3c72eeb6

Document how an agent connects with a delegate certificate

a73x 2026-08-19 08:10

Commit message

Document how an agent connects with a delegate certificate

The Delegates section explained enrolment, minting, the ceiling and
revocation, but stopped short of the last mile: what the agent actually
does with the credential. The answer is "nothing git-collab-specific",
and that is worth saying — ssh loads a -cert.pub beside an identity on
its own, so pointing git at the key is the whole client-side story.
Verified against a live server before writing it down: a fresh key plus
adjacent cert authenticates with no CertificateFile option anywhere.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

Old		New
@@ -473,6 +473,18 @@ Any OpenSSH CA works. Mint a short-lived credential and hand it to an agent:
473	$ ssh-keygen -s mint -I claude-a -n alex -V +10m agent_key.pub	473	$ ssh-keygen -s mint -I claude-a -n alex -V +10m agent_key.pub
474	```	474	```
475		475
		476	Nothing on the agent's side is git-collab-specific. `ssh-keygen -s` leaves
		477	`agent_key-cert.pub` beside the key, ssh loads a `-cert.pub` sitting next to
		478	an identity automatically, and git only needs pointing at the key:
		479
		480	```console
		481	$ GIT_SSH_COMMAND='ssh -i agent_key -o IdentitiesOnly=yes' \
		482	git clone ssh://git.example.com/tools.git
		483	```
		484
		485	A `Host` block with `IdentityFile` and `CertificateFile` in `~/.ssh/config`
		486	does the same when the certificate lives elsewhere.
		487
476	The cert's principal must name an enrolled person and its CA must be enrolled	488	The cert's principal must name an enrolled person and its CA must be enrolled
477	for that name — `cadir/` lends identity, it never creates it. `access.conf`	489	for that name — `cadir/` lends identity, it never creates it. `access.conf`
478	never mentions delegates — the person holds the grants and the certificate	490	never mentions delegates — the person holds the grants and the certificate