scaffold: AGENTS.md, Cargo.toml, licenses, agent conventions adapted for alktunnels

- AGENTS.md adapted from alkcall (via alktty's pattern) for the tunnel
  protocol crate: substrate-agnostic conventions, two-pump contract,
  no-forced-binding requirement, alkcall 0.4.0 dependency, wasm-clean
  default crate, ALPN naming
- .opencode/agents/implementation-specialist.md conventions section
  adapted from alkcall's call-protocol rules to tunnel-crate rules
  (mirroring alktty's adaptation)
- docs/sdd_process.md package reference fixed to alktunnels
- Cargo.toml scaffold: wasm-clean tokio subset, alkcall 0.4.0
- LICENSE-MIT / LICENSE-APACHE copied from alktty
- src/lib.rs protocol-only stub; docs/architecture/ lands in Phase 1

Verification: cargo test (0 tests, ok), cargo clippy --all-targets
-- -D warnings, cargo fmt --check, cargo clippy
--target wasm32-unknown-unknown -- -D warnings — all clean

.opencode/agents/implementation-specialist.md

@@ -210,62 +210,70 @@ This is especially important for complex tasks that span many file operations.
 Read `AGENTS.md` at project root for full details. Key rules:
 
 1. **No comments in code** — Per project convention. Doc comments (`///`, `//!`)
-   are fine and expected on public API.
-2. **Error handling** — `thiserror` for library error types. No panics in
-   library code. No `unwrap()` or `expect()` outside tests. For poisoned
-   `RwLock`/`Mutex`, use `unwrap_or_else(|e| e.into_inner())` so a panic in one
-   operation does not cascade to other operations.
-3. **`tokio` is the async runtime** — all I/O is async. Use `tokio::sync`
-   primitives (`oneshot`, `mpsc`) for request correlation and subscription
-   channels; `parking_lot` for short-held internal locks (`PendingRequestMap`).
-4. **No secret material on the wire** — `call.requested`/`call.responded`
-   payloads and `OperationContext.metadata` carry no private keys, API keys, or
-   decrypted credentials. Outbound credentials flow through `Capabilities`
-   injected at the assembly layer → `HandlerRegistration.capabilities` →
-   `OperationContext.capabilities` → handler.
-5. **No-env-vars invariant** — no handler reads outbound credentials from any
-   source other than `OperationContext.capabilities`. This is a spec-level
-   invariant, not a runtime convention.
-6. **`OperationEnv` must remain a trait** — the trait-based design enables
-   registry layering (session overlays, connection overlays, peer-keyed
-   composition). Do not make it concrete or hardcode the global registry.
-7. **Wire formats are stable** — `EventEnvelope` (`{ type, id, payload }` +
-   length-prefixed JSON framing) and the channels 8-byte chunk header
-   (`[channel_id:u32 BE][length:u32 BE][payload]`) are one-way doors. New event
-   types may be added; existing shapes must not change.
-8. **Producer/consumer, not server/client** — both sides of a call or channels
+   are fine and expected on public API. Inline `//` comments only when the user
+   asks or when a non-obvious safety/correctness constraint would otherwise be
+   missed (e.g., "a two-pump tunnel must shut down the opposite sink on pump
+   completion — `try_join!` alone deadlocks").
+2. **Error handling** — `thiserror` for library error types (`TunnelError`;
+   `HandlerError`/`StreamError` come from alkcall::core). No panics in library
+   code. No `unwrap()` or `expect()` outside tests. For poisoned
+   `RwLock`/`Mutex`, use `unwrap_or_else(|e| e.into_inner())`.
+3. **`tokio` is the async runtime** — all I/O is async. The tunnel pumps, the
+   channels integration, and the consumer session type are all async. Use
+   `tokio::sync` primitives (`oneshot`, `mpsc`) for lifecycle correlation and
+   per-direction data flow.
+4. **WASM target is load-bearing** — the default crate (protocol-only) MUST
+   compile to `wasm32-unknown-unknown`. Use the wasm-clean tokio subset
+   (`rt`, `sync`, `io-util`, `macros`, `time`); **do NOT use
+   `features = ["full"]`**. Substrate backends (local TCP/UDP sockets, process
+   listeners) are feature-gated and never imported from the
