**Default content.** `pyproject.toml` declares `tunnel-manager-mcp` as the single `scion_sdk.connector` entry point. The server lists the packaged `skill://` and `ontology://` resources and the packaged prompts with no `content=` argument. Proving test: `tests/test_default_content_surfaces.py`. | `resources/list` includes `skill://` and `ontology://`; `prompts/list` includes each packaged prompt.

**One canonical host inventory path across surfaces.** tunnel-manager resolves the shared host inventory from exactly one path, `$XDG_CONFIG_HOME/scion-sdk/inventory.yml` (using the XDG platform default when unset), with no working-directory, packaged-resource, legacy `.yaml`, or per-service fallback, and every CLI, library, MCP, and container surface reads that same file. | A fixture with only the canonical file present confirms every automatic reader resolves it, while a container-mount test confirms the deployed container reads the identical file read-only.

**Fleet name.** `pyproject.toml` declares `tunnel-manager-mcp` as the single `scion_sdk.connector` entry point. The content pack, the manifest `connector`, the fingerprints and the ingest binding all carry `tunnel-manager-mcp`. Proving test: `tests/test_fleet_name.py::test_connector_name_is_the_fleet_name`. | Every connector name in the package is `tunnel-manager-mcp`.

**SSH runs without a local username.** Every SSH connection uses the inventory entry's `user` explicitly and never depends on the local process username, so a container uid with no passwd entry and no `USER`/`LOGNAME` still connects. Tool failures are logged with their cause. The published image creates the runtime uid as a real user with a home directory. Proving test: `tests/test_no_local_username.py`. | With `getpass.getuser` raising `OSError`, a `Tunnel` built from an inventory entry resolves its username, and a failing tool call logs the underlying exception.

**Secret references resolve through the SDK.** tunnel-manager must resolve each env:// and openbao:// SSH credential reference through the SDK credential resolver. It must not parse reference schemes itself This row follows `SCION-CENTRALIZED-CAPABILITIES-R009`. | A unit test resolves env:// and openbao:// references and rejects malformed ones

**SDK floor and dependency set.** The package must require scion-sdk 0.3.11 or later. It must not pin requests This row follows `SCION-CENTRALIZED-CAPABILITIES-R040`. | pyproject.toml shows the floor and no requests pin

**Production wiring.** `resolve_secret_ref` in `tunnel_manager/connection_security.py` calls `resolve_secret_reference`. The MCP tools in `tunnel_manager/mcp_server.py` call it for every `password_ref` | A test enters at the production entry point and reaches the wired call site.

**Hot-path proof.** A test calls `resolve_secret_ref` with an env:// reference set in the environment. The test reaches the SDK resolver and returns the value | The named integration test passes.

**One wiring for every transport.** stdio, streamable HTTP with an explicit `--auth-type none`, and streamable HTTP with a JWT serve the same tools through scion-sdk's one actor and entitlement path. Nothing in tunnel-manager branches on transport. stdio and no-auth HTTP callers are the trusted local principal, and every alias is reachable. A JWT caller reaches the aliases its IdP roles, groups or `CONNECTOR_PRINCIPAL_GRANTS` entitle (`arbora=ssh:*` entitles the arbora service principal). A JWT request without a token gets HTTP 401. A refusal names its cause and never a secret. A known alias the caller is not entitled to gets `403 Refused: not entitled to ssh:<alias>` from both `tm_remote_*` and `tm_inventory_*`. `tunnel_manager_get_host` returns a typed `-32000` error. This row follows `SCION-CONNECTOR-CONTROL-R025` and `R025.3`. | `tests/test_served_actor_binding.py`; `tests/test_transport_parity_integration.py::test_jwt_refusals_name_their_cause`.

**One connection resolver.** `mcp_server.resolve_target` is the only place a host name becomes connection settings. `tm_remote`, `tm_inventory` on one host, `tm_system`, `tm_files` (both hosts of `diff_compare`) and `tm_security` use it. For each field the first set value wins: the caller's explicit argument, then the inventory alias (host vars, then group vars), then the `TUNNEL_*` settings, then the built-in default (port 22, `~/.ssh/config`). Tool parameters default to unset, so a parameter default never overrides the inventory. A name that is no alias, sent without an explicit user, is refused with `400 Unknown host alias: <name>`, the same from every tool. | `tests/test_transport_parity_integration.py` asserts that the listed port is the inventory group's port, not 22, and that both tools refuse an unknown alias identically.

**Every tool behaves the same on every transport.** Against an in-process SSH host whose user and port live only in group vars, each of the 41 tools gives the same outcome over stdio, no-auth HTTP on 0.0.0.0, and JWT HTTP. `tm_inventory_run_command` and `tm_remote_run_command` on the alias return the command's stdout. | `tests/test_transport_parity_integration.py::test_stdio_serves_every_tool`, `::test_http_without_auth_serves_every_tool_identically` and `::test_http_with_jwt_serves_every_tool_identically`, run in CI.

**Failures name their cause; no host binaries.** Every tool failure reports `Type: message`, sanitized of secrets and local paths, never a bare exception type. Key pairs are generated natively, so no `ssh-keygen` binary is needed. `check_ssh` reports key auth as working once a key-authenticated session succeeds; otherwise it reports it disabled only when `sshd_config` says `PubkeyAuthentication no`. `test_key_auth` keeps the target's port. Every destructive tool (`tm_remote_remove_host_key`, `tunnel_manager_remove_host`, `tm_operations` cancel) takes `confirm=true` when the client has no elicitation, with or without auth, on stdio and HTTP alike; the SDK refuses a client that cannot elicit and did not confirm with a message naming `confirm=true`, never a protocol error. Without either, it is refused as not confirmed, never failed with an error. A read-only inventory save reports `inventory is read-only: <path>`. | `tests/test_transport_parity_integration.py` (per-tool outcomes carry the cause). `tests/test_tm_remote_actions_characterize.py::TestRemoveHostKey::test_explicit_confirm_skips_elicitation`. `tests/test_transport_parity_integration.py::test_stdio_no_auth_destructive_call`, `::test_http_no_auth_localhost_destructive_call` and `::test_http_jwt_destructive_call` (real stdio, no-auth HTTP and JWT HTTP, with and without client elicitation). `tests/test_tunnel_manager.py::TestTunnel::test_check_ssh_server` and `::test_rotate_ssh_key`.

**Windows portability.** The package imports and runs on Windows with no POSIX-only API. Private files are hardened through `secure_descriptor` (`os.fchmod` 0o600 only where `os.fchmod` exists) and `secure_path` (0o600 on POSIX; `S_IREAD \| S_IWRITE` on Windows). The POSIX uid comes from `current_uid`, which is `None` where `os.getuid` is absent. Key pairs are generated natively and never by an `ssh-keygen` binary. On Windows, an SSH identity or known-hosts file that grants Everyone, Authenticated Users or BUILTIN\\Users access (write access, for known-hosts) is refused from its access-control list, since mode bits carry no group or other permission there. Proxy executables are trusted only in the Windows system and OpenSSH directories, compared case-insensitively. The Windows CI job runs the whole test suite and is a required check. | `tests/test_windows_portability.py`; `tests/test_host_key_security.py::test_known_hosts_rejects_symlinks_and_writable_files`; `tests/test_no_local_username.py::test_run_command_returns_specific_policy_cause`; the `Windows` job in `.github/workflows/windows-ci.yml`.