# Mac Studio Auth Audit Report

**Date:** 2026-04-15
**Phase:** 4 — Mac Studio auth diagnosis + fix (Dispatch + Harness Hardening)
**Host:** joes-mac-studio-11047 (100.105.59.118 via Tailscale)

---

## === shell + env ===

**Could not collect.** SSH connection failed — see diagnosis below.

## === Claude Code binary ===

**Could not collect.** SSH connection failed — see diagnosis below.

## === Relevant env vars (sanitized) ===

**Could not collect.** SSH connection failed — see diagnosis below.

## === Zsh rc files (last 20 lines of each, auth-related) ===

**Could not collect.** SSH connection failed — see diagnosis below.

## === Keychain entries (if any) ===

**Could not collect.** SSH connection failed — see diagnosis below.

## === ~/.claude/ contents ===

**Could not collect.** SSH connection failed — see diagnosis below.

---

## SSH Connection Diagnosis

The MacBook Pro's ed25519 public key (`SHA256:YkG9w+Rwk2RsY98xHUNNA4rBPBN8oBSzCxjCmEMOKDw`) was offered to the Studio but **rejected**. The Studio's `authorized_keys` does not contain this key.

Verbose SSH log (auth-relevant excerpt):

```
debug1: Offering public key: /Users/joeturnerlin/.ssh/id_ed25519 ED25519 SHA256:YkG9w+Rwk2RsY98xHUNNA4rBPBN8oBSzCxjCmEMOKDw
debug1: Authentications that can continue: publickey,password,keyboard-interactive
...
debug1: Next authentication method: keyboard-interactive
debug1: read_passphrase: can't open /dev/tty: Device not configured
...
debug1: Next authentication method: password
debug1: read_passphrase: can't open /dev/tty: Device not configured
...
Received disconnect from 100.105.59.118 port 22:2: Too many authentication failures
```

**Root cause:** The public key is not in `~/.ssh/authorized_keys` on the Studio. Fallback methods (keyboard-interactive, password) require an interactive TTY which is unavailable in a Claude Code session.

**Tailscale connectivity:** Confirmed working — the Studio is online and reachable at 100.105.59.118 (`joes-mac-studio-11047`). The connection establishes and key exchange completes; only authentication fails.

---

## Outcome: needs JT manual intervention

**Scenario D applies.** The audit could not be completed because SSH public-key auth is not configured between this MacBook Pro and the Mac Studio. No config changes were made on either machine.

### What JT needs to do

1. **From the Mac Studio directly** (or via Screen Sharing), add this MacBook's public key to `~/.ssh/authorized_keys` on the Studio:

   ```bash
   # On the Mac Studio terminal:
   echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMRjxRhR+L7tj+DTEdKFqRWCYbBC/bK71ZXhob8FAiOG joeturnerlin@joes-mac-studio" >> ~/.ssh/authorized_keys
   chmod 600 ~/.ssh/authorized_keys
   ```

   (This key is at `~/.ssh/id_ed25519.pub` on the MacBook Pro. Its comment says `joeturnerlin@joes-mac-studio`, suggesting it may have originally been generated on the Studio.)

2. **Test connectivity:**

   ```bash
   # From MacBook Pro:
   ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 joeturnerlin@100.105.59.118 'echo "SSH works"'
   ```

3. **Once SSH works,** re-run this phase to complete the auth audit and determine which scenario (A, B, or C) applies for Claude Code authentication on the Studio.

### Why this wasn't caught earlier

Previous dispatches to the Studio likely used a different auth method (e.g., a tmux session already running from a prior interactive SSH, or the key was added then later rotated). The current MacBook ed25519 key is not authorized.

---

## Changes made

**None.** No files were modified on either machine (per Scenario D constraints).