glm-5.3-flash
930d9c1996
The wave-3 gate read the landed server mappings against mapping.md/ADR-006/ADR-003/auth.md line by line: session/pty/shell/pipe (translation bridge + the derivation contract rules 1-6), git exec (full grammar, no-oracle validation, collapsed denial byte order), route-1 bridge direct rows, the full -R listen flow + forwarded-tcpip data leg, per-build decline matrices, identity observed at every seam, bounded bookkeeping, and the uniform safe tracing vocabulary. All four decomposition-time interpretations confirmed. Fixed inline (this gate): - install_forwarded_surface pre-checks the tunnel/forwarded op — alkcall's register silently replaces an existing entry, so a second adapter over the same shared seam registry silently stole the first adapter's arrival routes; now a failed construction (AdapterError::ListenRegistration), pinned by a new wire row - git take drops a stored pty entry (combined-build stale state) - doc hygiene: channel_cap release ordering, the session-row scoping of the handler Drop, the cancel-order recording, the post-cancel arrival caveat, the exit-chunk ADR lineage cross-ref, the stale lib.rs wave-state doc, the superseded dispatch test name, and mapping.md's listen-resource wording (address verbatim + tcp port) Booked for wave 4: the git row's status-before-close honored by scheduling not construction (needs a seam/shape change), the channel-not-held wire test rows, the tty coverage minors (cancel path, Closed/Break shape, stdout write deadline), and a defensive ListenRouter token-collision pre-check. Verified: cargo test (default) + --all-features (173 rows, 13 binaries), clippy --all-targets -D warnings ×2 (default + --all-features), fmt --check, cargo doc --no-deps (0 warnings), taskgraph validate (26 tasks).
status, last_updated
| status | last_updated |
|---|---|
| reviewed | 2026-10-28 |
Architecture index
Current State
Phase 1 (architecture) — complete pending implementation. Phase 0 is
closed: all three POCs passed (121 checks;
docs/research/poc-{1,2,3}-*.md) and the research docs record their
corrections. The ADR set (001–006) is Accepted — including the
post-review amendments (ADR-002's ed25519-only revert; ADR-003/006's
dynamic-forward retirement) — and the four spec docs
(overview/mapping/client/auth) are reviewed (2026-10-28): the OQ
resolution pass closed all thirteen open questions (OQ-08/11 decided,
OQ-10 converted to a derivation contract + upstream constraint,
OQ-01/04/09/13 closed as fully-decided dispositions) and the review
pass came back clean. Implementation may begin.
Architecture Documents
| Document | Status | Scope |
|---|---|---|
| overview.md | reviewed | Crate purpose, family position, surface categories, bounded-resources policy, non-goals |
| mapping.md | reviewed | The spine — server-direction rows, dispatch, spawn-and-return, decline matrix |
| client.md | reviewed | Client-direction surface: dial, op rows, the acceptor, lifecycle primitives |
| auth.md | reviewed | The auth bridge (server) + custody & host-key policy (client) |
| open-questions.md | reviewed | Centralized OQ tracker (all OQ-01…13 resolved) |
ADR Table
| ADR | Title | Status |
|---|---|---|
| ADR-001 | The alk/ssh ALPN pin — edge-termination contract for SshAdapter |
Accepted |
| ADR-002 | The russh pin — 0.65.0, aws-lc-rs, no compression, ed25519-only | Accepted |
| ADR-003 | The capability feature graph — flat, independent, two-direction | Accepted |
| ADR-004 | Auth dispositions — publickey-only, fail-closed, fingerprint identity | Accepted |
| ADR-005 | At-rest key custody — vault-wrapped OpenSSH-PEM, decrypt-at-use | Accepted |
| ADR-006 | Mapping decisions — route-1 bridge, exec-only git, session dispatch | Accepted |
Open Questions
Tracked in open-questions.md — OQ-01 … OQ-13,
seeded from the phase 0 POC findings and research docs. All thirteen
are resolved: the three mapping-detail decisions settled this pass
(OQ-08 shell convention → assembly-supplied serve-config field, no
crate default; OQ-10 → closed as the derivation contract on
mapping.md's exit rows + the upstream PTY-path constraint; OQ-11 →
universal compile + runtime Unix-gated decline), and the previously
deferred entries closed as fully-decided dispositions (OQ-01/04/09/13
— the decision surfaces were already fixed by ADR-001/ADR-004 and the
decline postures; what remained was forecasts about consumers, not
pending alkssh decisions). Upstream dependencies are listed as watch
items in the tracker, not OQs.
Document Lifecycle
| Status | Meaning | Transitions |
|---|---|---|
draft |
Under active development; may change significantly | → reviewed when its open questions are resolved |
reviewed |
Final; implementation may begin; changes require review | → stable when implementation is complete and verified |
stable |
Locked; changes require review and may warrant an ADR | → deprecated when superseded |
deprecated |
Superseded; kept for reference | Removed when unreferenced |
References
docs/sdd_process.md— the SDD processdocs/research/— phase 0 (vision, POC plans + findings, russh inventory, auth bridge, mapping table, reverse-runner extraction)- Family:
/workspace/@alkdev/alkfamily/docs/architecture/decisions/001..003(ADR-003 is the alkssh structural decision) - Sibling: alkcall ADRs 002/003/004/006/009/010/034/042/051 (ALPN
dispatch, auth surface, channels wire/relay); alkhttp ADR-014/073
(secret-material flow and door-surface posture — the patterns
ADR-005 and
auth.mdmirror)