alkssh/tasks/implementation/w1-error-model.md at 0b1bc284fa8c80ec986bb8ea7640227ef9cadd9b

alkdev/alkssh

0 Fork 0

Files

T

glm-5.3-flash 0b1bc284fa docs(plans): add wave-based implementation plan; decompose wave 1

- docs/plans/implementation.md: five-wave decomposition of the
  architecture (foundations -> server stack -> server mappings ||
  client direction -> validation & release), following the alkgit
  sibling pattern (decompose-implement-gate rhythm, per-wave
  decomposition records, review gates at wave boundaries)
- scope authority: v0.1.0 publishes the crate; assembly wiring stays
  out; sftp decline placeholder is shipped behavior
- wave 1 decomposed into eight task files under tasks/implementation/
  (manifest, error model, key sources, host-key policy, fingerprint,
  config surface, test doubles, review gate) with recorded
  interpretations flagged for the gate

Verification: taskgraph validate (12 tasks, no cycles); cargo test,
clippy -D warnings, fmt --check green

2026-10-28 06:13:26 +00:00

2.3 KiB

Raw Blame History

id, name, status, depends_on, scope, risk, impact, level

name

status

depends_on

scope

risk

impact

level

w1-error-model

Wave 1 — the error model (fail-closed taxonomy)

pending

w1-manifest

narrow

low

project

implementation

Description

Land the crate's error taxonomy in src/error.rs (one module per file, re-exported from the crate root — the alktty pattern), thiserror throughout, no catch-alls anywhere (AGENTS.md convention 2):

KeySourceError — the ADR-005 decision-4 failure matrix as distinct variants, the vault's error taxonomy reshaped by the adapter, never collapsed: Locked (vault locked → no dial, and no server: a host key that can't load prevents server construction), Absent (no blob at the requested path), Decryption (wrong mnemonic / tampered ciphertext — the refuse-at-crypto class), UnknownKeyVersion (the vault's refuse-before-crypto InvalidPath class), Decode (plaintext arrived but is not decodable key material — the one-time decode_secret_key failure). Doc comments carry the ADR semantics per variant, including the fail-closed consequence of each.
Deliberately not error types: auth declines (dispositions — Auth::Reject, ADR-004; never errors), wire decline reasons (SSH-shaped responses — wave-2 material), config validation (the OQ-08 fields are Option and decline at request time, not construction time — no config-error type ships unless the config task finds one needed, flagged for the gate).

The exact variant payload shapes are the task's to pin (minimal per the sibling-crate posture; stringly-typed payloads only where a message is the honest content), flagged for the wave-1 gate.

Acceptance Criteria

KeySourceError has exactly the five pinned variants; no catch-all, no Other/Unknown
Doc comments state each variant's ADR-005 semantics and its fail-closed consequence
Unit tests construct every variant and assert Display/Debug paths compile clean
cargo test, cargo clippy --all-targets -- -D warnings, cargo fmt --check pass

References

docs/architecture/decisions/005-at-rest-key-custody.md (decision 4)
docs/architecture/auth.md §Key custody (the failure-mode list)
docs/research/poc-2-vault-keys.md §3 (the failure matrix, 39/39)

Notes

To be filled by implementation agent

Summary

To be filled on completion

2.3 KiB Raw Blame History