The consumer's TCP front door (feature `local`, ADR-005/ADR-014): the
ssh `-D` local exposure vanilla clients point at.
- `src/door.rs`: `FrontDoor::builder().credentials(...).bind(...)`
→ `serve`/`serve_on`. The NoAuth door is the literal raw pipe
(accept → channel BiStream via copy_bidirectional, zero protocol
translation). The cred-bearing door terminates RFC 1929 locally
(the forked accept_password_auth shape) and re-originates in-band
via the token-carrying consumer sessions — the vanilla replies are
re-encoded at the door (the RFC codec boundary, ADR-003), the
password never crosses the channel as a SOCKS password. The BIND
door rides BindSession with reply#1 fidelity (the advertised
address passes through unchanged). UDP ASSOCIATE at the TCP door
refuses RFC-faithfully (0x07 — the UDP door's task). The ADR-014
accept-path defense: the idle-first-byte window (peek-based,
door-side close) + the max-sessions cap (semaphore) as constructor
config; per-accept failure isolation (the loop continues).
- The identity mechanism (decided + recorded in the task Notes): the
per-credential identity rides the open-op `auth_token` payload
(CF-005 precedence (1)) — the token is the mapped identity's id;
the producer resolves it through ServingConfig.identity_provider.
No per-credential ChannelClient.
- `src/consumer.rs`: `TokenClient` (the token-carrying open surface
over the taken CallConnection + shared manager) and the
`*_with_token` twins of the three session constructors through the
open_with_token_and_negotiate prologue (teardown-at-birth
preserved); `Socks5ChannelSession::reply_addr` (the CONNECT
reply's BND.ADDR for the door's re-encoding). Existing surfaces
untouched.
- `tests/door-tcp.rs`: 10 integration tests — the NoAuth raw-pipe
round-trip (the POC #1 curl shape), good/bad credentials (the
establisher witness sees the mapped identity, never the password;
a rejection opens no channel), the never-pipes-raw-post-auth pin,
the BIND door's vanilla conversation, the idle timeout, the
session cap, failure isolation, and the native-session/BIND-token
regression guards. Harness: wire_consumer_side_with_provider (the
producer's identity provider configurable).
Verification: cargo test (375) + --all-features (423) green; clippy
-D warnings clean (default + all-features); fmt --check clean; wasm
check + wasm clippy green; default graph stays net-free.
glm-5.3-flash
b8fd75b9f3