Design Windows SSH-agent forwarding and cross-adapter lifecycle migration

[BrettKinny]

This was generated by AI during triage.

Type: HITL

What to build

Design and validate a post-v1.1 Windows integration that can forward the Windows OpenSSH agent into a Linux Squarebox without exposing private-key files, and define an explicit safe migration between the adapter-native Git Bash and PowerShell Install identity formats. v1.1 itself supports Git Bash agent forwarding, native PowerShell read-only SSH-file fallback, and same-adapter rebuild/uninstall.

Acceptance criteria

• Document which Windows OpenSSH named-pipe or relay mechanisms work with supported Docker Desktop and Podman configurations, including their trust and cleanup boundaries.
• Prototype agent forwarding without copying private keys into the Box or requiring a read-write SSH directory mount.
• Define either a platform-neutral next Install identity schema or an explicit conversion command; FORMAT=1 files must remain data-only and must never be sourced or loosely reinterpreted.
• Preserve ownership checks, CurrentUserAllHosts and Git Bash profile safety, custom/non-ASCII paths, and retryable uninstall behavior across migration.
• Add native Windows tests for install in one adapter and migrate/uninstall in the other, plus negative tests for malformed or foreign state.
• Update README, SECURITY, migration guidance, and UAT only after the behavior is implemented and qualified.
• Record the chosen design and rejected alternatives in an ADR.

Blocked by

• Validate v1.1 Windows PowerShell and Git Bash lifecycle #102