{
  "version": 1,
  "repository": "Knuckles-Team/tunnel-manager",
  "revision": "ecc589035a875098f163a348581f28556dd8f3ba",
  "captured_at": "2026-11-01T09:42:03.969960+00:00",
  "records": [
    {
      "id": "CONN-TUNNEL-MANAGER-CONNECTOR-CONTENT",
      "kind": "spec",
      "parent": null,
      "source": "specs/connector-content/status.json",
      "title": "CONN-TUNNEL-MANAGER-CONNECTOR-CONTENT \u2014 The connector serves its packaged content",
      "delivery_state": "LANDED",
      "state": "landed",
      "done": false,
      "landed_in": [],
      "verified_by": [],
      "document": "specs/connector-content/spec.md",
      "component": "Unassigned",
      "code_refs": [
        {
          "declared_in": "specs/connector-content/plan.md",
          "evidence": "file exists; coverage not verified",
          "label": "spec.md",
          "repository": "Knuckles-Team/tunnel-manager",
          "role": "documentation",
          "url": "https://github.com/Knuckles-Team/tunnel-manager/blob/ecc589035a875098f163a348581f28556dd8f3ba/specs/connector-content/spec.md"
        },
        {
          "declared_in": "specs/connector-content/spec.md",
          "evidence": "file exists; coverage not verified",
          "label": "requirements.md",
          "repository": "Knuckles-Team/tunnel-manager",
          "role": "documentation",
          "url": "https://github.com/Knuckles-Team/tunnel-manager/blob/ecc589035a875098f163a348581f28556dd8f3ba/specs/connector-content/requirements.md"
        }
      ],
      "relations": [],
      "plan_diagrams": [],
      "unparsed_references": []
    },
    {
      "id": "CONN-TUNNEL-MANAGER-CONNECTOR-CONTENT-R001",
      "kind": "requirement",
      "parent": "CONN-TUNNEL-MANAGER-CONNECTOR-CONTENT",
      "source": "specs/connector-content/status.json",
      "title": "Default content",
      "delivery_state": "LANDED",
      "state": "landed",
      "done": false,
      "landed_in": [
        "3349a4f3eb56"
      ],
      "verified_by": [],
      "parent_title": "CONN-TUNNEL-MANAGER-CONNECTOR-CONTENT \u2014 The connector serves its packaged content",
      "definition": "**Default content.** `pyproject.toml` declares `tunnel-manager-mcp` as the single `scion_sdk.connector` entry point. The server lists the packaged `skill://` and `ontology://` resources and the packaged prompts with no `content=` argument. Proving test: `tests/test_default_content_surfaces.py`. | `resources/list` includes `skill://` and `ontology://`; `prompts/list` includes each packaged prompt.",
      "definition_source": "specs/connector-content/requirements.md",
      "definition_line": 9
    },
    {
      "id": "TM-INVENTORY",
      "kind": "spec",
      "parent": null,
      "source": "specs/inventory-authority/status.json",
      "title": "TM-INVENTORY \u2014 One operator inventory authority",
      "delivery_state": "SPECIFIED",
      "state": "specified",
      "done": false,
      "landed_in": [],
      "verified_by": [],
      "document": "specs/inventory-authority/spec.md",
      "component": "Unassigned",
      "code_refs": [
        {
          "declared_in": "specs/inventory-authority/spec.md",
          "evidence": "file exists; coverage not verified",
          "label": "`requirements.md`",
          "repository": "Knuckles-Team/tunnel-manager",
          "role": "documentation",
          "url": "https://github.com/Knuckles-Team/tunnel-manager/blob/ecc589035a875098f163a348581f28556dd8f3ba/specs/inventory-authority/requirements.md"
        },
        {
          "declared_in": "specs/inventory-authority/spec.md",
          "evidence": "file exists; coverage not verified",
          "label": "`status.json`",
          "repository": "Knuckles-Team/tunnel-manager",
          "role": "implementation",
          "url": "https://github.com/Knuckles-Team/tunnel-manager/blob/ecc589035a875098f163a348581f28556dd8f3ba/specs/inventory-authority/status.json"
        },
        {
