- ADR-002 (Accepted): pin russh 0.65 (0.65.0 published 2026-10-25
after the POCs' 0.64.1 verification — six security fixes incl.
three in internet-facing classes; breaks are handler-signature
shapes only, wire evidence transfers); aws-lc-rs backend confirmed
with a clean in-scratch build record (no provisioning; ring kept as
the recorded fallback); flate2 off (no compression); rsa on (front-
door compat — supersedes the research docs' earlier off-leaning;
RC-tree posture accepted with a recorded stable-release trigger);
des/dsa never; rust-version 1.89 lands with the dep
- russh.md: re-verification-at-architecture-time section added
(0.65.0 delta: PublicKeyOffer/VerifiedPublicKey, async-trait
removed, GHSA list, verified build + tree facts)
- ADR-003 (Accepted): five features (session/git/tunnel/
dynamic-forward/sftp-placeholder), flat + independent, default [],
two-direction symmetry rule (one name, both doors), client acceptor
fail-closed (not russh's accept-and-drop), x11/auth-agent never
features, honest advertisement per build
Phase 1 (architecture) — in progress. Phase 0 is closed: all three
POCs passed (121 checks; docs/research/poc-{1,2,3}-*.md) and the
research docs record their corrections. This directory is being
populated: ADR-001 (the alk/ssh ALPN pin) is drafted for review, the
OQ tracker is seeded from the POC findings, and the spec documents
below are being written. No implementation until specs reach
reviewed (per docs/sdd_process.md).
glm-5.3-flash
9d2e962bec