alkdev/alkhttp
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
165 Commits 1 Branch 6 Tags
df86f89440cafc0c905b2dfc85a4e00457ae6ca5
Commit Graph
5 Commits
Author SHA1 Message Date
glm-5.3-flash 5b62307be9 docs(review 003): Unit 1 re-pointed at alkcall review 004; bootstrap-op candidate recorded 
The alkcall decision work (WS-24 dispatch-resolution mechanism, WS-25
client-side op registration) now lives upstream as alkcall review 004.
Unit 1 records the leading candidates and their alkhttp consequences:

- WS-24 -> option (a), per-session base registry (the only
  wire-proven dispatch shape; fork surface = alkcall F-02)
- WS-25 -> channel-0 bootstrap op (op/register as an assumed op in
  the bootstrap set; requires the alkcall client serving half, F-04)
- discovery composition: services/list on the fork + peer-registered
  ops via the already-built services/list-peers

Consumer-set reframe from WS-23 unchanged; no findings added or
removed.
 2026-09-03 14:42:50 +00:00
glm-5.3-flash 19e30c9769 docs(review 003): WS data-channel wiring gap drill-down 
Focused review of the OQ-05 deferral (review-001 WS-03): what is
missing to wire browser/native data channels over WS, the deferral
rationale check, and the design gaps found behind the 'nothing new
to design' assumption.

Findings (continuing review-002 numbering):
- WS-20..22 [major]: mechanical wiring gap — install_channel_zero
  discards the ChannelManager, generic channel lifecycle ops never
  registered, no openable-ALPN deployment surface
- WS-23 [minor]: no browser-opened-channel e2e test; OQ-05 reopen
  trigger reframed (native WS consumers are not blocked on OQ-04)
- WS-24 [major, cross-crate]: top-level dispatch never consults the
  connection overlay — the ADR-047 §4 amendment mechanism cannot
  resolve open ops on the wire (needs an alkcall decision)
- WS-25 [major]: no wire mechanism for client-side op registration —
  ADR-048 browser-side bidirectionality is undesignable as specified
- WS-26 [major]: no retained live connection handle; hub cannot
  reach a session's overlay or push toward it
- WS-27 [minor]: dead-code-gated test hook cleanup

Includes a non-findings section (channel-id split, demux hardening,
open-op wrapper completeness, idle-knob posture) and a 4-unit
remediation plan sequenced so the alkcall decision task (Unit 1)
gates the alkhttp wiring shape (Unit 2).

Verification: cargo test (453) / --all-features (575), clippy
(all-targets, both feature sets), fmt — all clean at 58665f2.
 2026-09-03 08:31:44 +00:00
glm-5.3-flash e2c255d40c docs(tasks): decompose review-002 into 24 tasks (23 implementation + 1 bracketed follow-up) 
Decomposition of docs/reviews/002-post-remediation-review.md per its
5-unit remediation plan:

- Unit 1 (security-critical): gw15-publish-body-cap,
  prj16-schema-via-call (CF-004 filed alkcall-side), fwd13-dot-segments,
  fwd16-missing-capability, oai11-ref-memoization
- Unit 2 (timeout/terminality): ws13-idle-progress,
  fwd15-stream-timeout, cli01-retry-after-budget, con17-mcp-pagination,
  con18-wss-sweep-exit
- Unit 3 (projection/docs): projection-truthfulness, mcp-batch-cap,
  gw16-status-drift
- Unit 4 (spec-import): yaml-normalization, oai13-path-item-wildcards,
  import-loudness-cluster, js01-placeholder-check,
  fwd17-19-contract-decisions
- Unit 5 (WS polish + tests): con18b-ws-polish,
  client-policy-wire-tests, cov-deployment-knobs, cov13-dead-code,
  srv11-srv12-router-ordering
- review-002-bracketed-followup: tentatively planned post-bulk pass
  (stale-check, OQA-18 enforcement decision, CON-08/09 close() lever,
  cross-crate re-checks) — deliberately not serialized against the
  bulk

Also: review-002 numbering repair (CON-14 was double-booked; MCP
pagination now CON-14, from_wss monitor renumbered CON-18, missing
CON-14 section added).

taskgraph: 66 valid, no cycles; 24 pending (all review-002);
gen-1/gen-2 parallel waves identified; workflow-cost hotspots are
prj16 (12.8) and ws13 (11.1), both carrying the reviewed slicing
guidance in their Notes.
 2026-08-30 10:50:34 +00:00
glm-5.3-flash 5452785f0d docs(review 002): post-remediation review — 40 findings across 6 passes + coverage analysis 
Review 002 of the post-remediation tree (91483a7): six parallel
subsystem passes + coverage analysis, consolidated with direct source
re-verification of all consequential findings.

- Regression check: 76/82 review-001 findings verified FIXED; residuals
  filed as new findings (SRV-11/SRV-12, WS-13, CON-14, OAI-10..19,
  JS-01..03, PRJ-16..24, CLI-01..03, FWD-13..19, GW-15..17)
- Critical-class: GW-15 (unbounded /publish body), OAI-11 (exponential
  $ref expansion hangs import)
- Security: PRJ-16 (Internal op schema disclosure via services/schema
  over /call), FWD-13 (lone .. path escape with credentials)
- Coverage: 94.87% regions; redirect policy 100% dark (top gap),
  forward_stream terminal arms dark, COV-13 dead code batch

Headline counts: 5 major security/availability, 6 major correctness,
23 minor, 2 info; 2 agent findings rejected at verification.
 2026-08-30 09:52:10 +00:00
glm-5.3-flash 54f8e2310e docs(review 001): initial implementation review — findings, coverage, remediation plan 
Consolidated review of the 17-task initial implementation (tree 4a825d3):
8 subsystem passes + cargo-llvm-cov coverage analysis. Baseline: 256
tests green, clippy/fmt/doc clean, 93.86% line coverage.

Findings: 1 borderline-critical ($ref recursion aborts the process),
~30 major (extra_routes mounted without auth middleware, /schema leaks
Internal ops, /mcp unbounded body, forwarding URL construction/SSRF,
redirect credential leakage, non-idempotent retries, no default
timeouts, SSE chunk-boundary event loss, MCP schema ACL skip, from_wss
lost-EOF hang, projection-vs-runtime fidelity), and ~45 minor. Includes
verified-solid list, coverage gap analysis, and a 7-unit remediation
plan.
 2026-08-28 17:22:46 +00:00