssh_test.go

@@ @@ -0,0 +1,420 @@ @@
+package vmssh
+import (
+	"bytes"
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"errors"
+	"io"
+	"net"
+	"testing"
+	"time"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+// ── scaffolding ──────────────────────────────────────────────────────────────
+func newSigner(t *testing.T) ssh.Signer {
+	t.Helper()
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	s, err := ssh.NewSignerFromSigner(priv)
+	require.NoError(t, err)
+	return s
+}
+// hostCertSigner builds a host-cert-backed signer for principal, signed by ca —
+// what a VM presents once eitri has minted its host certificate.
+func hostCertSigner(t *testing.T, ca ssh.Signer, principal string) ssh.Signer {
+	t.Helper()
+	hostKey := newSigner(t)
+	cert := &ssh.Certificate{
+		Key:             hostKey.PublicKey(),
+		CertType:        ssh.HostCert,
+		ValidPrincipals: []string{principal},
+		ValidBefore:     ssh.CertTimeInfinity,
+	}
+	require.NoError(t, cert.SignCert(rand.Reader, ca))
+	cs, err := ssh.NewCertSigner(cert, hostKey)
+	require.NoError(t, err)
+	return cs
+}
+// caUserAuth mirrors a guest's TrustedUserCAKeys policy: only certificates
+// signed by the tenant's CA, and the principal must match the login user.
+func caUserAuth(ca ssh.PublicKey) func(ssh.ConnMetadata, ssh.PublicKey) (*ssh.Permissions, error) {
+	checker := &ssh.CertChecker{
+		IsUserAuthority: func(auth ssh.PublicKey) bool {
+			return auth != nil && ca != nil && bytes.Equal(auth.Marshal(), ca.Marshal())
+		},
+	}
+	return func(meta ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+		cert, ok := key.(*ssh.Certificate)
+		if !ok || cert.CertType != ssh.UserCert {
+			return nil, errors.New("only user certificates are accepted")
+		}
+		if !checker.IsUserAuthority(cert.SignatureKey) {
+			return nil, errors.New("certificate not signed by a trusted CA")
+		}
+		if err := checker.CheckCert(meta.User(), cert); err != nil {
+			return nil, err
+		}
+		return &ssh.Permissions{}, nil
+	}
+}
+// fakeTunnel is a TCPDialer whose pipe is served by an in-memory sshd. It
+// records the (hostID, vmID, port) it was asked for, which is how the tests see
+// what the dialer resolved.
+type fakeTunnel struct {
+	hostSigner ssh.Signer
+	userCA     ssh.PublicKey
+	execOut    string
+	openErr error
+	hostID  string
+	vmID    string
+	port    uint32
+}
+// OpenTCP hands back a byte pipe to an sshd standing in for the guest. It is
+// backed by a loopback socket rather than net.Pipe: an SSH handshake opens with
+// both ends writing their version string, which an unbuffered pipe deadlocks on.
+func (f *fakeTunnel) OpenTCP(_ context.Context, hostID, vmID string, port uint32) (io.ReadWriteCloser, error) {
+	f.hostID, f.vmID, f.port = hostID, vmID, port
+	if f.openErr != nil {
+		return nil, f.openErr
+	}
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return nil, err
+	}
+	conf := &ssh.ServerConfig{PublicKeyCallback: caUserAuth(f.userCA)}
+	conf.AddHostKey(f.hostSigner)
+	go func() {
+		defer ln.Close()
+		nc, err := ln.Accept()
+		if err != nil {
+			return
+		}
+		serveGuest(nc, conf, f.execOut)
+	}()
+	return net.Dial("tcp", ln.Addr().String())
+}
+func serveGuest(nc net.Conn, conf *ssh.ServerConfig, out string) {
+	sc, chans, reqs, err := ssh.NewServerConn(nc, conf)
+	if err != nil {
+		nc.Close()
+		return
+	}
+	defer sc.Close()
+	go ssh.DiscardRequests(reqs)
+	for newCh := range chans {
+		if newCh.ChannelType() != "session" {
+			newCh.Reject(ssh.UnknownChannelType, "only session")
+			continue
+		}
+		ch, chReqs, err := newCh.Accept()
+		if err != nil {
+			continue
+		}
+		go func() {
+			defer ch.Close()
+			for req := range chReqs {
+				if req.Type == "exec" {
+					req.Reply(true, nil)
+					io.WriteString(ch, out)
+					ch.SendRequest("exit-status", false, ssh.Marshal(struct{ Status uint32 }{0}))
+					return
+				}
+				if req.WantReply {
+					req.Reply(false, nil)
+				}
+			}
+		}()
+	}
+}
+// fakeCreds answers what the tenant has lent eitri, from fixed values.
+type fakeCreds struct {
+	signer ssh.Signer
+	hasCA  bool
+	err    error
+}
+func (f fakeCreds) Delegated(string) (ssh.Signer, bool) { return f.signer, f.signer != nil }
+func (f fakeCreds) TenantHasUserCA(string) (bool, error) {
+	if f.err != nil {
+		return false, f.err
+	}
+	return f.hasCA, nil
+}
+// delegatedSigner builds the credential a completed delegation leaves eitri
+// with: an ephemeral key plus a user certificate its tenant's CA signed.
+func delegatedSigner(t *testing.T, ca ssh.Signer, principal string) ssh.Signer {
+	t.Helper()
+	key := newSigner(t)
+	cert := &ssh.Certificate{
+		Key:             key.PublicKey(),
+		CertType:        ssh.UserCert,
+		KeyId:           "eitri-delegation",
+		ValidPrincipals: []string{principal},
+		ValidBefore:     ssh.CertTimeInfinity,
+	}
+	require.NoError(t, cert.SignCert(rand.Reader, ca))
+	cs, err := ssh.NewCertSigner(cert, key)
+	require.NoError(t, err)
+	return cs
+}
+// lookupOne resolves exactly one name, for one tenant, to a certified VM.
+func lookupOne(tenant, name, hostID, vmID string) VMLookup {
+	return func(gotTenant, gotName string) (VM, bool) {
+		if gotTenant != tenant || gotName != name {
+			return VM{}, false
+		}
+		return VM{HostID: hostID, VMID: vmID, HostCertified: true}, true
+	}
+}
+// newDialer wires a dialer whose tenant has delegated a live credential,
+// against a guest that trusts the CA behind it.
+func newDialer(t *testing.T) (*Dialer, *fakeTunnel) {
+	t.Helper()
+	hostCA := newSigner(t)
+	tenantCA := newSigner(t)
+	tun := &fakeTunnel{
+		hostSigner: hostCertSigner(t, hostCA, "acme.web-1"),
+		userCA:     tenantCA.PublicKey(),
+		execOut:    "hi\n",
+	}
+	return &Dialer{
+		Tenant: "acme",
+		VMUser: "ubuntu",
+		TCP:    tun,
+		Lookup: lookupOne("acme", "web-1", "h-1", "v-1"),
+		Creds:  fakeCreds{signer: delegatedSigner(t, tenantCA, "ubuntu"), hasCA: true},
+		HostCA: hostCA.PublicKey(),
+	}, tun
+}
+// ── tests ────────────────────────────────────────────────────────────────────
+// TestDialReachesTheGuest is the whole path: resolve, tunnel to port 22,
+// authenticate with the delegated credential, verify the guest's host
+// certificate under its namespaced name, run a command.
+func TestDialReachesTheGuest(t *testing.T) {
+	d, tun := newDialer(t)
+	client, err := d.Dial(t.Context(), "web-1")
+	require.NoError(t, err)
+	defer client.Close()
+	assert.Equal(t, "h-1", tun.hostID)
+	assert.Equal(t, "v-1", tun.vmID)
+	assert.Equal(t, uint32(22), tun.port)
+	sess, err := client.NewSession()
+	require.NoError(t, err)
+	defer sess.Close()
+	out, err := sess.Output("echo hi")
+	require.NoError(t, err)
+	assert.Equal(t, "hi\n", string(out))
+}
+// TestConnectNameIsNamespaced pins the name a guest's host certificate carries.
+func TestConnectNameIsNamespaced(t *testing.T) {
+	d, _ := newDialer(t)
+	name, err := d.ConnectName(t.Context(), "web-1")
+	require.NoError(t, err)
+	assert.Equal(t, "acme.web-1", name)
+}
+// TestDialRejectsAForeignHostCA: a guest whose host certificate was signed by
