---
id: w2-bounded-resources
name: Wave 2 — bounded resources (the in-crate channel cap at the handler surface)
status: pending
depends_on: [w2-spawn-return]
scope: narrow
risk: low
impact: component
level: implementation
---

## Description

Enforce the in-crate bounded-resources posture at the handler surface
(`overview.md` §Bounded-resources policy; AGENTS.md convention 9 —
SSH servers are internet-facing; unbounded loops and unbounded buffers
are bugs):

- **The in-crate concurrent-channel cap** — a count of active channels
  enforced at every `channel_open_*` hook: opens beyond
  `Limits::max_concurrent_channels` are declined fail-closed (a clean
  refuse, never queued, never a half-open channel). The count
  decrements on channel close so the cap recovers. Short-held
  internal state (`parking_lot`, the project convention).
- **The russh knobs are already wired** (`w2-server-mount` mapped
  `inactivity_timeout` always-`Some`, `max_auth_attempts`,
  `window_size`, `maximum_packet_size`, `channel_buffer_size` from
  `Limits`) — this task verifies them behaviorally where cheap
  (e.g., the auth-attempt ceiling disconnects an exceeding client
  through the harness) and records anything not cheaply observable
  as covered by the config-mapping tests.
- **Per-length exec-parse limits stay reserved** for the wave-3
  grammar's consumption (`Limits::max_exec_command_len` is carried,
  not yet enforced — the grammar owns it).

The per-identity policy layer (when the alkcall bridge carries it) is
additional and arrives with the bridge itself (wave 3's tunnel leg) —
not from this task.

## Acceptance Criteria

- [ ] The concurrent-channel cap is enforced at every
      `channel_open_*` hook: beyond `Limits::max_concurrent_channels`
      → clean decline; the count recovers on close
- [ ] Harness tests: cap reached → next open declines; a close → an
      open succeeds again; the cap is `Limits`-tunable
- [ ] The wired russh knobs verified behaviorally where cheap
      (auth-attempt ceiling through the harness) or recorded as
      covered by the config-mapping tests
- [ ] `cargo test`, `cargo clippy --all-targets -- -D warnings`,
      `cargo fmt --check` pass

## References

- docs/architecture/overview.md §Bounded-resources policy (the knob
  table)
- docs/architecture/mapping.md §Data-plane / limits
- docs/plans/implementation.md §Wave 2 (the bounded-resources bullet)
- src/config.rs (`Limits` — the budget model and its documented
  postures)

## Notes

> To be filled by implementation agent

## Summary

> To be filled on completion