glm-5.3-flash 2aead32fff docs(research): POC-1 findings — auth bridge + fail-closed declines verified end to end ...

- new: docs/research/poc-1-auth-bridge.md (standalone POC at
  /workspace/alkssh-poc1; russh 0.64.1 + OpenSSH 9.6p1; 31/31 checks)
- confirmed hypotheses: SHA256 fingerprint parity across russh/
  ssh-keygen/vanilla known_hosts; auth_publickey -> IdentityProvider
  resolve -> accept/decline; offered-hook accept-and-let-decide with
  OpenSSH probe-then-sign; ChannelOpenHandle drop = auto-reject
  (AdministrativelyProhibited) with clean vanilla diagnostics;
  max_auth_attempts counts the initial none probe; into_stream echo
  plumbing works both sides
- correction recorded to auth-bridge.md + russh.md: 0.64.1 default
  auth impls reject (only publickey_offered defaults to accept)
- new API fact in russh.md: rejected channel opens surface as Err
  from the typed open call
- OQ seeds: username-ignore direction, max_auth_attempts sizing,
  pin as one-way door (reject-defaults could change on bump)

2026-10-25 11:23:55 +00:00

..

research

docs(research): POC-1 findings — auth bridge + fail-closed declines verified end to end

2026-10-25 11:23:55 +00:00

sdd_process.md

docs(agents): de-alkgit the copied process scaffolding

2026-10-25 05:32:24 +00:00