+// some other CA is not this fleet's guest.
+func TestDialRejectsAForeignHostCA(t *testing.T) {
+	d, tun := newDialer(t)
+	tun.hostSigner = hostCertSigner(t, newSigner(t), "acme.web-1")
+	_, err := d.Dial(t.Context(), "web-1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "vm web-1 ssh handshake")
+}
+// TestDialRejectsAHostCertForAnotherVM: the certificate must name THIS VM, or a
+// tunnel pointed at the wrong guest would go unnoticed.
+func TestDialRejectsAHostCertForAnotherVM(t *testing.T) {
+	d, tun := newDialer(t)
+	hostCA := newSigner(t)
+	d.HostCA = hostCA.PublicKey()
+	tun.hostSigner = hostCertSigner(t, hostCA, "acme.other-vm")
+	_, err := d.Dial(t.Context(), "web-1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "vm web-1 ssh handshake")
+}
+// TestDialOnAVMThatDoesNotTrustTheDelegatedCA: the guest baked its CA set at
+// create, so a delegation signed by a CA registered later is refused by it. The
+// refusal has to say why, because "permission denied" reads as a key problem
+// when it is an ordering one.
+func TestDialOnAVMThatDoesNotTrustTheDelegatedCA(t *testing.T) {
+	d, tun := newDialer(t)
+	tun.userCA = newSigner(t).PublicKey() // the guest trusts some other CA
+	_, err := d.Dial(t.Context(), "web-1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "refused eitri's certificate")
+	assert.Contains(t, err.Error(), "the CA set it was created with")
+}
+// TestDialRefusesAForeignName: a name in another tenant answers exactly like a
+// missing one — existence is never leaked across tenants.
+func TestDialRefusesAForeignName(t *testing.T) {
+	d, _ := newDialer(t)
+	d.Lookup = lookupOne("other-tenant", "web-1", "h-1", "v-1")
+	_, err := d.Dial(t.Context(), "web-1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `no VM named "web-1"`)
+	// A name that does not exist at all produces the identical message.
+	d.Lookup = func(string, string) (VM, bool) { return VM{}, false }
+	_, missing := d.Dial(t.Context(), "web-1")
+	require.Error(t, missing)
+	assert.Equal(t, err.Error(), missing.Error())
+}
+// TestDialWithNoDelegation is the refusal that matters most: eitri cannot get
+// access on its own, so this message is a request, and it has to carry the
+// whole recipe.
+func TestDialWithNoDelegation(t *testing.T) {
+	d, _ := newDialer(t)
+	d.Creds = fakeCreds{hasCA: true}
+	_, err := d.Dial(t.Context(), "web-1")
+	require.Error(t, err)
+	msg := err.Error()
+	assert.Contains(t, msg, `no live SSH delegation for tenant "acme"`)
+	assert.Contains(t, msg, "eitri holds no signing key")
+	assert.Contains(t, msg, "delegate_begin")
+	assert.Contains(t, msg, "ssh-keygen -s <your-ca> -I eitri-delegation -n ubuntu")
+	assert.Contains(t, msg, "delegate_complete")
+	assert.Contains(t, msg, "a control-plane restart drops it")
+}
+// TestDialWithNoRegisteredCAAtAll adds the step before the recipe: there is
+// nothing for a delegated certificate to chain to yet.
+func TestDialWithNoRegisteredCAAtAll(t *testing.T) {
+	d, _ := newDialer(t)
+	d.Creds = fakeCreds{}
+	_, err := d.Dial(t.Context(), "web-1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "no registered SSH user CA at all")
+	assert.Contains(t, err.Error(), "eitri ca upload")
+	// And still the recipe, because that is the step after it.
+	assert.Contains(t, err.Error(), "delegate_begin")
+}
+// TestAnExpiredDelegationReadsAsNone: Delegated already dropped it, and the
+// same message is the correct one — it says how to renew.
+func TestAnExpiredDelegationReadsAsNone(t *testing.T) {
+	d, _ := newDialer(t)
+	d.Creds = fakeCreds{hasCA: true} // an expired entry reports itself absent
+	_, err := d.Dial(t.Context(), "web-1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "no live SSH delegation")
+}
+// TestDialWithoutAJumpGate: no host CA means guests carry no host certificate,
+// so there is nothing to verify and no safe connection to make.
+func TestDialWithoutAJumpGate(t *testing.T) {
+	d, _ := newDialer(t)
+	d.HostCA = nil
+	_, err := d.Dial(t.Context(), "web-1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "no SSH CA configured")
+}
+// TestDialWhenTheTunnelRefuses surfaces an offline host as an unreachable VM
+// rather than a CA problem.
+func TestDialWhenTheTunnelRefuses(t *testing.T) {
+	d, tun := newDialer(t)
+	tun.openErr = errors.New("host offline")
+	_, err := d.Dial(t.Context(), "web-1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "vm web-1 unreachable")
+}
+// TestDialSurfacesACAStoreFailureWithoutDetail: a lookup failure must not turn
+// into a message that describes the database.
+func TestDialSurfacesACAStoreFailureWithoutDetail(t *testing.T) {
+	d, _ := newDialer(t)
+	d.Creds = fakeCreds{err: errors.New("disk on fire")}
+	_, err := d.Dial(t.Context(), "web-1")
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), "disk on fire")
+}
+// TestPipeConnDeadlinesRefuse pins the adapter's honesty: a caller that sets a
+// deadline learns it did nothing, instead of trusting a silent no-op.
+func TestPipeConnDeadlinesRefuse(t *testing.T) {
+	client, server := net.Pipe()
+	defer client.Close()
+	defer server.Close()
+	c := pipeConn{client}
+	assert.ErrorIs(t, c.SetDeadline(time.Now()), errors.ErrUnsupported)
+	assert.ErrorIs(t, c.SetReadDeadline(time.Now()), errors.ErrUnsupported)
+	assert.ErrorIs(t, c.SetWriteDeadline(time.Now()), errors.ErrUnsupported)
+	assert.Equal(t, "eitri-sync", c.LocalAddr().Network())
+	assert.Equal(t, "tunnel", c.RemoteAddr().String())
+}
+// TestDialRefusesAVMThatPredatesCertifiedHostKeys: a guest with no host
+// certificate can never acquire one without being recreated, so the refusal is
+// a lifecycle instruction and it happens BEFORE a dial. The raw handshake
+// failure ("non-certificate host key") reads as a crypto problem and is a dead
+// end for anyone trying to fix it.
+func TestDialRefusesAVMThatPredatesCertifiedHostKeys(t *testing.T) {
+	d, tun := newDialer(t)
+	d.Lookup = func(string, string) (VM, bool) {
+		return VM{HostID: "h-1", VMID: "v-1", HostCertified: false}, true
+	}
+	_, err := d.Dial(t.Context(), "web-1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "vm web-1 predates certified host keys")
+	assert.Contains(t, err.Error(), "Upgrade that host's agent, then recreate the VM")
+	assert.Empty(t, tun.hostID, "nothing may be dialed for a VM that could never be verified")
+}
+// TestRefusalNamesADialableEndpoint: the REST API is not necessarily on the
+// host the caller is talking to, so the recipe carries a URL, not a path.
+func TestRefusalNamesADialableEndpoint(t *testing.T) {
+	d, _ := newDialer(t)
+	d.Creds = fakeCreds{hasCA: true}
+	d.DelegationsURL = "https://console.eitri.sh/api/v1/delegations"
+	_, err := d.Dial(t.Context(), "web-1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "POST https://console.eitri.sh/api/v1/delegations")
+	// Unconfigured, the recipe still reads — just less usefully.
+	d.DelegationsURL = ""
+	_, err = d.Dial(t.Context(), "web-1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "POST /api/v1/delegations")
+}