          "declared_in": "specs/inventory-authority/spec.md",
          "evidence": "file exists; coverage not verified",
          "label": "contracts/inventory-volume.md",
          "repository": "Knuckles-Team/tunnel-manager",
          "role": "documentation",
          "url": "https://github.com/Knuckles-Team/tunnel-manager/blob/ecc589035a875098f163a348581f28556dd8f3ba/specs/inventory-authority/contracts/inventory-volume.md"
        },
        {
          "declared_in": "specs/inventory-authority/spec.md",
          "evidence": "file exists; coverage not verified",
          "label": "plan.md",
          "repository": "Knuckles-Team/tunnel-manager",
          "role": "documentation",
          "url": "https://github.com/Knuckles-Team/tunnel-manager/blob/ecc589035a875098f163a348581f28556dd8f3ba/specs/inventory-authority/plan.md"
        },
        {
          "declared_in": "specs/inventory-authority/spec.md",
          "evidence": "file exists; coverage not verified",
          "label": "tasks.md",
          "repository": "Knuckles-Team/tunnel-manager",
          "role": "documentation",
          "url": "https://github.com/Knuckles-Team/tunnel-manager/blob/ecc589035a875098f163a348581f28556dd8f3ba/specs/inventory-authority/tasks.md"
        },
        {
          "declared_in": "specs/inventory-authority/spec.md",
          "evidence": "file exists; coverage not verified",
          "label": "test-spec.md",
          "repository": "Knuckles-Team/tunnel-manager",
          "role": "documentation",
          "url": "https://github.com/Knuckles-Team/tunnel-manager/blob/ecc589035a875098f163a348581f28556dd8f3ba/specs/inventory-authority/test-spec.md"
        },
        {
          "declared_in": "specs/inventory-authority/spec.md",
          "evidence": "file exists; coverage not verified",
          "label": "tunnel_manager/mcp_server.py",
          "repository": "Knuckles-Team/tunnel-manager",
          "role": "implementation",
          "url": "https://github.com/Knuckles-Team/tunnel-manager/blob/ecc589035a875098f163a348581f28556dd8f3ba/tunnel_manager/mcp_server.py"
        }
      ],
      "relations": [],
      "plan_diagrams": [],
      "unparsed_references": []
    },
    {
      "id": "TM-INVENTORY-R001",
      "kind": "requirement",
      "parent": "TM-INVENTORY",
      "source": "specs/inventory-authority/status.json",
      "title": "One canonical host inventory path across surfaces",
      "delivery_state": "SPECIFIED",
      "state": "specified",
      "done": false,
      "landed_in": [],
      "verified_by": [],
      "parent_title": "TM-INVENTORY \u2014 One operator inventory authority",
      "definition": "**One canonical host inventory path across surfaces.** tunnel-manager resolves the shared host inventory from exactly one path, `$XDG_CONFIG_HOME/scion-sdk/inventory.yml` (using the XDG platform default when unset), with no working-directory, packaged-resource, legacy `.yaml`, or per-service fallback, and every CLI, library, MCP, and container surface reads that same file. | A fixture with only the canonical file present confirms every automatic reader resolves it, while a container-mount test confirms the deployed container reads the identical file read-only.",
      "definition_source": "specs/inventory-authority/requirements.md",
      "definition_line": 10
    },
    {
      "id": "TM-INVENTORY-R002",
      "kind": "requirement",
      "parent": "TM-INVENTORY",
      "source": "specs/inventory-authority/status.json",
      "title": "Fleet name",
      "delivery_state": "VERIFIED",
      "state": "verified",
      "done": true,
      "landed_in": [
        "d3a8ecec3840"
      ],
      "verified_by": [
        "tests/test_fleet_name.py:34"
      ],
      "parent_title": "TM-INVENTORY \u2014 One operator inventory authority",
