Plan 00054: make GitHub SSH verification + git wrappers port-agnostic for 443

Two more port-22 hardwires that only surfaced at runtime on a port-22-blocked
network (the deploy chicken-and-egg the user hit):

1. 'Verify SSH access' probe targeted only the configured endpoint, so on a
   restricted network it tried github.com:22, got 'Connection refused', and the
   play died before 443 could help. Now it falls back to ssh.github.com:443
   (same host keys/identity) when the primary endpoint does not authenticate —
   the same auto-fallback ccy uses. Task timeout 30 -> 45 for the second attempt.

2. Deployed per-account git wrappers (git()/git-<alias>()/clone-<alias>) forced
   'ssh -F /dev/null -o HostName=github.com', isolating the key but also
   bypassing the ~/.ssh/config 443 override — so wrapper-driven git push stayed
   on port 22 even with 443 enabled. New shared _gh443_sshcmd helper builds the
   sshCommand from the GITHUB_SSH_443 runtime signal (ssh.github.com:443 when set,
   else github.com:22; unset = byte-identical to the old string). Key-isolation
   model untouched. Wrapper users need GITHUB_SSH_443 in-shell (automatic with
   always-on profile.d, or eval "$(github-ssh-443 env)").

Other play tasks (audit, override apply, key fetch) already use the GitHub HTTPS
API/meta endpoint, so they work on a port-22-blocked network.

Docs + plan notes updated. QA green; --syntax-check clean.

Refs: CLAUDE/Plan/00054-github-ssh-443-host-level

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: LTSCommerce

CLAUDE/Plan/00054-github-ssh-443-host-level/PLAN.md

@@ -280,3 +280,24 @@ signal. Always-on uses the profile.d export of the same var.
   self-default check (PCRE backreference, targets the `\1 | default` idiom only so
   it doesn't false-positive on `blockinfile` literals like nordvpn's
   `x: {{ x }}`). Documented in `CLAUDE/QA.md` and `CLAUDE/AgentNotes.md`.
+- **Restricted-network chicken-and-egg fixed (found on first HOST run, port 22
+  blocked).** Two more port-22 hardwires that only fail at runtime on a blocked
+  network:
+  1. The "Verify SSH access" probe targeted only the configured endpoint
+     (`github.com:22` when the toggle is off), so the play died with "Connection
+     refused" before 443 could help. Fix: the probe now falls back to
+     `ssh.github.com:443` (same host keys/identity) when the primary endpoint does
+     not authenticate — the same auto-fallback pattern ccy uses. Verification is
+     now port-agnostic; ansible task `timeout` 30→45 to fit two attempts.
+  2. The deployed per-account git wrappers (`git()` auto-detect, `git-<alias>()`,
+     `clone-<alias>`) forced `ssh -F /dev/null -o HostName=github.com`, which
+     isolates the key but also bypasses the `~/.ssh/config` 443 override — so even
+     with 443 enabled, wrapper-driven `git push` stayed on port 22. Fix: a shared
+     `_gh443_sshcmd` helper in the deployed include builds the sshCommand from the
+     `GITHUB_SSH_443` runtime signal (ssh.github.com:443 when set, else
+     github.com:22; unset → byte-identical to the old string). Key-isolation model
+     untouched. Note: wrapper users need `GITHUB_SSH_443` in the shell — automatic
+     with always-on (profile.d) or `eval "$(github-ssh-443 env)"`; plain `git`
+     with `git@github.com-<alias>:` remotes already routes via the override block.
+     Everything else in the play (key audit, override apply, key fetch) already used
+     the GitHub HTTPS API / meta endpoint, so it works on a port-22-blocked network.