internal/smoke/mcp.go

@@ @@ -0,0 +1,363 @@ @@
+package smoke
+import (
+	"context"
+	"crypto/rand"
+	"encoding/binary"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
+	"strings"
+	"time"
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+	"golang.org/x/crypto/ssh"
+)
+// mcpTools is what the remote-MCP leg needs from an MCP session: the advertised
+// tool list, and calling one. Declaring it lets the leg's sequencing be tested
+// without a control plane.
+type mcpTools interface {
+	List(ctx context.Context) ([]string, error)
+	Call(ctx context.Context, name string, args map[string]any) (map[string]any, error)
+}
+// remoteToolCount is the toolset a bearer PAT gets over HTTP: the ten VM tools,
+// ca_upload, tenant_info, and the two delegation tools.
+const remoteToolCount = 14
+// dialMCP opens a real MCP client against the control plane's /mcp endpoint,
+// authenticating with a bearer PAT exactly as a remote LLM client does. The
+// returned close function tears the session down.
+func dialMCP(ctx context.Context, serverURL, pat string) (sdkTools, func(), error) {
+	tr := &mcp.StreamableClientTransport{
+		Endpoint:   strings.TrimRight(serverURL, "/") + "/mcp",
+		HTTPClient: &http.Client{Transport: patTransport{pat: pat}, Timeout: 15 * time.Minute},
+	}
+	session, err := mcp.NewClient(&mcp.Implementation{Name: "eitri-smoke", Version: "1"}, nil).Connect(ctx, tr, nil)
+	if err != nil {
+		return sdkTools{}, nil, fmt.Errorf("connect to %s/mcp with a bearer PAT: %w", serverURL, err)
+	}
+	return sdkTools{session: session}, func() { session.Close() }, nil
+}
+// patTransport attaches the PAT the way a remote MCP client configuration does.
+type patTransport struct{ pat string }
+func (p patTransport) RoundTrip(r *http.Request) (*http.Response, error) {
+	r.Header.Set("Authorization", "Bearer "+p.pat)
+	return http.DefaultTransport.RoundTrip(r)
+}
+// sdkTools adapts an MCP session to mcpTools, folding a tool-level error into a
+// Go error so the leg reads one way for both failure kinds.
+type sdkTools struct{ session *mcp.ClientSession }
+func (s sdkTools) List(ctx context.Context) ([]string, error) {
+	res, err := s.session.ListTools(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	names := make([]string, 0, len(res.Tools))
+	for _, tool := range res.Tools {
+		names = append(names, tool.Name)
+	}
+	return names, nil
+}
+func (s sdkTools) Call(ctx context.Context, name string, args map[string]any) (map[string]any, error) {
+	res, err := s.session.CallTool(ctx, &mcp.CallToolParams{Name: name, Arguments: args})
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", name, err)
+	}
+	if res.IsError {
+		var b strings.Builder
+		for _, c := range res.Content {
+			if tc, ok := c.(*mcp.TextContent); ok {
+				b.WriteString(tc.Text)
+			}
+		}
+		return nil, fmt.Errorf("%s: %s", name, b.String())
+	}
+	raw, err := json.Marshal(res.StructuredContent)
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", name, err)
+	}
+	var out map[string]any
+	if err := json.Unmarshal(raw, &out); err != nil {
+		return nil, fmt.Errorf("%s: %w", name, err)
+	}
+	return out, nil
+}
+// proveRemoteMCPNeedsACredential is the cheap, fleet-independent half: the /mcp
+// endpoint must refuse an unauthenticated caller. It runs before any VM exists,
+// so a misrouted or unauthenticated endpoint fails the gate in a second rather
+// than after a boot.
+func proveRemoteMCPNeedsACredential(serverURL string) error {
+	body := `{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18",` +
+		`"capabilities":{},"clientInfo":{"name":"eitri-smoke","version":"1"}}}`
+	req, err := http.NewRequest(http.MethodPost, strings.TrimRight(serverURL, "/")+"/mcp", strings.NewReader(body))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "application/json, text/event-stream")
+	resp, err := (&http.Client{Timeout: 30 * time.Second}).Do(req)
+	if err != nil {
+		return fmt.Errorf("POST %s/mcp: %w", serverURL, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusUnauthorized {
+		return fmt.Errorf("FAIL: unauthenticated POST /mcp answered %d, want 401", resp.StatusCode)
+	}
+	return nil
+}
+// delegator is the out-of-band half of the exchange, as the smoke performs it:
+// register a CA with the tenant, and sign eitri's ephemeral key with it. In a
+// real session a human runs ssh-keygen; here the gate does it in-process,
+// which is the same act.
+type delegator struct {
+	ca ssh.Signer
+	// stranger is a CA nobody registered, for the negative leg.
+	stranger  ssh.Signer
+	principal string
+	now       func() time.Time
+}
+// proveMCP drives one full cycle through the remote MCP endpoint and nothing
+// else: delegate access to eitri, create a VM, run a command in it, publish a
+// port, read the guest's banner back through that port, and destroy it.
+//
+// The CA is registered BEFORE the VM is created, because a guest bakes its CA
+// set at create and a CA registered afterwards is one it will never trust. The
+// DELEGATION itself may happen on either side of the create — that is the whole
+// improvement over holding a signing key, and it is worth stating plainly here
+// so nobody reintroduces an ordering constraint that no longer exists.
+func proveMCP(ctx context.Context, c mcpTools, vmName string, d delegator, now func() time.Time, sleep func(time.Duration), dial bannerFunc) error {
+	names, err := c.List(ctx)
+	if err != nil {
+		return fmt.Errorf("list remote MCP tools: %w", err)
+	}
+	if len(names) != remoteToolCount {
+		return fmt.Errorf("FAIL: remote MCP advertises %d tools (%s), want %d", len(names), strings.Join(names, ", "), remoteToolCount)
+	}
+	for _, want := range []string{"ca_upload", "tenant_info", "delegate_begin", "delegate_complete", "vm_create", "vm_exec", "vm_expose", "vm_destroy"} {
+		if !slices.Contains(names, want) {
+			return fmt.Errorf("FAIL: remote MCP does not advertise %s (has: %s)", want, strings.Join(names, ", "))
+		}
+	}
+	// Through the tool, not the endpoint behind it: registering a CA is the
+	// first step a bare token has to take, so the gate drives the same call an
+	// LLM client would.
+	uploaded, err := c.Call(ctx, "ca_upload", map[string]any{
+		"public_key": authorizedLine(d.ca.PublicKey()),
+		"label":      "eitri-smoke",
+	})
+	if err != nil {
+		return fmt.Errorf("ca_upload: %w", err)
+	}
+	if got, _ := uploaded["fingerprint"].(string); got != ssh.FingerprintSHA256(d.ca.PublicKey()) {
+		return fmt.Errorf("FAIL: ca_upload registered %s, want %s", got, ssh.FingerprintSHA256(d.ca.PublicKey()))
+	}
+	begin, err := c.Call(ctx, "delegate_begin", nil)
+	if err != nil {
+		return fmt.Errorf("delegate_begin: %w", err)
+	}
+	pubLine, _ := begin["public_key"].(string)
+	if pubLine == "" {
+		return errors.New("FAIL: delegate_begin returned no public key to sign")
+	}
+	principal, _ := begin["principal"].(string)
+	if principal != d.principal {
+		return fmt.Errorf("FAIL: delegate_begin asked for principal %q, want %q", principal, d.principal)
+	}
+	// The negative leg: a certificate from a CA nobody registered must be
