ALL LESSONSWEEK 03FRIDAY

INSPECT · COMPUTER + TERMINAL

SSH keys and agents

The network beneath the URL30–60 MINUTESCORE + PRACTICAL
01

GROUND

Problem

What becomes confusing, fragile, or impossible without understanding SSH keys and agents? This lesson answers that through explanation, a worked example, two runnable exercises, and a reference solution. No teacher-supplied worksheet is required.

Before integrated development environments, the operating system, terminal, files, and text streams were the environment. Their small composable interfaces still underpin modern tooling.
02

LEARN

Concept explanation

SSH keys and agents belongs to “The network beneath the URL”. SSH keys and agents is inspected by introducing one realistic failure and proving root cause before repair.

For SSH keys and agents, trace concrete input, state transition, output, and failure through an operating-system boundary made visible through bytes, files, processes, and exit status.

Programs are processes. They read bytes, transform state, write bytes, open files and sockets, then report success or failure through observable boundaries. Apply that model to supplied normal, boundary, and failure cases; each case below names its input and expected evidence.

Observable

Evidence produced by the SSH keys and agents experiment: output, state, trace, bytes, timing, or diagnostics.

Invariant

Condition that must remain true while inputs or implementation of SSH keys and agents change.

Boundary

Point where SSH keys and agents crosses ownership, representation, time, process, network, or trust.

Example bank

Compare normal, boundary, failure, and cross-layer cases. Predict each observation before revealing the explanation.

Baseline · one variable

SETUPCapture healthy SSH keys and agents baseline from: Resolve example.com, connect with curl -v, and save response headers and body separately.

OBSERVEEvidence identifies first divergence, repair changes only proven cause, and rerun restores: Trace identifies resolved address, TLS/HTTP exchange, status, headers, body size, and connection failure.

WHY IT MATTERSThis isolates the normal contract of SSH keys and agents; preserve its raw evidence as the control for every later comparison.

Boundary · same contract, harder input

SETUPRecord SSH keys and agents behavior at: Repeat with redirects disabled, then enabled.

OBSERVERecord what remains invariant and the first representation, owner, size, or timing value that changes in Ghostty · tmux · hx · shell · curl · Git.

WHY IT MATTERSA boundary example is useful only when one named dimension changes and everything else stays comparable.

Failure · evidence before repair

SETUPDiagnose this exact SSH keys and agents failure before editing: Request an unused local port with a two-second timeout.

OBSERVECapture the first divergence from the baseline, including exact input, diagnostic, state, and recovery result. Expected recovery: Evidence identifies first divergence, repair changes only proven cause, and rerun restores: Trace identifies resolved address, TLS/HTTP exchange, status, headers, body size, and connection failure.

WHY IT MATTERSThe diagnostic is part of the interface. Repair the proven cause, not the most visible symptom.

Cross-layer · follow ownership

SETUPTrace SSH keys and agents one layer below its usual abstraction through an operating-system boundary made visible through bytes, files, processes, and exit status.

OBSERVEUse wc, od, stat, ps, lsof, curl, or Git plumbing as appropriate; save raw output before interpretation.

WHY IT MATTERSThe lower layer is earned when it explains evidence the current layer cannot. Otherwise keep SSH keys and agents at the simpler boundary.

03

SEE

Worked example

Start from supplied lab.sh. Focus: Capture healthy SSH keys and agents baseline from: Resolve example.com, connect with curl -v, and save response headers and body separately.

  1. Run: chmod +x lab.sh && ./lab.sh
  2. Save baseline evidence. Use wc, od, stat, ps, lsof, curl, or Git plumbing as appropriate; save raw output before interpretation.
  3. Boundary case: Record SSH keys and agents behavior at: Repeat with redirects disabled, then enabled.
  4. Failure case: Diagnose this exact SSH keys and agents failure before editing: Request an unused local port with a two-second timeout.
RESULT
Evidence identifies first divergence, repair changes only proven cause, and rerun restores: Trace identifies resolved address, TLS/HTTP exchange, status, headers, body size, and connection failure. Starter-level baseline: Command exits 0, prints a byte count, then prints hexadecimal and character views of the same file.
04

START HERE

Starter material

PREREQUISITESA POSIX shell with wc, od, chmod, and standard filesystem commands (macOS, Linux, or WSL).

ONE-TIME SETUPmkdir reforging-lab && cd reforging-lab

Create lab.sh, paste this exact content, then run the command below.

#!/usr/bin/env sh
set -eu
lab="${TMPDIR:-/tmp}/reforging-lab"
mkdir -p "$lab"
printf '%s\n' 'baseline: SSH keys and agents' > "$lab/input.txt"
printf 'bytes: ' && wc -c < "$lab/input.txt"
od -An -tx1 -c "$lab/input.txt"
RUNchmod +x lab.sh && ./lab.sh

STOP / CLEANUPNo background process. Keep generated evidence files for your notebook.

