docs: implementation plan (TTY precedents folded in); task decomposition (17 tasks)
Plan updated with the alknet-tty findings: the drainer pattern (single ordered writer) makes outbound chunk-boundary parsing sound; TestStdinSink's try_send→Full→Pending is the inbound backpressure precedent; OQ-01(a) now cites the reference. Task graph (taskgraph-validated, 17 tasks, 6 generations, no cycles): - tasks/server/: core-types, auth, healthz-decoy, adapter - tasks/gateway/: dispatch, routes, publish - tasks/websocket/: byte-adapter (research POC), upgrade-session, overlay-ops - tasks/adapters/: from-openapi, from-jsonschema, to-openapi, from-wss, mcp - tasks/client/: http-host - tasks/infra/: integration-suite (phase 4) Critical path runs through server core → adapter → WS session → overlay tests → integration suite. High-risk tasks are the three WS tasks, de-risked by the ws-byte-adapter POC blocking upgrade-session.
This commit is contained in:
@@ -0,0 +1,45 @@
|
||||
---
|
||||
id: server-adapter
|
||||
name: HttpAdapter — ProtocolHandler with hyper over BiStream
|
||||
status: pending
|
||||
depends_on: [server-core-types, server-auth, server-healthz-decoy]
|
||||
scope: moderate
|
||||
risk: medium
|
||||
impact: component
|
||||
level: implementation
|
||||
tags: [server, phase-1]
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
Port the `HttpAdapter` (`ProtocolHandler` for `http/1.1` + `h2`) from
|
||||
`/workspace/@alkdev/alknet/crates/alknet-http/src/server/adapter.rs`,
|
||||
adapted to alkcall's shapes: `handle()` receives a `Connection`
|
||||
(alkcall::core::types), takes the `BiStream` from `accept_bi()`, wraps
|
||||
with `TokioIo`, drives hyper's http1/http2 connection builder against
|
||||
the axum `Router` (built once at construction, `with_decoy` /
|
||||
`with_extra_routes` builders per ADR-046). Branch on
|
||||
`connection.remote_alpn()`. Leave a route slot for the WS upgrade
|
||||
(wired in the websocket tasks).
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] `HttpAdapter::new/h2/for_alpn` + `with_decoy` + `with_extra_routes` ported
|
||||
- [ ] `ProtocolHandler` impl drives hyper over the BiStream; returns on connection close
|
||||
- [ ] Router merges extra routes; default surface wins collisions
|
||||
- [ ] Integration test: full HTTP request/response cycle over `tokio::io::DuplexStream` → `Connection::from_bidi` → adapter
|
||||
- [ ] `cargo test` passes; feature gates `h2`/`http1` both compile
|
||||
|
||||
## References
|
||||
|
||||
- docs/architecture/http-server.md (§Running axum over a bidirectional stream)
|
||||
- docs/architecture/decisions/002-protocol-handler-trait.md
|
||||
- alkcall: `core::types::Connection::accept_bi` returns joined `BiStream` (alkcall ADR-005)
|
||||
|
||||
## Notes
|
||||
|
||||
> Agent fills during implementation.
|
||||
|
||||
## Summary
|
||||
|
||||
> Agent fills on completion.
|
||||
@@ -0,0 +1,42 @@
|
||||
---
|
||||
id: server-auth
|
||||
name: Bearer auth middleware and identity extraction
|
||||
status: pending
|
||||
depends_on: [server-core-types]
|
||||
scope: narrow
|
||||
risk: low
|
||||
impact: component
|
||||
level: implementation
|
||||
tags: [server, phase-1]
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
Port `bearer_auth_middleware` and `extract_bearer_identity` +
|
||||
`ResolvedIdentity` from
|
||||
`/workspace/@alkdev/alknet/crates/alknet-http/src/server/auth.rs`.
