alkssh/tasks/implementation/w1-manifest.md

id, name, status, depends_on, scope, risk, impact, level

id	name	status	depends_on	scope	risk	impact	level
w1-manifest	Wave 1 — manifest landing (russh pin + the feature graph)	completed		moderate	medium	project	implementation

Description

Land the implementation dependency set and the ADR-003 feature graph — the first commit of wave 1; everything else lands inside it. Per ADR-002 decision 6 ("manifest lands with the dependency") and overview.md §lifecycle note:

• russh = "0.65" (caret stops at the minor), default-features = false, features = ["aws-lc-rs"] — the family crypto posture (decision 2), no flate2 (decision 3), no rsa (decision 4: ed25519-only; the tree must drop rsa/pkcs1 RC deps entirely — ssh-key =0.7.0-rc.11 riding the russh keys path is the recorded exception).
• alkcall 0.10 (identity/ACL types at the wire layer — IdentityProvider, Identity, AccessControl), alkvault 0.1 (the ADR-005 custody model). Both pinned by version, never sibling-checkout paths.
• Standing toolkit: tokio, thiserror, tracing, parking_lot, zeroize (the ADR-005 Zeroizing wrap).
• edition = "2024", rust-version = "1.89" (supersedes the current 1.88/2021 manifest).
• The ADR-003 feature graph declared from the first commit: session, git, tunnel, sftp, default = [] — flat, independent, no feature implies another. Features gate nothing yet (the wave-2 decline core is their first consumer); the per-feature sibling deps (alktty under session, alktunnels under tunnel, alkgit under git) land with their first consuming wave, not as dead manifest entries — recorded interpretation, flagged for the wave-1 gate.
• Update the manifest comments (the current "deliberately empty until implementation start" notes are superseded); keep comments to the non-obvious-constraint class only.

Pre-flight: verify every pin exists on crates.io at the declared version (russh 0.65, alkcall 0.10, alkvault 0.1); if a crate/version is not published, stop and escalate — a blocking issue, not something to work around.

Acceptance Criteria

• Manifest declares russh 0.65 with aws-lc-rs only; cargo tree shows no rsa/pkcs1 packages and no flate2 (the ssh-key RC pin excepted, recorded)
• alkcall 0.10 and alkvault 0.1 pinned by version; no path deps anywhere
• Features session/git/tunnel/sftp declared, default = []; cargo test --all-features passes (features gate nothing yet)
• edition = "2024", rust-version = "1.89" set
• cargo test, cargo clippy --all-targets -- -D warnings, cargo fmt --check pass

References

• docs/architecture/decisions/002-russh-pin.md (decisions 1–6)
• docs/architecture/decisions/003-feature-graph.md (decision 1, §2)
• docs/architecture/overview.md §lifecycle note, §bounded-resources
• docs/research/russh.md (the 2026-10-26 re-verification section — feature names, tree inventory, MSRV)

Notes

Pre-flight executed: cargo info confirmed russh 0.65.0, alkcall 0.10.0, and alkvault 0.1.0 all published on crates.io — no blocking issue. alkcall pinned as "0.10" (latest in-range is 0.10.1; the caret stops at the minor, matching the ADR-002-russh convention for family pins). Toolkit versions: thiserror 2.0, tracing 0.1, parking_lot 0.12, zeroize 1.9, tokio 1.54 (as already pinned). alktty/alktunnels/alkgit sibling deps deliberately not added — they land with their first consuming wave (recorded interpretation, flagged for the wave-1 gate as the task states; no dead manifest entries). Manifest comments trimmed to the non-obvious-constraint class: the russh/default-features posture (ADR-002 — must not be re-enabled by a future editor) and the fail-closed feature-graph note (ADR-003).

Summary

Manifest landed: russh = "0.65" with default-features = false, features = ["aws-lc-rs"]; alkcall 0.10 and alkvault 0.1 version-pinned (no path deps); standing toolkit (tokio, thiserror, tracing, parking_lot, zeroize); edition = "2024", rust-version = "1.89"; ADR-003 feature graph (session/git/tunnel/sftp, default = [], flat and independent). Verified: cargo tree contains no rsa, pkcs1, or flate2 — only the recorded ssh-key 0.7.0-rc.11 exception riding the russh keys path; cargo test, cargo test --all-features, cargo clippy --all-targets -- -D warnings (default and all-features), and cargo fmt --check all pass. taskgraph validate clean.