---
id: w1-manifest
name: "Wave 1: manifest landing (russh pin + the feature graph)"
status: completed
depends_on: []
scope: moderate
risk: medium
impact: project
level: implementation
---

## Description

Land the implementation dependency set and the ADR-003 feature graph:
the first commit of wave 1, with everything else landing inside it.
Per
ADR-002 decision 6 ("manifest lands with the dependency") and
`overview.md` §lifecycle note:

- **`russh = "0.65"`** (caret stops at the minor), `default-features =
  false, features = ["aws-lc-rs"]` per the family crypto posture
  (decision 2), **no `flate2`** (decision 3), **no `rsa`** (decision 4:
  ed25519-only; the tree must drop `rsa`/`pkcs1` RC deps entirely,
  with `ssh-key =0.7.0-rc.11` riding the russh keys path as the
  recorded exception).
- **`alkcall 0.10`** (identity/ACL types at the wire layer:
  `IdentityProvider`, `Identity`, `AccessControl`), **`alkvault 0.1`**
  (the ADR-005 custody model). Both pinned by version, never
  sibling-checkout paths.
- Standing toolkit: `tokio`, `thiserror`, `tracing`, `parking_lot`,
  `zeroize` (the ADR-005 `Zeroizing` wrap).
- **`edition = "2024"`, `rust-version = "1.89"`** (supersedes the
  current 1.88/2021 manifest).
- **The ADR-003 feature graph declared from the first commit**:
  `session`, `git`, `tunnel`, `sftp`, `default = []`; the graph is
  flat, independent, and no feature implies another. Features gate
  nothing yet (the wave-2 decline core is their first consumer); the
  per-feature sibling deps (`alktty` under `session`, `alktunnels`
  under `tunnel`, `alkgit` under `git`) land with their first
  consuming wave, not as dead manifest entries (recorded
  interpretation, flagged for the wave-1 gate).
- Update the manifest comments (the current "deliberately empty until
  implementation start" notes are superseded); keep comments to the
  non-obvious-constraint class only.

Pre-flight: verify every pin exists on crates.io at the declared
version (`russh 0.65`, `alkcall 0.10`, `alkvault 0.1`); if a
crate/version is not published, stop and escalate, since a missing
pin is a blocking issue, not something to work around.

## Acceptance Criteria

- [x] Manifest declares russh 0.65 with `aws-lc-rs` only;
      `cargo tree` shows no `rsa`/`pkcs1` packages and no `flate2`
      (the `ssh-key` RC pin excepted, recorded)
- [x] `alkcall 0.10` and `alkvault 0.1` pinned by version; no path
      deps anywhere
- [x] Features `session`/`git`/`tunnel`/`sftp` declared, `default =
      []`; `cargo test --all-features` passes (features gate nothing
      yet)
- [x] `edition = "2024"`, `rust-version = "1.89"` set
- [x] `cargo test`, `cargo clippy --all-targets -- -D warnings`,
      `cargo fmt --check` pass

## References

- docs/architecture/decisions/002-russh-pin.md (decisions 1–6)
- docs/architecture/decisions/003-feature-graph.md (decision 1, §2)
- docs/architecture/overview.md §lifecycle note, §bounded-resources
- docs/research/russh.md (the 2026-10-26 re-verification section:
  feature names, tree inventory, MSRV)

## Notes

> Pre-flight executed: `cargo info` confirmed `russh 0.65.0`,
> `alkcall 0.10.0`, and `alkvault 0.1.0` all published on crates.io,
> so there is no blocking issue. `alkcall` pinned as `"0.10"` (latest
> in-range is 0.10.1; the caret stops at the minor, matching the
> ADR-002-russh convention for family pins). Toolkit versions:
> `thiserror 2.0`, `tracing 0.1`, `parking_lot 0.12`, `zeroize 1.9`,
> `tokio 1.54` (as already pinned). `alktty`/`alktunnels`/`alkgit`
> sibling deps deliberately not added, as they land with their first
> consuming wave (recorded interpretation, flagged for the wave-1
> gate as the task states; no dead manifest entries). Manifest
> comments trimmed to the non-obvious-constraint class: the
> russh/`default`-features posture (ADR-002, which must not be
> re-enabled by a future editor) and the fail-closed feature-graph note (ADR-003).

## Summary

> Manifest landed: `russh = "0.65"` with
> `default-features = false, features = ["aws-lc-rs"]`; `alkcall 0.10`
> and `alkvault 0.1` version-pinned (no path deps); standing toolkit
> (`tokio`, `thiserror`, `tracing`, `parking_lot`, `zeroize`);
> `edition = "2024"`, `rust-version = "1.89"`; ADR-003 feature graph
> (`session`/`git`/`tunnel`/`sftp`, `default = []`, flat and
> independent). Verified: `cargo tree` contains no `rsa`, `pkcs1`, or
> `flate2` (only the recorded `ssh-key 0.7.0-rc.11` exception riding
> the russh keys path); `cargo test`, `cargo test --all-features`,
> `cargo clippy --all-targets -- -D warnings` (default and
> all-features), and `cargo fmt --check` all pass. `taskgraph
> validate` clean.