feat(hostkey): M14.2 — host_key_trust API + @Revoked enforcement (FR-64) (#16)

Wires the M14.1 cert_authority parser into the connect-time host-key
check.  @Revoked entries become a hard, policy-overriding blocklist:
even StrictHostKeyChecking::No cannot accept a key whose fingerprint
appears in a matching @Revoked line.

src/hostkey.rs:

- New public type HostKeyTrust { fingerprints, cert_authorities, revoked }
  combining the embedded set, parsed direct pins, matching cert
  authorities, and matching revoked entries from one known_hosts
  pass.

- New public fn host_key_trust(host, custom_path) -> HostKeyTrust:
    1. Seeds with embedded fingerprints (GitHub / GitLab / Codeberg).
    2. Reads the user-supplied or default known_hosts file.
    3. Filters direct, cert-authority, and revoked entries by the
       host pattern using ssh_config::lexer::wildcard_match.
    4. Returns an empty trust set without erroring (unlike
       fingerprints_for_host) — the caller's policy decides.

- Existing fingerprints_for_host preserved verbatim for back-compat.

- New embedded_fingerprints helper extracted from fingerprints_for_host
  so host_key_trust can share the well-known-host seeding logic.

src/session.rs:

- GitwayHandler gains revoked: Vec<String> field.
- check_server_key consults `revoked` FIRST, before the
  StrictHostKeyChecking::No bypass and the fingerprint match path:
  any presented key whose SHA-256 fingerprint hits a revoked entry
  is rejected with a host_key_mismatch error and a hint mentioning
  the @Revoked entry.
- build_handler_pieces switched from fingerprints_for_host to
  host_key_trust so direct pins, revocations, and cert authorities
  are pulled in one pass.  The empty-fingerprint branch reproduces
  the long-form actionable hint that fingerprints_for_host emitted.

Tests: +7 new hostkey unit tests:
- host_key_trust embeds well-known fingerprints.
- host_key_trust pattern matches @cert-authority by host glob.
- host_key_trust excludes non-matching @cert-authority.
- host_key_trust pattern matches @Revoked.
- host_key_trust combines direct pins with embedded set.
- host_key_trust tolerates a missing custom_path file.
- host_key_trust returns empty for an unknown host with no file
  (caller decides whether the absence is fatal — the AcceptNew path
  relies on this).

Total: 207 lib tests, 0 failures, 5 ignored (pre-existing).

Plan: M14.2 of let-us-plan-on-bright-cosmos.md. Stacked on M14.1
(PR #15).

Author: UnbreakableMJ

src/hostkey.rs

@@ -27,7 +27,9 @@
 
 use std::path::Path;
 
+use crate::cert_authority::{parse_known_hosts, CertAuthority, KnownHostsFile, RevokedEntry};
 use crate::error::AnvilError;
+use crate::ssh_config::lexer::wildcard_match;
 
 // ── Well-known host constants ─────────────────────────────────────────────────
 
