push

Co-authored-by: Copilot <copilot@github.com>

CHANGELOG.md

@@ -0,0 +1,34 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+---
+
+## [Unreleased]
+
+### Added
+- `README.md` — project overview, description, example workflow, supported distributions, and suggested tooling
+- `ROADMAP.md` — phased development plan covering decisions, data collection, AI integration, CLI design, and hardening
+- `CHANGELOG.md` — this file; established changelog tracking for the project
+- `.gitea/workflows/ci.yml` — Gitea Actions CI workflow for push and pull request events
+- Python package scaffold with `src` layout and project metadata in `pyproject.toml`
+- Initial CLI entrypoint with agreed SSH flags: `--identity-file`, `--jump-host`, and `--ignore-ssh-config`
+- Input parsing/validation module and core request model
+- SSH configuration scaffold module for upcoming connection/read-only execution work
+- Implemented SSH module with real key-based command execution via system `ssh`
+- Added explicit SSH port support across CLI, input parsing, request model, and SSH client (`--port`, e.g. 5566)
+- Added live SSH connectivity probe (`uname -a`) enabled by default, with `--no-probe` opt-out and non-zero exit on failure
+- Read-only command policy enforcement (allowlist + blocked shell operators)
+- Test scaffold (`pytest`) with initial parser and CLI coverage
+- SSH test coverage for policy checks, SSH argument construction, and config summary behavior
+- CI workflow for lint (`ruff`), type-check (`mypy`), and tests (`pytest`)
+
+### Decided
+- Implementation language: **Python**
+- Distribution strategy: single distributable binary via **Nuitka** (PyInstaller as fallback)
+- SSH authentication: **keypair only** (ed25519/RSA); auto-accept new hosts; hard reject on host key change with MITM warning
+- SSH bastion support: `--jump-host` flag using SSH native ProxyJump
+- SSH config behavior: use `~/.ssh/config` by default; allow override via `--ignore-ssh-config`
+- Interface: **interactive REPL** for v0.1; `textual`-based TUI (split-pane) for v0.2+