It'd be better if the lock (Conch, sorry!) was acquired when you request the resource, and automatically released. In that vein, you'd need to write bespoke code for the "pre-production demo environment". Maybe there is something on the machine that lets only one SSH happen at a time. It could use your very cool Conch API to broadcast that to the Conch website so people can check before trying to SSH in. However that custom code is probably to be written by the users not yourself. But what might be helpful is a shell script "conchrun" that will run a command if the conch can be secured, and then releases the conch once the command exits.