+	// refused. It costs one call and no VM, and it is the only live proof that
+	// the trust check is wired to the tenant's real CA set rather than to
+	// whatever signature happens to verify.
+	stranger, err := signDelegation(d.stranger, pubLine, principal, d.now())
+	if err != nil {
+		return err
+	}
+	if _, err := c.Call(ctx, "delegate_complete", map[string]any{"certificate": stranger}); err == nil {
+		return errors.New("FAIL: delegate_complete accepted a certificate from an unregistered CA")
+	}
+	cert, err := signDelegation(d.ca, pubLine, principal, d.now())
+	if err != nil {
+		return err
+	}
+	done, err := c.Call(ctx, "delegate_complete", map[string]any{"certificate": cert})
+	if err != nil {
+		return fmt.Errorf("delegate_complete: %w", err)
+	}
+	if got, _ := done["ca_fingerprint"].(string); got != ssh.FingerprintSHA256(d.ca.PublicKey()) {
+		return fmt.Errorf("FAIL: delegation reports CA %s, want %s", got, ssh.FingerprintSHA256(d.ca.PublicKey()))
+	}
+	expiresAt, _ := done["expires_at"].(string)
+	if expiresAt == "" {
+		return errors.New("FAIL: delegation reports no expiry; a delegation that never ends is not one")
+	}
+	// What a caller would read back before doing anything else: the CA it just
+	// registered is listed, and the delegation it just made is live.
+	info, err := c.Call(ctx, "tenant_info", nil)
+	if err != nil {
+		return fmt.Errorf("tenant_info: %w", err)
+	}
+	if delegated, _ := info["delegated"].(bool); !delegated {
+		return errors.New("FAIL: tenant_info reports no delegation immediately after delegate_complete")
+	}
+	if err := infoListsCA(info, ssh.FingerprintSHA256(d.ca.PublicKey())); err != nil {
+		return err
+	}
+	if _, err := c.Call(ctx, "vm_create", map[string]any{"name": vmName}); err != nil {
+		return fmt.Errorf("vm_create over MCP: %w", err)
+	}
+	defer func() {
+		// Destroy on the way out even when the leg failed: the smoke leaves no
+		// VM behind on the live fleet.
+		if _, err := c.Call(context.WithoutCancel(ctx), "vm_destroy", map[string]any{"vm": vmName}); err != nil {
+			fmt.Printf("eitri-smoke: MCP vm_destroy failed; vm %s left behind: %v\n", vmName, err)
+		}
+	}()
+	nonce, err := randNonce()
+	if err != nil {
+		return err
+	}
+	exec, err := c.Call(ctx, "vm_exec", map[string]any{"vm": vmName, "command": "echo " + nonce})
+	if err != nil {
+		return fmt.Errorf("vm_exec over MCP: %w", err)
+	}
+	if stdout, _ := exec["stdout"].(string); !strings.Contains(stdout, nonce) {
+		return fmt.Errorf("FAIL: vm_exec over MCP echoed %q, want it to contain %q", stdout, nonce)
+	}
+	exposed, err := c.Call(ctx, "vm_expose", map[string]any{"vm": vmName, "guest_port": 22})
+	if err != nil {
+		return fmt.Errorf("vm_expose over MCP: %w", err)
+	}
+	address, err := exposureAddress(exposed)
+	if err != nil {
+		return err
+	}
+	if err := proveBanner(ctx, address, now, sleep, dial); err != nil {
+		return err
+	}
+	if _, err := c.Call(ctx, "vm_unexpose", map[string]any{"vm": vmName, "guest_port": 22}); err != nil {
+		return fmt.Errorf("vm_unexpose over MCP: %w", err)
+	}
+	return nil
+}
+// delegationTTL is how long the smoke's delegation lives. Long enough for one
+// gate run, short enough that a run which dies mid-way leaves nothing usable.
+const delegationTTL = 30 * time.Minute
+// signDelegation is `ssh-keygen -s`, performed in process: the caller's CA
+// signs eitri's ephemeral public key for the guest login user.
+func signDelegation(ca ssh.Signer, pubLine, principal string, now time.Time) (string, error) {
+	pub, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pubLine))
+	if err != nil {
+		return "", fmt.Errorf("parse the key eitri asked us to sign: %w", err)
+	}
+	var serial uint64
+	if err := binary.Read(rand.Reader, binary.BigEndian, &serial); err != nil {
+		return "", fmt.Errorf("certificate serial: %w", err)
+	}
+	cert := &ssh.Certificate{
+		Key:             pub,
+		Serial:          serial,
+		CertType:        ssh.UserCert,
+		KeyId:           "eitri-smoke-delegation",
+		ValidPrincipals: []string{principal},
+		ValidAfter:      uint64(now.Add(-time.Minute).Unix()),
+		ValidBefore:     uint64(now.Add(delegationTTL).Unix()),
+		Permissions: ssh.Permissions{Extensions: map[string]string{
+			"permit-pty": "", "permit-port-forwarding": "",
+		}},
+	}
+	if err := cert.SignCert(rand.Reader, ca); err != nil {
+		return "", fmt.Errorf("sign the delegation certificate: %w", err)
+	}
+	return authorizedLine(cert), nil
+}
+// authorizedLine renders a key or certificate as the one-line form ssh-keygen
+// writes and every endpoint here accepts.
+func authorizedLine(k ssh.PublicKey) string {
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(k)))
+}
+// infoListsCA checks tenant_info named the CA the leg registered, and that it
+// described it rather than reproducing it.
+func infoListsCA(info map[string]any, want string) error {
+	cas, _ := info["registered_cas"].([]any)
+	for _, raw := range cas {
+		ca, _ := raw.(map[string]any)
+		if fp, _ := ca["fingerprint"].(string); fp == want {
+			if _, leaked := ca["pubkey"]; leaked {
+				return errors.New("FAIL: tenant_info returned CA key material; it must describe, not reproduce")
+			}
+			return nil
+		}
+	}
+	return fmt.Errorf("FAIL: tenant_info does not list the CA this run registered (%s)", want)
+}
+// exposureAddress pulls the dialable address out of a vm_expose result. The
+// address is empty until the VM's host has reported its uplink, so an empty one
+// is a real failure rather than something to retry.
+func exposureAddress(out map[string]any) (string, error) {
+	exposure, ok := out["exposure"].(map[string]any)
+	if !ok {
+		return "", errors.New("FAIL: vm_expose returned no exposure")
+	}
+	address, _ := exposure["address"].(string)
+	if address == "" {
+		return "", errors.New("FAIL: vm_expose returned no address to dial")
+	}
+	return address, nil
+}
+// proveBanner dials a published address until the guest's sshd answers, the
+// same proof proveExposure makes of the API path.
+func proveBanner(ctx context.Context, address string, now func() time.Time, sleep func(time.Duration), dial bannerFunc) error {
+	var lastErr error
+	err := pollLoop(ctx, now, sleep, 60*time.Second, 3*time.Second, func() (bool, error) {
+		banner, derr := dial(ctx, address)
+		if derr != nil {
+			// The listener binds on the host's next converge, a tick away.
+			lastErr = derr
+			return false, nil
+		}
+		if !strings.HasPrefix(banner, sshBannerPrefix) {
+			return false, fmt.Errorf("FAIL: port published over MCP at %s answered %q, want an %s banner",
+				address, truncateBanner(banner), sshBannerPrefix)
+		}
+		return true, nil
+	})
+	if errors.Is(err, errPollTimeout) {
+		return fmt.Errorf("FAIL: no %s banner from the MCP-published port %s within 60s: %v", sshBannerPrefix, address, lastErr)
+	}
+	return err
+}
+// randNonce returns a value the guest cannot have echoed by accident.
+func randNonce() (string, error) {
+	var b [6]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		return "", fmt.Errorf("generate exec nonce: %w", err)
+	}
+	return "mcp-" + hex.EncodeToString(b[:]), nil
+}

