alkssh

81 Commits 1 Branch 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
glm-5.3-flash	f4b5f896b4	docs: sweep em dashes from all markdown prose Renames the written-usage rule into practice across the contract surface: docs/ (architecture, research, plans, sdd), tasks/ (all 43 task files, taskgraph validate passes), AGENTS.md, README.md, CHANGELOG.md, and the .opencode/agents/ prompts. Every replacement is a sense-preserving rewrite (colons, semicolons, commas, parentheses, sentence splits, varied), never a mechanical swap; no spaced hyphens were substituted. Enum fields, frontmatter, tables, wire data, and cited identifiers survive verbatim; en dashes inside numeric ranges keep their meaning. Verification: taskgraph validate (43 tasks), repo grep clean (single exempt hit: the verification command's own search pattern in AGENTS.md), cargo test, clippy --all-targets -D warnings, fmt --check, doc all green.	2026-11-04 20:28:00 +00:00
glm-5.3-flash	4d529dbacf	feat(key-source): land the vault-backed key sources (ADR-005 custody in code) - Two injected-handle seams: KeySource (dial-config, decrypt-at-use -> one PrivateKey) and HostKeySource (serve-config, decrypt-at-construction -> the Config::keys set); async_trait object-safe, the HostKeyPolicy handle shape - Crate-provided ADR-005 implementations: VaultKeySource (injected vault handle + Option<EncryptedData>, None -> Absent) and VaultHostKeySource (record set, empty -> Absent) over the shared decrypt_and_decode chain: vault.decrypt -> Zeroizing<String> seam wrap -> one-time decode_secret_key(plain, None) - EncryptedData opaque in src/ (no key_version interpretation); vault error taxonomy reshaped into the five-variant KeySourceError matrix, never collapsed; plaintext never persists - 12 in-module tests on the real in-memory alkvault handle: round-trip (fingerprint-identical ed25519 key that signs), full failure matrix, locked host-bootstrap refusal, lock-mid-session lifecycle, v2->v3 rotation identity; three committed throwaway PEM fixtures Verified: cargo test (23 + 4 parity), cargo test --all-features, clippy -D warnings (default + all-features), fmt --check, taskgraph validate	2026-10-28 06:45:56 +00:00
glm-5.3-flash	0b1bc284fa	docs(plans): add wave-based implementation plan; decompose wave 1 - docs/plans/implementation.md: five-wave decomposition of the architecture (foundations -> server stack -> server mappings \|\| client direction -> validation & release), following the alkgit sibling pattern (decompose-implement-gate rhythm, per-wave decomposition records, review gates at wave boundaries) - scope authority: v0.1.0 publishes the crate; assembly wiring stays out; sftp decline placeholder is shipped behavior - wave 1 decomposed into eight task files under tasks/implementation/ (manifest, error model, key sources, host-key policy, fingerprint, config surface, test doubles, review gate) with recorded interpretations flagged for the gate Verification: taskgraph validate (12 tasks, no cycles); cargo test, clippy -D warnings, fmt --check green	2026-10-28 06:13:26 +00:00

Author

SHA1

Message

Date

glm-5.3-flash

f4b5f896b4

docs: sweep em dashes from all markdown prose

Renames the written-usage rule into practice across the contract surface:
docs/ (architecture, research, plans, sdd), tasks/ (all 43 task files,
taskgraph validate passes), AGENTS.md, README.md, CHANGELOG.md, and the
.opencode/agents/ prompts. Every replacement is a sense-preserving
rewrite (colons, semicolons, commas, parentheses, sentence splits, varied),
never a mechanical swap; no spaced hyphens were substituted. Enum fields,
frontmatter, tables, wire data, and cited identifiers survive verbatim;
en dashes inside numeric ranges keep their meaning.

Verification: taskgraph validate (43 tasks), repo grep clean (single
exempt hit: the verification command's own search pattern in AGENTS.md),
cargo test, clippy --all-targets -D warnings, fmt --check, doc all green.

2026-11-04 20:28:00 +00:00

glm-5.3-flash

4d529dbacf

feat(key-source): land the vault-backed key sources (ADR-005 custody in code)

- Two injected-handle seams: KeySource (dial-config, decrypt-at-use ->
  one PrivateKey) and HostKeySource (serve-config, decrypt-at-construction
  -> the Config::keys set); async_trait object-safe, the HostKeyPolicy
  handle shape
- Crate-provided ADR-005 implementations: VaultKeySource (injected
  vault handle + Option<EncryptedData>, None -> Absent) and
  VaultHostKeySource (record set, empty -> Absent) over the shared
  decrypt_and_decode chain: vault.decrypt -> Zeroizing<String> seam
  wrap -> one-time decode_secret_key(plain, None)
- EncryptedData opaque in src/ (no key_version interpretation); vault
  error taxonomy reshaped into the five-variant KeySourceError matrix,
  never collapsed; plaintext never persists
- 12 in-module tests on the real in-memory alkvault handle: round-trip
  (fingerprint-identical ed25519 key that signs), full failure matrix,
  locked host-bootstrap refusal, lock-mid-session lifecycle,
  v2->v3 rotation identity; three committed throwaway PEM fixtures

Verified: cargo test (23 + 4 parity), cargo test --all-features,
clippy -D warnings (default + all-features), fmt --check, taskgraph
validate

2026-10-28 06:45:56 +00:00

glm-5.3-flash

0b1bc284fa

docs(plans): add wave-based implementation plan; decompose wave 1

- docs/plans/implementation.md: five-wave decomposition of the
  architecture (foundations -> server stack -> server mappings ||
  client direction -> validation & release), following the alkgit
  sibling pattern (decompose-implement-gate rhythm, per-wave
  decomposition records, review gates at wave boundaries)
- scope authority: v0.1.0 publishes the crate; assembly wiring stays
  out; sftp decline placeholder is shipped behavior
- wave 1 decomposed into eight task files under tasks/implementation/
  (manifest, error model, key sources, host-key policy, fingerprint,
  config surface, test doubles, review gate) with recorded
  interpretations flagged for the gate

Verification: taskgraph validate (12 tasks, no cycles); cargo test,
clippy -D warnings, fmt --check green

2026-10-28 06:13:26 +00:00