Merge pull request 'Run every command on the build VM over SSH (M1.3)' (#93) from ssh-execution into main

Reviewed-on: dongar/nisse#93
Reviewed-by: Don Garrett <dgarrett@acm.org>

docs/Architecture.md

@@ -543,8 +543,8 @@ event, work item, cause); every verdict, escalation and external effect is logge
 - **MCP tools are the one deliberate exception:** fixed code against an API, with
   the model choosing only arguments. They still pass through P3, P4 and L4, and their
   output is redacted (L12).
-- **Tests use SSH too,** against a throwaway `sshd` container, so the tested path is
-  the production path.
+- **Tests use SSH too,** against a throwaway `sshd`, so the tested path is the
+  production path.
 
 ---
 
@@ -674,9 +674,10 @@ Installing on any other host is dangerous.
   fresh and this one resumes from its branch.
 - **Publish only the work:** what the agent changed, counted from where the
   milestone started, never build artifacts; anything left out is reported.
-- **Pushes run on the build VM** with a key the model's commands never receive
-  (L12); PRs are opened from the agent's container with its API token, which never
-  reaches a build VM. Gitea is the only copy that has to survive.
+- **Pushes run on the build VM** with a push credential (a deploy key, or a
+  push-only account's token) the model's commands never receive (L12); PRs are
+  opened from the agent's container with its API token, which never reaches a
+  build VM. Gitea is the only copy that has to survive.
 - **Publishing is idempotent** (L8). A milestone with no changes is done if it wasn't
   expected to change code; otherwise it's raised with the operator.
 - **The agent never owns or administers a repository:** whoever does can turn
@@ -727,7 +728,7 @@ execution:
 
 **Secrets are namespaced by project.** A build VM's commands receive only their
 project's, and each secret's configuration says whether the model's commands may
-see it or only harness operations use it (the push key). Anything the model's
+see it or only harness operations use it (the push credential). Anything the model's
 commands can see must be scoped for testing, never production.
 
 **Provisioning:** build VMs come from a template via Terraform; eventually at

docs/Development-Plan.md

@@ -282,8 +282,10 @@ if the implementation differs.
 - **D3 preflight:** a project's needs are read from its files (`Cargo.toml`,
   `pyproject.toml`, `package.json`) or a declaration in the repository.
 - **D4 publishing:** standard excludes are configured in each clone, and only what
-  the work produced is committed. A push hands the key over stdin to a
-  short-lived `ssh-agent` on the build VM, for that one push.
+  the work produced is committed. The push credential is handed to each push
+  only: a deploy key over stdin to a short-lived `ssh-agent` on the build VM, or
+  a push-only account's HTTPS token as that command's secrets, read by a
+  credential helper that names environment variables, never values.
 - **D7:** test services use ports 18000–18099, so opening access later is a
   firewall change. The inference host is behind LiteLLM, so it is not a second
   egress exception.