      "definition": "**Fleet name.** `pyproject.toml` declares `tunnel-manager-mcp` as the single `scion_sdk.connector` entry point. The content pack, the manifest `connector`, the fingerprints and the ingest binding all carry `tunnel-manager-mcp`. Proving test: `tests/test_fleet_name.py::test_connector_name_is_the_fleet_name`. | Every connector name in the package is `tunnel-manager-mcp`.",
      "definition_source": "specs/inventory-authority/requirements.md",
      "definition_line": 11
    },
    {
      "id": "TM-INVENTORY-R003",
      "kind": "requirement",
      "parent": "TM-INVENTORY",
      "source": "specs/inventory-authority/status.json",
      "title": "SSH runs without a local username",
      "delivery_state": "SPECIFIED",
      "state": "specified",
      "done": false,
      "landed_in": [],
      "verified_by": [],
      "parent_title": "TM-INVENTORY \u2014 One operator inventory authority",
      "definition": "**SSH runs without a local username.** Every SSH connection uses the inventory entry's `user` explicitly and never depends on the local process username, so a container uid with no passwd entry and no `USER`/`LOGNAME` still connects. Tool failures are logged with their cause. The published image creates the runtime uid as a real user with a home directory. Proving test: `tests/test_no_local_username.py`. | With `getpass.getuser` raising `OSError`, a `Tunnel` built from an inventory entry resolves its username, and a failing tool call logs the underlying exception.",
      "definition_source": "specs/inventory-authority/requirements.md",
      "definition_line": 12
    },
    {
      "id": "CONN-TUNNEL-MANAGER-SDK",
      "kind": "spec",
      "parent": null,
      "source": "specs/sdk/status.json",
      "title": "CONN-TUNNEL-MANAGER-SDK \u2014 Shared SDK capabilities in tunnel-manager",
      "delivery_state": "LANDED",
      "state": "landed",
      "done": false,
      "landed_in": [],
      "verified_by": [],
      "document": "specs/sdk/spec.md",
      "component": "Unassigned",
      "code_refs": [
        {
          "declared_in": "specs/sdk/plan.md",
          "evidence": "file exists; coverage not verified",
          "label": "tunnel_manager/connection_security.py",
          "repository": "Knuckles-Team/tunnel-manager",
          "role": "implementation",
          "url": "https://github.com/Knuckles-Team/tunnel-manager/blob/ecc589035a875098f163a348581f28556dd8f3ba/tunnel_manager/connection_security.py"
        },
        {
          "declared_in": "specs/sdk/plan.md",
          "evidence": "file exists; coverage not verified",
          "label": "tunnel_manager/mcp_server.py",
          "repository": "Knuckles-Team/tunnel-manager",
          "role": "implementation",
          "url": "https://github.com/Knuckles-Team/tunnel-manager/blob/ecc589035a875098f163a348581f28556dd8f3ba/tunnel_manager/mcp_server.py"
        },
        {
          "declared_in": "specs/sdk/spec.md",
          "evidence": "file exists; coverage not verified",
          "label": "`requirements.md`",
          "repository": "Knuckles-Team/tunnel-manager",
          "role": "documentation",
          "url": "https://github.com/Knuckles-Team/tunnel-manager/blob/ecc589035a875098f163a348581f28556dd8f3ba/specs/sdk/requirements.md"
        },
        {
          "declared_in": "specs/sdk/spec.md",
          "evidence": "file exists; coverage not verified",
          "label": "`status.json`",
          "repository": "Knuckles-Team/tunnel-manager",
          "role": "implementation",
          "url": "https://github.com/Knuckles-Team/tunnel-manager/blob/ecc589035a875098f163a348581f28556dd8f3ba/specs/sdk/status.json"
        }
      ],
      "relations": [],
      "plan_diagrams": [],
      "unparsed_references": []
    },
    {
      "id": "CONN-TUNNEL-MANAGER-SDK-R001",
      "kind": "requirement",
      "parent": "CONN-TUNNEL-MANAGER-SDK",
      "source": "specs/sdk/status.json",
      "title": "Secret references resolve through the SDK",
      "delivery_state": "VERIFIED",
      "state": "verified",
      "done": true,
      "landed_in": [
        "d78dc1527bd4"
      ],
      "verified_by": [
