glm-5.3-flash
e86b8ba1b5
- AcceptAnyCertVerifier doc: the presented CertificateVerify signature
is not verified (no proof-of-possession) — the server-extracted
fingerprint is attacker-suppliable from observed public cert/SPKI
bytes; states the two safe patterns (auth-layer challenge-response /
a verifying verifier) and points at OQ-TLS-09
- FingerprintPinVerifier doc (N-1): fixed the "stolen-but-stale
fingerprint" phrasing (the cert is presented fresh each handshake;
the signature check defeats a stolen/observed cert used by a party
without the private key) and added the server-verifier cross-reference
- OQ-TLS-09 recorded (open, high): which layer owns server-path
proof-of-possession — three options; deferral noted (needs the
auth-layer design or an API call before the first consumer)
- tests/impersonation_posture.rs (tcp-gated): the S-1 probe made
permanent, both variants — X.509 victim cert + attacker key and RFC
7250 victim SPKI + attacker key complete the handshake, application
data flows, and the server extracts the victim's fingerprint; any
future pop change must fail/update this test with the doc + OQ
- server.md / client.md synced with the same posture
- task note: the review's N-4 parenthetical ("alknet's client resolver
offers both types") is inaccurate — rustls 0.23.41/0.23.44 offer
[RawPublicKey] iff the resolver's only_raw_public_keys() is true;
task 6 should write N-4 from the rustls sources
Verified: cargo test 68 default / 77 all-features (+2) green; clippy
-D warnings clean (default + all-features); fmt clean; cargo doc
--no-deps warning-free
status, last_updated
| status | last_updated |
|---|---|
| reviewed | 2026-09-10 |
alktls — Architecture
The authoritative architecture spec for the alktls crate (Phase 1 of the SDD process). The spec docs advanced Draft → Reviewed at the Phase 2 implementation review gate (see the lifecycle note at the end); statuses update here as docs advance.
All docs follow the SDD process conventions: specs reference ADRs and
OQs by number, ADRs explain WHY, open-questions.md tracks what is
unresolved.
Documents
| Doc | Status | Scope |
|---|---|---|
| overview.md | Reviewed | Purpose, transport picture, API surface, ADR/OQ index |
| server.md | Reviewed | TlsServerConfig, resolvers, ACME path, server invariants |
| client.md | Reviewed | TlsClientConfig, verifier selection, client auth, root-store fallback |
| open-questions.md | live | The authoritative OQ tracker (all Phase 0 OQs resolved at entry) |
ADRs
| ADR | Status | Decision |
|---|---|---|
| 001 | Accepted | Inherit the alknet TLS design as the baseline; deviations recorded as alktls ADRs |
| 002 | Accepted | TlsError: the ADR-088 six-variant shape from day one; config-construction scope boundary |
| 003 | Accepted | The QUIC feature is noq (iroh's extracted fork), not quinn; iroh stays key-not-config |
| 004 | Accepted | Complete accessors: for_tcp_tls() adopted; server borrows, client consumes |
| 005 | Accepted | Identity + credentials + fingerprint types move into alktls; auth layer stays out |
| 006 | Accepted | Eight-module layout; seed tests + integration invariant pins |
Lifecycle
Docs move Draft → Reviewed when their open questions are resolved
and the architecture review reports zero critical issues; ADRs are
Accepted at write time and never revert (supersede instead).
open-questions.md is the authoritative tracker; the Phase 0 doc's
OQ statuses are the historical record.
API-freeze note (2026-09-10): the Phase 2 implementation review
gate (tasks/review-impl.md) passed with zero un-pinned divergences
(two ADR amendments recorded — 002's verifier-error path, 003's noq
provider feature). The public API surface — the lib.rs re-export
block per ADR-004/005/006 — is frozen as of that review; the alknet
rewrite compiles against it. Additive evolution only.
Phase status
- Phase 0 (complete, 2026-09-10):
docs/research/phase-0.md— extraction inventory, verified invariants, gaps, noq investigation, OQ-TLS-01..08. - Phase 1 (this directory): all Phase 0 OQs resolved at entry — six via ADR-001..006, two as documented behavior (OQ-TLS-02, OQ-TLS-06). Reviewed 2026-09-10 at the Phase 2 gate.
- Phase 2 (complete, 2026-09-10): decomposition into
tasks/+ execution — the eight-task port graph landed crate-init → port-identity/fingerprint/pem-signing → port-server/port-client → integration-suite → this review gate. The crate is ready for the rewrite to consume.