install runs the system ssh and hands the host a short shell script.
The public key line reaches it on standard input, never on a command
line others on the host could read. The script makes ~/.ssh and
authorized_keys if missing, adds the line unless it is already there,
and says which of the two it did.
to serves the key from an agent inside the tool, on a unix socket in a
temporary directory only its owner can enter, and points ssh at it with
-o IdentityAgent. Socket and directory go when the command ends and the
private key is never written to disk. Only this command ends with the
status ssh ended with rather than status 1.
Model: opus-5
keyfunc mnemonic derives a 12, 18 or 24 word child mnemonic through BIP-85's own mnemonic application, with the specification's test vectors as tests. One review round, passed with no findings; the reviewer reproduced the vectors from an implementation written from the specification alone.
Model: opus-5 (implementation and review); fable-5-1 (landing)
The module, the script entrypoints and Makefile, Docker-only linting, the mnemonic sources in the specified order with their refusals, the BIP-85 derivation, and keyfunc ssh pub and priv with the README test vectors as tests. Two review rounds; the second passed with no findings.
Model: opus-5 (implementation and review); fable-5-1 (landing)
The README is the specification sneak approved on 2026-09-07, moved
here from the hacks repository: deterministic SSH keys, age identities
with encrypt and decrypt, and child mnemonics, all derived from one
BIP-39 mnemonic and stored nowhere.
Model: fable-5-1
