ssh

Two authentications happen in every SSH session, and the one usually left out is the server proving itself to you. Knowing who proves what, and where your agent socket ends up, is the scored material.

It copies a small Python program to the target over SSH, runs it, and deletes it. Once that is clear, the agentless claim, the performance characteristics and the idempotency requirement all stop being separate topics.

Experienced answers are ordered and verifiable: minimal base, benchmark applied as code, identity and exposure next, then continuous proof it stayed that way. Checklists recited out of order are the tell.