Expand native auth and benchmark gates

docs/PUBLIC_READINESS.md

@@ -8,14 +8,14 @@ The plan for replacing the day-to-day SSH workflow with native Dosh authenticati
 and forwarding is specified in `docs/NATIVE_V1_SPEC.md`, and the published threat
 model is in `docs/THREAT_MODEL.md`. Native v1 is now substantially implemented:
 native key-exchange + user auth, host-key pinning/trust, `-L`/`-R`/`-D` forwarding,
-and `dosh doctor` all exist (see the feature matrix and the verification-checklist
-status table below). It is **not yet fully verified**: per-IP token-bucket rate
-limiting, protocol-version negotiation hardening, fuzzing in CI, and external review
-are still open. Until the verification checklist (`NATIVE_V1_SPEC.md` section 16) is
-green and that review is done, Dosh's defensible public security claim remains fast
-encrypted native attach/reconnect with SSH-equivalent transport security and an
-explicit SSH bootstrap fallback — not a fully verified, externally reviewed SSH
-replacement.
+`dosh doctor`, token-bucket auth rate limiting, and fuzz-smoke CI all exist (see the
+feature matrix and the verification-checklist status table below). It is **not yet
+fully verified**: long sleep/roaming soak, adversarial UDP forwarding tests, deeper
+fuzzing, protocol-version compatibility policy, and external review are still open.
+Until the verification checklist (`NATIVE_V1_SPEC.md` section 16) is green and that
+review is done, Dosh's defensible public security claim remains fast encrypted native
+attach/reconnect with SSH-equivalent transport security and an explicit SSH bootstrap
+fallback — not a fully verified, externally reviewed SSH replacement.
 
 ## Objective Benchmarks
 
@@ -58,31 +58,31 @@ with ordinary SSH.
 | Feature | Mosh | Dosh now | Public status |
 | --- | --- | --- | --- |
 | SSH-based first authentication | yes | yes | ready |
-| Native UDP key auth (no SSH per attach) | no | yes, Ed25519 via ssh-agent or encrypted key | implemented; pending full verification |
+| Native UDP key auth (no SSH per attach) | no | yes, Ed25519, ECDSA P-256, and RSA-SHA2 via ssh-agent or OpenSSH identity files | implemented; pending full verification |
 | Dosh host-key pinning and trust | no | yes, `known_hosts` + `dosh trust` + mismatch hard-fail | implemented |
 | `authorized_keys` policy enforcement | no | yes, `from=`/`no-port-forwarding`/`permitopen=`, unsupported fail closed | implemented |
 | `dosh doctor` diagnostics | no | yes, config/auth/UDP/forwarding-policy check | implemented |
 | Encrypted UDP terminal data | yes | yes | ready |
-| Roaming by client address change | yes | yes | needs more hostile-network tests |
+| Roaming by client address change | yes | yes | implemented; needs more hostile-network/soak proof |
 | Survive sleep or network loss | yes | yes | needs long-running soak tests |
 | Fast repeat attach without SSH | no | yes, via attach tickets | core differentiator |
 | Resident server daemon | no | yes | core differentiator |
 | One UDP port for all sessions | port range by default | yes | ready |
 | Fresh session by default | yes | yes | ready |
-| Named persistent sessions | no built-in shared session model | yes | ready |
-| Multiple clients on one session | no | yes | needs conflict-policy docs |
+| Named persistent sessions | no built-in shared session model | yes, plus opt-in server-restart holders | implemented; holder mode needs stress-testing |
+| Multiple clients on one session | no | yes | implemented; needs conflict-policy docs |
 | View-only clients | no | yes | ready |
-| Full-screen TUI correctness | yes | improving | must stay green before public push |
+| Full-screen TUI correctness | yes | yes, scripted transport coverage for control sequences | implemented; needs broader app matrix |
 | Predictive local echo | mature | guarded printable-only opt-in | not parity |
-| Non-destructive disconnect UI | yes | not currently | needed |
+| Non-destructive disconnect UI | yes | yes, bottom-row save/restore status line | implemented |
 | Unicode edge-case handling | strong | basic terminal emulator dependent | not parity |
 | X11 forwarding | no | no | non-goal unless tunneled separately |
-| SSH agent forwarding | no | no | planned as forwarding channel |
-| Local TCP forwarding, `-L` | no | yes, native encrypted stream mux | implemented; needs hostile-network tests |
-| Remote TCP forwarding, `-R` | no | yes, loopback bind by default | implemented; needs hostile-network tests |
-| Dynamic SOCKS forwarding, `-D` | no | yes, SOCKS5 over native streams | implemented; needs hostile-network tests |
+| SSH agent forwarding | no | yes, explicit `-A` / `forward_agent` plus server allow-list | implemented; opt-in only |
+| Local TCP forwarding, `-L` | no | yes, native encrypted stream mux | implemented; load/priority tested, adversarial UDP pending |
+| Remote TCP forwarding, `-R` | no | yes, loopback bind by default | implemented; adversarial UDP pending |
+| Dynamic SOCKS forwarding, `-D` | no | yes, SOCKS5 over native streams | implemented; adversarial UDP pending |
 | Forward-only / background forwarding, `-N` / `-f` | no | yes, `-f` requires `-N` | implemented |
-| Per-stream flow control / terminal priority | no | yes, windowed credit per stream | implemented; needs load tests |
+| Per-stream flow control / terminal priority | no | yes, windowed credit per stream | implemented; covered by blocked-stream and local-forward load tests |
 
