Crew runs can SSH to a device the repository names: an owner-granted host:22 plus a key from the repo's secrets (the arm's Pi) #3470

Owner, 2026-10-20: "the crew members should be able to work with the pi via ssh too no? again security is big but this also isnt the end of the world if it breaks. really i want the convenience of having the forge on my phone and working with this so i can get off of my mac."

Today a crew shell's network is the forge and the package registry only (src/crew/sandbox.ts:4), so no run can reach a device. Ready on the device side (steward, 19:55Z): the Pi [email protected] (tailnet; dropbear) has a dedicated user - groups dialout, video, dietpi; writes /home/dietpi/so101; sudo only for systemctl restart|status so101.service|so101-camera@ and journalctl -u so101; key restricted no-port/agent/X11-forwarding. The private key is the trevato/arm repo secret ARM_PI_SSH_KEY. The forge reaches the Pi from 100.84.55.62.

Done:

1. A repository setting "Devices the crew may reach": entries user@host:port (exact, no ranges), each with a secret name for its key; site admin grants each (same grant model as #3437 for app egress; the two can share code).
2. A crew run on that repository gets: the sandbox allowing exactly those host:port destinations; the key materialized into the run's temp dir (0600), removed at run end, never in argv/env-dump/logs; a ready ssh <alias> config (StrictHostKeyChecking with the host key pinned on first grant).
3. The brief tells the crew the device exists and the rules: read and test freely, restart only the services sudo allows, never change the device's users/keys/network.
4. Every SSH session by the crew is logged on the repo (who, when, commands run) and visible to the owner.
5. Test: a fake SSH host granted - a run connects; ungranted host refused; the key never appears in the run log.

Parked by the crew: the check failed ("every spawn that pipes is listed with the reason it reads the pipe") and the decider saw no point in another try (pull #3492 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.

Parked by the crew: the check failed ("event audience coverage > every kind the source emits is classified") and the decider saw no point in another try (pull #3679 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.