LAB route confirmation (2026-09-27)

Confirming Tam -> LAB access route after shared-laptop re-auth.

Route (VERIFIED 2026-09-27)

• Route: lab@192.168.4.60 via ~/.ssh/lab_ctrl_key
• Pinned in ~/.ssh/config as Host lab
• Write test: sha256 local==remote MATCH (note landed in the vault)
• Vault path: /home/lab/SolOS/docs/vault/solos/research/tam (.solos/docs/vault is a symlink -> SolOS/docs/vault; one inode, no dual-root problem)

Key isolation matrix (IdentitiesOnly=yes + IdentityAgent=none)

⚠️ Diagnostic trap — ssh-agent masks key rejection

Naive test (no isolation flags) reports all five keys AUTH_OK: the agent offers 5 identities and the LAB accepts any one of the authorised ones, so a rejected -i key is silently rescued. Always test keys with -o IdentitiesOnly=yes -o IdentityAgent=none or you will get false positives. This is also why the reverse reading fails — the tam_* keys really are rejected.

OPEN: cron 305a8f2d68a3 still writes to the OLD box

scripts/sync_vault.sh RHOST=ubuntu@100.124.146.127, RBASE= /home/ubuntu/.solos/docs/vault/solos/research/tam, SSH_OPTS=tam_vault_key. Old box is still reachable and answers the write-only banner ("tam vault access is write-only"), so the cron is NOT failing — last run 2026-09-27 13:07 OK pushed=0. It is succeeding against a non-canonical target. Drift: local SRC 29 notes vs LAB 51 notes. Re-point to lab@192.168.4.60:/home/lab/SolOS/docs/vault/solos/research/tam with lab_ctrl_key when LAB is declared registry-of-record.