internal/smoke/mcp_test.go

@@ @@ -0,0 +1,363 @@ @@
+package smoke
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+// fakeMCP scripts an MCP endpoint: it records the calls the leg makes, answers
+// each from results, and can be made to fail one of them. delegate_complete is
+// answered like the real one — the certificate is parsed and its signing CA
+// reported back — so the leg's own checks are exercised rather than mocked past.
+type fakeMCP struct {
+	tools   []string
+	results map[string]map[string]any
+	failOn  string
+	// trusted is the tenant's registered CA set, as the control plane would
+	// hold it: a certificate signed by anything else is refused.
+	trusted []ssh.PublicKey
+	pubLine string
+	// uploaded records the CA lines ca_upload received.
+	uploaded []string
+	// delegated is what tenant_info reports; set once a certificate lands.
+	delegated bool
+	calls []string
+}
+func newFakeMCP(t *testing.T, trusted ...ssh.Signer) *fakeMCP {
+	t.Helper()
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	eitriKey, err := ssh.NewSignerFromSigner(priv)
+	require.NoError(t, err)
+	f := &fakeMCP{
+		tools: []string{
+			"vm_create", "vm_list", "vm_info", "vm_exec", "vm_write_file", "vm_read_file",
+			"vm_expose", "vm_exposures", "vm_unexpose", "vm_destroy",
+			"ca_upload", "tenant_info", "delegate_begin", "delegate_complete",
+		},
+		pubLine: authorizedLine(eitriKey.PublicKey()),
+		results: map[string]map[string]any{
+			"vm_create":   {"id": "v-1", "name": "smoke-mcp"},
+			"vm_exec":     {"stdout": "", "exit_code": 0.0},
+			"vm_expose":   {"exposure": map[string]any{"id": "x-1", "address": "10.0.0.1:30001"}},
+			"vm_unexpose": {"id": "x-1"},
+			"vm_destroy":  {"id": "v-1"},
+		},
+	}
+	for _, ca := range trusted {
+		f.trusted = append(f.trusted, ca.PublicKey())
+	}
+	f.results["delegate_begin"] = map[string]any{"public_key": f.pubLine, "principal": "ubuntu"}
+	return f
+}
+func (f *fakeMCP) List(context.Context) ([]string, error) { return f.tools, nil }
+func (f *fakeMCP) Call(_ context.Context, name string, args map[string]any) (map[string]any, error) {
+	f.calls = append(f.calls, name)
+	if name == f.failOn {
+		return nil, errors.New(name + ": refused")
+	}
+	if name == "ca_upload" {
+		line, _ := args["public_key"].(string)
+		pub, _, _, _, err := ssh.ParseAuthorizedKey([]byte(line))
+		if err != nil {
+			return nil, errors.New("ca_upload: not a public key")
+		}
+		f.uploaded = append(f.uploaded, line)
+		return map[string]any{"fingerprint": ssh.FingerprintSHA256(pub)}, nil
+	}
+	if name == "tenant_info" {
+		cas := []any{}
+		for _, line := range f.uploaded {
+			if pub, _, _, _, err := ssh.ParseAuthorizedKey([]byte(line)); err == nil {
+				cas = append(cas, map[string]any{"fingerprint": ssh.FingerprintSHA256(pub), "label": "eitri-smoke"})
+			}
+		}
+		return map[string]any{"registered_cas": cas, "delegated": f.delegated}, nil
+	}
+	if name == "delegate_complete" {
+		return f.complete(args)
+	}
+	out := map[string]any{}
+	for k, v := range f.results[name] {
+		out[k] = v
+	}
+	return out, nil
+}
+// complete stands in for the control plane's own validation: the certificate
+// must be over the key this fake handed out, and signed by a registered CA.
+func (f *fakeMCP) complete(args map[string]any) (map[string]any, error) {
+	line, _ := args["certificate"].(string)
+	pub, _, _, _, err := ssh.ParseAuthorizedKey([]byte(line))
+	if err != nil {
+		return nil, errors.New("delegate_complete: not a certificate")
+	}
+	cert, ok := pub.(*ssh.Certificate)
+	if !ok {
+		return nil, errors.New("delegate_complete: not a certificate")
+	}
+	if authorizedLine(cert.Key) != f.pubLine {
+		return nil, errors.New("delegate_complete: that certificate is for a different key")
+	}
+	for _, ca := range f.trusted {
+		if string(ca.Marshal()) == string(cert.SignatureKey.Marshal()) {
+			f.delegated = true
+			return map[string]any{
+				"ca_fingerprint": ssh.FingerprintSHA256(cert.SignatureKey),
+				"principals":     []any{"ubuntu"},
+				"expires_at":     time.Unix(int64(cert.ValidBefore), 0).UTC().Format(time.RFC3339),
+			}, nil
+		}
+	}
+	return nil, errors.New("delegate_complete: not a CA registered to this tenant")
+}
+// echoingMCP makes vm_exec behave like a guest: it echoes the command's
+// argument, which is the nonce the leg generated.
+type echoingMCP struct{ *fakeMCP }
+func (e echoingMCP) Call(ctx context.Context, name string, args map[string]any) (map[string]any, error) {
+	out, err := e.fakeMCP.Call(ctx, name, args)
+	if err != nil || name != "vm_exec" {
+		return out, err
+	}
+	cmd, _ := args["command"].(string)
+	out["stdout"] = strings.TrimPrefix(cmd, "echo ") + "\n"
+	return out, nil
+}
+func okBannerDial(context.Context, string) (string, error) { return "SSH-2.0-OpenSSH_9.6\r\n", nil }
+// newCA returns a signer standing in for somebody's own SSH user CA.
+func newCA(t *testing.T) ssh.Signer {
+	t.Helper()
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	s, err := ssh.NewSignerFromSigner(priv)
+	require.NoError(t, err)
+	return s
+}
+// testDelegator builds the out-of-band half: ca is the one the leg registers
+// and signs with, stranger is the one nobody registered.
+func testDelegator(ca, stranger ssh.Signer) delegator {
+	return delegator{
+		ca:        ca,
+		stranger:  stranger,
+		principal: "ubuntu",
+		now:       func() time.Time { return time.Unix(1_800_000_000, 0) },
+	}
+}
+// TestProveMCPDrivesTheWholeCycle pins the order the leg must run in: the CA is
+// registered BEFORE the VM is created, because a guest bakes its trusted CA set
+// at create and would otherwise refuse every certificate. The delegation itself
+// may fall on either side of the create, which is the improvement over holding
+// a signing key.
+func TestProveMCPDrivesTheWholeCycle(t *testing.T) {
+	ca, stranger := newCA(t), newCA(t)
+	f := echoingMCP{newFakeMCP(t, ca)}
+	clock := &fakeClock{}
+	require.NoError(t, proveMCP(t.Context(), f, "smoke-mcp", testDelegator(ca, stranger), clock.now, clock.sleep, okBannerDial))
+	assert.Equal(t, []string{authorizedLine(ca.PublicKey())}, f.uploaded,
+		"the CA is registered through the tool, before anything is created")
+	assert.Equal(t,
+		[]string{"ca_upload", "delegate_begin", "delegate_complete", "delegate_complete",
+			"tenant_info", "vm_create", "vm_exec", "vm_expose", "vm_unexpose", "vm_destroy"},
+		f.calls)
+}
+// TestProveMCPRequiresTheUnregisteredCAToBeRefused is the negative leg itself:
+// if the control plane ever accepted a certificate from a CA nobody registered,
+// the gate must fail.
+func TestProveMCPRequiresTheUnregisteredCAToBeRefused(t *testing.T) {
+	ca, stranger := newCA(t), newCA(t)
+	f := echoingMCP{newFakeMCP(t, ca, stranger)} // a plane that trusts everyone
+	clock := &fakeClock{}
+	err := proveMCP(t.Context(), f, "smoke-mcp", testDelegator(ca, stranger), clock.now, clock.sleep, okBannerDial)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "accepted a certificate from an unregistered CA")
+}
+// TestProveMCPRejectsAWrongPrincipal: the challenge names the principal the
+// certificate must carry, and a plane asking for a different one is a plane the
+// gate does not understand.
+func TestProveMCPRejectsAWrongPrincipal(t *testing.T) {
+	ca, stranger := newCA(t), newCA(t)
+	f := newFakeMCP(t, ca)
+	f.results["delegate_begin"] = map[string]any{"public_key": f.pubLine, "principal": "root"}
+	clock := &fakeClock{}
+	err := proveMCP(t.Context(), f, "smoke-mcp", testDelegator(ca, stranger), clock.now, clock.sleep, okBannerDial)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `asked for principal "root"`)
+}
+// TestProveMCPRejectsADelegationWithNoExpiry: a delegation that never ends is
+// not one.
+func TestProveMCPRejectsADelegationWithNoExpiry(t *testing.T) {
+	ca, stranger := newCA(t), newCA(t)
+	f := noExpiryMCP{newFakeMCP(t, ca)}
+	clock := &fakeClock{}
+	err := proveMCP(t.Context(), f, "smoke-mcp", testDelegator(ca, stranger), clock.now, clock.sleep, okBannerDial)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "reports no expiry")
+}
+type noExpiryMCP struct{ *fakeMCP }
+func (n noExpiryMCP) Call(ctx context.Context, name string, args map[string]any) (map[string]any, error) {
+	out, err := n.fakeMCP.Call(ctx, name, args)
+	if err == nil && name == "delegate_complete" {
+		delete(out, "expires_at")
+	}
+	return out, err
+}
+// TestProveMCPDestroysItsVMOnFailure: a failed leg must not leave a VM running
+// on the live fleet.
+func TestProveMCPDestroysItsVMOnFailure(t *testing.T) {
+	ca, stranger := newCA(t), newCA(t)
+	f := newFakeMCP(t, ca)
+	f.failOn = "vm_exec"
+	clock := &fakeClock{}
+	err := proveMCP(t.Context(), f, "smoke-mcp", testDelegator(ca, stranger), clock.now, clock.sleep, okBannerDial)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "vm_exec over MCP")
+	assert.Contains(t, f.calls, "vm_destroy", "the leg must reap its own VM even when it fails")
+}
+// TestProveMCPRejectsAShortToolset: a transport that advertises fewer tools than
+// the stdio binary means the two have drifted apart.
+func TestProveMCPRejectsAShortToolset(t *testing.T) {
+	ca, stranger := newCA(t), newCA(t)
+	f := newFakeMCP(t, ca)
+	f.tools = f.tools[:5]
+	clock := &fakeClock{}
+	err := proveMCP(t.Context(), f, "smoke-mcp", testDelegator(ca, stranger), clock.now, clock.sleep, okBannerDial)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "advertises 5 tools")
+}
+// TestProveMCPRejectsAMissingDelegateTool guards the tools a remote caller
+// cannot work without.
+func TestProveMCPRejectsAMissingDelegateTool(t *testing.T) {
+	ca, stranger := newCA(t), newCA(t)
+	f := newFakeMCP(t, ca)
+	for i, name := range f.tools {
+		if name == "delegate_begin" {
+			f.tools[i] = "vm_something_else"
+		}
+	}
+	clock := &fakeClock{}
+	err := proveMCP(t.Context(), f, "smoke-mcp", testDelegator(ca, stranger), clock.now, clock.sleep, okBannerDial)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "does not advertise delegate_begin")
+}
+// TestProveMCPRejectsAnExposureWithNoAddress: a grant with nowhere to dial is a
+// failure, not something to retry.
+func TestProveMCPRejectsAnExposureWithNoAddress(t *testing.T) {
+	ca, stranger := newCA(t), newCA(t)
+	f := echoingMCP{newFakeMCP(t, ca)}
+	f.results["vm_expose"] = map[string]any{"exposure": map[string]any{"id": "x-1"}}
+	clock := &fakeClock{}
+	err := proveMCP(t.Context(), f, "smoke-mcp", testDelegator(ca, stranger), clock.now, clock.sleep, okBannerDial)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "no address to dial")
+}
+// TestProveMCPRejectsAWrongBanner: something is listening on the published port,
+// but it is not the guest's sshd.
+func TestProveMCPRejectsAWrongBanner(t *testing.T) {
+	ca, stranger := newCA(t), newCA(t)
+	f := echoingMCP{newFakeMCP(t, ca)}
+	clock := &fakeClock{}
+	err := proveMCP(t.Context(), f, "smoke-mcp", testDelegator(ca, stranger), clock.now, clock.sleep,
+		func(context.Context, string) (string, error) { return "HTTP/1.1 200 OK", nil })
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "want an SSH-2.0 banner")
+}
+// TestProveMCPRejectsAnEchoThatDoesNotComeBack: the nonce proves the command
+// actually ran in the guest rather than being answered by the control plane.
+func TestProveMCPRejectsAnEchoThatDoesNotComeBack(t *testing.T) {
+	ca, stranger := newCA(t), newCA(t)
+	f := newFakeMCP(t, ca) // plain fake: vm_exec returns an empty stdout
+	clock := &fakeClock{}
+	err := proveMCP(t.Context(), f, "smoke-mcp", testDelegator(ca, stranger), clock.now, clock.sleep, okBannerDial)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "want it to contain")
+}
+// TestSignDelegationProducesAUsableCertificate pins the shape the control plane
+// checks: a user certificate over the key it handed out, naming the login user,
+// with a real validity window.
+func TestSignDelegationProducesAUsableCertificate(t *testing.T) {
+	ca := newCA(t)
+	f := newFakeMCP(t, ca)
+	now := time.Unix(1_800_000_000, 0)
+	line, err := signDelegation(ca, f.pubLine, "ubuntu", now)
+	require.NoError(t, err)
+	pub, _, _, _, err := ssh.ParseAuthorizedKey([]byte(line))
+	require.NoError(t, err)
+	cert, ok := pub.(*ssh.Certificate)
+	require.True(t, ok)
+	assert.Equal(t, uint32(ssh.UserCert), cert.CertType)
+	assert.Equal(t, []string{"ubuntu"}, cert.ValidPrincipals)
+	assert.Equal(t, f.pubLine, authorizedLine(cert.Key))
+	assert.Equal(t, uint64(now.Add(delegationTTL).Unix()), cert.ValidBefore)
+	checker := &ssh.CertChecker{
+		IsUserAuthority: func(auth ssh.PublicKey) bool {
+			return string(auth.Marshal()) == string(ca.PublicKey().Marshal())
+		},
+		Clock: func() time.Time { return now },
+	}
+	require.NoError(t, checker.CheckCert("ubuntu", cert))
+}
+// TestProveRemoteMCPNeedsACredential passes only on a 401 — an endpoint that
+// answers anything else is either unprotected or not the MCP endpoint.
+func TestProveRemoteMCPNeedsACredential(t *testing.T) {
+	unauthorized := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "sign in required", http.StatusUnauthorized)
+	}))
+	defer unauthorized.Close()
+	assert.NoError(t, proveRemoteMCPNeedsACredential(unauthorized.URL))
+	open := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer open.Close()
+	err := proveRemoteMCPNeedsACredential(open.URL)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "answered 200, want 401")
+}