 ## SSH Config Inheritance
 
@@ -131,7 +131,8 @@ Implemented:
 Still open before claiming forwarding parity:
 
 - A dedicated dropped/reordered/replayed-UDP forwarding test suite.
-- Load tests proving large forwarded transfers add no visible terminal input lag.
+- More real-host load soak. The integration suite already covers terminal-priority
+  behavior while a local forward is under blocked-stream pressure.
 
 ## Native v1 Verification Checklist Status
 
@@ -145,15 +146,17 @@ from code; in progress = partially implemented; pending = not yet implemented.
 | Known host-key mismatch hard fails | done | `KnownHostStatus::Mismatch` aborts; `trust_host` refuses overwrite without `--replace`. |
 | Native Ed25519 auth via ssh-agent | done | `src/ssh_agent.rs` signs the user-auth transcript. |
 | Native Ed25519 auth via encrypted key prompt | done | `load_ed25519_identity_with_passphrase` decrypts OpenSSH keys. |
+| Native ECDSA P-256 auth | done | ssh-agent and OpenSSH identity-file paths are wired; `native_user_auth_accepts_ecdsa_p256_private_key` verifies the direct key path. |
+| Native RSA-SHA2 auth | done | ssh-agent requests `rsa-sha2-512`; direct OpenSSH RSA identities sign with `rsa-sha2-512`; legacy SHA-1 `ssh-rsa` signatures are rejected. |
 | Removed authorized key can no longer authenticate | done | Covered by `native_user_auth_accepts_authorized_key_and_rejects_removed_key`. |
 | Unsupported authorized-key options fail closed | done | `ensure_native_allowed` bails on any unsupported option. |
 | Replayed handshake packets rejected | done | Handshake is transcript-bound and signature-verified; pending entries TTL-evicted. |
 | Replayed transport packets rejected | done | `ReplayWindow` (128-wide) over per-direction counter. |
 | Stale encrypted packets after reconnect ignored, not fatal | done | `session_key_id` mismatch drops the packet instead of erroring fatally. |
 | Client IP/port change preserves session | done | Server matches by `ClientId`/session key id, updates endpoint. |
-| Native cold auth beats cold `ssh host true` | pending | Benchmark gate not yet run for native cold path (Track C / `BENCHMARKS.md`). |
-| Cached attach near network RTT | pending | Same benchmark dependency. |
-| `-L` works without delaying terminal input | in progress | Implemented with per-stream window; load proof pending. |
+| Native cold auth beats cold `ssh host true` | done | Docker gate runs `dosh-bench --cold-native` after one-time `dosh trust` and requires Dosh mean <= SSH mean. |
+| Cached attach near network RTT | done | Local loopback samples are ~3 ms; Docker cached gate is under 25 ms. See `docs/BENCHMARKS.md`. |
+| `-L` works without delaying terminal input | done | Per-stream windowing plus `native_local_forward_bulk_load_does_not_delay_interactive_terminal` and blocked-stream priority regression. |
 | `-R` enforces bind and permission policy | done | `remote_bind_allowed` + `start_remote_forwards` policy checks. |
 | `-N -L` does not allocate a PTY | done | `forward-only` mode skips PTY allocation. |
