alksocks/tasks/architecture/oq-sk2-07-virtual-subnet-helper.md at 986bd13ce715096f3553fd4701b9fe6afdedaaa0

0 Fork 0

Files

T

glm-5.3-flash 9587670138 docs: Phase 1 architecture — specs, ADRs 001-012, open-questions tracker

- docs/architecture/: README index, overview, wire, producer,
  consumer, vendor, bast specs + open-questions.md (the OQ-SK-01..09
  ledger promoted; new questions as OQ-SK2-06..)
- ADRs 001-012: ALPN/op/params, protocol base, the handle swap,
  the dial-callback shape, auth split by the door, access control
  (open gate + BIND command gate), BIND in base, provider defaults,
  feature gates, channel capacity, the inline vendor, target policy
- deferred OQs (SK2-06, SK2-07) with tracker tasks in
  tasks/architecture/ per the sdd_process deferred-OQ protocol
- review pass applied: frame-length joint bound (65766 corner),
  accept_no_auth vs skip_auth corrected against fast-socks5 source,
  composed-feature wasm posture, cross-reference fixes

Verified: cross-references (all ADR/OQ refs resolve), doc sizes
under split threshold, Phase 0 fidelity spot-checks

2026-09-20 18:41:56 +00:00

1.5 KiB

Raw Blame History

id, name, status, depends_on, scope, risk, impact, level

name

status

depends_on

scope

risk

impact

level

architecture/oq-sk2-07-virtual-subnet-helper

Track — OQ-SK2-07 unblock condition (virtual-subnet deployment)

pending

single

trivial

component

research

Description

External-trigger tracker for OQ-SK2-07 (docs/architecture/ open-questions.md): the virtual-subnet translation-layer helper. This task is NOT actionable work — it tracks whether the external unblocking condition has arrived. Tagged [external-trigger, deferred-oq] per docs/sdd_process.md §Deferred OQs.

Unblocking condition: a concrete deployment wants identity-scoped virtual subnets (proxied resources IP-addressable per identity) — the shape ADR-012 resolved as assembly-layer policy over the dial callback.

Work

When the condition arrives:

Mark this task completed (the condition arrived).
Transition OQ-SK2-07 from deferred(scope) to open (or directly to resolved if assembly-layer policy still suffices).
Decide: does a translation-table helper graduate into the crate (subnet sizing, per-identity tables, hub exposure)? Check tun2proxy's virtual-network/virtual-DNS support as prior art (/workspace/tun2proxy).

Verification

N/A (tracking task — trivial risk, no code).

Out of scope

Any crate-level implementation of the translation layer before the condition arrives (ADR-012: the dial callback is the seam; the crate's obligation is only that the seams support it).

Notes

Agent fills this during implementation.

Summary

Agent fills this on completion.

1.5 KiB Raw Blame History