fix(install): pre-flight SSH github.com marketplace plugins over SSH - #3200

APM Review Panel: ship_now

SSH marketplace install fidelity: identical production diff on main-integrated head, CI-repair spec annotation with 8 mutation traps, four specialist personas across two delta waves return zero findings.

panel-mode=delta; personas=test-coverage-expert,apm-ceo

cc Mohammed Alkindi (@MohammedAlkindi) Sergio Sisternes (@sergio-sisternes-epam) -- a fresh advisory pass is ready for your review.

Mechanical integration: The existing ship_now assessment carries to d3d0679ae95ebbf3262f9f7c3d67ca588c470d50 after faithful integration of main ee08bb59b9a7bce67fb4010e4af8652c4c53a7de. No new panel was run. The reviewed source/test/owner patch is unchanged, every reviewed regression-test file is byte-identical, and no semantic conflict resolution was needed. Current exact-head validation is recorded below; the original panel synthesis follows for provenance.

This fourth delta synthesis covers the narrow CI-repair scope after main integration. The production diff between the prior reviewed head (42fc40a on 9fb5ce8) and the previously published candidate (facd594 on 2a8213a) is byte-identical (SHA-256 059cb6ce...b79b), confirmed by production-review-equivalence.json. All prior auth, performance, supply-chain-security, and test-coverage findings from the three preceding panels remain valid without rerun because the production delta has not changed. The only new work since the prior ship_now synthesis is the spec-conformance CI repair: SpecConformance ModeB flagged source critical-path additions lacking req-linked evidence. Rather than waive or weaken the gate, four new test cases were added to tests/spec_conformance/test_lockfile_reqs.py, annotating the already-reviewed real-Git SSH bare-cache fixture under req-lk-003 -- proving repository identity and exact resolved commit are persisted in the lockfile. No new production code, no gate bypass. CONFORMANCE.json and CONFORMANCE.md were regenerated. The latest delta roster (test-coverage-expert) returned zero findings and confirmed the annotation is genuine, not a stub.

The hermetic integration fixture exercises real Git transport through native git upload-pack served via an SSH command seam against a local bare repository. This is not a live private-GitHub smoke test. It is a sound, reproducible boundary for the transport-fidelity and credential-isolation promises this PR makes. Live-endpoint coverage remains a future hardening opportunity, not a gap in this change.

At the original panel, verification of then-published head facd594 was: 402 tests passed in 158.41s, full conformance suite 313 pass 2 skip in 94.76s, all canonical lint and architecture boundary gates pass, eight mutation traps across bare-cache ref verification, scrub ordering, SSH preflight, and explicit-caller paths prove the guards are load-bearing. At panel time, six standard workflows were executing. The final observation below supplies their actual results independently of this code-quality and security assessment.

Aligned with: Credentials scrubbed from bare-cache remote before ref verification; safe.bareRepository=explicit honored; missing refs fail closed with no silent default-HEAD fallback. SSH-registered marketplace installs preserve the registered transport end-to-end with no silent HTTPS fallback. Named-ref resolution routed through Git, not the GitHub HTTPS commits API. SpecConformance ModeB gap addressed by genuine req-linked annotation under req-lk-003 -- proving repository identity and exact resolved commit persisted in lockfile -- over existing integration fixture, not by gate weakening or waiver. CONFORMANCE artifacts regenerated at the exact candidate head. SSH-key-only private marketplace installs work without an HTTPS token, matching the ergonomic expectation that a registered SSH transport should just work.

Panel summary

B = blocking-severity findings, R = recommended, N = nits.
Counts are signal strength, not gates. The maintainer ships.

Recommendation

Current exact-head validation: 402 passed in 53.99s; conformance: 315 passed, 2 skipped in 92.39s; all seven current lint checks and the architecture boundary check passed. Canonical-owner evidence was re-derived and semantically verified for this exact head and integrated base. The eight prior mutation executions are retained with unchanged regression files; no new mutation run is claimed.

Four distinct specialist personas across two delta waves (auth, test-coverage, performance, supply-chain-security in the prior wave; test-coverage in the CI-repair wave) -- five returns total -- yield zero aggregate findings. The production diff is byte-identical to the prior ship_now assessment. Spec-conformance CI repair adds genuine req-lk-003 evidence without gate weakening. The code is ready to ship; all six technical workflows have now succeeded at this exact head. No follow-ups to track.

Final observation: Published/reviewed head d3d0679ae95ebbf3262f9f7c3d67ca588c470d50 has all six technical workflows passing. The earlier head's transient Windows runner-profile cleanup failure passed on its one targeted rerun; the replacement head's CI was observed independently. No production code or check policy was changed during mechanical integration. All four original review threads are resolved. Existing requested reviewers remain unchanged.

GitHub currently reports MERGEABLE, while a fresh local merge preview against main ee08bb59b9a7bce67fb4010e4af8652c4c53a7de is clean with no overlap in this PR's changed source paths. The locally tested incorporated base remains ee08bb59b9a7bce67fb4010e4af8652c4c53a7de; the later main preview is not a claim of full retesting on a later base. Landing remains the maintainer's decision. No merge was performed.

_{This panel is advisory. It does not block merge. Re-apply the
panel-review label after addressing feedback to re-run.}

Generated by autopilot-pr-merge-worker. This comment is AI-generated and may contain errors.