M12.5+M12.6: AnvilConfig 0.3.0 — multi-IdentityFile, StrictHostKeyChecking, parse-and-warn

[UnbreakableMJ]

Summary

Two M12 sub-milestones combined in one PR (single file diff between them — keeping them separate would have been more friction than value):

• M12.5 — the semver-minor API break: identity_file → identity_files: Vec<PathBuf>, skip_host_check: bool → strict_host_key_checking: StrictHostKeyChecking. Cuts anvil-ssh 0.3.0.
• M12.6 — log::warn fires once per apply_ssh_config() call when the resolved config contains directives Anvil parses but does not yet honor (HostKeyAlgorithms, KexAlgorithms, Ciphers, MACs → M17; ConnectTimeout, ConnectionAttempts → M18).

This is the second of the M12 PRs. The first (M12.1-4: ssh_config parser + resolver, additive types) merged as #1. Subsequent work (gitway config show, NFR-24 diag wiring, NFR-15 bench, matrix completion) follows in M12.7-9 across this repo and Steelbore/Gitway.

M12.5 — Breaking changes (with deprecated shims)

0.2.x	0.3.0
AnvilConfig.identity_file: Option<PathBuf>	AnvilConfig.identity_files: Vec<PathBuf>
AnvilConfig.skip_host_check: bool	AnvilConfig.strict_host_key_checking: StrictHostKeyChecking
AnvilConfigBuilder::identity_file(p)	add_identity_file(p) / identity_files(vec)
AnvilConfigBuilder::skip_host_check(b)	strict_host_key_checking(StrictHostKeyChecking)

The deprecated builder methods + accessors stay as #[deprecated] shims so 0.2.x code keeps compiling (with warnings). Removal target: 1.0.

M12.5 — New additions

• AnvilConfigBuilder::apply_ssh_config(&ResolvedSshConfig) — layers ssh_config-derived defaults into the builder (HostName/Port/User override, IdentityFile-extend, StrictHostKeyChecking override, first UserKnownHostsFile fills custom_known_hosts if unset). Call before CLI overrides if you want CLI to win.
• StrictHostKeyChecking::AcceptNew minimal write path — when custom_known_hosts is set, the first-seen fingerprint of an unknown host is recorded; without that path set, the connect downgrades to Yes semantics with a warning. Full TOFU UX (interactive prompt + display) is post-M12.
• add_identity_file() / identity_files() / strict_host_key_checking() builder methods.

M12.5 — auth.rs semantics

find_identity now iterates config.identity_files in order. When the explicit list is non-empty, the well-known default search (~/.ssh/id_*) is suppressed — this matches OpenSSH: an explicit IdentityFile / --identity silences the default fallback. The default search runs only when no explicit identities were configured.

M12.6 — Warn on parsed-but-not-yet-honored directives

apply_ssh_config() calls a small helper that emits one log::warn! per pending milestone when the resolved config contains directives Anvil knows about but doesn't yet plumb through:

ssh_config: directive(s) HostKeyAlgorithms, KexAlgorithms parsed but not
yet honored (landing in M17 — Gitway PRD §8); current connections use
Anvil's hardcoded algorithm preferences

The warn fires at the bridge between ssh_config and AnvilConfig — gitway config show and similar inspection paths (which call resolve() directly without applying it to a builder) don't trigger it.

Test surface

• 154 lib tests (up from 143) including 9 new config tests (default policy, multi-add, replace-list, deprecated shims for both replaced fields, all three policy variants, apply_ssh_config layering + identity_files extension + custom-known-hosts non-overwrite) and 1 new auth test (multi-identity probe).
• 6 integration tests still green (test_connection + test_clone). Updated to the new strict_host_key_checking() builder method.
• The 1 ignored test is the pre-existing RSA SSHSIG limitation in ssh-key 0.6.7.

Test plan

• CI passes (Linux/macOS/Windows + MSRV 1.88).
• cargo fmt --all -- --check clean.
• cargo clippy --all-targets --all-features -- -D warnings clean.
• cargo test --lib --tests --locked green on all platforms.
• After merge: tag v0.3.0, publish to crates.io.

🤖 Generated with Claude Code