0 Fork 0

Files

T

glm-5.3-flash e196ed43e3 docs: remove em dashes from repo prose and forbid them going forward

- Rewrote em dash prose across the whole tree outside docs/reviews/
  (the historical reviews stay verbatim, matching the alktunnels and
  alktty precedent): src doc comments and inline comments (587),
  docs/architecture (319), docs/research + sdd_process (484), tests
  (361), tasks (899), fuzz (28), README/CHANGELOG/Cargo.toml (77),
  AGENTS.md (85), and the .opencode/agents prompts (109)
- Fenced content follows the precedent: comments, ASCII-diagram label
  separators, and template placeholders rewritten; wire data, JSON/BAST
  documents, byte diagrams, and transcripts survive verbatim; assert,
  expect, panic, error-display, and format message literals rewritten
  as prose; no code, fixture, or test data change
- src/rfc1928/LICENSE: the two dashes in alksocks' own provenance
  header rewritten; the MIT legal text untouched
- AGENTS.md adds Project Convention 18: no em dashes in prose; varied
  restructure, no spaced-hyphen substitutes, fenced prose rule, en
  dash numeric ranges exempt, docs/reviews/ exempt from the greps
- tasks/*.md frontmatter: the name values rewritten by the sweep are
  now quoted (a raw colon inside an unquoted YAML scalar parsed as
  null); taskgraph validate reports 37 tasks, no issues

Verification: cargo test; cargo clippy --all-targets -D warnings;
cargo fmt --check; cargo doc --no-deps; fuzz corpus replay
(cargo test --manifest-path fuzz/shared/Cargo.toml); wasm check and
clippy for wasm32-unknown-unknown with -D warnings; em dash grep over
the repo returns matches only in docs/reviews/ and the bast.md BAST
JSON data fence

2026-11-03 19:31:53 +00:00

4.1 KiB

Raw Blame History

ADR-005: Auth Mapping: "Both," Split by the Door

Status

Accepted (2026-09-20, Phase 1; the posture settled 2026-09-13 (OQ-SK-02), and POC #1 validated the identity seam end to end)

Context

Two auth mechanisms are real: alkcall's identity seam (the per-call opener identity arrives on the open-op hooks; alkcall ledger CF-005/CF-006) and RFC 1929's in-band username/password. Phase 0 resolved the posture: both mechanisms are real, each on its own side of the door: the consumer's optional front door (where the vanilla world meets the ACL world). A producer-side password would add nothing the identity seam doesn't already do, and the ACL system is strictly better than a shared secret.

POC #1's wiring finding (the accept-side install hook must call channel0_conn.set_identity(resolved); the transport identity does not flow to channel-0 dispatch automatically) is a producer-harness requirement worth surfacing in the spec, not a protocol-layer concern.

Decision

Producer side: identity only. The channels-native open is authorized by the alkcall ACL/identity seam. The producer's in-band RFC conversation runs NoAuth via the typestate's normal path: accept_no_auth (the greeting and method selection still happen; POC #2/#5's validated shape: accept_no_auth → read_command). The negotiation is real but the auth decision is vacuous in-band because authorization already happened at the open gate. skip_auth_this_is_not_rfc_compliant is excluded from the in-band path; it wraps a stream already marked authenticated, skipping the greeting entirely; feeding it a client that speaks the RFC greeting would misparse the greeting as command bytes. (At most it belongs to a raw-pipe door that never speaks RFC in-band; the crate's doors speak RFC.)
Consumer front door (component 2's optional shape): RFC 1929 where vanilla clients need it. The door owns credential presentation: a vanilla client carrying user:pass gets a real RFC 1929 conversation at the door. The door then maps the accepted credential to local configuration (which channel identity/endpoint to open the producer channel with), and that identity reaches the producer via the CF-005/CF-006 seam. The SOCKS password never crosses the channel as a SOCKS password; the channel identity never reaches the vanilla client.
No fast-socks5 AuthMethod impl is required. The door checks credentials itself before/around handing the stream to the typestate; the door is this crate's code; the trait was designed for embedders who don't own the accept loop.
The door's credential→identity mapping shape: static config. The mapping is a caller-supplied configuration table (username/password → channel identity or endpoint selection), static, declarative, assembly-layer. A pluggable lookup (callback) remains possible as an additive extension if a deployment needs dynamic resolution; v1 ships the static shape because the front door's use cases (tun2proxy's fixed user:pass@host, curl's --proxy-user) are single-credential or small-table shapes.
The NoAuth door remains valid for loopback-only or wrapper-aware use (POC #1's raw-pipe shape: zero protocol translation); the cred-bearing door is the same bridge plus the greeting half. Door variant selection is an assembly-layer choice.

Consequences

Vanilla-client compatibility at the front door is real (RFC 1929), without polluting the channels-native path with shared secrets.
The producer-side optional local backend (a front door in the other direction: vanilla clients → a locally-served SOCKS5 resource) offers the same door surface: door = vanilla↔ACL boundary, same code shape.
The mapping is not wire-visible: no params, no reply fields, no ALPN changes; the door is entirely assembly-layer.

References

OQ-SK-02 (the full reasoning: "replace or second-gate" dissolved; the mechanisms occupy different planes)
POC #1 poc-connect-wasm-findings.md (the identity-seam wiring finding; the raw-pipe front door)
alkcall ledger CF-005/CF-006 (the identity seam); alkcall ADR-049 (the establisher sees the per-call opener identity)

4.1 KiB Raw Blame History