PR #22625 / git.cafe #22626 real runtime verification
main: 6575ce32508bd7908444241f3719aa33aaf77f90
original PR: 316ed8fff2a9357ef8a51eee21b22126bb45e05b
fixed: d058e7a3f91e011f389e1bfdd6684b63ee07ec06

main server: /home/user/main, server 16733, web 8693
PR server: /home/user/t3code, server 13773, web 5733
Servers used isolated .t3 state with no seeding. Main stopped before PR started.
A real local clone was added through the web project picker.
origin = ssh://git@ssh.github.com:443/pingdotgg/t3code.git
Real Codex gpt-6.1-sol turns launched through the web composer. No mocks or demo data.

MAIN: Guide > Write guide for GitHub #22625
Could not start a review guide
Guides are written from this project's checkout, and this pull request is in another repository. Write it from a project that is a checkout of that repository.

ORIGINAL PR: same Guide action starts a run, passing repository identity check.
The run then fails on real git fetch (host_key_unverified).
Direct reproduction:
$ timeout 15 git -C /home/user/forge-ssh-checkout fetch --quiet --no-tags -- origin refs/heads/main
ssh_askpass: exec(/usr/bin/ssh-askpass): No such file or directory
Host key verification failed.
fatal: Could not read from remote repository.

The following RPCs went to the running server's authenticated /ws endpoint from the real browser.
Request: {tag: git.resolvePullRequest, payload: {cwd: /home/user/forge-ssh-checkout, reference: 22625}}

ORIGINAL PR, sole SSH-over-443 origin
{
  "_tag": "Exit",
  "requestId": 1,
  "exit": {
    "_tag": "Failure",
    "cause": [
      {
        "_tag": "Fail",
        "error": {
          "_tag": "SourceControlProviderError",
          "provider": "github",
          "operation": "getChangeRequest",
          "cwd": "/home/user/forge-ssh-checkout",
          "reference": "22625",
          "detail": "Could not reach GitHub at ssh.github.com.",
          "cause": {
            "name": "GitHubApiRequestError",
            "message": "Could not reach GitHub at ssh.github.com.",
            "cause": {
              "name": "~effect/graphql/GraphQLClientError",
              "message": "PullRequestByNumber: TransportError: Transport error (POST https://ssh.github.com/api/graphql)",
              "cause": {
                "name": "effect/graphql/GraphQLClientError/TransportError",
                "message": "Transport error (POST https://ssh.github.com/api/graphql)",
                "cause": {
                  "name": "HttpClientError",
                  "message": "Transport error (POST https://ssh.github.com/api/graphql)",
                  "cause": {
                    "name": "TypeError",
                    "message": "fetch failed",
                    "cause": {
                      "name": "Error",
                      "message": "408D8BC88D740000:error:0A00010B:SSL routines:tls_validate_record_header:wrong version number:../deps/openssl/openssl/ssl/record/methods/tlsany_meth.c:77:\n"
                    }
                  }
                }
              }
            }
          }
        }
      }
    ]
  }
}

ORIGINAL PR, origin marked gh-resolved base plus competing Gourav224/t3code upstream
{
  "_tag": "Exit",
  "requestId": 1,
  "exit": {
    "_tag": "Failure",
    "cause": [
      {
        "_tag": "Fail",
        "error": {
          "_tag": "SourceControlProviderError",
          "provider": "github",
          "operation": "getChangeRequest",
          "cwd": "/home/user/forge-ssh-checkout",
          "reference": "22625",
          "detail": "Could not reach GitHub at ssh.github.com.",
          "cause": {
            "name": "GitHubApiRequestError",
            "message": "Could not reach GitHub at ssh.github.com.",
            "cause": {
              "name": "~effect/graphql/GraphQLClientError",
              "message": "PullRequestByNumber: TransportError: Transport error (POST https://ssh.github.com/api/graphql)",
              "cause": {
                "name": "effect/graphql/GraphQLClientError/TransportError",
                "message": "Transport error (POST https://ssh.github.com/api/graphql)",
                "cause": {
                  "name": "HttpClientError",
                  "message": "Transport error (POST https://ssh.github.com/api/graphql)",
                  "cause": {
                    "name": "TypeError",
                    "message": "fetch failed",
                    "cause": {
                      "name": "Error",
                      "message": "Client network socket disconnected before secure TLS connection was established"
                    }
                  }
                }
              }
            }
          }
        }
      }
    ]
  }
}

FIXED PR, same competing remotes and explicit origin marker
{
  "_tag": "Exit",
  "requestId": 1,
  "exit": {
    "_tag": "Success",
    "value": {
      "pullRequest": {
        "number": 22625,
        "title": "fix(shared): a forge's SSH-only host keys to the same repository as its web host",
        "url": "https://github.com/pingdotgg/t3code/pull/22625",
        "baseBranch": "main",
        "headBranch": "fix/forge-ssh-host-repository-key",
        "state": "open"
      }
    }
  }
}

FIXED PR, sole SSH-over-443 origin and foreign-project guide rejection
SSH single remote {"_tag":"Exit","requestId":1,"exit":{"_tag":"Success","value":{"pullRequest":{"number":22625,"title":"fix(shared): a forge's SSH-only host keys to the same repository as its web host","url":"https://github.com/pingdotgg/t3code/pull/22625","baseBranch":"main","headBranch":"fix/forge-ssh-host-repository-key","state":"open"}}}}
foreign checkout guide {"_tag":"Exit","requestId":1,"exit":{"_tag":"Failure","cause":[{"_tag":"Fail","error":{"_tag":"PullRequestOperationError","operation":"generateReviewGuide","detail":"Guides are written from this project's checkout, and this pull request is in another repository. Write it from a project that is a checkout of that repository."}}]}}

FIXED PR, HTTPS origin
{"_tag":"Exit","requestId":1,"exit":{"_tag":"Success","value":{"pullRequest":{"number":22625,"title":"fix(shared): a forge's SSH-only host keys to the same repository as its web host","url":"https://github.com/pingdotgg/t3code/pull/22625","baseBranch":"main","headBranch":"fix/forge-ssh-host-repository-key","state":"open"}}}}

FIXED PR, standard git@github.com origin
{"_tag":"Exit","requestId":1,"exit":{"_tag":"Success","value":{"pullRequest":{"number":22625,"title":"fix(shared): a forge's SSH-only host keys to the same repository as its web host","url":"https://github.com/pingdotgg/t3code/pull/22625","baseBranch":"main","headBranch":"fix/forge-ssh-host-repository-key","state":"open"}}}}


Regression assertions in the existing test file failed before the fix and passed afterward.
Blacksmith vp run check:changed passed: format, lint, GraphQL generation check, both knip passes, 13 affected typechecks, 61 tests across 5 files.

Not verified: full guide generation through SSH, Bitbucket/GitLab external services, native desktop/mobile, remote relay/tunnel modes.
GitHub reports conflicts with current main. No merge, rebase, force-push, label changes, or other PR changes performed.

REAL PROVIDER PATH ON FIXED HEAD:
Web composer -> Codex gpt-6.1-sol -> mcp__t3_code__read_pull_request_guide -> running server -> GitHub.
Returned: {"host":"github.com","repository":"pingdotgg/t3code","currentHeadSha":"d058e7a3f91e011f389e1bfdd6684b63ee07ec06","run":null}.
A later read after the one-minute enrichment cache expired reported no matching project. The existing ProjectService.listShells/getAvailable path returns the available identity before its background refresh completes. This pre-existing cold-identity limitation was observed and left outside this SSH normalization fix.