alksocks/tasks/implementation/review-assembly-layer.md

id, name, status, depends_on, scope, risk, impact, level

id	name	status	depends_on	scope	risk	impact	level
review-assembly-layer	Review — the assembly layer (the batch-2 gate)	pending	implementation/assembly-integration-suite	narrow	low	project	review

Description

Review checkpoint closing batch 2 (the assembly layer: local providers, the front doors, the producer-side local backend, composed providers). After this gate the crate is feature-complete against the Phase 1 spec set; the remaining work is release polish (publish prep, the OQ-SK2-08 tuning note).

Review against the architecture, in this order:

1. The never-binds posture (the crate's defining requirement): the protocol layer still binds nothing — every kernel bind lives in local-gated code, is an explicit constructor decision, and the default crate's dependency graph carries no tokio/net (cargo tree spot-check). The doors' binds are the doors' own (assembly-layer, ADR-009).
2. Seam-contract compliance by the providers (ADR-004): the readiness contract honored by both egress providers (real async parks; no hot Ok(None)); ownership rides the handle structurally (the composed owner-wrapper inside the payloads; no _ bindings of owning values); the accept future owns its resources end-to-end (both accept variants); framing-once (the providers speak inner bytes; no double prefix).
3. Door fidelity (ADR-005/ADR-003): the NoAuth door is a literal raw pipe; the cred-bearing door terminates RFC 1929 locally and re-originates in-band (never pipes raw post-auth); the password never crosses the channel as a SOCKS password; the RFC UDP-header codec appears only at the door boundary; FRAG ≠ 0 refused.
4. The graduation's shape (ADR-007 variant 2): the composed accept advertises the real bound and the real peer — no expected-addr stand-in; the POC's superseded workaround is not resurrected.
5. Convention compliance (AGENTS.md): no unwrap/expect/ panics outside tests; thiserror surfaces; no comments in code except doc comments + pinned non-obvious-correctness notes; naming; module structure (feature-gated backend modules never imported from the protocol/adapter/client modules — convention 15's last line); producer/consumer vocabulary.
6. Feature-gate hygiene (ADR-009): local brings only tokio/net (+ socket2 if justified); composed brings only alktunnels; the default graph unchanged; the wasm checks green for default + composed; local on wasm fails to build (the alktty posture — verify the failure is the expected one).
7. POC-fidelity spot-check: for two or three of the trickiest assembly behaviors (the composed egress's LRU eviction + closed- queue posture, the cred-bearing door's re-origination, the bind-first correlation), diff the crate's behavior against the POC crates' findings — the POCs are the empirical record; drift is a finding (except where an ADR supersedes the POC's shape — the bind-first graduation is the known one).
8. Docs sync: the specs match what landed (the integration task's reconciliation verified; any residue is a finding).

Notes

To be filled by the review agent — see the Summary and the Findings.

Acceptance Criteria

• The never-binds posture verified (protocol layer + default graph)
• Seam-contract compliance verified for every provider
• Door fidelity verified (both variants + the UDP boundary)
• The graduation's shape verified (no stand-ins)
• Convention compliance swept
• Feature-gate hygiene verified (all four verification targets)
• POC-fidelity spot-check of the trickiest assembly behaviors
• Docs sync verified; findings recorded; the gate to release polish opens

References

• docs/architecture/overview.md, wire.md, producer.md, consumer.md (the specs under review)
• docs/architecture/decisions/003/004/005/006/007/008/009/010/012/014
• POC crates: /workspace/alksocks-{connect,udp,bind}-poc (the fidelity sources)
• AGENTS.md (conventions 1–17; the verification commands)
• The batch-1 review precedent: tasks/implementation/review-protocol-core.md

Summary

To be filled on completion