feat(ssh): support macOS targets with a native connector #153

Parent roadmap: #141. Extension after the eleven core phases; it does not block the Windows-target acceptance gate #150.

Objective

Support selected macOS SSH targets with a user-owned connector and verified Codex chat visibility.

Scope

Port the #146/#147 connector contract to the authenticated macOS target account, with readiness evaluated separately for each execution mode. Check OpenSSH reachability, Codex installation/login/version and mode-specific capabilities before installation or dispatch. An SSH connection by itself does not establish permission to control the GUI session. Distinguish NEW and EXISTING visible app chats from hidden codex exec --ephemeral, and prove actual target-app rendering or absence for the pinned client version. Visible modes require the intended logged-in GUI session and its permissions; refuse unsupported or ambiguous GUI routing. Hidden mode does not inherently require an open app or GUI session: independently verify CLI authentication, protected key access and execution lifecycle. If those prerequisites fail after logout or locking, report hidden mode unavailable without bypassing them.

Install/update an account-owned signed/trusted versioned connector with atomic activation, rollback, durable UUID/digest receipts and remote admission locks interoperable with #147. Use macOS account/Keychain protection plus authenticated encryption for persisted prompt/output state, define locked-Keychain and logout behavior, and keep provider transcripts and OS crash/log copies separate from Atenea's history. Use a lifecycle mechanism appropriate to each mode; a background launch daemon is not evidence of an interactive app session. Any required GUI-control permission must be granted through the normal local OS flow; do not copy permission databases or bypass consent.

Extend doctor, UI and history with macOS-specific prerequisites and visible/hidden readiness. Preserve controller trust, per-account credential authorization, audited mutations, safe cancellation and ambiguous-request recovery. A macOS target can coexist with Windows targets without alias-based identity collisions.

Feasibility before implementation

Run a harmless new-visible/existing-visible/hidden canary on the intended Codex version before building the full connector. Record mode-specific session, authentication, Keychain and permission requirements. The three-mode acceptance below remains required; an unavailable route requires an explicit scope decision rather than assuming that installation will resolve it.

Acceptance criteria

• A real authorized macOS target passes install/update/rollback, doctor and protected-state checks under the correct user.
• NEW and EXISTING visible chats and hidden mode are each proved against the actual supported Codex client version. If a required route is unavailable, retain the issue as blocked or narrow scope only through an explicit product decision; a doctor result alone does not count as feature completion.
• Wrong/locked/logged-out user, app already busy, restart, lost connection and duplicate-controller cases keep truthful states and same-ID reconciliation.
• The existing controller window lists macOS and Windows targets with correct capabilities, logs and history.

Validation and evidence level

Native macOS packaging/signing and session tests, Go/connector checks, encrypted artifact scans and harmless real-target runs. Distinguish URI/process launch, app conversation ownership and observed rendering.

Dependencies and risks

Depends on #147 and the core acceptance #150. Reuse #142 protocol, #143 inventory/trust, #144 credentials and #145 audit; negotiate any new connector capability instead of assuming Windows behavior.

Out of scope

Copying a ChatGPT account between PCs, controlling another macOS user's GUI session, automatic SSH setup on an unreachable Mac, or a general remote shell.

Delivery boundary

One implementable branch/PR closes this issue only. Parent #141 remains the core delivery tracker; this extension has its own evidence and does not retroactively change #150. No real prompts, credentials or unredacted host logs in GitHub.