glm-5.3-flash
b1e569d1a8
The biggest single-row surface of the spine: pty/shell/pipe-exec serve
through the published alktty seam (drive_session_pre_negotiated) over a
translation bridge, re-landing POC-3 stage D as contract:
- src/tty_map.rs (session feature): the bridge (SSH data → Chunk::stdin
through a bounded mpsc + framing task; SSH EOF → the zero-length
stdin sentinel — verified against alktty's pump semantics; stdout →
data; stderr → extended_data(1); exit chunk → the derivation
contract), the locally-built negotiation (OQ-08: shell argv verbatim,
wrapper ++ [cmd], cwd/env session-side, ttymodes → the reserved {}
modes JSON), and the spawned serving path.
- serve_tty_row: driven chunks→SSH inline so the exit report is the
path's final act (status before close, ADR-006 decision 4); two
cancel signals (per-channel watch fired by channel_close, connection
teardown fired by SessionHandler::Drop) abort the alktty session
task — the ADR-056 kill-on-drop contract is the cancelled session's
cleanup.
- Derivation contract rules 1–6 in derive_exit + the crate-local
signum→name table: −N → exit-signal(name), −1 → exit-status(255),
core_dumped never, unmapped negatives → 255, the PTY-path rule-5
fidelity limit documented; wire rows pin the shapes.
- Negotiation-error frames (alktty's 0x00-length-prefixed error
framing) → negotiation-failed serving decline + exit-status(255) +
close — the one could-not-start claim this door makes (nothing ran).
- Control rows: window_change/signal → the per-channel BridgeSurface
(bounded mpsc, try_send, never awaited on the packet loop); signal
names verbatim (no decline shape — fire-and-forget); pre-serve
resizes update the stored pty params (final size wins).
- Unset-declines (OQ-08) keep the git row's serving-path shape
(failure then close, spawned): shell-unconfigured /
wrapper-unconfigured / seam-unconfigured; pipe-less shell SERVES
pipe-mode (the recorded vanilla-sshd posture); env_request decline
unchanged (OQ-09).
- tests: the hand-rolled TtyBackend shim + ownership witness doubles;
serving rows through the harness, the unset-field decline matrix,
derivation rows on the wire, negotiation-failure rows, the identity
ride asserted live at the seam, the kill witness; the real-tool
smoke — OpenSSH -tt against a real PTY via dev-dep alktty local
(test graph only), skip-with-reason posture. Wave-2 stub rows
migrated to the new decline reasons (dispatch_core, observe).
Verification: cargo test (113) / --features session (149) / git (142) /
tunnel (115) / --all-features (161) — all green; cargo clippy
--all-targets -- -D warnings ×5 feature configs; cargo fmt --check;
cargo doc --no-deps ×3 builds clean; taskgraph validate.
status, last_updated
| status | last_updated |
|---|---|
| reviewed | 2026-10-28 |
Architecture index
Current State
Phase 1 (architecture) — complete pending implementation. Phase 0 is
closed: all three POCs passed (121 checks;
docs/research/poc-{1,2,3}-*.md) and the research docs record their
corrections. The ADR set (001–006) is Accepted — including the
post-review amendments (ADR-002's ed25519-only revert; ADR-003/006's
dynamic-forward retirement) — and the four spec docs
(overview/mapping/client/auth) are reviewed (2026-10-28): the OQ
resolution pass closed all thirteen open questions (OQ-08/11 decided,
OQ-10 converted to a derivation contract + upstream constraint,
OQ-01/04/09/13 closed as fully-decided dispositions) and the review
pass came back clean. Implementation may begin.
Architecture Documents
| Document | Status | Scope |
|---|---|---|
| overview.md | reviewed | Crate purpose, family position, surface categories, bounded-resources policy, non-goals |
| mapping.md | reviewed | The spine — server-direction rows, dispatch, spawn-and-return, decline matrix |
| client.md | reviewed | Client-direction surface: dial, op rows, the acceptor, lifecycle primitives |
| auth.md | reviewed | The auth bridge (server) + custody & host-key policy (client) |
| open-questions.md | reviewed | Centralized OQ tracker (all OQ-01…13 resolved) |
ADR Table
| ADR | Title | Status |
|---|---|---|
| ADR-001 | The alk/ssh ALPN pin — edge-termination contract for SshAdapter |
Accepted |
| ADR-002 | The russh pin — 0.65.0, aws-lc-rs, no compression, ed25519-only | Accepted |
| ADR-003 | The capability feature graph — flat, independent, two-direction | Accepted |
| ADR-004 | Auth dispositions — publickey-only, fail-closed, fingerprint identity | Accepted |
| ADR-005 | At-rest key custody — vault-wrapped OpenSSH-PEM, decrypt-at-use | Accepted |
| ADR-006 | Mapping decisions — route-1 bridge, exec-only git, session dispatch | Accepted |
Open Questions
Tracked in open-questions.md — OQ-01 … OQ-13,
seeded from the phase 0 POC findings and research docs. All thirteen
are resolved: the three mapping-detail decisions settled this pass
(OQ-08 shell convention → assembly-supplied serve-config field, no
crate default; OQ-10 → closed as the derivation contract on
mapping.md's exit rows + the upstream PTY-path constraint; OQ-11 →
universal compile + runtime Unix-gated decline), and the previously
deferred entries closed as fully-decided dispositions (OQ-01/04/09/13
— the decision surfaces were already fixed by ADR-001/ADR-004 and the
decline postures; what remained was forecasts about consumers, not
pending alkssh decisions). Upstream dependencies are listed as watch
items in the tracker, not OQs.
Document Lifecycle
| Status | Meaning | Transitions |
|---|---|---|
draft |
Under active development; may change significantly | → reviewed when its open questions are resolved |
reviewed |
Final; implementation may begin; changes require review | → stable when implementation is complete and verified |
stable |
Locked; changes require review and may warrant an ADR | → deprecated when superseded |
deprecated |
Superseded; kept for reference | Removed when unreferenced |
References
docs/sdd_process.md— the SDD processdocs/research/— phase 0 (vision, POC plans + findings, russh inventory, auth bridge, mapping table, reverse-runner extraction)- Family:
/workspace/@alkdev/alkfamily/docs/architecture/decisions/001..003(ADR-003 is the alkssh structural decision) - Sibling: alkcall ADRs 002/003/004/006/009/010/034/042/051 (ALPN
dispatch, auth surface, channels wire/relay); alkhttp ADR-014/073
(secret-material flow and door-surface posture — the patterns
ADR-005 and
auth.mdmirror)