@@ -217,6 +219,111 @@ pub fn fingerprints_for_host(
     Ok(fps)
 }
 
+// ── M14: combined trust view (FR-60, FR-64) ──────────────────────────────────
+
+/// Combined view of every `known_hosts` entry that bears on the
+/// connection target.
+///
+/// Returned by [`host_key_trust`].  A connection target's effective
+/// trust is the union of:
+///
+/// - `fingerprints` — direct SHA-256 pins (embedded + custom-file).
+///   Identical to what [`fingerprints_for_host`] returns.
+/// - `cert_authorities` — `@cert-authority` entries whose host pattern
+///   matches the target.  Live cert verification (FR-61, FR-62, FR-63)
+///   is deferred until russh exposes the server's certificate; the
+///   field is populated today so `gitway config show --json` and
+///   audit tooling can surface CA identities.
+/// - `revoked` — `@revoked` entries whose host pattern matches.
+///   Enforced first in
+///   [`crate::session::AnvilSession::connect`]'s host-key check: any
+///   presented key whose fingerprint hits one of these is rejected
+///   regardless of `StrictHostKeyChecking` policy.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct HostKeyTrust {
+    pub fingerprints: Vec<String>,
+    pub cert_authorities: Vec<CertAuthority>,
+    pub revoked: Vec<RevokedEntry>,
+}
+
+/// Returns the [`HostKeyTrust`] for `host`, combining the embedded
+/// fingerprint set, any direct pins / `@cert-authority` / `@revoked`
+/// lines from the user-supplied or default `known_hosts` file, and
+/// pattern-matching for the cert-authority + revoked classes.
+///
+/// Unlike [`fingerprints_for_host`], an empty trust set is **not** an
+/// error — the caller decides whether the absence is fatal (the
+/// `StrictHostKeyChecking::AcceptNew` path tolerates an empty set; the
+/// `Yes` path does not).
+///
+/// # Errors
+/// [`AnvilError::invalid_config`] when the known-hosts file exists but
+/// fails to parse (a malformed `@cert-authority` line, for instance).
+/// File-not-found is silently treated as no entries.
+pub fn host_key_trust(
+    host: &str,
+    custom_path: &Option<std::path::PathBuf>,
+) -> Result<HostKeyTrust, AnvilError> {
+    let mut trust = HostKeyTrust {
+        fingerprints: embedded_fingerprints(host),
+        cert_authorities: Vec::new(),
+        revoked: Vec::new(),
+    };
+
+    let known_hosts_path = custom_path.clone().or_else(default_known_hosts_path);
+    let Some(path) = known_hosts_path else {
+        return Ok(trust);
+    };
+    if !path.exists() {
+        return Ok(trust);
+    }
+
+    let content = std::fs::read_to_string(&path).map_err(|e| {
+        AnvilError::invalid_config(format!(
+            "could not read known_hosts {}: {e}",
+            path.display(),
+        ))
+    })?;
+    let parsed: KnownHostsFile = parse_known_hosts(&content)?;
+
+    for direct in parsed.direct {
+        if wildcard_match(&direct.host_pattern, host) {
+            trust.fingerprints.push(direct.fingerprint);
+        }
+    }
+    for ca in parsed.cert_authorities {
+        if wildcard_match(&ca.host_pattern, host) {
+            trust.cert_authorities.push(ca);
+        }
+    }
+    for rev in parsed.revoked {
+        if wildcard_match(&rev.host_pattern, host) {
+            trust.revoked.push(rev);
+        }
+    }
+
+    Ok(trust)
+}
+
+/// Returns the embedded SHA-256 fingerprints for the listed
+/// well-known hosts.  Internal helper used by both
+/// [`fingerprints_for_host`] and [`host_key_trust`].
+fn embedded_fingerprints(host: &str) -> Vec<String> {
+    match host {
+        "github.com" | "ssh.github.com" => {
+            GITHUB_FINGERPRINTS.iter().map(|&s| s.to_owned()).collect()
+        }
+        "gitlab.com" | "altssh.gitlab.com" => {
+            GITLAB_FINGERPRINTS.iter().map(|&s| s.to_owned()).collect()
+        }
