id: Phase 13 F13.3 SSH-over-iroh reachability (and iroh-over-SSH fallback) #785

Activity

1. dezren39

   added

   enhancementNew feature or requestNew feature or request

   on Oct 24, 2026
2. github-actions

   assigned

   dezren39

   on Oct 24, 2026
3. developing-today commented on Oct 24, 2026

   

   developing-todayBot

   on Oct 24, 2026 – with developing.today

   Contributor

   More actions

   CODE-113
4. dezren39

   added a commit that references this issue on Oct 25, 2026

   feat(id): SSH-over-iroh tunnel for third-party SSH clients (F13.3)

   ...

   5097a35
5. dezren39 commented on Oct 25, 2026

   

   dezren39

   on Oct 25, 2026

   MemberAuthor

   More actions

   SSH-over-iroh landed on PR #842 (SshTunnelProtocol + id world ssh-tunnel, verified with unmodified OpenSSH). Remaining open here: the iroh-over-SSH fallback when UDP is denied — needs a non-QUIC iroh transport or SSH-carried datagram channel, which does not exist yet. F13.2's exec transport covers joins in that network meanwhile.
6. dezren39

   added

   kind/featureNew feature or capability requestNew feature or capability request

   status/needs-triageNot yet triaged; needs a first lookNot yet triaged; needs a first look

   priority/lowNice to have; do when convenientNice to have; do when convenient

   effort/lLarge: multi-day or open-ended; expect staged check-insLarge: multi-day or open-ended; expect staged check-ins

   app/idPackage/app: id (pkgs/ or apps/ in this repo)Package/app: id (pkgs/ or apps/ in this repo)

   meta/enrichedIntake review done: acceptance criteria, links, and normalized labels addedIntake review done: acceptance criteria, links, and normalized labels added

   source/humanFiled directly by a humanFiled directly by a human

   on Oct 26, 2026
7. dezren39 commented on Oct 26, 2026

   

   dezren39

   on Oct 26, 2026

   MemberAuthor

   More actions

   Intake review

   Fleet monitor intake pass (protocol §5).

   Related: Phase 13 sibling set — #785 (F13.3), #786 (F13.4), #787 (F13.5), #788 (F13.6), #789 (F13.7), #790 (F13.8); this issue is F13.3 SSH-over-iroh reachability (and iroh-over-SSH fallback). It is a forward roadmap/spec item, not a reported fixed bug; nothing in the issue or its comments indicates it has been implemented.

   Notes / risks: acceptance criteria were already present in the body; none appended. Phase-13 items are large, interdependent platform work (effort/l, priority/low as roadmap items): the set should be sequenced deliberately rather than picked up piecemeal by a worker, and earlier-phase dependencies should be confirmed before implementation starts.

   Suggested approach: keep in the Phase 13 backlog until its phase dependencies land; when scheduled, split into a design pass plus implementation slices rather than a single change.

   Labels normalized by the monitor.
8. dezren39

   added

   work/assignedQueue worker lifecycle stateQueue worker lifecycle state

   queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

   on Oct 28, 2026
9. 17 remaining items

   Load more
10. dezren39

    added

    queue/blockedQueue or user escalation stateQueue or user escalation state

    status/blockedQueue or user escalation stateQueue or user escalation state

    and removed

    queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

    work/assignedQueue worker lifecycle stateQueue worker lifecycle state

    on Nov 1, 2026
11. dezren39 commented on Nov 1, 2026

    

    dezren39

    on Nov 1, 2026

    MemberAuthor

    More actions

    Triage verdict — PARTIALLY SATISFIED; fallback remains blocked on transport design

    Freshly checked against current origin/main (9be9c2298c51368f8eacaacd2f50bfe2b627ba99) and GitHub on 2026-11-01:

    • Acceptance 1 is met: merged PR id: Phase 13 first slice — shell contract (F13.1), SSH transports (F13.2/F13.3), F13.7 design #842 includes the host-side SshTunnelProtocol (pkgs/id/src/world_ssh.rs:83+), the id world ssh-tunnel client (pkgs/id/src/commands/world.rs:926+), and the ssh_reaches_the_world_through_the_iroh_tunnel test (world_ssh.rs:2728+). id: Phase 13 first slice — shell contract (F13.1), SSH transports (F13.2/F13.3), F13.7 design #842 also records verification with unmodified OpenSSH.
    • Acceptance 3 is met: the tunnel carries SSH bytes and the host still performs normal SSH authentication; the implementation comment says iroh peer identity grants no SSH access by itself.
    • Acceptance 2 is not met: current code and repo-wide search show no iroh-over-SSH fallback for UDP-denied networks. The existing path is SSH-over-iroh, the opposite direction.

    The latest note on transport tracker #536 describes D1-051 as superseded by Phase 13, but that accounts for the SSH-over-iroh path only; it does not satisfy this issue's explicit UDP-denied fallback criterion. The remaining scope is L and needs a transport design decision (implement a non-QUIC/SSH-carried transport, or revise the requirement based on the existing F13.2 SSH-exec route). I did not enqueue it as a small_fix: that would misclassify the unresolved transport design. #785 stays OPEN with queue/blocked + status/blocked until the fallback requirement is settled; no Drew-specific decision is being escalated.

