glm-5.3-flash
58d0b86ec5
The wave-2 gate's booked finding: observability on the decline paths. `tracing` rides the manifest per the ADR-002 toolkit but nothing in src/ emitted — a decline's "reason" was only the routing decision documented per build. - src/observe.rs: the event vocabulary, adopting the family posture read from alktty/alktunnels/alkcall/alkhttp (free tracing fns, message-last lowercase, flat fields; no info!/trace!, no macros, no spans): feature_build + row + channel_id + decline_class (open/request/serving/auth) + reason + exec_route (exec rows); declines at debug, the serving-path failure arm the vocabulary's one warn - handler.rs: every decline site emits — auth dispositions (non-ed25519 / fingerprint-unresolved / the four unimplemented methods), open-level declines (unfeatured / never-feature / cap-exceeded / tunnel connect-failed stub), request-level capability declines (exec route-aware, subsystem, env, x11, agent, the -R listen forms), and the seam-stub serving declines with the spawned-path lifecycle (started / ended / failed — the shape the wave-3 mappings inherit) - tests/observe.rs: the event-presence pin — a hand-rolled global capture subscriber (the recorded test convention; no event-capture precedent exists in the family), field-matching rows across the default/git/session/tunnel/--all-features builds, and the safety scan (no username, no fingerprint ever in an event) - helper-level exact shapes pinned in src/observe.rs unit rows Verification: cargo test (default, --features git/session/tunnel, --all-features all green), clippy x2 --all-targets -D warnings, fmt --check, cargo doc --no-deps 0 warnings, taskgraph validate.
62 lines
2.8 KiB
Rust
62 lines
2.8 KiB
Rust
//! alkssh — the alk family's SSH adapter (the alkhttp-style door for the
|
||
//! SSH protocol): a thin wrapper around russh terminating the vanilla-ssh
|
||
//! wire and bridging to/from alkcall channels (the `alk/ssh` ALPN).
|
||
//!
|
||
//! No SSH framing is authored in-family (family ADR-003): russh owns the
|
||
//! wire, and the crate's substance is the channel-type mappings —
|
||
//! session/pty → alktty, direct/forwarded-tcpip → alktunnels, git exec →
|
||
//! alkgit, sftp → alkfs later (a declining placeholder until then), each
|
||
//! behind its cargo feature. Git over SSH is exec-only (ADR-006): a
|
||
//! subsystem request can never carry the repository, so it declines. A
|
||
//! client opening an unfeatured or unimplemented channel type gets a
|
||
//! clean decline — never a half-capability, never a silent fallback; the
|
||
//! default build (no features) is structurally incapable of serving
|
||
//! anything but declines.
|
||
//!
|
||
//! Identity is the family's, not SSH's: a verified key's fingerprint →
|
||
//! alkcall `IdentityProvider`. Keys the crate holds (client dial keys,
|
||
//! host keys) come from alkvault-backed sources — vault-encrypted at
|
||
//! rest, decrypted at use (ADR-005), never env vars.
|
||
//!
|
||
//! Architecture: `docs/architecture/` (phase 1 — ADRs 001–006 accepted;
|
||
//! the dependency surface, feature graph, and wave-1 foundations are
|
||
//! landed; the server stack, the mappings, the client direction, and
|
||
//! validation are later implementation waves — wave 2 decomposes after
|
||
//! this gate). See also `docs/research/` and family ADR-003.
|
||
|
||
mod adapter;
|
||
mod channel_cap;
|
||
mod config;
|
||
mod dispatch;
|
||
mod error;
|
||
mod fingerprint;
|
||
mod handler;
|
||
mod host_key;
|
||
mod key_source;
|
||
mod observe;
|
||
mod serve;
|
||
|
||
pub use adapter::SshAdapter;
|
||
#[cfg(feature = "git")]
|
||
pub use config::GitSeam;
|
||
#[cfg(feature = "session")]
|
||
pub use config::SessionSeam;
|
||
pub use config::{DialConfig, Limits, ServeConfig};
|
||
pub use error::{AdapterError, KeySourceError};
|
||
pub use fingerprint::fingerprint;
|
||
/// Contract-test surface (`#[doc(hidden)]`): the per-connection auth
|
||
/// bridge handler — constructible so the tests drive its hooks directly
|
||
/// against the wave-1 doubles (see `handler.rs` §Test surface). Not
|
||
/// documented API: the wire-facing surface is exactly `SshAdapter` +
|
||
/// the config/error/host/key-source types.
|
||
#[doc(hidden)]
|
||
pub use handler::SessionHandler;
|
||
pub use host_key::{HostKeyPolicy, PresentedHostKey, RejectAll};
|
||
pub use key_source::{HostKeySource, KeySource, VaultHostKeySource, VaultKeySource};
|
||
/// Contract-test surface (`#[doc(hidden)]`): the spawn-and-return
|
||
/// plumbing (`ADR-006 decision 4`, see `serve.rs`) — the mechanics the
|
||
/// mechanics-proof rows in `tests/spawn_return.rs` compose over the
|
||
/// real wire to pin the constraint as tests. Not documented API.
|
||
#[doc(hidden)]
|
||
pub use serve::{report_exit_status_then_close, spawn_serving_path};
|