AGENTS.md: record SSH mini-m4 -> oldbox now working

Supersedes the long-standing 'SSH denied, needs manual provisioning' note, which
was wrong in its diagnosis. Recorded: root cause was authorization (our ed25519
public key missing from umbra's authorized_keys on oldbox), not networking,
TCC, or host keys; the local key + fingerprint; all three pinned host-key
fingerprints verified matching; the Host oldbox config block and its backup; the
remote-broker profile now returning exit 0 (and the oldbox-umbra vs
oldbox-umbra-ssh naming trap); the read-only fingerprint-verification recipe and
the rule not to pin a handed-over fingerprint unchecked; and oldbox's specs
including the NVML permission gap that blocks nvidia-smi for umbra.

AGENTS.md

@@ -88,6 +88,46 @@
   after connect. Test plists/probes (`com.umba.netcheck`, `netpost`, `rootnetcheck`) were bootstrapped
   into launchd and cleaned up; after any of these env changes, restart web via
   `launchctl kickstart -k "gui/$(id -u)/com.umbraaudio.web"`.
+- **SSH from this machine to oldbox WORKS (2026-10-05) — this supersedes the old "denied, needs
+  manual provisioning" note.** Key-based auth as `umbra`; use the `oldbox` alias, no flags.
+  - **Root cause of the original failure was never the network or host keys — it was
+    authorization.** Diagnosis that settled it: `ssh -v -o BatchMode=yes` showed
+    `Offering public key: …id_ed25519` → `Permission denied`, while also showing
+    `Host … is known and matches the ED25519 host key`. So the host key was always fine and the
+    key simply was not in `umbra`'s `authorized_keys`. Fix was one command **run on oldbox**:
+    ```bash
+    mkdir -p ~/.ssh && chmod 700 ~/.ssh
+    echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIqSyRVyS65iI+IJht2HIYVrf72WCBj3P572nfYc5nvU umbra_gpu_deploy' >> ~/.ssh/authorized_keys
+    chmod 600 ~/.ssh/authorized_keys
+    ```
+  - **This machine's key**: `~/.ssh/id_ed25519`, comment `umbra_gpu_deploy`, **no passphrase**,
+    fingerprint `SHA256:qrq0WqszS/MNHkYsCTaZH/PQv+bx+Ox7PwyfyOpa2WM`. Loaded into the agent with
+    `ssh-add --apple-use-keychain` so it survives reboots (the agent previously held **no
+    identities**, which silently breaks every non-interactive/automated SSH path).
+  - **Host keys pinned and matching** (checked 2026-10-05, no drift): ED25519
+    `SHA256:YrZxtGNm0cN7q82k3mL5NBPeSIAjIoiLcSjKgpW90EQ`, ECDSA
+    `SHA256:fdTVV77wv/eFEjYUK2PKcwseZC015IXuW5TcELvuSGA`, RSA
+    `SHA256:fa60nisrlObOOEOi4Keo8m7b4t/TVDYsww6HlRfm/8Q`. `oldbox.bdmurphy.me` resolves to
+    192.168.123.14 and both forms are in `known_hosts`.
+  - **`~/.ssh/config`** gained a `Host oldbox` block (User umbra, IdentityFile
+    `~/.ssh/id_ed25519`, `IdentitiesOnly yes`, ServerAlive 30/3). Backup alongside it:
+    `config.bak.20261005_203303`.
+  - **The remote-broker `oldbox-umbra` profile works now too** (was `exit_code 255` Permission
+    denied → now `exit_code 0`), so agent-driven remote commands go through it. Note the profile
+    is named **`oldbox-umbra`**, while `oldbox-umbra-ssh` / `oldbox-umbra-sudo` are only
+    *Keychain credential* names — `remote_status({profile:"oldbox-umbra-ssh"})` fails with
+    "Unknown remote profile". Config lives in
+    `~/.config/umbra-trans/remote-broker.json` (it pins `~/.ssh/known_hosts`).
+  - **Do NOT trust a fingerprint you were handed without checking it.** A supplied
+    `SHA256:95qbJicDPOmBN3AORHCNFoFi7wxYX6EYZTLB2SXq4Lk` matched **no** host key here and no
+    local `.pub` file — it was neither oldbox's nor this machine's key. Verify with
+    `ssh-keyscan -T 8 -t ed25519,ecdsa,rsa <host> | ssh-keygen -lf -` (read-only, stores
+    nothing) and compare against `known_hosts` **before** pinning anything.
+  - **oldbox specs** (via ssh): Linux Mint 22.1, 16 cores, **31 GB RAM**, 1.4 TB free on
+    `/home`. **RTX 3060 is present** (`/dev/nvidia0`, PCI `GA106 … GeForce RTX 3060`), but
+    **`nvidia-smi` fails for `umbra`** with "Failed to initialize NVML: Insufficient Permissions" —
+    a *permissions* gap, not a missing GPU. Anything that needs CUDA/NVML from this account
+    (e.g. GPU Qwen TTS) will need the `video`/`render` group membership fixed first.
 - **Relay correction (2026-09-27) — the two claims above were both wrong in practice; verified:**
   1. **The `settimeout(None)` fix was NOT in the deployed file.** `/Library/LaunchDaemons/qwen_relay.py`
      (mtime Sep 10 06:33) had no `settimeout` call, so the 10s-mid-response-kill bug was still live.
@@ -171,6 +211,32 @@ Each pass has quality gates. Quality is the primary concern; generation speed is
 
