glm-5.2
5941280bca
Address the root cause of rework-causing hedging: the architect was
put in a logical bind where it couldn't express justified uncertainty
('the pieces exist but the shape isn't clear yet'). The only options
were 'decide now' (premature) or 'deferred(scope)' (false — the
information isn't missing, it's un-synthesized). The agent picked
deferred(scope) with a circular blocking condition (OQ-64 blocked on
OQ-55, OQ-55 needs OQ-64) because there was no honest way to say 'I
can see the pieces but I can't see the shape.'
Changes to the architect role spec:
- Add deferred(unclear) state: the pieces exist but the composition
isn't clear; resolution requires investigation (work through
examples, POC), not waiting. Has an investigation target and an
impacts field.
- Add 'Impacts' field to the OQ format: what does this block
downstream? Be specific ('blocks the first hub deployment because
the hub dials workers' not 'blocks the hub crate'). The triage
signal that makes deferral urgency visible — the field that would
have made the AlknetClient circular hedge visible.
- Add circular-reasoning guard to self-review: 'check that your
blocking condition isn't a prerequisite of the thing you're
deferring.'
- Trim anti-patterns #9-#11 (hedging synonyms catalog, ~40 lines):
detection belongs in the reviewer, not the architect's self-review.
The architect is too close to its own reasoning to see its own
circular hedges.
- Trim door-types section (30→10 lines): keep the one-paragraph
summary, cut the elaboration.
Changes to the architecture-reviewer role spec:
- Add Decision Quality (F) category: false-deferral check
distinguishing three cases — (1) hedging on a resolved decision, (2)
false deferral / circular hedge (the blocking condition is a
prerequisite of the thing being deferred), (3) legitimate deferral.
- Add Impacts Field Coverage (G) category: check that unresolved OQs
have specific impacts fields.
- Note: the Decision Quality category is often the highest-value
check on poorly-defined projects — the architect cannot self-review
it (circular reasoning is invisible from inside the circle).
Retrofit existing OQs:
- Add Impacts field to all 16 unresolved OQs (10 deferred, 6 open).
- Update OQ-63 (TlsError shape) to reflect ADR-087's client-side
addition — the error type now covers both server and client
variants.
- Move OQ-65 (WebSocket carrying channels) to alknet-http theme
(done in prior commit; this commit adds its impacts field).
- Verified: no circular reasoning found in existing deferrals. The
AlknetClient hedge (OQ-64) was the circular one; it's already
resolved by ADR-087.
49 lines
2.8 KiB
Markdown
49 lines
2.8 KiB
Markdown
# OQ-38: WebTransport Standalone Relay Service Scope
|
|
|
|
- **Origin**: [ADR-034](decisions/034-outgoing-only-x509-and-three-peer-roles.md)
|
|
§5, [webtransport.md](crates/http/webtransport.md)
|
|
- **Status**: open (scope, not deferral)
|
|
- **Door type**: One-way (crate boundary), two-way (mechanism)
|
|
- **Priority**: low
|
|
- **Impacts**: None — the browser path uses WebSocket (ADR-044). Would
|
|
impact a browser-to-P2P-peer relay use case if one arises.
|
|
- **Resolution**: There are two distinct "WebTransport proxy" concepts
|
|
that must not be conflated:
|
|
|
|
1. **In-process ALPN-stream-proxy (resolved, in `alknet-http`).**
|
|
The `h3` handler hands a WebTransport stream to another ALPN
|
|
handler (`SshAdapter`, `GitAdapter`, etc.) as a `Connection`, so
|
|
a browser with a WASM parser can reach any ALPN service via
|
|
WebTransport. This is resolved by
|
|
[ADR-040](decisions/040-webtransport-alpn-stream-proxy.md) and
|
|
lives in `alknet-http`'s `h3` handler. Not this OQ.
|
|
|
|
2. **Standalone relay service (this OQ).** A full relay — a fork of
|
|
`iroh-relay` — that provides NAT traversal infrastructure with
|
|
WebTransport-based proxy as a fallback alongside WebSocket. This
|
|
is a separate service, not a mode of the `h3` handler: it
|
|
terminates the browser's WebTransport connection and forwards
|
|
encrypted traffic to a P2P hub's Ed25519 endpoint (so the hub need
|
|
not expose its own public X.509 cert). ADR-034 §5 recorded it in
|
|
the h3/WebTransport bucket; ADR-038 brought h3/WebTransport into
|
|
scope (later superseded by [ADR-044](decisions/044-defer-webtransport-browsers-use-websocket.md),
|
|
which deferred h3/WebTransport as a scope decision — the browser
|
|
bidirectional path uses WebSocket); ADR-040 resolved the in-process
|
|
proxy (now parked per ADR-044). This OQ is the remaining scope
|
|
question: does the standalone relay live in a future `alknet-relay`
|
|
crate (a fork of `iroh-relay` with WebTransport proxy fallback) or
|
|
is it out of scope for the current alknet work?
|
|
|
|
This is a genuine scope question, not a deferral. The relay use case
|
|
is not yet concrete enough to commit the crate boundary — no
|
|
deployment has asked for a standalone relay with WebTransport
|
|
fallback yet, and the design (transport-only proxy, no auth-model
|
|
change per ADR-034 §5) is clear but the home is not. The decision is
|
|
made when the browser-to-P2P-peer relay use case becomes concrete;
|
|
until then it is tracked here, not deferred with "v1/later" language.
|
|
The relay does not change the auth model (bearer token +
|
|
`PeerEntry.auth_token_hash`; relay is transport-only), so it does not
|
|
block any other ADR.
|
|
- **Cross-references**: ADR-027, ADR-030, ADR-034, ADR-038 (superseded),
|
|
ADR-040 (parked), ADR-044, [webtransport.md](crates/http/webtransport.md)
|