|
||||
Resolution via `IdentityProvider::resolve_from_token(&AuthToken { raw })
|
||||
` (alkcall::core::auth). Middleware behavior: no/invalid token →
|
||||
identity None (routes decide 401 vs anonymous); token present →
|
||||
ResolvedIdentity(Some(identity)). Unit tests over the middleware with a
|
||||
static identity provider.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] Middleware ports with tests (missing header, malformed, valid token, unknown token)
|
||||
- [ ] `set_identity` observability path documented for the WS route's use
|
||||
- [ ] No env-var reads anywhere (no-env-vars invariant)
|
||||
- [ ] `cargo test` passes
|
||||
|
||||
## References
|
||||
|
||||
- docs/architecture/http-server.md (§Auth)
|
||||
- docs/architecture/decisions/004-auth-as-shared-core.md
|
||||
|
||||
## Notes
|
||||
|
||||
> Agent fills during implementation.
|
||||
|
||||
## Summary
|
||||
|
||||
> Agent fills on completion.
|
||||
@@ -0,0 +1,40 @@
|
||||
---
|
||||
id: server-core-types
|
||||
name: Shared server state, config, and error types
|
||||
status: pending
|
||||
depends_on: []
|
||||
scope: narrow
|
||||
risk: low
|
||||
impact: component
|
||||
level: implementation
|
||||
tags: [server, phase-1]
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
Port the shared types the whole server subsystem hangs off:
|
||||
`DecoyConfig` (NotFound/StaticSite/Redirect), `RouterState` (registry,
|
||||
identity provider, decoy — with axum `FromRef` impls), and the
|
||||
module skeleton for `src/server/`. Ported from
|
||||
`/workspace/@alkdev/alknet/crates/alknet-http/src/server/adapter.rs`
|
||||
(the type definitions) and `server/mod.rs`.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] `DecoyConfig`, `RouterState` ported with the 6-endpoint reserved-path doc comments
|
||||
- [ ] `alkcall::core::auth::IdentityProvider` / `alkcall::registry::registration::OperationRegistry` type paths correct
|
||||
- [ ] No comments in code (project convention); doc comments on public API only
|
||||
- [ ] `cargo clippy --all-targets -- -D warnings` clean
|
||||
|
||||
## References
|
||||
|
||||
- docs/architecture/http-server.md (§What — the struct shapes)
|
||||
- docs/architecture/decisions/046-assembly-layer-custom-http-routes.md
|
||||
|
||||
## Notes
|
||||
|
||||
> Agent fills during implementation.
|
||||
|
||||
## Summary
|
||||
|
||||
> Agent fills on completion.
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
id: server-healthz-decoy
|
||||
name: /healthz raw route and stealth decoy fallback
|
||||
status: pending
|
||||
depends_on: [server-core-types]
|
||||
scope: narrow
|
||||
risk: low
|
||||
impact: component
|
||||
level: implementation
|
||||
tags: [server, phase-1]
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
Port `healthz` (`server/healthz.rs` — raw 200 "ok", no auth, no call
|
||||
protocol) and the decoy fallback (`server/decoy.rs` — fake nginx-style
|
||||
404, static site, or redirect per `DecoyConfig`). Ported from
|
||||
`/workspace/@alkdev/alknet/crates/alknet-http/src/server/{healthz,decoy}.rs`.
|
||||
Tests: healthz responds without auth; decoy serves all three configs.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] `/healthz` returns 200 text/plain without auth
|
||||
- [ ] Decoy fallback for unmatched paths per DecoyConfig (404/static/redirect)
|
||||
- [ ] Reserved paths (6 gateway + /healthz + /openapi.json + /mcp + /alk/channels) never hit the decoy
|
||||
- [ ] `cargo test` passes
|
||||
|
||||
## References
|
||||
|
||||
- docs/architecture/http-server.md (§/healthz, §Stealth decoy)
|
||||
- docs/architecture/decisions/010-alpn-router-and-endpoint.md
|
||||
|
||||
## Notes
|
||||
|
||||
> Agent fills during implementation.
|
||||
|
||||
## Summary
|
||||
|
||||
> Agent fills on completion.
|
||||
Reference in New Issue
Block a user