Renames the written-usage rule into practice across the contract surface:
docs/ (architecture, research, plans, sdd), tasks/ (all 43 task files,
taskgraph validate passes), AGENTS.md, README.md, CHANGELOG.md, and the
.opencode/agents/ prompts. Every replacement is a sense-preserving
rewrite (colons, semicolons, commas, parentheses, sentence splits, varied),
never a mechanical swap; no spaced hyphens were substituted. Enum fields,
frontmatter, tables, wire data, and cited identifiers survive verbatim;
en dashes inside numeric ranges keep their meaning.
Verification: taskgraph validate (43 tasks), repo grep clean (single
exempt hit: the verification command's own search pattern in AGENTS.md),
cargo test, clippy --all-targets -D warnings, fmt --check, doc all green.
- ADR-005 decision 3 amended (the gap is closed upstream: alkvault
0.2.0's Zeroizing<String> return on every path incl. the error one;
the adapter wrap dropped — the double wrap would be dead posture);
the Negative consequence amended; the vault-surface note updated.
- mapping.md: the forwarded-tcpip row rides the gate shape (typed
call-plane miss, residual race re-scoped); derivation-contract
rule 5 amended (the PTY flattening constraint retired, alktty
0.8.2 — no contract change); the exit_signal row + OQ anchors
updated.
- open-questions.md: OQ-07 + OQ-10 amended with the upstream
closures; the two closed watch items struck with pointers.
- client.md: the OQ-07 anchor updated.
- src/client_accept.rs: the ReverseListener handles (ReverseEndpoint
carried; cancel() the wire-honest teardown) returned by the -R listen
rows; the shared cancel paths both the handles and the stateless wire
forms compose into; the confirmed cancel releases the listener count
exactly once; no Drop hides a wire op
- src/client.rs: the SshConnection internals behind the Arc
(ConnectionShared) — the handles' independent cancels compose on the
same stack; the §Lifecycle posture module docs (primitives-not-policy,
OQ-12; the abrupt-drop/clean-close facts, row-pinned)
- rows: drop-handle no-wire-state, handle-cancel + budget release,
cancel-mid-data-leg (tunnel build) + the every-build abrupt-drop row;
existing reverse rows adapted to the handles; the unix cancel rides
the handle flavor
- docs/architecture/client.md: the §Lifecycle primitives landing block;
task file filled
Verification: cargo test (default / session / git / tunnel / all-features)
all green; clippy ×2 -D warnings clean; fmt clean; cargo doc --no-deps clean
- src/client_accept.rs: the assembly-mutable acceptor registry
(per-type fixed slots under `tunnel`; refuse-never-replace install;
payload = the `TunnelChannel` duplex + the open's echo/originator
fields — the harness `ForwardedAcceptor` vocabulary grown), the
reverse-listen rows (bound-port surfaced; the listen/cancel forms;
the runtime-Unix gate at the listen), and the accepted-opens'
spawned handoff tasks.
- src/client_handler.rs: the `forwarded-tcpip` /
`forwarded-streamlocal` hooks route through the registry at
arrival time — registered + admitted → accept + handoff;
unregistered/unfeatured/cap-exhausted → the clean
`AdministrativelyProhibited` decline (never accept-and-drop);
pre-install arrivals decline, never buffered.
- src/client.rs: the dial wires the empty registry into the handler
+ the connection (`SshConnection::acceptors`, the late-install
accessor) + the listener budget's dedicated counter.
- src/error.rs: `OpError::NoAcceptor` / `ListenRefused` /
`ListenCapExceeded`; `RequestDenied` → `ListenRefused` (the
listen/cancel forms' wire decline class; the port-0 mint rides
alone at this pin — an explicit port's bound *is* the requested
one, surfaced).
- tests/common/sshd_double.rs: the fake `sshd`'s `-R` half — the
listen/cancel hooks bind real sockets (the out-param mint is the
real bound port), the accept loops open the server-initiated
forwarded channels + pump per accepted connection, cancels match
by the raw wire strings and tear the listener down.
