alksocks/tasks/implementation/local-backend-producer.md

id, name, status, depends_on, scope, risk, impact, level

id	name	status	depends_on	scope	risk	impact	level
implementation/local-backend-producer	Producer-side local backend — the producer's front door (vanilla clients → a locally-served SOCKS5 resource)	pending	implementation/local-providers	narrow	low	component	implementation

Description

The producer-side local backend (feature local): the same door shape in the other direction — the producer serves from a real listener, so vanilla clients reach a locally-served SOCKS5 resource (producer.md §Producer-Side Local Backend). This is the shape where the SOCKS5 service rides a real TcpListener instead of (or alongside) channels: each accepted TCP connection is handed to the landed substrate-free entry Socks5Producer::serve_socks5_over directly — the RFC conversation runs on the accepted socket, the seams dial locally.

Deliverables:

1. src/local/ additions (feature local) — the producer-side listener shape:
   • A serve_local-shaped constructor on the local module (exact name at implementation; producer.md names no symbol — record the choice in Notes): takes a Socks5Producer (the landed builder type), a bind address, and the door-policy knobs (the idle-first-byte timeout + max-concurrent-sessions cap — the same two knobs the consumer door carries, ADR-014's accept-path defense; an accepted socket is not a channel).
   • The accept loop: bind the listener, per accepted connection spawn producer.serve_socks5_over(stream); per-connection failures are logged + isolated (the loop continues). The listener's lifetime is the caller's (a close/Drop shape — the alktunnels TunnelListener teardown posture).
   • This is a front door for the producer side: the door surface (NoAuth raw pipe vs RFC 1929 cred-bearing, ADR-005) is the consumer door's code shape. For the producer-side backend the NoAuth shape is the primary one (the producer IS the RFC conversation here — serve_socks5_over runs accept_no_auth in-stream); a cred-bearing variant would wrap accept_password_auth before serve_socks5_over — land the NoAuth shape; the cred-bearing producer-side door is a documented follow-up unless a test drives it (record the decision in Notes).
   • The BIND command gate on this path is the builder's bind_policy (the landed Socks5ProducerBuilder::bind_policy — the substrate-free entry's gate); document that the per-caller gate (the pump handler's identity-derived one) does not apply here — this path has no open-op identity.
2. Tests (tests/local-backend-producer.rs): a vanilla RFC 1928 client against the locally-served producer — CONNECT round-trip through local::tcp_dial() seams (the whole stack on real sockets); BIND through the local backend (the faithful-RFC variant: real reply#1/reply#2 addresses); the idle-first-byte timeout; the session cap; per-connection failure isolation; the bind_policy(false) gate refuses BIND RFC-faithfully (0x02).

Acceptance Criteria

• cargo test passes; cargo test --all-features passes
• cargo clippy --all-targets -- -D warnings clean; cargo fmt --check clean
• Default wasm checks stay green (backend code is local-gated)
• The backend serves via Socks5Producer::serve_socks5_over (the landed substrate-free entry) — no new protocol-layer code
• The accept path owns the idle defense + session cap (the two knobs) — pinned by tests
• Per-connection failure isolation — pinned by test
• The bind_policy gate is honored on this path — pinned by test

References

• docs/architecture/producer.md §Producer-Side Local Backend, §Wiring
• docs/architecture/decisions/005-auth-split-by-door.md (the door surface), 014-idle-timeout-posture.md, 006 (the bind gate)
• Landed surfaces: src/producer.rs (Socks5Producer/ Socks5ProducerBuilder::bind_policy/serve_socks5_over), src/local/ (the providers from local-providers)
• POC reference: /workspace/alksocks-connect-poc/src/producer.rs (the serve_socks5_over shape the POC validated)

Notes

To be filled by implementation agent

Summary

To be filled on completion