alkssh

alkdev/alkssh

0 Fork 0

T

glm-5.3-flash f2c4b75c9d docs(phase-0): POC-2 findings — vault-backed key custody confirmed

- OpenSSH-PEM inner + alkvault EncryptedData outer confirmed as the
  at-rest shape (4-way inner-format comparison recorded; alkvault's
  &str-only encrypt/decrypt surface is the decisive API constraint)
- decrypt-at-dial lifecycle proven: mid-session vault lock leaves live
  sessions intact; locked/absent/tampered/rotate all fail closed with
  distinct error shapes
- Signer seam dismissed with evidence: no provided impl in russh
  0.64.1 (doc claim stale), splice convention hand-rolled, in-process
  vault gains nothing over one-time decode
- host keys ride the same model end to end incl. vanilla-tool
  compatibility; 39/39 checks pass
- OQ seeds: decrypt-returns-plain-String zeroization gap, opaque
  EncryptedData handling, vault-per-role policy

Verification: POC run 39 checks / 5 groups all PASS (source at
/workspace/alkssh-poc2, standalone, never merges)

2026-10-25 12:11:58 +00:00

.opencode/agents

docs(agents): de-alkgit the copied process scaffolding

2026-10-25 05:32:24 +00:00

docs

docs(phase-0): POC-2 findings — vault-backed key custody confirmed

2026-10-25 12:11:58 +00:00

src

chore: initialize crate base (manifest, lib stub, licensing, agents)

2026-10-25 05:32:29 +00:00

.gitignore

chore: initialize crate base (manifest, lib stub, licensing, agents)