- tests/client_reverse_listen.rs: the contract rows (listen + data
leg, the mint, the pre-wire gates, the declines, late-install
on/off, the cancels, the ceiling, the unix twins).
- tests/tunnel_mapping.rs: the full-circle client ↔ server-direction
smoke (both `-R` legs through the alkcall fabric double); real-
`sshd` `-R` stays wave-5 e2e (recorded).
- client.md: the acceptor's landing record (shape, cap relation,
gates, unix-gate placement, port-0 parity).
- fix(w4-op-rows, test cfg): the test mod's `family_exit_code`
import gated to the exit-consuming builds (`--features tunnel`
did not compile its tests before).
Verification: cargo test (default / each feature / --all-features)
green; cargo clippy --all-targets -- -D warnings (none +
--all-features) clean; cargo fmt --check clean; cargo doc --no-deps
clean (default build; all-features carries only the pre-existing
client_ops private-link warnings).
The family op → vanilla translation surfaces on SshConnection, per
client.md §op rows:
- session: exec (pipe) / pty_exec / shell → RemoteSession — the
alktty chunk plane both directions, the exit consumed in-band as
the family exit chunk (exit-chunk-is-last); the POC-3 §D.3
mechanics pinned (exec() + wait()-drain, split-halves pump for
exit-consuming rows, typed-open-then-straight-into_stream for the
exit-less tunnel rows)
- tunnel: tunnel_direct / tunnel_direct_unix → TunnelChannel — typed
opens, rejections mirrored to OpError::OpenDeclined
(OpenDeclineReason), the connection stays usable after every
decline (row-pinned per class); the OQ-11 runtime-Unix gate mirrored
- git: git_service(Service, repo_id) → GitPackSession — the shared
grammar's construction arm in dispatch.rs (parse round-trips
unit-pinned), the raw pack duplex pumped, the exit consumed
- sftp: the every-build OQ-13 placeholder (OpError::SftpNotServed,
Infallible Ok type), before any wire op
- shared exit-currency module src/exit_code.rs (extracted from
tty_map.rs): SIGNAL_NAMES + derive_exit + sig maps two-direction,
new signal_code_from_name client arm
- OpError taxonomy (closed, family-mirrored) in error.rs; the fake
sshd double grown with the op-row script + observations;
tests/client_ops.rs — 18 rows + the alkssh↔alkssh exec smoke
(real-vanilla-sshd smoke named wave-5 e2e territory)
Verification: cargo test (default + per-feature + all-features) all
green; clippy ×2 -D warnings clean; fmt clean; cargo doc --no-deps
warning-free.
The wave-3 gate read the landed server mappings against
mapping.md/ADR-006/ADR-003/auth.md line by line: session/pty/shell/pipe
(translation bridge + the derivation contract rules 1-6), git exec
(full grammar, no-oracle validation, collapsed denial byte order),
route-1 bridge direct rows, the full -R listen flow + forwarded-tcpip
data leg, per-build decline matrices, identity observed at every seam,
bounded bookkeeping, and the uniform safe tracing vocabulary. All four
decomposition-time interpretations confirmed.
Fixed inline (this gate):
- install_forwarded_surface pre-checks the tunnel/forwarded op —
alkcall's register silently replaces an existing entry, so a second
adapter over the same shared seam registry silently stole the first
adapter's arrival routes; now a failed construction
(AdapterError::ListenRegistration), pinned by a new wire row
- git take drops a stored pty entry (combined-build stale state)
- doc hygiene: channel_cap release ordering, the session-row scoping
of the handler Drop, the cancel-order recording, the post-cancel
arrival caveat, the exit-chunk ADR lineage cross-ref, the stale
lib.rs wave-state doc, the superseded dispatch test name, and
mapping.md's listen-resource wording (address verbatim + tcp port)
Booked for wave 4: the git row's status-before-close honored by
scheduling not construction (needs a seam/shape change), the
channel-not-held wire test rows, the tty coverage minors (cancel path,
Closed/Break shape, stdout write deadline), and a defensive
ListenRouter token-collision pre-check.