+        "codeberg.org" => CODEBERG_FINGERPRINTS
+            .iter()
+            .map(|&s| s.to_owned())
+            .collect(),
+        _ => Vec::new(),
+    }
+}
+
 /// Appends `host SHA256:<fingerprint>` as a new line to the `known_hosts`
 /// file at `path`, creating the file (and any missing parent directories)
 /// if needed.
@@ -334,4 +441,84 @@ mod tests {
         let err = result.unwrap_err();
         assert!(err.to_string().contains("git.example.com"));
     }
+
+    // ── M14: host_key_trust ──────────────────────────────────────────────────
+
+    /// Helper: write `content` to a fresh temp file and return its path.
+    fn write_known_hosts(content: &str) -> (tempfile::TempDir, std::path::PathBuf) {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("known_hosts");
+        std::fs::write(&path, content).expect("write");
+        (dir, path)
+    }
+
+    #[test]
+    fn host_key_trust_embeds_well_known_fingerprints() {
+        let trust = host_key_trust("github.com", &None).expect("trust");
+        assert_eq!(trust.fingerprints.len(), 3);
+        assert!(trust.cert_authorities.is_empty());
+        assert!(trust.revoked.is_empty());
+    }
+
+    #[test]
+    fn host_key_trust_pattern_matches_cert_authority() {
+        let (_g, path) = write_known_hosts(
+            "@cert-authority *.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILM+rvN+ot98qgEN796jTiQfZfG1KaT0PtFDJ/XFSqti ca\n",
+        );
+        let trust = host_key_trust("foo.example.com", &Some(path)).expect("trust");
+        assert_eq!(trust.cert_authorities.len(), 1);
+        assert_eq!(trust.cert_authorities[0].host_pattern, "*.example.com");
+    }
+
+    #[test]
+    fn host_key_trust_pattern_excludes_non_match() {
+        let (_g, path) = write_known_hosts(
+            "@cert-authority *.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILM+rvN+ot98qgEN796jTiQfZfG1KaT0PtFDJ/XFSqti ca\n",
+        );
+        let trust = host_key_trust("other.org", &Some(path)).expect("trust");
+        assert!(trust.cert_authorities.is_empty());
+    }
+
+    #[test]
+    fn host_key_trust_revoked_pattern_matches() {
+        let (_g, path) = write_known_hosts(
+            "@revoked *.example.com SHA256:revokedfp\n\
+             @revoked unrelated.com SHA256:other\n",
+        );
+        let trust = host_key_trust("foo.example.com", &Some(path)).expect("trust");
+        assert_eq!(trust.revoked.len(), 1);
+        assert_eq!(trust.revoked[0].fingerprint, "SHA256:revokedfp");
+    }
+
+    #[test]
+    fn host_key_trust_combines_direct_and_embedded() {
+        let (_g, path) = write_known_hosts("github.com SHA256:extra-pin\n");
+        let trust = host_key_trust("github.com", &Some(path)).expect("trust");
+        // Three embedded + one extra direct.
+        assert_eq!(trust.fingerprints.len(), 4);
+        assert!(trust.fingerprints.contains(&"SHA256:extra-pin".to_owned()));
+    }
+
+    #[test]
+    fn host_key_trust_missing_file_returns_embedded_only() {
+        let trust = host_key_trust(
+            "github.com",
+            &Some(std::path::PathBuf::from("/this/path/does/not/exist")),
+        )
+        .expect("trust");
+        assert_eq!(trust.fingerprints.len(), 3);
+        assert!(trust.cert_authorities.is_empty());
+        assert!(trust.revoked.is_empty());
+    }
+
+    #[test]
+    fn host_key_trust_empty_for_unknown_host_no_file() {
+        // Unlike `fingerprints_for_host`, `host_key_trust` does NOT
+        // error on an empty trust set — that is the caller's policy
+        // call.  This is the path the AcceptNew policy relies on.
+        let trust = host_key_trust("git.example.com", &None).expect("trust");
+        assert!(trust.fingerprints.is_empty());
+        assert!(trust.cert_authorities.is_empty());
+        assert!(trust.revoked.is_empty());
+    }
 }