        "tests/test_connection_security.py:129"
      ],
      "parent_title": "CONN-TUNNEL-MANAGER-SDK \u2014 Shared SDK capabilities in tunnel-manager",
      "definition": "**Secret references resolve through the SDK.** tunnel-manager must resolve each env:// and openbao:// SSH credential reference through the SDK credential resolver. It must not parse reference schemes itself This row follows `SCION-CENTRALIZED-CAPABILITIES-R009`. | A unit test resolves env:// and openbao:// references and rejects malformed ones",
      "definition_source": "specs/sdk/requirements.md",
      "definition_line": 7
    },
    {
      "id": "CONN-TUNNEL-MANAGER-SDK-R002",
      "kind": "requirement",
      "parent": "CONN-TUNNEL-MANAGER-SDK",
      "source": "specs/sdk/status.json",
      "title": "SDK floor and dependency set",
      "delivery_state": "VERIFIED",
      "state": "verified",
      "done": true,
      "landed_in": [
        "2ad135203ee0",
        "d78dc1527bd4"
      ],
      "verified_by": [
        "tests/test_connection_security.py:144"
      ],
      "parent_title": "CONN-TUNNEL-MANAGER-SDK \u2014 Shared SDK capabilities in tunnel-manager",
      "definition": "**SDK floor and dependency set.** The package must require scion-sdk 0.3.11 or later. It must not pin requests This row follows `SCION-CENTRALIZED-CAPABILITIES-R040`. | pyproject.toml shows the floor and no requests pin",
      "definition_source": "specs/sdk/requirements.md",
      "definition_line": 8
    },
    {
      "id": "CONN-TUNNEL-MANAGER-SDK-R003",
      "kind": "requirement",
      "parent": "CONN-TUNNEL-MANAGER-SDK",
      "source": "specs/sdk/status.json",
      "title": "Production wiring",
      "delivery_state": "VERIFIED",
      "state": "verified",
      "done": true,
      "landed_in": [
        "d78dc1527bd4"
      ],
      "verified_by": [
        "tests/test_connection_security.py:129"
      ],
      "parent_title": "CONN-TUNNEL-MANAGER-SDK \u2014 Shared SDK capabilities in tunnel-manager",
      "definition": "**Production wiring.** `resolve_secret_ref` in `tunnel_manager/connection_security.py` calls `resolve_secret_reference`. The MCP tools in `tunnel_manager/mcp_server.py` call it for every `password_ref` | A test enters at the production entry point and reaches the wired call site.",
      "definition_source": "specs/sdk/requirements.md",
      "definition_line": 9
    },
    {
      "id": "CONN-TUNNEL-MANAGER-SDK-R004",
      "kind": "requirement",
      "parent": "CONN-TUNNEL-MANAGER-SDK",
      "source": "specs/sdk/status.json",
      "title": "Hot-path proof",
      "delivery_state": "VERIFIED",
      "state": "verified",
      "done": true,
      "landed_in": [
        "d78dc1527bd4"
      ],
      "verified_by": [
        "tests/test_connection_security.py:129"
      ],
      "parent_title": "CONN-TUNNEL-MANAGER-SDK \u2014 Shared SDK capabilities in tunnel-manager",
      "definition": "**Hot-path proof.** A test calls `resolve_secret_ref` with an env:// reference set in the environment. The test reaches the SDK resolver and returns the value | The named integration test passes.",
      "definition_source": "specs/sdk/requirements.md",
      "definition_line": 10
    },
    {
      "id": "CONN-TUNNEL-MANAGER-SDK-R005",
      "kind": "requirement",
      "parent": "CONN-TUNNEL-MANAGER-SDK",
      "source": "specs/sdk/status.json",
      "title": "One wiring for every transport",
      "delivery_state": "LANDED",
      "state": "landed",
      "done": false,
      "landed_in": [
        "2d825f294f0a",
        "48f70b0ad8e4",
        "6325763c387a",
        "a91d2bdcce2b",
        "c698cefba2fc"
      ],
      "verified_by": [
        "tests/test_served_actor_binding.py:103",
        "tests/test_served_actor_binding.py:114",
        "tests/test_served_actor_binding.py:138",
        "tests/test_served_actor_binding.py:75",
        "tests/test_served_actor_binding.py:84"
      ],
