glm-5.3-flash
18ef55c60d
Six implementation tasks + the gate under tasks/implementation/, chained sequentially (the auth hooks, dispatch, and channel cap all edit the same per-connection Handler impl): - w2-server-mount: SshAdapter::handle mount + russh Config construction from the serve-config (honest advertisement, host-key decrypt-at-construction, the Limits knob mapping) + the Handler skeleton at fail-closed defaults - w2-auth-bridge: the ADR-004 dispositions (ed25519-only explicit decline, fingerprint-only resolution, explicit declines for every non-publickey method) - w2-loopback-harness: the in-process client/server contract-test vehicle over the wave-1 doubles - w2-dispatch-decline-core: parse-only dispatch + the fail-closed decline core, contract-tested per feature build - w2-spawn-return: the structural constraint pinned by test + the exit-reporting mechanics via the cloned Session::handle() - w2-bounded-resources: the in-crate concurrent-channel cap at the handler surface - review-wave-2: the gate The plan carries the wave-2 decomposition record with four interpretations flagged for the gate (skeleton-level git probe, declining routing stubs, the adapter error surface, the harness transport choice). taskgraph validate: 19 tasks, clean.
2.5 KiB
2.5 KiB
id, name, status, depends_on, scope, risk, impact, level
| id | name | status | depends_on | scope | risk | impact | level | |
|---|---|---|---|---|---|---|---|---|
| w2-bounded-resources | Wave 2 — bounded resources (the in-crate channel cap at the handler surface) | pending |
|
narrow | low | component | implementation |
Description
Enforce the in-crate bounded-resources posture at the handler surface
(overview.md §Bounded-resources policy; AGENTS.md convention 9 —
SSH servers are internet-facing; unbounded loops and unbounded buffers
are bugs):
- The in-crate concurrent-channel cap — a count of active channels
enforced at every
channel_open_*hook: opens beyondLimits::max_concurrent_channelsare declined fail-closed (a clean refuse, never queued, never a half-open channel). The count decrements on channel close so the cap recovers. Short-held internal state (parking_lot, the project convention). - The russh knobs are already wired (
w2-server-mountmappedinactivity_timeoutalways-Some,max_auth_attempts,window_size,maximum_packet_size,channel_buffer_sizefromLimits) — this task verifies them behaviorally where cheap (e.g., the auth-attempt ceiling disconnects an exceeding client through the harness) and records anything not cheaply observable as covered by the config-mapping tests. - Per-length exec-parse limits stay reserved for the wave-3
grammar's consumption (
Limits::max_exec_command_lenis carried, not yet enforced — the grammar owns it).
The per-identity policy layer (when the alkcall bridge carries it) is additional and arrives with the bridge itself (wave 3's tunnel leg) — not from this task.
Acceptance Criteria
- The concurrent-channel cap is enforced at every
channel_open_*hook: beyondLimits::max_concurrent_channels→ clean decline; the count recovers on close - Harness tests: cap reached → next open declines; a close → an
open succeeds again; the cap is
Limits-tunable - The wired russh knobs verified behaviorally where cheap (auth-attempt ceiling through the harness) or recorded as covered by the config-mapping tests
cargo test,cargo clippy --all-targets -- -D warnings,cargo fmt --checkpass
References
- docs/architecture/overview.md §Bounded-resources policy (the knob table)
- docs/architecture/mapping.md §Data-plane / limits
- docs/plans/implementation.md §Wave 2 (the bounded-resources bullet)
- src/config.rs (
Limits— the budget model and its documented postures)
Notes
To be filled by implementation agent
Summary
To be filled on completion