- Review 003 written (docs/reviews/003-assembly-layer-implementation-
review.md): the batch-2 assembly layer post-landing, the review-002
template — correctness/security/smells/coverage over the five
batch-2 modules + the batch-2 consumer/producer diff surface.
Baseline: 375 default / 620 all-features green, clippy/fmt/doc
clean, both wasm checks clean, publish dry-run completes,
llvm-cov 93.68% lines / 91.01% functions.
- F-1 (major, fixed): the cred-bearing door swallowed every in-band
refusal's mapped reply code (the CONNECT/BIND session-open errors
and the accept-stage Err were bare closes) — a vanilla client got
no reply where ADR-007 pins a reply-code-shaped refusal. Fixed with
a write_refusal_reply helper (the door's boundary codec, RFC
placeholder BND.ADDR) at all three sites, pinned by
cred_door_in_band_refusal_surfaces_the_reply_code.
- F-2 (major, fixed): UdpFrontDoor::serve_on returned Ok(()) on a
fatal relay-socket I/O failure against its own doc contract —
the Io exit now surfaces as Err; the idle/association/session
exits stay clean.
- Findings recorded, not fixed (the release-polish round's residue):
D-1 (associate_with_token 0% covered), D-2 (the composed-egress
failure matrix), D-3 (the io-kind refusal-table arms), S-1 (the
UDP door's learned client address), N-1..N-8 (doc lines, posture
notes, coverage residue).
Verification: cargo test (375) + --all-features (620) green,
clippy --all-targets --all-features -D warnings clean, fmt --check
clean, doc --no-deps clean, both wasm checks clean, publish
dry-run completes.
Review checkpoint closing batch 2 (the assembly layer). The gate
opens: the never-binds posture, seam contracts, door fidelity, the
bind-first graduation, feature-gate hygiene, and POC fidelity all
verify clean; two findings were corrected in the review change.
Findings corrected:
- R-1 (major): the UDP front door's in-band decode created a fresh
DatagramReader per call and kept only the first frame of a batch —
POC #2's first-cut bug (reader state must persist across calls;
batched datagrams were silently dropped, mid-frame EOF was silent).
Fix: an owning InbandBridge (persistent reader + pending queue +
fail-loud mid-frame EOF, the AssociateSession shape) threaded
through the channel->socket pump; pinned by three bridge unit
tests (which fail against the per-call reader) and an end-to-end
doubled-echo door-udp test.
- R-2 (convention 2): seven non-test expects -> typed errors —
DoorBuildError (both door builders' .build() is now Result),
ProducerDoorBuildError/ProducerDoorError (the bind decision is
serve's typed error), the composed table invariant as an egress
error, register_forwarded_serving -> Result (the alkcall
diagnostic surfaced), TokenClientError (wrap on a spent client).
New error types re-exported; test call sites updated.
- R-3/R-4 (doc residues): producer.md's local-backend section
described a channel pipe — the landed ProducerDoor serves
serve_socks5_over on the accepted socket directly;
associate_with_token's doc (the TCP door refuses ASSOCIATE, never
calls it); SessionOwner's doc (the accept uses SyncHalves/
OwnedWrite).
Verification: cargo test (default) green; cargo test --all-features
green; cargo clippy --all-targets [--all-features] -- -D warnings
clean; cargo fmt --check clean; both wasm checks clean (default +
composed); local-on-wasm fails at mio as designed; cargo doc
--no-deps clean.
Task: tasks/implementation/review-assembly-layer.md (status:
completed; the batch-2 gate opens release polish).
The consumer's TCP front door (feature `local`, ADR-005/ADR-014): the
ssh `-D` local exposure vanilla clients point at.
- `src/door.rs`: `FrontDoor::builder().credentials(...).bind(...)`
→ `serve`/`serve_on`. The NoAuth door is the literal raw pipe
(accept → channel BiStream via copy_bidirectional, zero protocol
translation). The cred-bearing door terminates RFC 1929 locally
(the forked accept_password_auth shape) and re-originates in-band
via the token-carrying consumer sessions — the vanilla replies are
re-encoded at the door (the RFC codec boundary, ADR-003), the
password never crosses the channel as a SOCKS password. The BIND
door rides BindSession with reply#1 fidelity (the advertised
address passes through unchanged). UDP ASSOCIATE at the TCP door
refuses RFC-faithfully (0x07 — the UDP door's task). The ADR-014
accept-path defense: the idle-first-byte window (peek-based,
door-side close) + the max-sessions cap (semaphore) as constructor
config; per-accept failure isolation (the loop continues).
- The identity mechanism (decided + recorded in the task Notes): the
per-credential identity rides the open-op `auth_token` payload
(CF-005 precedence (1)) — the token is the mapped identity's id;
the producer resolves it through ServingConfig.identity_provider.
No per-credential ChannelClient.
- `src/consumer.rs`: `TokenClient` (the token-carrying open surface
over the taken CallConnection + shared manager) and the
`*_with_token` twins of the three session constructors through the
open_with_token_and_negotiate prologue (teardown-at-birth
preserved); `Socks5ChannelSession::reply_addr` (the CONNECT
reply's BND.ADDR for the door's re-encoding). Existing surfaces
untouched.
- `tests/door-tcp.rs`: 10 integration tests — the NoAuth raw-pipe
round-trip (the POC #1 curl shape), good/bad credentials (the
establisher witness sees the mapped identity, never the password;
a rejection opens no channel), the never-pipes-raw-post-auth pin,
the BIND door's vanilla conversation, the idle timeout, the
session cap, failure isolation, and the native-session/BIND-token
regression guards. Harness: wire_consumer_side_with_provider (the
producer's identity provider configurable).
Verification: cargo test (375) + --all-features (423) green; clippy
-D warnings clean (default + all-features); fmt --check clean; wasm
check + wasm clippy green; default graph stays net-free.
glm-5.3-flash