internal/smoke/run.go

Old		New
@@ -54,6 +54,14 @@ func Run() error {
54	}	54	}
55	fmt.Printf("credential chain OK (tenant %s)\n", ciTenant)	55	fmt.Printf("credential chain OK (tenant %s)\n", ciTenant)
56		56
		57	// The remote MCP endpoint's cheap half: it must exist and must refuse an
		58	// unauthenticated caller. It needs no guest, so a misrouted or unprotected
		59	// /mcp fails here in a second rather than after a VM has booted.
		60	if err := proveRemoteMCPNeedsACredential(cfg.ServerURL); err != nil {
		61	return err
		62	}
		63	fmt.Println("remote MCP endpoint refuses an unauthenticated caller")
		64
57	// Phase 2 — VM lifecycle. Authenticate with an operator-minted PAT read from	65	// Phase 2 — VM lifecycle. Authenticate with an operator-minted PAT read from
58	// CI_PAT_FILE (a normal, tenant-scoped console PAT — spec §3's automation	66	// CI_PAT_FILE (a normal, tenant-scoped console PAT — spec §3's automation
59	// story). The scenario's tenant is DERIVED via Me(), never assumed, and	67	// story). The scenario's tenant is DERIVED via Me(), never assumed, and
@@ -85,19 +93,47 @@ func Run() error {
85	return fmt.Errorf("generate vm name: %w", err)	93	return fmt.Errorf("generate vm name: %w", err)
86	}	94	}
87		95
		96	// The smoke's own user CA. It is the gate check's CA when one is configured,
		97	// and it is what the MCP leg delegates with either way — so an in-memory CA
		98	// stands in when SMOKE_USER_CA_FILE is unset, and the delegation leg never
		99	// depends on how the gate happens to be configured.
		100	userCA, err := smokeUserCA(cfg.SmokeUserCAFile)
		101	if err != nil {
		102	return err
		103	}
		104
88	var gate *gateHooks	105	var gate *gateHooks
89	if cfg.SmokeGate != "" && cfg.SmokeUserCAFile != "" {	106	if cfg.SmokeGate != "" && cfg.SmokeUserCAFile != "" {
90	userCA, err := loadOrCreateUserCA(cfg.SmokeUserCAFile)
91	if err != nil {
92	return fmt.Errorf("load smoke user CA: %w", err)
93	}
94	gate = realGateHooks(cfg, tenant, api, userCA, time.Now, time.Sleep)	107	gate = realGateHooks(cfg, tenant, api, userCA, time.Now, time.Sleep)
95	} else {	108	} else {
96	fmt.Fprintln(os.Stderr, "eitri-smoke: gate SSH check skipped (SMOKE_GATE/SMOKE_USER_CA_FILE not set)")	109	fmt.Fprintln(os.Stderr, "eitri-smoke: gate SSH check skipped (SMOKE_GATE/SMOKE_USER_CA_FILE not set)")
97	}	110	}
98		111
		112	// A second CA, registered with nobody, for the negative delegation leg.
		113	stranger, err := generateUserCA()
		114	if err != nil {
		115	return err
		116	}
		117
99	ctx := context.Background()	118	ctx := context.Background()
100	msg, err := runScenario(ctx, cfg, vmName, api, realRunSSH(cfg.AgentUserHost, cfg.AgentPort), gate, time.Now, time.Sleep, realReadPubKey, readBanner)	119
		120	// Remote MCP, over the same PAT: no local install, no uploaded CA, nothing
		121	// but a token and an HTTP endpoint. The session lives for the whole run.
		122	tools, closeMCP, err := dialMCP(ctx, cfg.ServerURL, pat)
		123	if err != nil {
		124	return err
		125	}
		126	defer closeMCP()
		127	mcp := func(ctx context.Context, name string) error {
		128	return proveMCP(ctx, tools, name, delegator{
		129	ca: userCA,
		130	stranger: stranger,
		131	principal: cfg.SmokeVMUser,
		132	now: time.Now,
		133	}, time.Now, time.Sleep, readBanner)
		134	}
		135
		136	msg, err := runScenario(ctx, cfg, vmName, api, realRunSSH(cfg.AgentUserHost, cfg.AgentPort), gate, mcp, time.Now, time.Sleep, realReadPubKey, readBanner)
101	if err != nil {	137	if err != nil {
102	return err	138	return err
103	}	139	}

internal/smoke/scenario.go

Old		New
@@ -116,6 +116,10 @@ type gateHooks struct {
116	exec func(ctx context.Context, vmName string) error // reach the guest through the gate (after boot)	116	exec func(ctx context.Context, vmName string) error // reach the guest through the gate (after boot)
117	}	117	}
118		118
		119	// mcpLeg is the remote-MCP proof: one full cycle driven entirely through the
		120	// control plane's /mcp endpoint with a bearer PAT. nil means "skip it".
		121	type mcpLeg func(ctx context.Context, vmName string) error
		122
119	// pollLoop calls attempt repeatedly (with sleep between calls) until attempt	123	// pollLoop calls attempt repeatedly (with sleep between calls) until attempt
120	// reports done, returns a non-nil error, or the deadline (now()+timeout) is	124	// reports done, returns a non-nil error, or the deadline (now()+timeout) is
121	// reached, in which case it returns errPollTimeout. now and sleep are	125	// reached, in which case it returns errPollTimeout. now and sleep are
@@ -148,10 +152,13 @@ func pollLoop(ctx context.Context, now func() time.Time, sleep func(time.Duratio
148	// smoke's user CA with the tenant before create (the guest bakes its trusted	152	// smoke's user CA with the tenant before create (the guest bakes its trusted
149	// CAs at boot, so registration MUST happen first) and proves gate SSH access	153	// CAs at boot, so registration MUST happen first) and proves gate SSH access
150	// after the boot-proof — a hard gate, so a failure there fails the scenario.	154	// after the boot-proof — a hard gate, so a failure there fails the scenario.
		155	// mcp, when non-nil, drives a second VM's whole life through the remote MCP
		156	// endpoint — that leg owns its own VM, created after it registers its own CA
		157	// with the tenant, so the guest trusts the certificates eitri presents.
151	// now/sleep are the injected clock so the poll deadlines are unit-testable	158	// now/sleep are the injected clock so the poll deadlines are unit-testable
152	// without real waiting. On success it returns the human-readable COMPLETE	159	// without real waiting. On success it returns the human-readable COMPLETE
153	// line; on any failure it returns a descriptive error.	160	// line; on any failure it returns a descriptive error.
154	func runScenario(ctx context.Context, cfg Config, vmName string, c vmAPI, runSSH sshFunc, gate *gateHooks, now func() time.Time, sleep func(time.Duration), readPubKey func() string, dialBanner bannerFunc) (string, error) {	161	func runScenario(ctx context.Context, cfg Config, vmName string, c vmAPI, runSSH sshFunc, gate *gateHooks, mcp mcpLeg, now func() time.Time, sleep func(time.Duration), readPubKey func() string, dialBanner bannerFunc) (string, error) {
155	if gate != nil {	162	if gate != nil {
156	if err := gate.register(ctx); err != nil {	163	if err := gate.register(ctx); err != nil {
157	return "", fmt.Errorf("register smoke user CA: %w", err)	164	return "", fmt.Errorf("register smoke user CA: %w", err)
@@ -219,6 +226,16 @@ func runScenario(ctx context.Context, cfg Config, vmName string, c vmAPI, runSSH
219	}	226	}
220	exposureOK = true	227	exposureOK = true
221		228
		229	// Remote MCP: the same fleet, driven by a bearer PAT over HTTP with no
		230	// local install and no uploaded CA. It creates and destroys its own VM.
		231	mcpOK := false
		232	if mcp != nil {
		233	if err := mcp(ctx, vmName+"-mcp"); err != nil {
		234	return "", err
		235	}
		236	mcpOK = true
		237	}
		238
222	// Power cycle: prove the guest comes BACK. A first boot runs on the	239	// Power cycle: prove the guest comes BACK. A first boot runs on the
223	// kernel's in-memory partition table; only a stop→start proves the	240	// kernel's in-memory partition table; only a stop→start proves the
224	// on-disk GPT survived growpart. The sector-0 regression hid exactly	241	// on-disk GPT survived growpart. The sector-0 regression hid exactly
@@ -292,5 +309,8 @@ func runScenario(ctx context.Context, cfg Config, vmName string, c vmAPI, runSSH
292	if exposureOK {	309	if exposureOK {
293	msg += ", exposed port: ok"	310	msg += ", exposed port: ok"
294	}	311	}
		312	if mcpOK {
		313	msg += ", remote MCP: ok"
		314	}
295	return msg, nil	315	return msg, nil
296	}	316	}