Verified: cargo test (default) + --all-features (173 rows, 13
binaries), clippy --all-targets -D warnings ×2 (default +
--all-features), fmt --check, cargo doc --no-deps (0 warnings),
taskgraph validate (26 tasks).
The tunnel branch's other half is served for real against published
alktunnels 0.4.1 / alkcall 0.10.1, with POC-3 §C.4 as the template:
- tcpip_forward/streamlocal_forward (+ both cancel forms) map the
vanilla listen request family-ward through TunnelListener::open on
the held ChannelClient (bounded inline dial — the global request's
reply + the &mut u32 bound-port out-param are the hook's); the
wire bind endpoint rides as the resource string verbatim (OpenSSH
client-side normalization parity). A reply without the minted
listen token/bound report declines and reaps its fabric listener.
- the door serves the fabric's inbound tunnel/forwarded opens: the
serve config gains TunnelListenSeam (the seam-config second
course-correction — the shared ServingConfig registry the assembly
wired at from_connection_with_serving); alkssh registers the
forwarded openable (ChannelCore over a clone of the held client's
manager) at SshAdapter::new — a failed registration is a failed
construction (AdapterError::ListenRegistration).
- the forwarded-tcpip data leg: token correlation through the shared
ListenRouter → the in-crate per-session channel cap at the accept
surface (the acceptor vocabulary) → Handle::
channel_open_forwarded_tcpip streaming the listen request's own
args + the actually-bound port (sshd parity) with
TunnelForwardedParams.peer as the originator → pump_bidi(ssh,
fabric). Correlation-miss → teardown-at-birth, never a half-open
SSH channel. Unix arrivals ride forwarded-streamlocal@openssh.com.
- bounded bookkeeping: the per-session listener map packet-loop-only
with a dedicated max_concurrent_channels-ceiling counter; the
route map bounded by construction (mints at accepted listens,
removed at cancels + session teardown — the handler's Drop).
- the harness grew the client-side accept hook
(server_channel_open_forwarded_tcpip/_streamlocal,
acceptor-driven) + a hand-rolled tracing subscriber; 18 contract
rows + both real-tool smokes (ssh -L, ssh -R + curl) green in
tests/tunnel_mapping.rs; the wave-2 stub listen rows migrated per
build (unfeatured / seam-unconfigured).
Verified: cargo test across default/git/session/sftp/tunnel and all
combos + --all-features; clippy -D warnings (default, all-features,
combos); cargo fmt --check; cargo doc --no-deps clean;
taskgraph validate (26 tasks).
The biggest single-row surface of the spine: pty/shell/pipe-exec serve
through the published alktty seam (drive_session_pre_negotiated) over a
translation bridge, re-landing POC-3 stage D as contract:
- src/tty_map.rs (session feature): the bridge (SSH data → Chunk::stdin
through a bounded mpsc + framing task; SSH EOF → the zero-length
stdin sentinel — verified against alktty's pump semantics; stdout →
data; stderr → extended_data(1); exit chunk → the derivation
contract), the locally-built negotiation (OQ-08: shell argv verbatim,
wrapper ++ [cmd], cwd/env session-side, ttymodes → the reserved {}
modes JSON), and the spawned serving path.
- serve_tty_row: driven chunks→SSH inline so the exit report is the
path's final act (status before close, ADR-006 decision 4); two
cancel signals (per-channel watch fired by channel_close, connection
teardown fired by SessionHandler::Drop) abort the alktty session
task — the ADR-056 kill-on-drop contract is the cancelled session's
cleanup.
- Derivation contract rules 1–6 in derive_exit + the crate-local
signum→name table: −N → exit-signal(name), −1 → exit-status(255),
core_dumped never, unmapped negatives → 255, the PTY-path rule-5
fidelity limit documented; wire rows pin the shapes.
- Negotiation-error frames (alktty's 0x00-length-prefixed error
framing) → negotiation-failed serving decline + exit-status(255) +
close — the one could-not-start claim this door makes (nothing ran).
- Control rows: window_change/signal → the per-channel BridgeSurface
(bounded mpsc, try_send, never awaited on the packet loop); signal
names verbatim (no decline shape — fire-and-forget); pre-serve
resizes update the stored pty params (final size wins).