05

DO WITH GUIDANCE

Guided exercise

Diagnose a controlled failure: SSH keys and agents

  1. Normal case: Capture healthy SSH keys and agents baseline from: Resolve example.com, connect with curl -v, and save response headers and body separately.
  2. Write predicted evidence from this named case before running starter.
  3. Break one assumption, capture evidence, then repair only proven cause.
  4. Run exact normal case. Save commands, inputs, outputs, and diagnostics in notebook.
  5. Explain changed evidence using lesson mental model in no more than five sentences.
Concrete guided solution
  1. Copy the supplied lab.sh unchanged and run: chmod +x lab.sh && ./lab.sh
  2. Write this prediction before inspecting output: Evidence identifies first divergence, repair changes only proven cause, and rerun restores: Trace identifies resolved address, TLS/HTTP exchange, status, headers, body size, and connection failure.
  3. Perform only the named normal case: Capture healthy SSH keys and agents baseline from: Resolve example.com, connect with curl -v, and save response headers and body separately.
  4. Save the raw output, then annotate input → transition → evidence. Use Ghostty · tmux · hx · shell · curl · Git to confirm the transition rather than inferring it.
  5. Compare prediction with evidence; if they differ, keep both and write the rule that explains the difference. Reference baseline: Command exits 0, prints a byte count, then prints hexadecimal and character views of the same file.
06

DO ALONE

Independent exercise

Prove root cause: SSH keys and agents

  1. Create second case from blank file: Record SSH keys and agents behavior at: Repeat with redirects disabled, then enabled.
  2. Then create controlled failure: Diagnose this exact SSH keys and agents failure before editing: Request an unused local port with a two-second timeout.
  3. Use Ghostty · tmux · hx · shell · curl · Git to prove behavior, then repair controlled failure.
  4. Compare result against supplied acceptance checks and reference approach before marking complete.
Concrete independent solution
  1. Duplicate the starter into a clean comparison case; change only this boundary: Record SSH keys and agents behavior at: Repeat with redirects disabled, then enabled.
  2. Save its evidence beside the baseline and identify the first changed value. Use wc, od, stat, ps, lsof, curl, or Git plumbing as appropriate; save raw output before interpretation.
  3. Create the exact controlled failure: Diagnose this exact SSH keys and agents failure before editing: Request an unused local port with a two-second timeout.
  4. Save healthy trace, output, metadata, or state snapshot for SSH keys and agents: Resolve example.com, connect with curl -v, and save response headers and body separately.
  5. Write one cause hypothesis and evidence that would falsify it.
  6. Trigger exact failure without adding other changes: Request an unused local port with a two-second timeout.
  7. Diff healthy and failed evidence; repair first divergent boundary only.
  8. Run boundary plus baseline again and confirm: Trace identifies resolved address, TLS/HTTP exchange, status, headers, body size, and connection failure.
  9. Rerun baseline, boundary, and repaired failure together. Accept only if all reproduce: Evidence identifies first divergence, repair changes only proven cause, and rerun restores: Trace identifies resolved address, TLS/HTTP exchange, status, headers, body size, and connection failure.
07

COMPARE

Expected result

  • Evidence identifies first divergence, repair changes only proven cause, and rerun restores: Trace identifies resolved address, TLS/HTTP exchange, status, headers, body size, and connection failure.
  • Command exits 0, prints a byte count, then prints hexadecimal and character views of the same file.
  • Controlled SSH keys and agents failure produces captured evidence; repair restores stated invariant without hiding error.
08

PROVE

Acceptance checks

Lesson is complete only when every check is true. Each check is stored locally and travels with your JSON backup.

0/5 complete · saved on this device

09

UNSTICK

Hints

Reveal hints
  1. Start with supplied normal case exactly as written: Capture healthy SSH keys and agents baseline from: Resolve example.com, connect with curl -v, and save response headers and body separately.
  2. For boundary case, change only named dimension: Record SSH keys and agents behavior at: Repeat with redirects disabled, then enabled.
  3. If result is confusing, diff raw inputs and evidence before editing implementation.
  4. If tool shows nothing useful, move observation one boundary lower: representation, runtime, OS, or network.
10

VERIFY

Solution

Attempt both exercises before opening reference approach.

Reveal reference solution
  1. Run unmodified starter and preserve baseline evidence: Command exits 0, prints a byte count, then prints hexadecimal and character views of the same file.
  2. Save healthy trace, output, metadata, or state snapshot for SSH keys and agents: Resolve example.com, connect with curl -v, and save response headers and body separately.
  3. Write one cause hypothesis and evidence that would falsify it.
  4. Trigger exact failure without adding other changes: Request an unused local port with a two-second timeout.
  5. Diff healthy and failed evidence; repair first divergent boundary only.
  6. Run boundary plus baseline again and confirm: Trace identifies resolved address, TLS/HTTP exchange, status, headers, body size, and connection failure.
11

PREDICT · INSPECT · BREAK · DEBUG · MEASURE

Interrogate reality

Prediction: write expected output, state transition, ordering, and failure evidence before running either exercise.

