- Rewrote em dash prose across the whole tree outside docs/reviews/
(the historical reviews stay verbatim, matching the alktunnels and
alktty precedent): src doc comments and inline comments (587),
docs/architecture (319), docs/research + sdd_process (484), tests
(361), tasks (899), fuzz (28), README/CHANGELOG/Cargo.toml (77),
AGENTS.md (85), and the .opencode/agents prompts (109)
- Fenced content follows the precedent: comments, ASCII-diagram label
separators, and template placeholders rewritten; wire data, JSON/BAST
documents, byte diagrams, and transcripts survive verbatim; assert,
expect, panic, error-display, and format message literals rewritten
as prose; no code, fixture, or test data change
- src/rfc1928/LICENSE: the two dashes in alksocks' own provenance
header rewritten; the MIT legal text untouched
- AGENTS.md adds Project Convention 18: no em dashes in prose; varied
restructure, no spaced-hyphen substitutes, fenced prose rule, en
dash numeric ranges exempt, docs/reviews/ exempt from the greps
- tasks/*.md frontmatter: the name values rewritten by the sweep are
now quoted (a raw colon inside an unquoted YAML scalar parsed as
null); taskgraph validate reports 37 tasks, no issues
Verification: cargo test; cargo clippy --all-targets -D warnings;
cargo fmt --check; cargo doc --no-deps; fuzz corpus replay
(cargo test --manifest-path fuzz/shared/Cargo.toml); wasm check and
clippy for wasm32-unknown-unknown with -D warnings; em dash grep over
the repo returns matches only in docs/reviews/ and the bast.md BAST
JSON data fence
Review checkpoint closing batch 2 (the assembly layer). The gate
opens: the never-binds posture, seam contracts, door fidelity, the
bind-first graduation, feature-gate hygiene, and POC fidelity all
verify clean; two findings were corrected in the review change.
Findings corrected:
- R-1 (major): the UDP front door's in-band decode created a fresh
DatagramReader per call and kept only the first frame of a batch —
POC #2's first-cut bug (reader state must persist across calls;
batched datagrams were silently dropped, mid-frame EOF was silent).
Fix: an owning InbandBridge (persistent reader + pending queue +
fail-loud mid-frame EOF, the AssociateSession shape) threaded
through the channel->socket pump; pinned by three bridge unit
tests (which fail against the per-call reader) and an end-to-end
doubled-echo door-udp test.
- R-2 (convention 2): seven non-test expects -> typed errors —
DoorBuildError (both door builders' .build() is now Result),
ProducerDoorBuildError/ProducerDoorError (the bind decision is
serve's typed error), the composed table invariant as an egress
error, register_forwarded_serving -> Result (the alkcall
diagnostic surfaced), TokenClientError (wrap on a spent client).
New error types re-exported; test call sites updated.
- R-3/R-4 (doc residues): producer.md's local-backend section
described a channel pipe — the landed ProducerDoor serves
serve_socks5_over on the accepted socket directly;
associate_with_token's doc (the TCP door refuses ASSOCIATE, never
calls it); SessionOwner's doc (the accept uses SyncHalves/
OwnedWrite).
Verification: cargo test (default) green; cargo test --all-features
green; cargo clippy --all-targets [--all-features] -- -D warnings
clean; cargo fmt --check clean; both wasm checks clean (default +
composed); local-on-wasm fails at mio as designed; cargo doc
--no-deps clean.
Task: tasks/implementation/review-assembly-layer.md (status:
completed; the batch-2 gate opens release polish).
- ProducerDoor (feature local, src/local/producer_door.rs): a real
TcpListener accept loop handing each accepted connection to the
landed Socks5Producer::serve_socks5_over — the NoAuth in-stream RFC
conversation with the local seam providers dialing/egressing/accepting;
no new protocol-layer code.
- The accept path owns ADR-014's two knobs: the idle-first-byte peek
(non-consuming) and the max-concurrent-sessions cap (try_acquire —
an accept beyond the bound is refused door-side).
- ProducerDoorGuard: the listener's lifetime is the caller's — graceful
close() awaits the loop's end; Drop aborts best-effort (the
alktunnels TunnelListener teardown posture). In-flight sessions are
never force-closed.
- Per-connection failures are logged + isolated (the loop continues).
- The BIND gate on this path is the builder's bind_policy (no open-op
identity here; the pump handler's identity-derived gate does not
apply) — pinned by the 0x02-refusal test.
- tests/local-backend-producer.rs (9): vanilla CONNECT round-trip on
real sockets, faithful-RFC BIND (real reply#1/reply#2 addresses),
UDP ASSOCIATE through the real egress, domain resolution at the
seam, idle timeout, session cap, failure isolation, bind_policy(false).
Verification: cargo test + --all-features green; clippy clean (default,
all-features, wasm32 targets); cargo fmt --check clean; wasm checks
green (backend is local-gated).
The `local` feature's first-party providers (ADR-008's local variants,
ADR-009's gate): the three seams' faithful-RFC assembly-layer
constructors over the landed seam types; the protocol layer never
sees them.
- Cargo.toml: `local = ["tokio/net"]` (no socket2 — the POCs ran
tokio-only); the default graph stays net/mio/socket2-free
(cargo tree spot-checked both ways)
- src/local/: `tcp_dial()` (real TcpStream per CONNECT, domain
resolution at the provider — the ssh -D semantic; the resolved
address set iterated, faithful SocksDialError mapping,
NotAllowed never synthesized), `udp_egress()` (one real UdpSocket
per association bound 127.0.0.1:0 — the explicit bind decision;
the POC #2 LocalEgress readiness shape: park on readable(),
try_recv_from, WouldBlock -> spurious Ok(None); inner bytes
to_be_bytes() + data, framing-once; resolve at the egress),
`bind_accept(bind_host)` (real TcpListener per BIND session,
ADR-007 variant 1: requested port honored when non-zero, local_addr
as reply#1's BND.ADDR, the accept future owning the listener
end-to-end, peer byte-exact; two-stage failure mapping; the bind
host is the caller's explicit choice)
- lib.rs: cfg-gated module + re-exports; crate doc updated
- tests: 12 unit (real-socket round-trips, the readiness contract's
park-then-datagram, the drop-closes-the-listener witness, the
refusal mappings) + 6 integration (tests/local-providers.rs,
feature-gated: the three commands end to end through the producer's
real dispatch path with real targets, connect-refused -> 0x05
through the producer's reply, the readiness contract re-pinned
through the datagram stage, client-gone -> the advertised port
frees)
- task status -> completed (acceptance criteria checked; Notes +
Summary filled)
Verification: cargo test (157 green) + --all-features green,
clippy -D warnings clean (default + all-features), fmt --check clean,
both wasm checks clean, the dependency-graph spot-checks green.
glm-5.3-flash