[LIghtJUNction]

Refs #82 and #85. This narrowly fixes the SSH adapter's OS-entry guard; it does not close the full CLI/TUI/real-client acceptance issue.

Reproduced defect

An ordinary non-root Python process could set its Linux process name to sshd, spawn the adapter, and pass require_sshd_process(): the old fallback accepted any root-owned executable. A root-owned Python interpreter does not prove an OpenSSH-authenticated session. The same bypass affected sshd-session and sshd-auth names.

Fix

Require a root-owned /proc ancestor with all four UID fields equal to root, continue past unprivileged children to the privileged monitor/listener, and remove executable-ownership fallback. Root application callers remain prohibited. Unreadable/inconsistent process metadata fails closed. No shell commands, accepted operations, credential ceiling, certificate or service configuration is expanded.

Verification

tests/test_ssh_process_identity.py uses real unprivileged Linux processes and PR_SET_NAME for all three spoofed names, plus process metadata/root-caller edge cases. Before the fix: 4 failed / 4 passed. After: 12 passed for this file plus tests/test_ssh_rss.py, including real PostgreSQL identity/revocation and real Git reference transactions. Combined with the separate pending TUI changes, 28 tests passed locally under Python 3.13.5 / PostgreSQL 16.15. Complete Python 3.15 CI must pass independently.

The proc-fixture positive test is not a real sshd deployment acceptance. Full AuthorizedKeysCommand/real sshd, tools isolation and other #82 matrices remain tracked there. No production deployment or administrator SSH configuration changes.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[LIghtJUNction]

Additional isolated verification on 2026-09-27 UTC: ran an actual OpenSSH 9.6p1 listener on a temporary loopback port with temporary Ed25519 host/client keys and a restricted authorized_keys forced command invoking the changed require_sshd_process() plus parse_command().

Five checks passed: authorized msg call discovery.get {} reached the OS-authenticated entry; shell command sh was rejected; msgd cert issue x was rejected; a different client key was denied authentication; ssh -W forwarding was administratively prohibited. The listener was terminated and temporary key files removed. No production service or global sshd configuration was modified.

This verifies the real OpenSSH process ancestry boundary, not the full application's AuthorizedKeysCommand/database/certificate/clone/push acceptance matrix. The repository's Python 3.15 CI is still a separate merge gate; #82 remains open.