- Unset-declines (OQ-08) keep the git row's serving-path shape
(failure then close, spawned): shell-unconfigured /
wrapper-unconfigured / seam-unconfigured; pipe-less shell SERVES
pipe-mode (the recorded vanilla-sshd posture); env_request decline
unchanged (OQ-09).
- tests: the hand-rolled TtyBackend shim + ownership witness doubles;
serving rows through the harness, the unset-field decline matrix,
derivation rows on the wire, negotiation-failure rows, the identity
ride asserted live at the seam, the kill witness; the real-tool
smoke — OpenSSH -tt against a real PTY via dev-dep alktty local
(test graph only), skip-with-reason posture. Wave-2 stub rows
migrated to the new decline reasons (dispatch_core, observe).
Verification: cargo test (113) / --features session (149) / git (142) /
tunnel (115) / --all-features (161) — all green; cargo clippy
--all-targets -- -D warnings ×5 feature configs; cargo fmt --check;
cargo doc --no-deps ×3 builds clean; taskgraph validate.
The format contract (ADR-004 decision 1) is SHA256: + unpadded
standard base64 — not url-safe. The ssh-key re-export and ssh-keygen
both emit the +/ alphabet (visible in the recorded fingerprints); the
'url-safe' wording in ADR-004/auth.md/plans/implementation.md and the
POC-1 §1 finding was a misnomer. Wording corrected; the parity
contract itself unchanged on both sides.
- OQ-10 is not resolved: the mapping-contract derivation details (name
table, core-dumped disposition, −1 disposition) are working
dispositions on mapping.md's exit rows until formalized there / as an
ADR-006 amendment. The 1a40bfb commit prematurely closed them and left
ADR-006's reference (OQ-10 open) stale.
- Premise correction integrated into the seed, not argued after the
fact; the portable-pty 0.9.0 source now cited as verified
(From<std::process::ExitStatus> maps signal-terminated → code 1 +
locale-dependent strsignal string; the number is unrecoverable).
- mapping.md: exit_signal row and the Open Questions entry updated to
open OQ-10 with the working-draft framing.
Verification: cargo test (2/2 targets ok), cargo clippy --all-targets -- -D warnings, cargo fmt --check (docs-only change)
- OQ-10 resolved: alkssh derives SSH exit-signal from the alktty exit
chunk's negative code (−N = signal N, pipe path) server-side; −1
(alktty's could-not-determine sentinel) → exit-status(255), never a
signal claim; core_dumped never asserted in v1; no alktty wire change
- new verified backend finding recorded: portable-pty 0.9 reduces
PTY-mode signal termination to a plain exit code 1 (signal number
unrecoverable through its trait surface) — faithful exit-signal on
the PTY row is an alktty/portable-pty upstream ask, not an alkssh one
- research docs (poc-3 §D.2, pocs.md, mapping-table rows) restated
accurately instead of carrying inline correction scaffolding
Verification: cargo doc --no-deps earlier this session (docs-only change)
- OQ-10's seed overstated alktty's exit-chunk design as a 'signal-identity
gap': the negative code is the documented signal encoding (alktty ADR-004,
ported from alknet ADR-055; src/local/pipe.rs::exit_code_from — Unix
ExitStatus::signal() → -sig), a tty/pty-grounded convention
- 'alktty widens the chunk' demoted from co-equal candidate to gated
exception: it would widen ControlMessage::Exit's one-way parsed shape,
the backend-wide exit_code API, and the alknet ADR-055 lineage — requires
an alktty ADR with explicit tty/pty-grounded justification, never an
alkssh convenience ask
- OQ-10 re-scoped to the real remaining detail: −1 (wait failure vs SIGHUP)
collision, core-dumped disposition, non-Unix semantics, name derivation
- correction notes added in place: poc-3 §D.2, pocs.md, mapping-table.md
(both rows); mapping.md exit_signal row updated
Verification: cargo doc --no-deps (docs-only change)
- the alkssh-level contract is the adapter-side Zeroizing wrap