docs/github-multi-account.md

@@ -260,6 +260,15 @@ to `github.com`, pass their globs so they are rerouted too:
 github-ssh-443 on --aliases 'myorg_deploy_*,clientco_*'
 ```
 
+> **Run `eval "$(github-ssh-443 env)"` too.** The per-account git wrappers
+> (`git`, `git-<alias>`, `clone-<alias>`) force an isolated `ssh -F /dev/null`
+> command that bypasses `~/.ssh/config`, so they follow the `GITHUB_SSH_443`
+> **environment** signal, not the config block. Without the `eval`, plain `git`
+> with a `git@github.com-<alias>:` remote still routes over 443 (via the config
+> override), but the wrappers would stay on port 22. Always-on mode sets the env
+> var for every shell via `/etc/profile.d`, so this only matters for the temporary
+> CLI path.
+
 ### Desktop host — always-on (persisted)
 
 Set the variable in `environment/localhost/host_vars/localhost.yml` and re-run the

playbooks/imports/play-github-cli-multi.yml

@@ -539,13 +539,26 @@
             # specified key. Without these, ssh also offers every key in the
             # running ssh-agent — GitHub rate-limits after ~5 failed attempts
             # and ssh hangs until the outer timeout fires (rc=124, no output).
-            timeout 15 ssh -F /dev/null -o IdentityAgent=none -o IdentitiesOnly=yes \
-              -o BatchMode=yes -o ConnectTimeout=10 \
-              -o StrictHostKeyChecking=accept-new -i "$tmp_key" \
-              -p {{ github_ssh_port }} -T git@{{ github_ssh_hostname }} 2>&1
+            out=$(timeout 15 ssh -F /dev/null -o IdentityAgent=none -o IdentitiesOnly=yes \
+              -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new \
+              -i "$tmp_key" -p {{ github_ssh_port }} -T git@{{ github_ssh_hostname }} 2>&1)
+            # Port-agnostic fallback: if the primary endpoint did not authenticate
+            # (e.g. a network that firewalls port 22), retry over ssh.github.com:443,
+            # which serves the SAME host keys and identity. This keeps verification
+            # working on restricted networks and removes the chicken-and-egg where
+            # the play cannot pass on a port-22-blocked network before 443 is on.
+            if ! printf '%s' "$out" | grep -q "successfully authenticated"; then
+              alt=$(timeout 15 ssh -F /dev/null -o IdentityAgent=none -o IdentitiesOnly=yes \
+                -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new \
+                -i "$tmp_key" -p 443 -T git@ssh.github.com 2>&1)
+              if printf '%s' "$alt" | grep -q "successfully authenticated"; then
+                out="$alt"
+              fi
+            fi
+            printf '%s\n' "$out"
           args:
             executable: /bin/bash
-          timeout: 30
+          timeout: 45
           register: ssh_test
           changed_when: false
           failed_when: ssh_test.rc not in [0, 1, 124, 255]
@@ -656,6 +669,24 @@
             block: |
               # GitHub CLI Multi-Account Aliases and Functions
 
+              # GitHub SSH-over-443 awareness for the per-account git wrappers.
+              # Those wrappers force `ssh -F /dev/null -o HostName=github.com` to
+              # isolate to a single key (ignoring ~/.ssh/config), which also
+              # bypasses the 443 override block. So they build their sshCommand
+              # through this helper, which consults the GITHUB_SSH_443 runtime
+              # signal and swaps the endpoint to ssh.github.com:443 when set
+              # (host export, /etc/profile.d, or `eval "$(github-ssh-443 env)"`),
+              # else github.com:22. Unset → identical to the previous behaviour.
+              _gh443_sshcmd() {
+                  local key="$1"
+                  local host="github.com" port="22"
+                  if [ "${GITHUB_SSH_443:-0}" = "1" ]; then
+                      host="ssh.github.com"
+                      port="443"
+                  fi
+                  printf 'ssh -F /dev/null -o HostName=%s -p %s -i %s -o IdentitiesOnly=yes -o AddKeysToAgent=yes' "$host" "$port" "$key"
+              }
+
               # Quick status check for all GitHub accounts
               function gh-status() {
                   echo "GitHub CLI Account Status:"
@@ -792,7 +823,7 @@
 
                   # Switch to the right account and clone
                   gh auth switch --hostname github.com --user "{{ username }}" 2>/dev/null
-                  gh repo clone "$repo_path" -- --config core.sshCommand="ssh -F /dev/null -o HostName=github.com -i ~/.ssh/github_{{ alias }} -o IdentitiesOnly=yes -o AddKeysToAgent=yes"
+                  gh repo clone "$repo_path" -- --config core.sshCommand="$(_gh443_sshcmd ~/.ssh/github_{{ alias }})"
                   local exit_code=$?
 
                   # Set the remote to use the specific SSH key
@@ -1034,7 +1065,7 @@
                       # would try to resolve the literal host "github.com-<alias>"
                       # and fail ("Could not resolve hostname"). Forcing HostName
                       # restores the real target while keeping the isolation.
-                      command git -c "core.sshCommand=ssh -F /dev/null -o HostName=github.com -i ~/.ssh/github_${detected_alias} -o IdentitiesOnly=yes -o AddKeysToAgent=yes" "$@"
+                      command git -c "core.sshCommand=$(_gh443_sshcmd ~/.ssh/github_${detected_alias})" "$@"
                   else
                       # No account detected, use standard git
                       command git "$@"
@@ -1051,7 +1082,7 @@
               # "github.com-<alias>" used by clone-<alias>/remote-<alias> remotes.
               {% for alias in github_accounts.keys() %}
               function git-{{ alias }}() {
-                  command git -c "core.sshCommand=ssh -F /dev/null -o HostName=github.com -i ~/.ssh/github_{{ alias }} -o IdentitiesOnly=yes -o AddKeysToAgent=yes" "$@"
+                  command git -c "core.sshCommand=$(_gh443_sshcmd ~/.ssh/github_{{ alias }})" "$@"
               }
               {% endfor %}