 | `-f -N -L` backgrounds only after listener readiness | done | `spawn_background_forwarder` waits for a readiness token. |
@@ -161,26 +164,30 @@ from code; in progress = partially implemented; pending = not yet implemented.
 | `dosh doctor` identifies UDP-blocked/auth-denied/mismatch/forwarding-denied | done | `run_doctor_command` reports each state. |
 | Closing laptop 30+ min does not kill session | in progress | Long `client_timeout_secs` + resume; 30-min soak evidence pending. |
 | Three concurrent terminals independent unless named | done | Generated session names per attach; named sessions shared on purpose. |
-| Large forwarded transfers add no visible input lag | in progress | Per-stream flow control exists; load test pending. |
-| Fuzz targets run in CI | pending | No `fuzz/` dir; CI runs fmt/test/build/bench only. |
+| Large forwarded transfers add no visible input lag | done | Covered by the local-forward bulk-load integration test; still needs real-host soak before launch claims. |
+| Fuzz targets run in CI | done | `fuzz/` has parser/auth targets and CI runs a nightly `fuzz-smoke` job when cargo-fuzz is available. |
 | Threat model updated with accepted residual risks | done | `docs/THREAT_MODEL.md`. |
 
 Additional security hardening tracked outside the section 16 list:
 
-- Full per-IP token-bucket rate limiting: in progress (another track). Today only
-  handshake-map eviction and a static `rate_limit_remaining` hint exist.
-- Protocol VERSION negotiation: in progress. Single version, fail-closed reject; no
-  multi-version negotiation yet.
-- ECDSA P-256 / SHA-2 RSA user keys: pending. Ed25519 only today.
+- Full per-IP token-bucket rate limiting: implemented for native auth and covered by
+  unit/integration tests. It still needs real-host tuning under abusive traffic.
+- Protocol VERSION handling: current behavior is single-version, fail-closed reject
+  at the packet/header and native-handshake layers. Future multi-version
+  compatibility/downgrade policy is still open.
+- ECDSA P-256 / SHA-2 RSA user keys: implemented for ssh-agent and OpenSSH
+  identity-file native auth. RSA is compatibility-only and uses SHA-2 signatures;
+  legacy SHA-1 `ssh-rsa` signatures are not accepted.
 
 ## Before Public Launch
 
 - Keep `cargo test`, `make bench-docker-ssh`, and `make bench-docker-mosh` green.
-- Add a non-destructive disconnect indicator.
-- Run scripted TUI tests for alternate-screen apps, arrow keys, resize, mouse mode,
-  bracketed paste, and terminal cleanup.
+- Keep scripted TUI tests green and add a broader app matrix for real alternate-screen
+  tools.
 - Publish benchmark output with raw samples, not just averages.
 - Mark prediction as experimental until it has a real framebuffer model.
-- Land full per-IP token-bucket auth rate limiting and wire fuzz targets into CI.
+- Stress-test `persist_sessions = true` before making restart-survivable holders the
+  default.
+- Tune the native auth token bucket under abusive real-host traffic.
 - Complete the native-v1 verification checklist above and an external security review
   before making any "native SSH replacement" claim (`NATIVE_V1_SPEC.md` section 17).