      "parent_title": "CONN-TUNNEL-MANAGER-SDK \u2014 Shared SDK capabilities in tunnel-manager",
      "definition": "**One wiring for every transport.** stdio, streamable HTTP with an explicit `--auth-type none`, and streamable HTTP with a JWT serve the same tools through scion-sdk's one actor and entitlement path. Nothing in tunnel-manager branches on transport. stdio and no-auth HTTP callers are the trusted local principal, and every alias is reachable. A JWT caller reaches the aliases its IdP roles, groups or `CONNECTOR_PRINCIPAL_GRANTS` entitle (`arbora=ssh:*` entitles the arbora service principal). A JWT request without a token gets HTTP 401. A refusal names its cause and never a secret. A known alias the caller is not entitled to gets `403 Refused: not entitled to ssh:<alias>` from both `tm_remote_*` and `tm_inventory_*`. `tunnel_manager_get_host` returns a typed `-32000` error. This row follows `SCION-CONNECTOR-CONTROL-R025` and `R025.3`. | `tests/test_served_actor_binding.py`; `tests/test_transport_parity_integration.py::test_jwt_refusals_name_their_cause`.",
      "definition_source": "specs/sdk/requirements.md",
      "definition_line": 11
    },
    {
      "id": "CONN-TUNNEL-MANAGER-SDK-R005.1",
      "kind": "requirement",
      "parent": "CONN-TUNNEL-MANAGER-SDK",
      "source": "specs/sdk/status.json",
      "title": "One connection resolver",
      "delivery_state": "LANDED",
      "state": "landed",
      "done": false,
      "landed_in": [
        "2d825f294f0a"
      ],
      "verified_by": [],
      "parent_title": "CONN-TUNNEL-MANAGER-SDK \u2014 Shared SDK capabilities in tunnel-manager",
      "definition": "**One connection resolver.** `mcp_server.resolve_target` is the only place a host name becomes connection settings. `tm_remote`, `tm_inventory` on one host, `tm_system`, `tm_files` (both hosts of `diff_compare`) and `tm_security` use it. For each field the first set value wins: the caller's explicit argument, then the inventory alias (host vars, then group vars), then the `TUNNEL_*` settings, then the built-in default (port 22, `~/.ssh/config`). Tool parameters default to unset, so a parameter default never overrides the inventory. A name that is no alias, sent without an explicit user, is refused with `400 Unknown host alias: <name>`, the same from every tool. | `tests/test_transport_parity_integration.py` asserts that the listed port is the inventory group's port, not 22, and that both tools refuse an unknown alias identically.",
      "definition_source": "specs/sdk/requirements.md",
      "definition_line": 12
    },
    {
      "id": "CONN-TUNNEL-MANAGER-SDK-R005.2",
      "kind": "requirement",
      "parent": "CONN-TUNNEL-MANAGER-SDK",
      "source": "specs/sdk/status.json",
      "title": "Every tool behaves the same on every transport",
      "delivery_state": "LANDED",
      "state": "landed",
      "done": false,
      "landed_in": [
        "2d825f294f0a"
      ],
      "verified_by": [],
      "parent_title": "CONN-TUNNEL-MANAGER-SDK \u2014 Shared SDK capabilities in tunnel-manager",
      "definition": "**Every tool behaves the same on every transport.** Against an in-process SSH host whose user and port live only in group vars, each of the 41 tools gives the same outcome over stdio, no-auth HTTP on 0.0.0.0, and JWT HTTP. `tm_inventory_run_command` and `tm_remote_run_command` on the alias return the command's stdout. | `tests/test_transport_parity_integration.py::test_stdio_serves_every_tool`, `::test_http_without_auth_serves_every_tool_identically` and `::test_http_with_jwt_serves_every_tool_identically`, run in CI.",
      "definition_source": "specs/sdk/requirements.md",
      "definition_line": 13
    },
    {
      "id": "CONN-TUNNEL-MANAGER-SDK-R005.3",
      "kind": "requirement",
      "parent": "CONN-TUNNEL-MANAGER-SDK",
      "source": "specs/sdk/status.json",
      "title": "Failures name their cause; no host binaries",
      "delivery_state": "VERIFIED",
      "state": "verified",
      "done": true,
