alkdev/alkssh
6
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
31 Commits 1 Branch 1 Tag
635e82b54b5324fcf5acd54575d5fe2e42e3f7b3
Commit Graph
4 Commits
Author SHA1 Message Date
glm-5.3-flash 635e82b54b feat(fingerprint): land the single fingerprint path + ssh-keygen parity vectors 
- src/fingerprint.rs: alkssh::fingerprint wraps the ssh-key re-export
  (HashAlg::Sha256) — the crate's only fingerprint computation and
  formatting site (ADR-004 decision 1's contract invariant)
- tests/fingerprint_parity.rs: 4 committed ed25519 fixtures with
  ssh-keygen -lf-recorded fingerprints (OpenSSH 9.6p1, independent
  issuer); blobs cross-checked against the vectors manifest
- verified: cargo test, clippy (default + all-features, -D warnings),
  fmt; taskgraph validate clean
 2026-10-28 06:27:49 +00:00
glm-5.3-flash d85299df38 feat(error): land the fail-closed key-source error taxonomy 
- KeySourceError with exactly five variants (Locked, Absent,
  Decryption, UnknownKeyVersion, Decode) — ADR-005 decision 4's
  failure matrix as distinct shapes, the vault taxonomy reshaped
  never collapsed; no catch-all, no Other/Unknown
- payload shapes pinned: Locked/Absent payload-free;
  Decryption/UnknownKeyVersion carry the vault's opaque messages;
  Decode carries a message so the RC-pinned ssh-key error type
  never enters the public API (flagged for the wave-1 gate)
- each variant doc-commented with ADR-005 semantics + fail-closed
  consequence; module stays engine-blind (no vault/russh types)
- no From<VaultServiceError>: non-mappable vault variants would
  force a collapse; w1-key-sources maps explicitly at its seam
- exhaustive-match + Display/Debug/Clone unit tests

Verified: cargo test (default + all-features), cargo clippy
--all-targets --all-features -- -D warnings, cargo fmt --check,
cargo doc --no-deps, taskgraph validate
 2026-10-28 06:22:52 +00:00
glm-5.3-flash 78ae905b21 build(manifest): land wave-1 dependency set and ADR-003 feature graph 
- russh = "0.65", default-features off, aws-lc-rs only (ADR-002:
  no flate2, no rsa; tree RC-free except the recorded ssh-key
  0.7.0-rc.11 pin riding the russh keys path)
- alkcall 0.10, alkvault 0.1 version-pinned; no path deps
- standing toolkit: tokio, thiserror, tracing, parking_lot, zeroize
- edition 2024, rust-version 1.89
- ADR-003 feature graph: session/git/tunnel/sftp, default = [],
  flat and independent — features gate nothing yet (wave-2
  decline core is the first consumer)
- task w1-manifest completed; notes/summary filled

Verified: cargo tree (no rsa/pkcs1/flate2), cargo test, cargo test
--all-features, cargo clippy --all-targets -- -D warnings (default +
all-features), cargo fmt --check, taskgraph validate
 2026-10-28 06:20:20 +00:00
glm-5.3-flash 0b1bc284fa docs(plans): add wave-based implementation plan; decompose wave 1 
- docs/plans/implementation.md: five-wave decomposition of the
  architecture (foundations -> server stack -> server mappings ||
  client direction -> validation & release), following the alkgit
  sibling pattern (decompose-implement-gate rhythm, per-wave
  decomposition records, review gates at wave boundaries)
- scope authority: v0.1.0 publishes the crate; assembly wiring stays
  out; sftp decline placeholder is shipped behavior
- wave 1 decomposed into eight task files under tasks/implementation/
  (manifest, error model, key sources, host-key policy, fingerprint,
  config surface, test doubles, review gate) with recorded
  interpretations flagged for the gate

Verification: taskgraph validate (12 tasks, no cycles); cargo test,
clippy -D warnings, fmt --check green
 2026-10-28 06:13:26 +00:00