Inspection: Use the shell, process table, filesystem metadata, curl, and Git plumbing. Never trust a command you cannot observe.

Measurement: Count bytes, processes, descriptors, syscalls, round trips, and elapsed time before explaining performance.

INSPECT

Capture raw evidence before explaining.

BREAK

Change one assumption and force controlled failure.

DEBUG

Find cause with Ghostty · tmux · hx · shell · curl · Git before editing fix.

TOOL DRILL · keyboard only · record one retrievable command or shortcut
12

MASTERY + FRONTIER + BOUNDARY

Own the knowledge

TEACH

Explain SSH keys and agents at beginner, intermediate, and senior depth.

REBUILD

Recreate smallest useful example from blank file without notes or AI.

RETRIEVE

Schedule recall for day 1, 7, 30, and 90.

Creative frontier lab

Try first without opening the solutions. The constraints invite invention; the reference gives one concrete direction, never the only valid answer.

Constraint inversion

Re-solve SSH keys and agents by removing the most convenient abstraction. solve it with POSIX files and pipes only—no editor plugin, framework, or opaque GUI.

CONSTRAINTKeep the same inputs, observable result, and failure evidence; change the means, not the contract.

ORIGINAL IDEATurn subtraction into a design tool: the missing abstraction should reveal which responsibility it used to hide.

Reveal frontier solution
  1. Freeze the contract as three fixtures: Capture healthy SSH keys and agents baseline from: Resolve example.com, connect with curl -v, and save response headers and body separately. / Record SSH keys and agents behavior at: Repeat with redirects disabled, then enabled. / Diagnose this exact SSH keys and agents failure before editing: Request an unused local port with a two-second timeout.
  2. List every convenience used by the starter; remove the highest-level one while preserving chmod +x lab.sh && ./lab.sh.
  3. Implement the smallest replacement using solve it with POSIX files and pipes only—no editor plugin, framework, or opaque GUI.
  4. Run all fixtures and compare raw evidence. Keep the simpler version unless the removed abstraction has a demonstrated benefit.
Representation x-ray

Build an explanation artifact for SSH keys and agents: turn every invisible state into a diffable byte, process, descriptor, or exit-status artifact.

CONSTRAINTA peer must be able to locate the first divergence without reading implementation code.

ORIGINAL IDEATreat the explanation itself as a product: make invisible transitions visible, replayable, and diffable.

Reveal frontier solution
  1. Create one row or timestamped event for each transition in: Capture healthy SSH keys and agents baseline from: Resolve example.com, connect with curl -v, and save response headers and body separately.
  2. For every row record input, representation, owner, operation, output, and tool evidence from Ghostty · tmux · hx · shell · curl · Git.
  3. Replay Record SSH keys and agents behavior at: Repeat with redirects disabled, then enabled.; highlight only changed rows.
  4. Replay Diagnose this exact SSH keys and agents failure before editing: Request an unused local port with a two-second timeout.; stop at the first divergent row and attach its recovery action.
Adversarial remix

Combine the boundary and failure into a new user-visible scenario for SSH keys and agents. make a self-auditing artifact whose output includes the command and invariant that produced it.

CONSTRAINTDo not merely add more input. Invent a recovery interaction, alternate representation, or self-checking behavior.

ORIGINAL IDEAMake the system teach its own limits: the artifact should expose the invariant and offer a safe next action when it breaks.

Reveal frontier solution
  1. Combine these two pressures without changing them: Record SSH keys and agents behavior at: Repeat with redirects disabled, then enabled. AND Diagnose this exact SSH keys and agents failure before editing: Request an unused local port with a two-second timeout.
  2. Name the invariant that must survive and the user-visible evidence when it cannot: Evidence identifies first divergence, repair changes only proven cause, and rerun restores: Trace identifies resolved address, TLS/HTTP exchange, status, headers, body size, and connection failure.
  3. Implement this original direction: make a self-auditing artifact whose output includes the command and invariant that produced it.
  4. Demonstrate baseline, combined failure, recovery, then baseline again; save the sequence as a regression fixture.

Capability frontier

Push SSH keys and agents until another layer becomes justified. Record one robust technique, one contextual trade-off, and one labeled hack or historical curiosity.

CORE · PRACTICAL · CONTEXTUAL · HACK · FRAGILE · HISTORICAL · GOLF

Boundary

Shell composition becomes costly when state, error recovery, or data structure complexity dominates the pipeline.

If this vanished tomorrow…

Reproduce the useful behavior with files, text streams, process primitives, and a minimal compiled or interpreted program.

Why next layer is earned

Networking and HTTP are earned when local processes need to exchange representations across a boundary.