Post-POC #2 findings review: a real BIND use case and mechanism
surfaced, plus a channel-capacity analysis for proxy workloads.
- OQ-SK-08: fast-socks5 parses but refuses TCPBind — the wrapper owns
the whole shape (zero upstream ask). Phase-model extension: reply#1
(BND.ADDR) -> quiet wait -> one inbound accept -> reply#2 (peer) ->
raw pass-through; iroh-socks5's channels-native BIND is convergent
precedent. Accept variants mirror OQ-SK-03's egress variants:
feature-gated local listener (faithful RFC) vs composed alktunnels
listen-tunnel (needs a listen-addr-inspection ask) vs wrapper-aware
only. Security note: BIND is inbound egress — SOCKS5_OPEN_SCOPE must
distinguish it from CONNECT/ASSOCIATE.
- OQ-SK-09: 256-channel default vs proxy fan-out; wire change
rejected, assembly-layer config + documented proxy-workload
recommendation is the mechanism; in-channel port multiplexing
([port:u16] per chunk) considered and rejected (re-opens OQ-SK-03's
demux-vs-phase trade, breaks 0-B pass-through, AGENTS.md #10).
- OQ-SK-05 addendum: virtual address space / identity-scoped subnets
adoptable with no wire change — DST.ADDR/BND.ADDR translation via
the dial callback; hub exposure via terminate-and-re-produce.
- POC #5 (BIND, both accept variants, vanilla front-door test) added
to OQ-SK-07; checklist + convergence updated; upstream-asks list
pinned (fast-socks5: net gate + UDP bind seam; alktunnels:
listen-addr inspection).
Verification: docs-only change (phase-0.md).
glm-5.3-flash
601afa3922