      "landed_in": [
        "2d825f294f0a",
        "6325763c387a",
        "ecc589035a87"
      ],
      "verified_by": [
        "tests/test_transport_parity_integration.py:763",
        "tests/test_transport_parity_integration.py:778",
        "tests/test_transport_parity_integration.py:810",
        "tests/test_transport_parity_integration.py:829"
      ],
      "parent_title": "CONN-TUNNEL-MANAGER-SDK \u2014 Shared SDK capabilities in tunnel-manager",
      "definition": "**Failures name their cause; no host binaries.** Every tool failure reports `Type: message`, sanitized of secrets and local paths, never a bare exception type. Key pairs are generated natively, so no `ssh-keygen` binary is needed. `check_ssh` reports key auth as working once a key-authenticated session succeeds; otherwise it reports it disabled only when `sshd_config` says `PubkeyAuthentication no`. `test_key_auth` keeps the target's port. Every destructive tool (`tm_remote_remove_host_key`, `tunnel_manager_remove_host`, `tm_operations` cancel) takes `confirm=true` when the client has no elicitation, with or without auth, on stdio and HTTP alike; the SDK refuses a client that cannot elicit and did not confirm with a message naming `confirm=true`, never a protocol error. Without either, it is refused as not confirmed, never failed with an error. A read-only inventory save reports `inventory is read-only: <path>`. | `tests/test_transport_parity_integration.py` (per-tool outcomes carry the cause). `tests/test_tm_remote_actions_characterize.py::TestRemoveHostKey::test_explicit_confirm_skips_elicitation`. `tests/test_transport_parity_integration.py::test_stdio_no_auth_destructive_call`, `::test_http_no_auth_localhost_destructive_call` and `::test_http_jwt_destructive_call` (real stdio, no-auth HTTP and JWT HTTP, with and without client elicitation). `tests/test_tunnel_manager.py::TestTunnel::test_check_ssh_server` and `::test_rotate_ssh_key`.",
      "definition_source": "specs/sdk/requirements.md",
      "definition_line": 14
    },
    {
      "id": "CONN-TUNNEL-MANAGER-SDK-R006",
      "kind": "requirement",
      "parent": "CONN-TUNNEL-MANAGER-SDK",
      "source": "specs/sdk/status.json",
      "title": "Windows portability",
      "delivery_state": "LANDED",
      "state": "landed",
      "done": false,
      "landed_in": [
        "262f0a816132",
        "319f492360f2",
        "852d0ed19036",
        "b6dfabcaffbc"
      ],
      "verified_by": [],
      "parent_title": "CONN-TUNNEL-MANAGER-SDK \u2014 Shared SDK capabilities in tunnel-manager",
      "definition": "**Windows portability.** The package imports and runs on Windows with no POSIX-only API. Private files are hardened through `secure_descriptor` (`os.fchmod` 0o600 only where `os.fchmod` exists) and `secure_path` (0o600 on POSIX; `S_IREAD \\| S_IWRITE` on Windows). The POSIX uid comes from `current_uid`, which is `None` where `os.getuid` is absent. Key pairs are generated natively and never by an `ssh-keygen` binary. On Windows, an SSH identity or known-hosts file that grants Everyone, Authenticated Users or BUILTIN\\\\Users access (write access, for known-hosts) is refused from its access-control list, since mode bits carry no group or other permission there. Proxy executables are trusted only in the Windows system and OpenSSH directories, compared case-insensitively. The Windows CI job runs the whole test suite and is a required check. | `tests/test_windows_portability.py`; `tests/test_host_key_security.py::test_known_hosts_rejects_symlinks_and_writable_files`; `tests/test_no_local_username.py::test_run_command_returns_specific_policy_cause`; the `Windows` job in `.github/workflows/windows-ci.yml`.",
      "definition_source": "specs/sdk/requirements.md",
      "definition_line": 15
    }
  ],
  "github": {
    "issues": {
      "available": true,
      "items": []
    },
    "pull_requests": {
      "available": true,
      "items": []
    }
  },
  "spec_edges": []
}