Release Scope

Summary

Traversio 1.0.x is the current documented Apple-first SSH client release line.

The release line focuses on a practical client surface:

connect to SSH servers with explicit host trust and authentication
run commands and interactive shells
transfer files through SFTP and single-file SCP helpers
forward TCP and Unix-socket traffic through SSH
route SSH setup through SOCKS5, HTTP CONNECT, or ProxyJump
expose structured diagnostics for application support flows

The release is not an all-purpose OpenSSH replacement. It does not own every credential store, trust database, reconnect policy, terminal behavior, forwarding variant, proxy auth family, or legacy algorithm.

Included In The Current Boundary

Connection

SSHClient.connect(configuration:) for explicit long-lived ownership.
SSHClient.withConnection(configuration:_:) for closure-scoped ownership.
Structured connection metadata, state snapshots, and state event streams.
Setup timeouts, host-key trust timeouts, reply timeouts, automatic local rekey policy, optional idle keepalive, optional compression, optional connection proxies, and optional ProxyJump hop chains.

Authentication And Trust

Password authentication.
Password-change callback authentication.
Keyboard-interactive authentication.
Built-in Ed25519, RSA, and ECDSA public-key authentication.
Callback-backed public-key signing.
SSH agent-backed public-key signing.
OpenSSH Ed25519, RSA, and ECDSA private-key loading.
OpenSSH key generation for supported Ed25519, ECDSA, and RSA paths.
Explicit opt-in legacy ssh-rsa.
Exact pinning, trusted key sets, app-owned first-seen trust, changed-key handling, async trust callbacks, and OpenSSH known_hosts.

Sessions

Collected exec.
Streamed exec.
Named subsystem startup.
PTY-backed shell startup.
Environment requests, standard-error writes, PTY resize, outbound signals, exit status, and exit-signal reporting.
Channel window snapshots and manual receive-window adjustment for advanced callers.

SFTP And SCP

SFTP metadata, listing, file handles, reads, writes, mutations, filesystem queries, symlink/readlink, and selected OpenSSH extensions.
Bounded whole-file read/write helpers.
Local file URL upload/download.
Recursive directory upload/download.
Resumable whole-file upload/download.
Progress callbacks and caller-owned continuation checks.
Single-file SCP receive/send and local URL wrappers.

Forwarding And Routing

Raw direct-tcpip channels.
Raw [email protected] channels.
Local TCP forwarding.
Dynamic SOCKS forwarding.
Raw remote TCP listener helpers.
Fixed remote TCP bridge helpers.
Remote streamlocal listener helpers for OpenSSH streamlocal servers.
SOCKS5 and HTTP CONNECT connection proxies for the outer TCP route.
API-level ProxyJump hop chains.

Diagnostics

Structured SSHClientError wrappers for connection and post-auth failures.
Public connection and operation diagnostic payloads.
SFTP status details.
Structured log handlers and a bounded log recorder.
OSLog adapters for supported deployment targets.
Redacted support-report helpers.
Route-aware SSH port latency measurement.

Application-Owned Responsibilities

Applications should own:

reconnect timing
session and shell restoration
SFTP and forwarding restoration after reconnect
credential storage
trust-store persistence
Keychain integration
large-output retention limits
user-facing approval flows for changed host keys
critical-workload rollout policy

Traversio exposes state, errors, diagnostics, and explicit close behavior so applications can build those policies without depending on hidden library retries.

Not Included In This Release Line

These areas are not part of the current release line:

library-owned automatic reconnect
local ssh_config parsing
mandatory built-in trust-store persistence
mandatory Keychain-backed credential storage
hostbased authentication
security-key authentication
X11 forwarding
auth-agent forwarding
enterprise proxy auth families beyond documented SOCKS5 and HTTP CONNECT support
recursive SCP
broad legacy algorithm compatibility beyond explicit ssh-rsa
automatic segmented multi-session SFTP transfers
full OpenSSH host-certificate breadth beyond the documented Ed25519 and ECDSA P-256 paths

Unsupported algorithms and auth modes are not silent fallback paths. Traversio either does not offer them or requires an explicit caller-controlled compatibility option.

Recovery Boundary

SSHConnection.stateEvents and typed operation failures are the public recovery boundary.

Applications can observe:

transport state changes
path changes where the active backend provides them
viability changes where the active backend provides them
terminal connection loss
explicit close
setup, auth, trust, proxy, timeout, and post-auth operation failures

Applications should then decide whether to reconnect, how long to wait, which user message to show, and which child work to recreate.

Compatibility Statement

The current documented transport profile focuses on:

Curve25519 and NIST ECDH key exchange.
Ed25519, ECDSA, RSA SHA-2, and explicit opt-in ssh-rsa.
AES-CTR with HMAC-SHA-2 or UMAC.
AES-GCM and Chacha20-Poly1305 AEAD.
none, RFC 4253 zlib, and delayed OpenSSH [email protected] compression.
OpenSSH strict-kex marker handling.

The release line has repeatable validation across OpenSSH, Dropbear, AsyncSSH, proxy routes, ProxyJump, rekey, compression, adverse-path, long-running, and performance/resource workloads. Broader deployment validation remains important for applications that depend on unusual servers, old algorithms, enterprise proxies, or long-lived unattended sessions.