    🤖 Agent note · blocked

    • Agent: queue worker (repo-worker-code), OpenChamber scheduled lane
    • Session / ID: queue task 5561 (triage)
    • Found via: queue claim
    • Task: Re-triage id: Phase 13 F13.3 SSH-over-iroh reachability (and iroh-over-SSH fallback) #785; distinguish the landed SSH-over-iroh slice from the still-required iroh-over-SSH fallback.
    • Blocker: transport design/scope reconciliation for the UDP-denied fallback; linked tracker id(transport): transport designs #536 (D1-051).
    • Links: merged PR id: Phase 13 first slice — shell contract (F13.1), SSH transports (F13.2/F13.3), F13.7 design #842 · id(transport): transport designs #536 · id: Phase 13 F13.3 SSH-over-iroh reachability (and iroh-over-SSH fallback) #785
12. dezren39 commented on Nov 1, 2026

    

    dezren39

    on Nov 1, 2026

    MemberAuthor

    More actions

    🤖 Agent note · done

    • Agent: queue worker (repo-worker-code), OpenChamber scheduled lane
    • Session / ID: queue task 5561
    • Found via: queue claim
    • Task: Triage id: Phase 13 F13.3 SSH-over-iroh reachability (and iroh-over-SSH fallback) #785 against current main; confirmed the SSH-over-iroh slice landed in id: Phase 13 first slice — shell contract (F13.1), SSH transports (F13.2/F13.3), F13.7 design #842 and the UDP-denied fallback remains blocked pending transport design on id(transport): transport designs #536.
    • Expectation: evidence-based verdict and truthful issue state; verdict posted and issue marked blocked; no implementation follow-up was enqueued because the remaining design is L-sized and unresolved.
    • Links: id: Phase 13 F13.3 SSH-over-iroh reachability (and iroh-over-SSH fallback) #785 triage verdict · PR id: Phase 13 first slice — shell contract (F13.1), SSH transports (F13.2/F13.3), F13.7 design #842 · id(transport): transport designs #536
13. dezren39

    added a commit that references this issue on Nov 1, 2026

    docs(id): design UDP-denied SSH fallback for #785

    8cd099d
14. developing-today

    added

    status:in-review

    on Nov 1, 2026
15. dezren39 commented on Nov 1, 2026

    

    dezren39

    on Nov 1, 2026

    MemberAuthor

    More actions

    Design summary

    • PR id: Phase 13 first slice — shell contract (F13.1), SSH transports (F13.2/F13.3), F13.7 design #842 already delivers SSH-over-Iroh and preserves normal SSH authentication; only the UDP-denied fallback remains open.
    • Recommendation: make this a session-level fallback to F13.2's SSH exec frame transport, not Iroh/QUIC carried over SSH.
    • Opt-in fallback requires both an Iroh destination and a separately trusted SSH destination; existing explicit --via modes stay unchanged.
    • Fall back only on Iroh reachability failures; peer identity, SSH host key/authentication, world authorization, and protocol failures remain terminal.
    • Acceptance adds a UDP-denied/SSH-available test and frame parity/security regressions; the listener stays opt-in.
    • Plan: (1) route contract/policy, (2) Iroh-first SSH-exec fallback, (3) UDP-denied and trust tests, (4) reconcile docs/acceptance.
    • Design note: doc/2026-11-01_design_id785.md.
    • PR: design(id): #785 UDP-denied SSH fallback #3798

    Question for Drew

    @dezren39 — Should criterion 2 require A) literal Iroh-over-SSH via a new non-QUIC transport/SSH-carried datagram channel, B) session-level failover to the existing SSH exec frame transport (recommended, reuses F13.2 and meets the port-22 world-join outcome), or C) explicit id world join --via ssh only and remove automatic fallback? I recommend B and updating the criterion's wording so it names the transport actually used. The design records the implementation plan either way and does not close #785.
16. dezren39

    added a commit that references this issue on Nov 1, 2026

    Merge pull request #3798 from developing-today/design/id-785

    ...

    6a5c589
17. developing-today

    added

    status:done

    and removed

    status:in-review

    on Nov 1, 2026
18. developing-today

    closed this as completedon Nov 1, 2026
19. dezren39 commented on Nov 1, 2026

    

    dezren39

    on Nov 1, 2026

    MemberAuthor

    More actions

    🤖 Agent note · done

    • Agent: queue worker (repo-worker-code), lane D shift
    • Session / ID: task 5759
    • Found via: queue claim
    • Task: Triage of issue id: Phase 13 F13.3 SSH-over-iroh reachability (and iroh-over-SSH fallback) #785 reconciled as already done: this packet was created at 16:34Z, before the design landed — the design record was posted on this issue at 16:45Z and PR design(id): #785 UDP-denied SSH fallback #3798 merged at 16:48Z, closing the issue. No parallel record from this lane. The A/B/C question for Drew in the 16:45Z design summary (recommendation: B, session-level failover to the F13.2 SSH exec frame transport) remains open for Drew's ruling and is surfaced in this shift's report.
20. dezren39

    removed

    status/blockedQueue or user escalation stateQueue or user escalation state

    on Nov 1, 2026