src/session.rs

@@ -38,6 +38,12 @@ struct GitwayHandler {
     /// — the handler will record the first fingerprint it sees in that
     /// case.
     fingerprints: Vec<String>,
+    /// SHA-256 fingerprints explicitly revoked for this host (M14, FR-64).
+    /// Checked **before** the policy and fingerprint paths: a presented
+    /// key that hits one of these is rejected unconditionally — even
+    /// [`StrictHostKeyChecking::No`] cannot override a `@revoked`
+    /// entry.
+    revoked: Vec<String>,
     /// Host-key verification policy (FR-8).
     policy: StrictHostKeyChecking,
     /// Hostname being connected to — needed by the
@@ -64,6 +70,7 @@ impl fmt::Debug for GitwayHandler {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         f.debug_struct("GitwayHandler")
             .field("fingerprints", &self.fingerprints)
+            .field("revoked", &self.revoked)
             .field("policy", &self.policy)
             .field("host", &self.host)
             .field("custom_known_hosts", &self.custom_known_hosts)
@@ -83,8 +90,24 @@ impl client::Handler for GitwayHandler {
         let fp = server_public_key.fingerprint(HashAlg::Sha256).to_string();
         log::debug!("session: checking server host key {fp}");
 
+        // M14 / FR-64: a `@revoked` entry beats every other policy —
+        // even `StrictHostKeyChecking::No` cannot override an explicit
+        // revocation.  This runs first so a compromised key can't be
+        // accepted via the insecure-skip path.
+        if self.revoked.iter().any(|r| r == &fp) {
+            return Err(AnvilError::host_key_mismatch(fp.clone()).with_hint(format!(
+                "{fp} is listed in a @revoked entry for {} in the known_hosts \
+                 file (M14, FR-64). Refusing the connection unconditionally — \
+                 the key has been explicitly blocklisted. Remove the @revoked \
+                 line if the revocation was a mistake, or rotate the upstream \
+                 host key.",
+                self.host,
+            )));
+        }
+
         // StrictHostKeyChecking=No: accept any key.  Equivalent to the
-        // 0.2.x `--insecure-skip-host-check` path.
+        // 0.2.x `--insecure-skip-host-check` path.  Reached only after
+        // the `@revoked` check above.
         if matches!(self.policy, StrictHostKeyChecking::No) {
             log::warn!("host-key verification skipped (StrictHostKeyChecking=No)");
             if let Ok(mut guard) = self.verified_fingerprint.lock() {
@@ -201,35 +224,56 @@ impl AnvilSession {
     /// `auth_banner` / `verified_fingerprint` mutex pair.
     fn build_handler_pieces(config: &AnvilConfig) -> Result<HandlerPieces, AnvilError> {
         let russh_cfg = Arc::new(build_russh_config(config.inactivity_timeout));
-        // For StrictHostKeyChecking=AcceptNew with a writable known_hosts
-        // path, an empty fingerprint set is acceptable — the handler will
-        // record the first fingerprint it sees.  Every other policy
-        // (Yes / No) treats the lookup error as fatal as before.
-        let fingerprints =
-            match hostkey::fingerprints_for_host(&config.host, &config.custom_known_hosts) {
-                Ok(fps) => fps,
-                Err(e) => {
-                    if matches!(
-                        config.strict_host_key_checking,
-                        StrictHostKeyChecking::AcceptNew
-                    ) && config.custom_known_hosts.is_some()
-                    {
-                        log::info!(
-                            "session: no fingerprints known for {}; \
-                         accept-new will record on first connection",
-                            config.host,
-                        );
-                        Vec::new()
-                    } else {
-                        return Err(e);
-                    }
-                }
-            };
+        // M14: pull the trust view (direct fingerprints + revoked
+        // entries) in one pass.  For
+        // `StrictHostKeyChecking::AcceptNew` with a writable
+        // `custom_known_hosts` path an empty fingerprint set is
+        // tolerated — the handler will record the first fingerprint
+        // it sees.  Every other policy (Yes / No) treats a fully-
+        // empty trust set as fatal, with the long-form hint copied
+        // from `fingerprints_for_host`.
+        let trust = hostkey::host_key_trust(&config.host, &config.custom_known_hosts)?;
+        let revoked: Vec<String> = trust.revoked.into_iter().map(|r| r.fingerprint).collect();
+
+        let fingerprints = if !trust.fingerprints.is_empty() {
+            trust.fingerprints
+        } else if matches!(
+            config.strict_host_key_checking,
+            StrictHostKeyChecking::AcceptNew
+        ) && config.custom_known_hosts.is_some()
+        {
+            log::info!(
+                "session: no fingerprints known for {}; \
+                 accept-new will record on first connection",
+                config.host,
+            );
+            Vec::new()
+        } else {
+            return Err(AnvilError::invalid_config(format!(
+                "no fingerprints known for host '{}'",
+                config.host
+            ))
+            .with_hint(format!(
+                "Gitway refuses to connect to hosts whose SSH fingerprint it can't \
+                         verify (no trust-on-first-use). Either you typed the hostname wrong, \
+                         or this is a self-hosted server and you need to pin its fingerprint: \
+                         fetch it from the provider's docs (GitHub, GitLab, Codeberg publish \
+                         them) and append one line to ~/.config/gitway/known_hosts:\n\
+                         \n\
+                             {} SHA256:<base64-fingerprint>\n\
+                         \n\
+                         As a last resort, re-run with --insecure-skip-host-check (not \
+                         recommended — this disables MITM protection).",
+                config.host,
+            )));
+        };
+
         let auth_banner = Arc::new(Mutex::new(None));
         let verified_fingerprint = Arc::new(Mutex::new(None));
 
         let handler = GitwayHandler {
             fingerprints,
+            revoked,
             policy: config.strict_host_key_checking,
             host: config.host.clone(),
             custom_known_hosts: config.custom_known_hosts.clone(),