internal/smoke/scenario_test.go

Old		New
@@ -169,7 +169,7 @@ func TestRunScenarioSuccess(t *testing.T) {
169	}	169	}
170		170
171	clock := &fakeClock{t: time.Unix(0, 0)}	171	clock := &fakeClock{t: time.Unix(0, 0)}
172	msg, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, runSSH, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)	172	msg, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, runSSH, nil, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)
173	if err != nil {	173	if err != nil {
174	t.Fatalf("runScenario: %v", err)	174	t.Fatalf("runScenario: %v", err)
175	}	175	}
@@ -230,7 +230,7 @@ func TestRunScenarioRebootDeathFails(t *testing.T) {
230	}	230	}
231		231
232	clock := &fakeClock{t: time.Unix(0, 0)}	232	clock := &fakeClock{t: time.Unix(0, 0)}
233	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, runSSH, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)	233	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, runSSH, nil, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)
234	if err == nil {	234	if err == nil {
235	t.Fatal("runScenario: want error for a VM that never came back, got nil")	235	t.Fatal("runScenario: want error for a VM that never came back, got nil")
236	}	236	}
@@ -256,7 +256,7 @@ func TestRunScenarioExposureFailureFails(t *testing.T) {
256	badBanner := func(ctx context.Context, addr string) (string, error) { return "HTTP/1.1 400\r\n", nil }	256	badBanner := func(ctx context.Context, addr string) (string, error) { return "HTTP/1.1 400\r\n", nil }
257		257
258	clock := &fakeClock{t: time.Unix(0, 0)}	258	clock := &fakeClock{t: time.Unix(0, 0)}
259	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, happyPathRunSSH(), nil, clock.now, clock.sleep, noopReadPubKey, badBanner)	259	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, happyPathRunSSH(), nil, nil, clock.now, clock.sleep, noopReadPubKey, badBanner)
260	if err == nil {	260	if err == nil {
261	t.Fatal("runScenario: want error, got nil")	261	t.Fatal("runScenario: want error, got nil")
262	}	262	}
@@ -291,7 +291,7 @@ func TestRunScenarioSerialPanicFails(t *testing.T) {
291	}	291	}
292		292
293	clock := &fakeClock{t: time.Unix(0, 0)}	293	clock := &fakeClock{t: time.Unix(0, 0)}
294	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, runSSH, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)	294	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, runSSH, nil, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)
295	if err == nil {	295	if err == nil {
296	t.Fatal("runScenario: want error, got nil")	296	t.Fatal("runScenario: want error, got nil")
297	}	297	}
@@ -324,7 +324,7 @@ func TestRunScenarioNeverReadyTimesOut(t *testing.T) {
324	}	324	}
325		325
326	clock := &fakeClock{t: time.Unix(0, 0)}	326	clock := &fakeClock{t: time.Unix(0, 0)}
327	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, runSSH, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)	327	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, runSSH, nil, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)
328	if err == nil {	328	if err == nil {
329	t.Fatal("runScenario: want error, got nil")	329	t.Fatal("runScenario: want error, got nil")
330	}	330	}
@@ -362,7 +362,7 @@ func TestRunScenarioNeverReapedTimesOut(t *testing.T) {
362	}	362	}
363		363
364	clock := &fakeClock{t: time.Unix(0, 0)}	364	clock := &fakeClock{t: time.Unix(0, 0)}
365	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, runSSH, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)	365	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, runSSH, nil, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)
366	if err == nil {	366	if err == nil {
367	t.Fatal("runScenario: want error, got nil")	367	t.Fatal("runScenario: want error, got nil")
368	}	368	}
@@ -390,7 +390,7 @@ func TestRunScenarioNoHosts(t *testing.T) {
390	},	390	},
391	}	391	}
392	clock := &fakeClock{t: time.Unix(0, 0)}	392	clock := &fakeClock{t: time.Unix(0, 0)}
393	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, nil, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)	393	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, nil, nil, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)
394	if err == nil {	394	if err == nil {
395	t.Fatal("runScenario: want error, got nil")	395	t.Fatal("runScenario: want error, got nil")
396	}	396	}
@@ -464,7 +464,7 @@ func TestRunScenarioGateRegistersBeforeCreateAndExecsAfterBoot(t *testing.T) {
464	}	464	}
465		465
466	clock := &fakeClock{t: time.Unix(0, 0)}	466	clock := &fakeClock{t: time.Unix(0, 0)}
467	msg, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, happyPathRunSSH(), gate, clock.now, clock.sleep, noopReadPubKey, okBanner)	467	msg, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, happyPathRunSSH(), gate, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)
468	if err != nil {	468	if err != nil {
469	t.Fatalf("runScenario: %v", err)	469	t.Fatalf("runScenario: %v", err)
470	}	470	}
@@ -514,7 +514,7 @@ func TestRunScenarioGateRegisterErrorAbortsBeforeCreate(t *testing.T) {
514	}	514	}
515		515
516	clock := &fakeClock{t: time.Unix(0, 0)}	516	clock := &fakeClock{t: time.Unix(0, 0)}
517	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, nil, gate, clock.now, clock.sleep, noopReadPubKey, okBanner)	517	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, nil, gate, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)
518	if err == nil {	518	if err == nil {
519	t.Fatal("runScenario: want error, got nil")	519	t.Fatal("runScenario: want error, got nil")
520	}	520	}
@@ -538,7 +538,7 @@ func TestRunScenarioGateExecErrorFails(t *testing.T) {
538	}	538	}
539		539
540	clock := &fakeClock{t: time.Unix(0, 0)}	540	clock := &fakeClock{t: time.Unix(0, 0)}
541	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, happyPathRunSSH(), gate, clock.now, clock.sleep, noopReadPubKey, okBanner)	541	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, happyPathRunSSH(), gate, nil, clock.now, clock.sleep, noopReadPubKey, okBanner)
542	if err == nil {	542	if err == nil {
543	t.Fatal("runScenario: want error, got nil")	543	t.Fatal("runScenario: want error, got nil")
544	}	544	}
@@ -599,3 +599,44 @@ func TestGetVMFiltersById(t *testing.T) {
599	t.Errorf("getVM(vm-3) against a non-empty list = present %v, err %v; want absent", present, err)	599	t.Errorf("getVM(vm-3) against a non-empty list = present %v, err %v; want absent", present, err)
600	}	600	}
601	}	601	}
		602
		603	// TestRunScenarioRunsTheMCPLegOnItsOwnVM pins where the remote-MCP leg sits and
		604	// that it owns a separate VM: it must not reuse the scenario's, whose CA set
		605	// was baked before the MCP leg registered the CA it delegates with.
		606	func TestRunScenarioRunsTheMCPLegOnItsOwnVM(t *testing.T) {
		607	var calls []string
		608	api := happyPathAPI(t, &calls)
		609
		610	mcpVM := ""
		611	mcp := func(_ context.Context, vmName string) error {
		612	mcpVM = vmName
		613	calls = append(calls, "mcp")
		614	return nil
		615	}
		616
		617	clock := &fakeClock{t: time.Unix(0, 0)}
		618	msg, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, happyPathRunSSH(), nil, mcp, clock.now, clock.sleep, noopReadPubKey, okBanner)
		619	if err != nil {
		620	t.Fatalf("runScenario: %v", err)
		621	}
		622	if !strings.Contains(msg, "remote MCP: ok") {
		623	t.Errorf("message = %q, want it to mention remote MCP: ok", msg)
		624	}
		625	if mcpVM == "smoke-test" \|\| mcpVM == "" {
		626	t.Errorf("MCP leg drove vm %q, want a VM of its own", mcpVM)
		627	}
		628	}
		629
		630	// TestRunScenarioFailsWhenTheMCPLegFails: the remote endpoint is a hard gate,
		631	// not an advisory check.
		632	func TestRunScenarioFailsWhenTheMCPLegFails(t *testing.T) {
		633	var calls []string
		634	api := happyPathAPI(t, &calls)
		635	mcp := func(context.Context, string) error { return errors.New("FAIL: register refused") }
		636
		637	clock := &fakeClock{t: time.Unix(0, 0)}
		638	_, err := runScenario(context.Background(), baseCfg(), "smoke-test", api, happyPathRunSSH(), nil, mcp, clock.now, clock.sleep, noopReadPubKey, okBanner)
		639	if err == nil \|\| !strings.Contains(err.Error(), "register refused") {
		640	t.Fatalf("runScenario err = %v, want the MCP leg's failure to fail the gate", err)
		641	}
		642	}

internal/smoke/userca.go

@@ @@ -13,6 +13,30 @@ import ( @@
+	"golang.org/x/crypto/ssh"
+// smokeUserCA returns the CA the smoke signs with: the persistent one at path,
+// or a throwaway held in memory when no path is configured. The gate check
+// needs the persistent one (its public half is registered once and reused);
+// the delegation leg registers whichever it gets, so it works either way.
+func smokeUserCA(path string) (ssh.Signer, error) {
+	if path == "" {
+		return generateUserCA()
+	}
+	return loadOrCreateUserCA(path)
+}
+// generateUserCA returns a fresh ed25519 CA that is never written down.
+func generateUserCA() (ssh.Signer, error) {
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, fmt.Errorf("generate user CA key: %w", err)
+	}
+	signer, err := ssh.NewSignerFromSigner(priv)
+	if err != nil {
+		return nil, fmt.Errorf("build user CA signer: %w", err)
+	}
+	return signer, nil
+}
+// loadOrCreateUserCA loads the smoke's persistent user CA key from path,
+// generating and persisting a fresh ed25519 key on first run so subsequent
+// smoke runs reuse the same CA identity (the gate check registers this key's

scripts/coverage.sh

Old		New
@@ -30,7 +30,10 @@ declare -A FLOOR=(
30	[internal/agent/syncclient]=74	30	[internal/agent/syncclient]=74
31	[internal/agent/exposeproxy]=80	31	[internal/agent/exposeproxy]=80
32	[internal/server/api]=76	32	[internal/server/api]=76
33	[internal/server/boot]=17	33	[internal/server/delegation]=90
		34	[internal/server/mcphttp]=88
		35	[internal/server/vmssh]=90
		36	[internal/server/boot]=20
34	[internal/server/api/client]=89	37	[internal/server/api/client]=89
35	[internal/server/api/spec]=91	38	[internal/server/api/spec]=91
36	[internal/server/store]=76	39	[internal/server/store]=76

web/src/lib/api-types.ts

@@ @@ -52,6 +52,140 @@ export interface paths { @@
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/delegations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Describe the caller tenant's live delegation, including when it expires. 404 when there is none. */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description success */
+: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Delegation"];
+                    };
+                };
+                /** @description error (plain text) */
+                default: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "text/plain": string;
+                    };
+                };
+            };
+        };
+        /** Complete a delegation with the certificate your CA signed. The certificate must be a user certificate over the key this delegation issued, signed by a CA registered to your tenant, naming the guest login user as a principal. */
+        put: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": components["schemas"]["DelegationRequest"];
+                };
+            };
+            responses: {
+                /** @description success */
+: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Delegation"];
+                    };
+                };
+                /** @description error (plain text) */
+                default: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "text/plain": string;
+                    };
+                };
+            };
+        };
+        /** Start a delegation: returns the ephemeral public key eitri will authenticate with, the principal the certificate must carry, and the ssh-keygen command that signs it. The key is stable for the life of the process. */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description success */
+: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["DelegationChallenge"];
+                    };
+                };
+                /** @description error (plain text) */
+                default: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "text/plain": string;
+                    };
+                };
+            };
+        };
+        /** End the caller tenant's delegation now. eitri drops the certificate and can no longer reach that tenant's VMs. */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description success */
+: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description error (plain text) */
+                default: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "text/plain": string;
+                    };
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/enroll": {
+        parameters: {
+            query?: never;
@@ @@ -1400,6 +1534,22 @@ export interface components { @@
+            id: string;
+            name: string;
+        };
+        Delegation: {
+            ca_fingerprint: string;
+            expires_at: string;
+            key_id: string;
+            principals: string[];
+            public_key: string;
+            serial: string;
+        };
+        DelegationChallenge: {
+            instructions: string;
+            principal: string;
+            public_key: string;
+        };
+        DelegationRequest: {
+            certificate?: string;
+        };
+        EnrollRequest: {
+            arch?: string;
+            bridge_cidr?: string | null;

