From e59ef791f4ef292ed7f44312669b8c576f84f2be Mon Sep 17 00:00:00 2001 From: "glm-5.3-flash" Date: Fri, 30 Oct 2026 22:23:11 +0000 Subject: [PATCH] chore(release): record the plan closure for the alkssh 0.1.0 publish (w5-publish) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - plan file status → closed; wave-5 row → published; §Plan closure added (the freeze inventory one-way, the still-booked upstream asks) - w5-publish task: the checklist record (manifest sanity, the full verification set, dry-run, package list) + status, over the green review-wave-5 verdict --- docs/plans/implementation.md | 37 ++++++++++++++++++++++---- tasks/implementation/w5-publish.md | 42 ++++++++++++++++++++++++++++-- 2 files changed, 72 insertions(+), 7 deletions(-) diff --git a/docs/plans/implementation.md b/docs/plans/implementation.md index 91fa60d..13b932e 100644 --- a/docs/plans/implementation.md +++ b/docs/plans/implementation.md @@ -1,8 +1,8 @@ --- -status: draft -last_updated: 2026-10-30 (wave 5 decomposed after the wave-4 gate - closed green — nothing to absorb beyond the wave's own plan; waves - 1–4 decomposed + implemented + gated 2026-10-28/29) +status: closed +last_updated: 2026-10-30 (the plan closed at the publish of alkssh + 0.1.0 — tag `alkssh-v0.1.0`; waves 1–5 decomposed + implemented + + gated 2026-10-28/30) --- # alkssh — Implementation plan @@ -48,7 +48,7 @@ mappings ∥ client direction) → validation & release. | [2](#wave-2--the-server-stack) | `SshAdapter::handle` mount + `Config` construction; the auth bridge; parse-only dispatch + fail-closed decline core; spawn-and-return plumbing; bounded resources; loopback harness | wave 1 | decomposed | | [3](#wave-3--server-mappings) | session → alktty (translation bridge + exit derivation); git → alkgit (exec grammar + dispatch); tunnel → alktunnels route 1; sftp placeholder declines | wave 2 | decomposed | | [4](#wave-4--client-direction) | Dial surface; op rows (exec/pty, direct-tcpip, git exec); the `-R` leg (listen + acceptor registry); lifecycle primitives | wave 1 | decomposed | -| [5](#wave-5--validation--release) | Decline-matrix contract suite; real-tool e2e; fuzzing; docs; **the publish** | waves 3 + 4 | decomposed | +| [5](#wave-5--validation--release) | Decline-matrix contract suite; real-tool e2e; fuzzing; docs; **the publish** | waves 3 + 4 | published | ## Wave 1 — Foundations @@ -526,6 +526,33 @@ Interpretations recorded (flagged for the wave-5 gate): - **No version bump** — the manifest already carries 0.1.0; the publish task verifies rather than bumps. +## Plan closure (2026-10-30) + +The plan closed at the publish of **`alkssh 0.1.0`** — the publish +commit, tagged **`alkssh-v0.1.0`** (the crate-qualified alkgit tag +convention) and pushed to `origin/main`. Scope authority discharged: +the complete two-direction door shipped (server stack + all mappings, +client stack + op rows, key sources, host-key policy seam, the +decline matrix contract-tested per build per `scripts/matrix.sh` — +see AGENTS.md's verification list), the assembly stays out (seams +only — identity/ACL/fabric policy is downstream composition), no +binary, single crate. All five review gates closed green (waves 1–4 +2026-10-28/29; the wave-5 release gate 2026-10-30). + +**The freeze inventory is one-way from the publish** (recorded in +`w5-release-readiness.md` §The freeze inventory, verified accurate +against the landed code at the wave-5 gate): the mapping contracts, +the honest-advertisement posture, the decline-matrix behavior, the +fingerprint string format, the russh 0.65 pin's wire posture. +Further wire-relevant change is a new ADR + a semver event. + +Still booked with their owners (nothing absorbed through the +release): the wave-3 gate's item-5 upstream asks (the +alktunnels/alkcall non-detaching post-construction identity seam; +mapping.md's correlation-miss event-vocabulary nuance) and the +`ssh-key` PPK parse-echo ask recorded in `w5-fuzz-harness.md` +(the tracker filing is owner-territory). + ## References - `docs/architecture/` — overview, mapping, client, auth, diff --git a/tasks/implementation/w5-publish.md b/tasks/implementation/w5-publish.md index c2c05bd..efafde8 100644 --- a/tasks/implementation/w5-publish.md +++ b/tasks/implementation/w5-publish.md @@ -1,7 +1,7 @@ --- id: w5-publish name: Wave 5 — the publish of alkssh 0.1 -status: pending +status: in-progress depends_on: [review-wave-5] scope: narrow risk: medium @@ -71,7 +71,45 @@ The checklist: ## Notes -> To be filled by implementation agent +Filled by the implementation agent (2026-10-30), executing over the +green `review-wave-5` verdict at `9383e95`. + +- **No findings in the checklist itself** — unlike the alkgit + publish (which had to land missing LICENSE files), the wave-5 + release readiness already landed every artifact; this task only + verified. +- **Manifest sanity verified** (no bump — 0.1.0 is the manifest + value): version 0.1.0, edition 2024, `rust-version` 1.89, + `license = "MIT OR Apache-2.0"` with `LICENSE-MIT` + + `LICENSE-APACHE` present, the pins exactly as ADR-002 records them + (russh 0.65 `default-features = false` + `aws-lc-rs`; alkcall + 0.10; alkvault 0.1; the optional siblings alktty 0.8.1 / alkgit + 0.1.0 / alktunnels 0.4.1), the package-policy `exclude` list in + place, the feature graph exactly ADR-003's flat shape + (`default = []`, no implies). +- **The full verification set green at the gate commit** (the tree + was clean — gate commit == publish base): `scripts/matrix.sh` all + six builds' `cargo test` + clippy ×2 (`--all-targets -D warnings`, + with and without `--all-features`) + `cargo fmt --check` + + `cargo doc --no-deps` (doctests included — the two `no_run` + usage doctests compile-checked per build); the fuzz corpus gate + `cargo test --manifest-path fuzz/shared/Cargo.toml` 11/11. +- **The dry-run clean**: `cargo publish --dry-run --allow-dirty` — + 76 files packaged, the packaged tree compiled (verification + compile passed), upload aborted by dry run as expected; + `cargo package --list` spot-checked against the package policy — + exactly `src/` (20), `tests/` (+ `common/` + `vectors/`), the + architecture docs (`docs/architecture/`), `README.md`, + `CHANGELOG.md`, both licenses, the manifests, and + `scripts/matrix.sh`; none of the excluded surface appears + (`AGENTS.md`, `.opencode/`, `docs/plans|reviews|research/`, + `docs/sdd_process.md`, `tasks/`, `fuzz/`). +- **The publish credential is present in this environment** — the + publish executes live, no operator handover, no silent skip. +- **The closure records ride the publish commit**: the plan file's + status → `closed`, the wave-5 row → `published`, and the §Plan + closure note (the freeze inventory one-way; the still-booked + upstream asks) land in the tagged commit. ## Summary