Non-exporting signing through a caller-selected OpenSSH agent Unix socket.

Protocol: draft-miller-ssh-agent-14, RFC 8709, RFC 8332, and RFC 5656.

new/4 accepts a trusted public key and an explicit absolute socket path (1–103 bytes, no NUL). It proves possession by signing empty bytes and checking the returned signature. Only timeout: is accepted, with the custody boundary's 5,000 ms default and 1–300,000 ms bound. It never reads SSH_AUTH_SOCK, starts an agent, loads keys, or accesses private files. The caller owns agent access and authorization. An OpenSSH agent is a separate process, not an HSM guarantee.

Supports HTTP Ed25519, RSA-v1_5-SHA256 (agent flag 2), P-256, and P-384, plus explicit JWS EdDSA, RS256, ES256, and ES384. PSS and HMAC reject. Each sign uses one new connection; replies cannot spill into another operation. Identity lists are bounded to 256 keys, frames to 1,048,576 bytes, key blobs and comments to 16,384 bytes. Selection uses exact public components, never a comment or key ID. ECDSA mpints convert to fixed-width r || s, and every returned signature must verify with Crypto before release. Verification uses the trusted public key locally; it does not assert current agent possession or authorization.

Unknown keys at construction yield :custodian_rejected; removed keys during signing yield :key_not_found. Connect and pre-send connection failures yield retryable :custodian_unavailable. After a request is written, a closed connection, short frame, or malformed reply yields nonretryable :custodian_protocol; deadline expiry yields :deadline_exceeded. Deadline or caller death closes the worker's connection. No logs or telemetry contain the path, references, comments, bases, or signatures.