2 Commits

Include renames

Author	SHA1	Message	Date
glm-5.2	9823c6e4ab	docs(research): TCP+TLS first-class dispatch, not sibling afterthought ... The endpoint refactor findings doc relegated TCP+TLS to a 'sibling accept loop' that duplicated the endpoint's dispatch logic at the assembly layer. That was ADR-010 Amendment 1's workaround for the endpoint being welded to quinn — not a deliberate design. The endpoint now exposes a public dispatch() method so every transport (quinn, iroh, TCP+TLS, future SSH, future WebTransport) calls the same dispatch path: handler lookup, build_auth_context, spawn. The transport-specific parts (ALPN extraction, fingerprint extraction, Connection construction, no-handler close) happen before dispatch is called. No duplicated logic at the assembly layer. Also: the acme-tls/1 guard is quinn-specific (ACME challenges arrive over QUIC); a TCP+TLS listener serving HTTPS does not advertise acme-tls/1. build_auth_context becomes a private helper called by dispatch, not a standalone function.	2026-07-13 13:54:57 +00:00
glm-5.2	e06446ae9d	docs(research): endpoint-as-pure-ALPN-dispatcher findings — transport construction moves to assembly layer ... Captures the full picture of the AlknetEndpoint refactor interleaved with the alknet-tls extraction: - AlknetEndpoint becomes a pure accept-loop runner (no transport construction, no StaticConfig, no tls_identity reading) - A hub holds one or two TlsServerConfigs (raw key + X.509), not one; cert-reuse is within each identity, shared across that identity's transports - TCP fallback for native clients uses the raw-key config (no X.509 needed); raw-key/X.509 mixing works in the TLS handshake - iroh and SSH share the Ed25519SecretKey, not the TlsServerConfig - The reverse-proxy as reference for ACME lifecycle and live renewal - The remaining tls spec review items (C2-C6, W3-W5) carried forward	2026-07-13 13:41:00 +00:00