Review checkpoint closing batch 2 (the assembly layer). The gate
opens: the never-binds posture, seam contracts, door fidelity, the
bind-first graduation, feature-gate hygiene, and POC fidelity all
verify clean; two findings were corrected in the review change.
Findings corrected:
- R-1 (major): the UDP front door's in-band decode created a fresh
DatagramReader per call and kept only the first frame of a batch —
POC #2's first-cut bug (reader state must persist across calls;
batched datagrams were silently dropped, mid-frame EOF was silent).
Fix: an owning InbandBridge (persistent reader + pending queue +
fail-loud mid-frame EOF, the AssociateSession shape) threaded
through the channel->socket pump; pinned by three bridge unit
tests (which fail against the per-call reader) and an end-to-end
doubled-echo door-udp test.
- R-2 (convention 2): seven non-test expects -> typed errors —
DoorBuildError (both door builders' .build() is now Result),
ProducerDoorBuildError/ProducerDoorError (the bind decision is
serve's typed error), the composed table invariant as an egress
error, register_forwarded_serving -> Result (the alkcall
diagnostic surfaced), TokenClientError (wrap on a spent client).
New error types re-exported; test call sites updated.
- R-3/R-4 (doc residues): producer.md's local-backend section
described a channel pipe — the landed ProducerDoor serves
serve_socks5_over on the accepted socket directly;
associate_with_token's doc (the TCP door refuses ASSOCIATE, never
calls it); SessionOwner's doc (the accept uses SyncHalves/
OwnedWrite).
Verification: cargo test (default) green; cargo test --all-features
green; cargo clippy --all-targets [--all-features] -- -D warnings
clean; cargo fmt --check clean; both wasm checks clean (default +
composed); local-on-wasm fails at mio as designed; cargo doc
--no-deps clean.
Task: tasks/implementation/review-assembly-layer.md (status:
completed; the batch-2 gate opens release polish).
- tests/assembly-integration.rs (7 tests, local + composed): the full
-D story (vanilla cred-bearing client -> TCP door + UDP door ->
producer w/ local providers -> real echo targets; CONNECT + BIND +
ASSOCIATE live, one-command-per-connection, teardown + fresh
sessions), the composed story (direct_egress + bindfirst_accept +
real TCP dial; all three commands; the lazy-table dial-count
witness), mixed assembly (channels-native + door clients on one
registration; composed seams beside native sessions), the assembly
teardown matrix (UDP-door idle bound; channel reaped; fresh
association after), the producer door driving all three commands,
and the -D domain-target pin (resolution at the producer's seam,
ADR-012).
- Fix the drift the suite surfaced: ComposedEgress::next_reply ended
fresh (never-opened-table) associations at birth — the ended-relay
Err now fires only once a tunnel existed and every relay ended; the
fresh table parks (the readiness contract). Regression-pinned in
tests/composed-egress.rs (fresh_association_parks_before_any_
tunnel_is_opened).
- Harness: the composed-accept machinery single-sourced into
tests/harness.rs (the composed suites' shapes + the five-gate
composed identity); composed-accept.rs consumes the shared shapes.
- Docs sync: README Current State (the assembly layer landed; both
suites named), lib.rs crate docs (the assembly-layer paragraph),
consumer.md (the TokenClient door-only contract + the
one-command-per-connection posture reconciled).
- Task assembly-integration-suite: completed; Notes + Summary filled
(the local-on-wasm failure observed: mio's unsupported-wasm error).
Verification: cargo test (375), cargo test --all-features (615),
clippy --all-targets -D warnings (default + all-features), fmt --check,
doc --no-deps (0 warnings), both wasm checks (default + composed),
local-on-wasm fails as designed.
Lands the composed accept (ADR-007 variant 2 / ADR-008): the BIND
accept whose listener lives on an alktunnels 0.2.0 bind-first listen
resource, at the graduation's vanilla fidelity.
- `composed::bindfirst_accept` — the BindAcceptFactory: opens the
listen channel (reply#1 advertises the open-op reply's real
`bound`, the 0.8.0 reply projection — no expected-addr stand-in),
inserts the minted `listen` token into the correlation registry,
and returns the accept future parked on the token's oneshot.
- `composed::register_forwarded_serving` — the forwarded-op serving
half on the SOCKS5 producer's connection: the shared handler
correlates by token and owns the middle pump (either-EOF
completion; a three-party per-direction shutdown cascade would
deadlock).
- The Sync-bound wrinkle: `SyncHalves`/`OwnedWrite` (mutex
Sync-proof, no unsafe) over the forwarded halves; the owner
(`ForwardedOwner`, the TunnelListener) rides inside the write
payload — dropping the handle drops the session, halves, and
listener together (teardown structural, compiler-enforced).
- `tests/composed-accept.rs`: the full story (real bound, real peer,
raw pass-through round trip), client-gone teardown drop-witness,
distinct tokens for concurrent BINDs, per-accept isolation of a
FORBIDDEN forwarded open, late-forwarded correlation miss.
- The producer-side adopted forwarded entry rides the per-adopter
contract (transport-EOF reap), as upstream's bind-first suites
concede; the no-leak probe reflects that shape.
Verification: cargo test (default + --all-features), wasm
check/clippy (hard gate), clippy --all-targets --all-features -D
warnings, fmt --check — all clean.
glm-5.3-flash