# Forge 4.0.2

Matched signed Anvil, Hammer and Connect release. Product versions are 4.0.2; installer file versions are 4.0.2.0.

## Workspace verification using existing SSH access

Connect now supports workspace verification over existing authorized SSH access without requiring Spark. The supported target is a Linux/POSIX Git workspace with `/usr/bin/git`, an actual absolute repository/working-directory assignment, and a committed HEAD. Native Windows remote shells and non-Git or unborn repositories are not supported by this SSH transport.

SSH private keys remain on the Windows workstation. Connect uses its existing SSH key or agent and strict known-host trust; it does not upload SSH private keys to Anvil or automatically accept changed host keys. An Administrator must explicitly approve the workstation executor and the reviewed SSH host fingerprint. Executor approval alone does not verify a workspace.

## Upgrade and use

1. Back up Anvil data, database, encrypted Secrets and the matching certificate/private-key recovery material together. Retain previous signed installers.
2. Install the matched Anvil 4.0.2 server first, then Connect and Hammer 4.0.2. Start a fresh Codex chat after updating Connect.
3. From the Windows workstation that already has authorized SSH access, ask Connect to inspect the engineer's workspace executor using `forge_connect_workspace_executor` with `action: inspect`, the engineer and existing SSH target.
4. An Administrator reviews the executor and host fingerprints and explicitly authorizes approval using those exact fingerprints. An agent must not approve itself.
5. Ask Connect to run `forge_connect_verify_workspace` with `transport: ssh`. The signed verification receipt is checked by Anvil against current authority and a single-use challenge. Reopen the engineer after successful verification; all other startup requirements still apply.

The SSH workflow uses Connect. Hammer consumes the verified workspace proof from Anvil; Hammer's VERIFY WORKSPACE button still initiates the Spark path. Spark remains an optional supported verification transport, and its download packages are unchanged by this release.

Changed workspace assignments require renewed approval and verification. Failed or incomplete verification, revocation and missing Git/HEAD leave startup blocked. Previous discovery evidence and engineering history are retained. Do not edit database records or mark declarations as verified to bypass discovery.

This is explicitly approved workstation-executor trust, not independent hardware attestation. A compromised approved workstation or signing key can forge its own receipts; revoke the affected device or executor grant through normal administration.

## Controlled validation

Controlled staging passed 99 architecture tests, 7 installer tests, 28 Connect unit tests, 77 memory/authority checks, 54 Spark discovery checks, 24 actual SSH checks and 3 empty-conversation Hammer adapter reconstructions. All 13,527 original historical records and permanent artifact hashes were preserved.

The SSH checks exercised an existing key against an actual Linux Git repository without an assigned Spark. External customer acceptance and production Anvil installation are not claimed. Customers must validate their own environment after an authorized upgrade.

Verify the downloaded SHA-256 checksums before installation. Immutable versioned 4.0.2 files identify this release; standard installer aliases advance only as a matched set.