 ## Current Session Summary
 
+### Session: SSH mini-m4 → oldbox established (was blocked for months)
+- **Outcome**: key-based SSH as `umbra` now works; `ssh oldbox` (alias) and `scp` both verified.
+  The remote-broker `oldbox-umbra` profile went `255 Permission denied` → `exit_code 0`, so
+  agent-driven remote commands work too. Recorded in System & Deployment Notes.
+- **Root cause was authorization, not networking or host keys.** What settled it was
+  `ssh -v -o BatchMode=yes`: it showed `Offering public key: …id_ed25519` immediately followed by
+  `Permission denied`, while simultaneously proving `Host … is known and matches the ED25519 host
+  key`. The host key had been correct the whole time; the key simply was not in `umbra`'s
+  `authorized_keys`. One command run on oldbox fixed it. **Lesson for next time: run the verbose
+  handshake before theorising about network/TCC/relay causes — it names the failing stage.**
+- **Key facts recorded in AGENTS.md**: local key `umbra_gpu_deploy` (no passphrase,
+  `SHA256:qrq0WqszS/MNHkYsCTaZH/PQv+bx+Ox7PwyfyOpa2WM`) added to the agent with
+  `--apple-use-keychain` (the agent had held *no identities*, which breaks all non-interactive SSH);
+  all three host-key fingerprints pinned and matching; `~/.ssh/config` `Host oldbox` block added
+  with backup `config.bak.20261005_203303`.
+- **Fingerprint hygiene**: the `SHA256:95qbJicD…` the operator supplied matched **nothing** — not
+  oldbox's host keys, not any local `.pub`. Documented the read-only verification recipe
+  (`ssh-keyscan … | ssh-keygen -lf -` vs `known_hosts`) and the rule to check before pinning.
+- **Broker naming trap recorded**: `remote_status({profile:"oldbox-umbra-ssh"})` fails "Unknown
+  remote profile" — `oldbox-umbra-ssh`/`-sudo` are *Keychain credential* names; the SSH profile is
+  `oldbox-umbra` (config `~/.config/umbra-trans/remote-broker.json`, pins `known_hosts`).
+- **oldbox**: Linux Mint 22.1, 16 cores, 31 GB RAM, 1.4 TB free. RTX 3060 **is** present
+  (`/dev/nvidia0`, PCI GA106) but **`nvidia-smi` fails for `umbra`** — "Failed to initialize NVML:
+  Insufficient Permissions". That is a group-membership gap, not a missing GPU; GPU CUDA work
+  (Qwen TTS) needs it fixed first. **Not yet fixed.**
+
 ### Session: Release comments as a release step + implicit voice approval (spec 22 §1.1)
 - **Two corrections from the operator, both of which I had wrong:**
   1. *"I didn't explicitly approve all minor character voices. By releasing the audiobook I
@@ -780,8 +846,11 @@ almost always, and asked whether a GPU box's Qwen3-TTS (192.168.123.14:1234) cou
   torch + `qwen_tts` pip package + the HF Qwen3-TTS-12Hz-1.7B-VoiceDesign model — local copies already
   exist under `models/`; if using LM Studio instead, a TTS-capable LM Studio version + full model set
   would still need a client rewrite, so it's NOT worth it). Then point the Mac at it via
-  `TTSConfig.qwen_tts_url` (env `UMBRA_TTS__QWEN_TTS_URL=http://192.168.123.14:8881`). SSH from this
-  Mac to the box is denied (key+password) — needs user-provided access or manual provisioning.
+  `TTSConfig.qwen_tts_url` (env `UMBRA_TTS__QWEN_TTS_URL=http://192.168.123.14:8881`). ~~SSH from this
+  Mac to the box is denied (key+password) — needs user-provided access or manual provisioning.~~
+  **SUPERSEDED 2026-10-05: SSH now works** (key-based as `umbra`, `ssh oldbox`) — see System &
+  Deployment Notes. It was never a network/key problem; the public key was just missing from
+  `authorized_keys`.
 - Xylia (Last Dwarf): regenerated lower — median F0 **141.6 → 111.9 Hz** via a pinned
   `voice_description` in `speakers.json` ("lowest baritone register possible, much deeper than any
   man… light Irish accent"). Pin overrides auto-built description verbatim (`voice_profile_manager.py`