glm-5.3-flash
d74a27f764
- ADR-001: inherit the alknet TLS design as the baseline; deviations recorded as alktls ADRs - ADR-002: TlsError ships the ADR-088 six-variant shape from day one (typed #[from] sources; NoqWrap; no string catch-all) - ADR-003: the QUIC feature is noq (iroh's extracted fork), pre- consumer rename; default = [] per the lean-crate convention (corrects the extracted code's default = ["quinn"]) - ADR-004: complete accessors — for_tcp_tls() adopted, rustls_config() adopted; server accessors borrow (&self), client accessors consume - ADR-005: identity + credentials + fingerprint types move into alktls; auth layer stays out - ADR-006: eight-module layout; seed tests + integration invariant pins (exact nine-scheme list, client enable_early_data) - specs: overview (transport picture, terminology), server.md (ACME lifecycle, invariants), client.md (verifier selection matrix, root- store fallback); open-questions.md promotes OQ-TLS-01..08 (all resolved at entry) - Cargo.toml: quinn feature -> noq (per ADR-003); AGENTS.md aligned Architecture review pass done: 0 critical, 2 major (ADR-002 AcmeConfig doc comment contradiction; ADR-003 unrecorded default deviation) and 8 minors all addressed; cross-references verified against alknet ADRs, rustls/noq/iroh sources. Verified: cargo test, test --all-features, clippy -D warnings, fmt --check, doc --no-deps
status, last_updated
| status | last_updated |
|---|---|
| draft | 2026-09-10 |
alktls — Architecture
The authoritative architecture spec for the alktls crate (Phase 1 of the SDD process). All docs are Draft pending the architecture review pass; statuses update here as docs advance.
All docs follow the SDD process conventions: specs reference ADRs and
OQs by number, ADRs explain WHY, open-questions.md tracks what is
unresolved.
Documents
| Doc | Status | Scope |
|---|---|---|
| overview.md | Draft | Purpose, transport picture, API surface, ADR/OQ index |
| server.md | Draft | TlsServerConfig, resolvers, ACME path, server invariants |
| client.md | Draft | TlsClientConfig, verifier selection, client auth, root-store fallback |
| open-questions.md | live | The authoritative OQ tracker (all Phase 0 OQs resolved at entry) |
ADRs
| ADR | Status | Decision |
|---|---|---|
| 001 | Accepted | Inherit the alknet TLS design as the baseline; deviations recorded as alktls ADRs |
| 002 | Accepted | TlsError: the ADR-088 six-variant shape from day one; config-construction scope boundary |
| 003 | Accepted | The QUIC feature is noq (iroh's extracted fork), not quinn; iroh stays key-not-config |
| 004 | Accepted | Complete accessors: for_tcp_tls() adopted; server borrows, client consumes |
| 005 | Accepted | Identity + credentials + fingerprint types move into alktls; auth layer stays out |
| 006 | Accepted | Eight-module layout; seed tests + integration invariant pins |
Lifecycle
Docs move Draft → Reviewed when their open questions are resolved
and the architecture review reports zero critical issues; ADRs are
Accepted at write time and never revert (supersede instead).
open-questions.md is the authoritative tracker; the Phase 0 doc's
OQ statuses are the historical record.
Phase status
- Phase 0 (complete, 2026-09-10):
docs/research/phase-0.md— extraction inventory, verified invariants, gaps, noq investigation, OQ-TLS-01..08. - Phase 1 (this directory): all Phase 0 OQs resolved at entry — six via ADR-001..006, two as documented behavior (OQ-TLS-02, OQ-TLS-06); review pass pending.
- Phase 2 (next): decomposition into
tasks/— the port guided by ADR-006's module map and seed tests.