Same treatment for the prose the compiler carries: doc and line comments
across src/ and tests/, test assertion and error-message strings (prose
surfaces: the tunnel-map registration/establish errors, the key-source
decode payload, assertion messages), scripts/matrix.sh comment lines,
the fuzz sidecar's comments and README (corpus seeds untouched), and the
Cargo.toml comment headers plus the crates.io description. The AGENTS.md
no-em-dash rule (convention 14) now holds for the whole tracked tree.
Verification: repo-wide git grep is clean (single exempt hit: the
verification command's own search pattern), cargo test (18 suites, zero
failures, default and per-feature builds via scripts/matrix.sh), clippy
--all-targets -D warnings and clippy all-features, fmt --check, doc
--no-deps, and the fuzz corpus gate (fuzz/shared, 11 tests) all green.
- src/client_accept.rs: the assembly-mutable acceptor registry
(per-type fixed slots under `tunnel`; refuse-never-replace install;
payload = the `TunnelChannel` duplex + the open's echo/originator
fields — the harness `ForwardedAcceptor` vocabulary grown), the
reverse-listen rows (bound-port surfaced; the listen/cancel forms;
the runtime-Unix gate at the listen), and the accepted-opens'
spawned handoff tasks.
- src/client_handler.rs: the `forwarded-tcpip` /
`forwarded-streamlocal` hooks route through the registry at
arrival time — registered + admitted → accept + handoff;
unregistered/unfeatured/cap-exhausted → the clean
`AdministrativelyProhibited` decline (never accept-and-drop);
pre-install arrivals decline, never buffered.
- src/client.rs: the dial wires the empty registry into the handler
+ the connection (`SshConnection::acceptors`, the late-install
accessor) + the listener budget's dedicated counter.
- src/error.rs: `OpError::NoAcceptor` / `ListenRefused` /
`ListenCapExceeded`; `RequestDenied` → `ListenRefused` (the
listen/cancel forms' wire decline class; the port-0 mint rides
alone at this pin — an explicit port's bound *is* the requested
one, surfaced).
- tests/common/sshd_double.rs: the fake `sshd`'s `-R` half — the
listen/cancel hooks bind real sockets (the out-param mint is the
real bound port), the accept loops open the server-initiated
forwarded channels + pump per accepted connection, cancels match
by the raw wire strings and tear the listener down.
- tests/client_reverse_listen.rs: the contract rows (listen + data
leg, the mint, the pre-wire gates, the declines, late-install
on/off, the cancels, the ceiling, the unix twins).
- tests/tunnel_mapping.rs: the full-circle client ↔ server-direction
smoke (both `-R` legs through the alkcall fabric double); real-
`sshd` `-R` stays wave-5 e2e (recorded).
- client.md: the acceptor's landing record (shape, cap relation,
gates, unix-gate placement, port-0 parity).
- fix(w4-op-rows, test cfg): the test mod's `family_exit_code`
import gated to the exit-consuming builds (`--features tunnel`
did not compile its tests before).
Verification: cargo test (default / each feature / --all-features)
green; cargo clippy --all-targets -- -D warnings (none +
--all-features) clean; cargo fmt --check clean; cargo doc --no-deps
clean (default build; all-features carries only the pre-existing
client_ops private-link warnings).
The family op → vanilla translation surfaces on SshConnection, per
client.md §op rows:
- session: exec (pipe) / pty_exec / shell → RemoteSession — the
alktty chunk plane both directions, the exit consumed in-band as
the family exit chunk (exit-chunk-is-last); the POC-3 §D.3
mechanics pinned (exec() + wait()-drain, split-halves pump for
exit-consuming rows, typed-open-then-straight-into_stream for the
exit-less tunnel rows)
- tunnel: tunnel_direct / tunnel_direct_unix → TunnelChannel — typed
opens, rejections mirrored to OpError::OpenDeclined
(OpenDeclineReason), the connection stays usable after every
decline (row-pinned per class); the OQ-11 runtime-Unix gate mirrored
- git: git_service(Service, repo_id) → GitPackSession — the shared
grammar's construction arm in dispatch.rs (parse round-trips
unit-pinned), the raw pack duplex pumped, the exit consumed
- sftp: the every-build OQ-13 placeholder (OpError::SftpNotServed,
Infallible Ok type), before any wire op
- shared exit-currency module src/exit_code.rs (extracted from
tty_map.rs): SIGNAL_NAMES + derive_exit + sig maps two-direction,
new signal_code_from_name client arm
- OpError taxonomy (closed, family-mirrored) in error.rs; the fake
sshd double grown with the op-row script + observations;
tests/client_ops.rs — 18 rows + the alkssh↔alkssh exec smoke
(real-vanilla-sshd smoke named wave-5 e2e territory)
Verification: cargo test (default + per-feature + all-features) all
green; clippy ×2 -D warnings clean; fmt clean; cargo doc --no-deps
warning-free.
The client direction's substrate (client.md §The dial surface), the
mirror of w2-server-mount: dial(DialConfig) runs the fail-closed
four-step sequence — decrypt-at-dial key load (every KeySource
posture a distinct no-dial outcome), the bounded russh client Config
from Limits (keepalive 15 s / 3, the wall clock always Some, window/
packet/buffer verbatim), the injected host-key policy at
check_server_key (RejectAll connects to nothing; UnknownKey maps to
DialError::HostKeyRejected — its only producer), and exactly one
publickey-only auth attempt — and returns the authenticated
SshConnection handle everything else in the wave rides.
- DialConfig amendment (the sanctioned course-correction, recorded):
the required `username` field — the USERAUTH_REQUEST's user string;
no crate default, never identity, never logged (ADR-004 decision 5).
- The client Handler skeleton (src/client_handler.rs): every
server_channel_open_* hook overridden explicit-over-inherited with
a clean AdministrativelyProhibited reject (never russh's
accept-and-drop default, ADR-003 §4); should_accept_unknown_
server_channel the explicit false; decline events on the crate
vocabulary (no-acceptor / never-feature reasons).
- The in-process fake sshd (tests/common/sshd_double.rs): the
client-direction contract vehicle — a plain russh server on a real
loopback TCP listener, accept-set identity resolution, the auth_
succeeded handle carrier for the server-initiated-open rows, the
per-session outcome channel for the clean-close rows.
- tests/client_dial.rs: 10 contract rows — dial success, the five
key-source no-dial postures, RejectAll / pin-mismatch / case-2
policy rows, refused auth, the malformed-address dial-time refusal,
the bounded-config observable, the six-hook decline wire rows with
decline events, and the smoke: alkssh-client ↔ alkssh-server over a
real TCP loopback (real-sshd dial stays wave-5 e2e).
Verification: cargo test + per-feature + --all-features (14 binaries,
all green), cargo clippy ×2 (-D warnings), cargo fmt --check,
cargo doc --no-deps — all clean. taskgraph validate: 35 tasks valid.
glm-5.3-flash