---
id: w1-config
name: Wave 1 — the config surface (serve-config, dial-config, Limits)
status: pending
depends_on: [w1-manifest, w1-key-sources, w1-host-key-policy]
scope: moderate
risk: low
impact: project
level: implementation
---

## Description

Land the pure configuration types both directions implement against —
the shapes every later wave's constructors take:

- **Serve-config** (server direction, `mapping.md`/`overview.md`) —
  the assembly-supplied serving configuration: the OQ-08 fields
  (**shell argv** and **exec wrapper argv**, each `Option<Vec<String>>`
  — unset → its row declines with a clean error, never a fallback, no
  crate default; the wrapper form is platform-neutral), the
  `IdentityProvider` handle (`Arc<dyn IdentityProvider>` — the
  assembly injects it; the crate never resolves identities itself),
  the host-key source handle (the wave-1 key-source seam), the tunnel
  `ChannelClient` handle (the route-1 bridge's family-fabric entry —
  `Option`, absent → tunnel rows decline even under the feature), and
  the `Limits`. `cwd`/`env` in `NegotiateRequest` are assembly-supplied
  serve-config values, never wire-derived (OQ-09 posture).
- **Dial-config** (client direction, `client.md` §The dial surface) —
  address, key source (the wave-1 seam — never static keys, never env
  vars), the `HostKeyPolicy` handle, and the bounded-resource knobs:
  `keepalive_interval`/`keepalive_max` (15 s / 3 default posture per
  the reverse-runner evidence), `inactivity_timeout`, window/packet
  knobs.
- **`Limits`** — the bounded-resources budget model (`overview.md`'s
  table): the in-crate max-concurrent-channels cap, exec-parse length
  caps (consumed by the wave-3 grammar), and the russh knob mapping
  with documented default postures — `max_auth_attempts` default 10
  (sized for the counting `none`-probe, ADR-004 decision 6),
  `window_size`/`maximum_packet_size`/`channel_buffer_size` set,
  `inactivity_timeout` set (assembly-tunable). Every session carries
  it; no unbounded loops, no unbounded buffers.

Types only — no russh `Config` construction (wave 2), no dialing
(wave 4). The OQ-08 unset-declines semantics live in the type shape
(`Option` fields + doc contracts), not in construction-time
validation.

## Acceptance Criteria

- [ ] Serve-config carries the OQ-08 fields as `Option` with
      unset-declines doc contracts; no crate default shell/wrapper
- [ ] `IdentityProvider`, host-key source, and `ChannelClient` are
      injected handles; the crate holds no identity/trust policy of
      its own
- [ ] Dial-config carries key source + `HostKeyPolicy` + the
      keepalive/inactivity/window knobs with the documented defaults
- [ ] `Limits` carries the in-crate caps (channels, exec-parse) and
      the russh knob defaults (`max_auth_attempts` 10, keepalive
      15 s / 3 client posture)
- [ ] Unit tests cover default construction and the `Option`-field
      semantics
- [ ] `cargo test`, `cargo clippy --all-targets -- -D warnings`,
      `cargo fmt --check` pass

## References

- docs/architecture/overview.md §Public surface, §Bounded-resources
  policy
- docs/architecture/mapping.md (OQ-08 rows, the data-plane/limits
  section)
- docs/architecture/client.md §The dial surface
- docs/architecture/open-questions.md (OQ-08, OQ-09 resolutions)
- docs/architecture/decisions/004-auth-dispositions.md (decision 6 —
  the `max_auth_attempts` default)

## Notes

> To be filled by implementation agent

## Summary

> To be filled on completion