glm-5.3-flash
9fab51d4a8
All four stages ran against vanilla clients (OpenSSH -L/-R, real git, real curl) and the published crates.io seams with zero seam fixups (51/51 checks, reproduced twice; POC source /workspace/alkssh-poc3): - stage A: vanilla git push/clone/second-push through russh exec parse -> alkgit serve_duplex_resolved + alkgit-substrate mem composition; exit-status proven both directions; denial is repo-blind before any protocol byte - stage B: alkgit serve_socks5_over over a session channel with the shipped tcp_dial; real curl through the proxy; 8 MiB throughput - stage C: direct-tcpip via alktunnels route 1 (TunnelSession:: open_direct over a real alkcall ChannelClient + local_dial); vanilla ssh -L + curl; -R global request declines (honest advertisement); opener identity rides the transport into the establisher witness (CF-005) - stage D: session/pty mapping via a translation bridge (SSH bytes <-> alktty chunk plane) and drive_session_pre_negotiated over a real PTY: pty params, window-change resize, pipe stderr as extended_data, exit chunk -> exit-status/exit-signal Corrections recorded in mapping-table.md (git subsystem over SSH is exec-only; vanilla ssh -D speaks SOCKS client-side and opens direct-tcpip; the alktty bridge is chunk-framed both ways with the exit-chunk signal-identity gap), plus the load-bearing russh 0.64.1 runtime facts in russh.md (inline handler dispatch — serving paths must spawn; Session::handle() exit reporting; client drain-to-target message routing). Verification: cargo test / clippy -D warnings / fmt --check / doc on alkssh (docs-only change); POC crate builds warning-free and runs overall=true.