(ADR-005 decision 3, POC-2-proven); the vault-side fix (Zeroizing-out
API) is filed in alkvault's own tracker — not carried, not gated on
here; ADR-005 §3 wording updated accordingly
Review untangle (three layers: local door / wire protocol / fabric):
- vanilla ssh -D binds its SOCKS5 proxy client-side (the local door —
alksocks' local-door shape) and opens plain direct-tcpip per
connection: the server needs nothing SOCKS-shaped (tunnel row +
route-1 bridge cover the leg; POC-3 correction 2 already said this)
- the family-native SOCKS5-in-channel server row served no consumer
of ours: family apps compose alksocks' local door locally over the
alkssh client's direct-tcpip DialFn — alkssh doesn't depend on
alksocks on this path
- amendments: ADR-003 §1a (feature removed), ADR-006 point 3 (SOCKS-
detect retired; session dispatch is parse-only; request-less
session channels decline), OQ-02 resolution updated with the
simplification, mapping-table.md rows annotated (research doc keeps
POC-3 stage B as the re-add feasibility record)
- ADR-006 (Accepted): direct-tcpip rides the adapter-side bridge
(alktunnels route 1; registry-side bridging rejected as door-posture
inversion; absence note resolved); git over SSH is exec-only with
subsystem declining (vanilla git's connection model is exec of
git-{upload,receive}-pack — POC-3 grammar table); session dispatch:
request-driven parse wins, request-less channels get the bounded
SOCKS-detect (first-byte 0x05, 500 ms default, assembly-configurable);
spawn-and-return recorded as a structural constraint
- OQ-02 resolved by ADR-006; README doc/ADr tables + OQ summary updated
- enabling the rsa feature is reverted: no other family location uses
RSA, ed25519 is the suggested path everywhere; the tree drops
rsa 0.10.0-rc.18 + pkcs1 0.8.0-rc.4 entirely (verified: aws-lc-rs-only
scratch build clean and RC-free except ssh-key =0.7.0-rc.11, which
russh exact-pins itself on the russh::keys path)
- RSA user keys decline fail-closed (russh fails RSA signing explicitly
when the feature is absent — 0.63.2 fix); assembly registration policy
(alkforge: register ed25519) noted as assembler territory
- README ADR table title updated
- ADR-002 (Accepted): pin russh 0.65 (0.65.0 published 2026-10-25
after the POCs' 0.64.1 verification — six security fixes incl.
three in internet-facing classes; breaks are handler-signature
shapes only, wire evidence transfers); aws-lc-rs backend confirmed
with a clean in-scratch build record (no provisioning; ring kept as
the recorded fallback); flate2 off (no compression); rsa on (front-
door compat — supersedes the research docs' earlier off-leaning;
RC-tree posture accepted with a recorded stable-release trigger);
des/dsa never; rust-version 1.89 lands with the dep
- russh.md: re-verification-at-architecture-time section added
(0.65.0 delta: PublicKeyOffer/VerifiedPublicKey, async-trait
removed, GHSA list, verified build + tree facts)
- ADR-003 (Accepted): five features (session/git/tunnel/
dynamic-forward/sftp-placeholder), flat + independent, default [],
two-direction symmetry rule (one name, both doors), client acceptor
fail-closed (not russh's accept-and-drop), x11/auth-agent never
features, honest advertisement per build
- OQ-05 resolved: known-beforehand hosts (assembly-minted/family runners)
-> pinned, hard-decline on mismatch; unknown-beforehand hosts (rental
fleets) -> assembly-provided HostKeyPolicy the crate calls — prompt-
record, provider-metadata match, or learn-and-record. Crate default
stays fail-closed reject-unknown; crate never decides trust; storage
of learned pins is assembly detail
- auth-bridge.md: refinement postscript — no-TOFU is a no-trust-decisions-
-in-crate rule, not pin-everything; alkminer's accept-all was the fleet-
churn collapse, and the real anchor for ephemeral fleets is hub-held
key material, not host pins
- reverse-runner.md §5 rewritten with the same nuance
glm-5.3-flash