Old		New
@@ -247,7 +247,7 @@ func TestExecThroughGate(t *testing.T) {
247	// verifies it under that host.	247	// verifies it under that host.
248	gateAddr := startGate(t, hostCertSigner(t, ca, "127.0.0.1"), ca.PublicKey(), vmAddr)	248	gateAddr := startGate(t, hostCertSigner(t, ca, "127.0.0.1"), ca.PublicKey(), vmAddr)
249		249
250	r := &Runner{cfg: RunnerConfig{Gate: gateAddr, VMUser: "ubuntu"}, auth: ga}	250	r := NewRunner(&gateDialer{cfg: gateDialerConfig{Gate: gateAddr, VMUser: "ubuntu"}, auth: ga})
251	res, err := r.Exec(t.Context(), "testvm", "echo hi", 10*time.Second)	251	res, err := r.Exec(t.Context(), "testvm", "echo hi", 10*time.Second)
252	require.NoError(t, err)	252	require.NoError(t, err)
253	assert.Equal(t, "hi\n", res.Stdout)	253	assert.Equal(t, "hi\n", res.Stdout)
@@ -265,7 +265,7 @@ func TestExecVMForeignCAHostCertRejected(t *testing.T) {
265	vmAddr := startBackingVM(t, hostCertSigner(t, foreignCA, "default.testvm"), ca.PublicKey(), "hi\n", 0)	265	vmAddr := startBackingVM(t, hostCertSigner(t, foreignCA, "default.testvm"), ca.PublicKey(), "hi\n", 0)
266	gateAddr := startGate(t, hostCertSigner(t, ca, "127.0.0.1"), ca.PublicKey(), vmAddr)	266	gateAddr := startGate(t, hostCertSigner(t, ca, "127.0.0.1"), ca.PublicKey(), vmAddr)
267		267
268	r := &Runner{cfg: RunnerConfig{Gate: gateAddr, VMUser: "ubuntu"}, auth: ga}	268	r := NewRunner(&gateDialer{cfg: gateDialerConfig{Gate: gateAddr, VMUser: "ubuntu"}, auth: ga})
269	_, err := r.Exec(t.Context(), "testvm", "echo hi", 10*time.Second)	269	_, err := r.Exec(t.Context(), "testvm", "echo hi", 10*time.Second)
270	require.Error(t, err)	270	require.Error(t, err)
271	assert.Contains(t, err.Error(), "vm testvm ssh handshake", "expected the VM hop to reject the foreign-CA host cert")	271	assert.Contains(t, err.Error(), "vm testvm ssh handshake", "expected the VM hop to reject the foreign-CA host cert")
@@ -282,7 +282,7 @@ func TestExecGateRejectsNonCAUserKey(t *testing.T) {
282	// so its handshake must fail auth. Host verification still uses the real CA,	282	// so its handshake must fail auth. Host verification still uses the real CA,
283	// isolating the client-auth rejection at the gate hop.	283	// isolating the client-auth rejection at the gate hop.
284	creds := fakeGateCreds{signer: newSigner(t), hostCB: ga.HostKeyCallback()}	284	creds := fakeGateCreds{signer: newSigner(t), hostCB: ga.HostKeyCallback()}
285	r := &Runner{cfg: RunnerConfig{Gate: gateAddr, VMUser: "ubuntu"}, auth: creds}	285	r := NewRunner(&gateDialer{cfg: gateDialerConfig{Gate: gateAddr, VMUser: "ubuntu"}, auth: creds})
286	_, err := r.Exec(t.Context(), "testvm", "echo hi", 10*time.Second)	286	_, err := r.Exec(t.Context(), "testvm", "echo hi", 10*time.Second)
287	require.Error(t, err)	287	require.Error(t, err)
288	assert.Contains(t, err.Error(), "gate "+gateAddr+" ssh handshake", "expected the gate hop to reject the non-CA user key")	288	assert.Contains(t, err.Error(), "gate "+gateAddr+" ssh handshake", "expected the gate hop to reject the non-CA user key")
@@ -350,7 +350,7 @@ func (f *fakeGateAPI) UploadUserCA(_ context.Context, tenant, line string) error
350	func TestRunnerEnsureRegistersUserCAWhenAbsent(t *testing.T) {	350	func TestRunnerEnsureRegistersUserCAWhenAbsent(t *testing.T) {
351	userCA := newSigner(t)	351	userCA := newSigner(t)
352	api := &fakeGateAPI{caSigner: newSigner(t), meTenant: "acme"} // listCAs empty ⇒ absent	352	api := &fakeGateAPI{caSigner: newSigner(t), meTenant: "acme"} // listCAs empty ⇒ absent
353	r := NewRunner(RunnerConfig{Gate: "g:22", VMUser: "ubuntu", API: api, UserCA: userCA})	353	r := newGateDialer(gateDialerConfig{Gate: "g:22", VMUser: "ubuntu", API: api, UserCA: userCA})
354		354
355	name, err := r.ConnectName(t.Context(), "web-1")	355	name, err := r.ConnectName(t.Context(), "web-1")
356	require.NoError(t, err)	356	require.NoError(t, err)
@@ -367,7 +367,7 @@ func TestRunnerEnsureSkipsUploadWhenFingerprintPresent(t *testing.T) {
367	userCA := newSigner(t)	367	userCA := newSigner(t)
368	fp := ssh.FingerprintSHA256(userCA.PublicKey())	368	fp := ssh.FingerprintSHA256(userCA.PublicKey())
369	api := &fakeGateAPI{caSigner: newSigner(t), meTenant: "acme", listCAs: []client.UserCA{{Fingerprint: fp, Label: "mcp"}}}	369	api := &fakeGateAPI{caSigner: newSigner(t), meTenant: "acme", listCAs: []client.UserCA{{Fingerprint: fp, Label: "mcp"}}}
370	r := NewRunner(RunnerConfig{Gate: "g:22", VMUser: "ubuntu", API: api, UserCA: userCA})	370	r := newGateDialer(gateDialerConfig{Gate: "g:22", VMUser: "ubuntu", API: api, UserCA: userCA})
371		371
372	_, err := r.ConnectName(t.Context(), "web-1")	372	_, err := r.ConnectName(t.Context(), "web-1")
373	require.NoError(t, err)	373	require.NoError(t, err)
@@ -379,7 +379,7 @@ func TestRunnerEnsureSkipsUploadWhenFingerprintPresent(t *testing.T) {
379		379
380	func TestRunnerEnsureExplicitTenantSkipsMe(t *testing.T) {	380	func TestRunnerEnsureExplicitTenantSkipsMe(t *testing.T) {
381	api := &fakeGateAPI{caSigner: newSigner(t), meTenant: "should-not-be-used"}	381	api := &fakeGateAPI{caSigner: newSigner(t), meTenant: "should-not-be-used"}
382	r := NewRunner(RunnerConfig{Gate: "g:22", VMUser: "ubuntu", API: api, UserCA: newSigner(t), Tenant: "team"})	382	r := newGateDialer(gateDialerConfig{Gate: "g:22", VMUser: "ubuntu", API: api, UserCA: newSigner(t), Tenant: "team"})
383		383
384	name, err := r.ConnectName(t.Context(), "web-1")	384	name, err := r.ConnectName(t.Context(), "web-1")
385	require.NoError(t, err)	385	require.NoError(t, err)
@@ -393,7 +393,7 @@ func TestRunnerEnsureExplicitTenantSkipsMe(t *testing.T) {
393		393
394	func TestRunnerEnsureRegistrationFailureNamesFallback(t *testing.T) {	394	func TestRunnerEnsureRegistrationFailureNamesFallback(t *testing.T) {
395	api := &fakeGateAPI{caSigner: newSigner(t), meTenant: "acme", uploadErr: errors.New("boom")}	395	api := &fakeGateAPI{caSigner: newSigner(t), meTenant: "acme", uploadErr: errors.New("boom")}
396	r := NewRunner(RunnerConfig{Gate: "g:22", VMUser: "ubuntu", API: api, UserCA: newSigner(t)})	396	r := newGateDialer(gateDialerConfig{Gate: "g:22", VMUser: "ubuntu", API: api, UserCA: newSigner(t)})
397		397
398	_, err := r.ConnectName(t.Context(), "web-1")	398	_, err := r.ConnectName(t.Context(), "web-1")
399	require.Error(t, err)	399	require.Error(t, err)
@@ -402,7 +402,7 @@ func TestRunnerEnsureRegistrationFailureNamesFallback(t *testing.T) {
402		402
403	func TestRunnerEnsureRetriesAfterFailureThenCaches(t *testing.T) {	403	func TestRunnerEnsureRetriesAfterFailureThenCaches(t *testing.T) {
404	api := &fakeGateAPI{caSigner: newSigner(t), meTenant: "acme", listErrs: 1} // first list fails	404	api := &fakeGateAPI{caSigner: newSigner(t), meTenant: "acme", listErrs: 1} // first list fails
405	r := NewRunner(RunnerConfig{Gate: "g:22", VMUser: "ubuntu", API: api, UserCA: newSigner(t)})	405	r := newGateDialer(gateDialerConfig{Gate: "g:22", VMUser: "ubuntu", API: api, UserCA: newSigner(t)})
406		406
407	_, err := r.ConnectName(t.Context(), "web-1")	407	_, err := r.ConnectName(t.Context(), "web-1")
408	require.Error(t, err, "a failed ensure surfaces the error")	408	require.Error(t, err, "a failed ensure surfaces the error")