SSH & remote work

Remote work is a separate authority boundary. Host identity, authentication, path scope, and command exposure must all be explicit.

Remote tools

Read and search operations inspect configured hosts. Writes and command execution require the corresponding local capability exposure and approval.

Connections

/ssh opens the native SSH configuration and status view. It reports available connection identities without printing private key material.

Host identity

Use pinned known-hosts data for unattended work. Do not disable host-key verification to make an automation path pass. Scope remote identities to the exact command or filesystem surface they need.

Evidence

Remote requests, terminal status, bounded output, and artifacts remain attached to the local session. A remote mutation should be followed by a remote read or service-level smoke check.