The CI pipeline deploys without holding a key

Every CI system accumulates the same liability: SSH deploy keys in the secrets vault, one per environment, rotated never.

Against a Hoody container, the pipeline just POSTs. /api/v1/terminal/execute with the deploy command, wait: false, a timeout: then polls /api/v1/terminal/result/{command_id} until it gets an exit code. The session is stateful, so cd /app in step one still holds in step four. Access is the URL plus proxy permissions: a JWT scoped to the pipeline, revocable without touching any server's authorized_keys.

There's no key to leak in a CI log, because there's no key.