+   shared/producer/consumer modules.
+5. **Wire format is stable** — the tunnel payload rides inside channels data
+   channels as raw bytes (channels strips its 8-byte header transparently; the
+   tunnel protocol owns whatever framing it puts inside the `BiStream`). Any
+   negotiation/setup frame is self-contained (length-prefixed JSON per alktty
+   ADR-006 precedent), not alkcall's `EventEnvelope` framing. Wire-format
+   changes after the first consumer are additive-only.
+6. **Producer/consumer, not server/client** — both sides of a channels
    connection can initiate. Use "producer"/"consumer" or "accept side"/"connect
    side," not "server"/"client."
-9. **Vendored core types** — `Connection`, `ProtocolHandler`, `BiStream`,
-   `BidiStreamSource`, `AuthContext`, `IdentityProvider`, `Identity`,
-   `AuthToken`, `Capabilities`, `OwnershipProvider`, `HandlerError`,
-   `StreamError` live in this crate. Do not add a separate `alkcore` dependency.
-   Keep them lean (no TLS, no transport coupling, no endpoint/accept-loop).
-10. **BAST documents for wire formats** — every binary wire format carries a
-    BAST (Binary Abstract Syntax Tree) document as its machine-readable spec
-    (e.g. the channels chunk header's `docs/architecture/chunk-header.bast.json`,
-    embedded as `CHUNK_HEADER_BAST`). BAST is plain JSON — no dependency
-    required to author or consume it. The `alktype` crate compiles BAST into
-    readers/writers/validators; future codegen derives language-specific
-    implementations. Trivial or hot-path formats (chunk header, tty framing)
-    stay hand-rolled with the BAST doc as the contract; complex formats (sftp)
-    use the alktype engine or codegen. Do not roll your own offset map or
-    validator for complex formats.
-11. **Feature flags** — transports may be feature-gated if the need arises. The
-    base crate should compile lean (no `quinn`, no `iroh` unless the feature is
-    on). Verify both `cargo test` (default) and `cargo test --all-features` pass
-    if features are added.
-12. **Abort cascades to descendants** — `call.aborted` for a parent cascades to
-    all non-terminal descendants. Default `abort-dependents`;
-    `continue-running` opt-in. The composing handler decides the child's policy,
-    not the wire caller.
-13. **Peer authorization via `AccessControl`** — a remote peer's call is
-    authorized by `AccessControl::check(peer_identity)`. No `remote_safe` flag,
-    no `trusted_peer` bypass. `Visibility::Internal` ops are never wire-callable.
+7. **Substrate-agnostic by construction** — the protocol layer must not know
+   whether bytes come from TCP, UDP, a Unix socket, or stdio. Target
+   addressing, direction, and lifecycle bookkeeping must not hardcode a
+   substrate.
+8. **Two-pump shutdown-on-completion is a contract** — each pump MUST shut
+   down the opposite sink when it completes; `tokio::try_join!` alone
+   deadlocks (POC-validated, alknet ADR-078). Emit EOF sentinels (zero-length
+   chunks) on clean sink shutdown.
+9. **No forced local binding** — a tunnel must not require the producer (or
+   consumer) to bind a local port. Support both SSH `-L` and `-R` style
+   directions and unbound/listen-optional flows; the binding decision belongs
+   to the caller.
+10. **Backpressure and limits are inherited** — bounded per-channel buffers,
+    the 256-channel cap, monotonic IDs, and zero-length-sentinel EOF are
+    alkcall channels invariants. Do not build a second demux/mux or re-derive
+    limits.
+11. **Vendored core types come from alkcall** — `Connection`,
+    `ProtocolHandler`, `BiStream`, `BidiStreamSource`, `AuthContext`,
+    `Identity`, `IdentityProvider`, `AccessControl`, `OwnershipProvider`,
+    `HandlerError`, `StreamError` come from `alkcall::core`. Do not vendor
+    copies. Pin `alkcall = "0.4.0"`; bump deliberately; fix issues upstream.
+12. **BAST document for the wire format** — binary framing (if any beyond
+    pass-through) carries a BAST document under `docs/architecture/`
+    conforming to `https://alk.dev/bast/v1/schema`. alktunnels does not depend
+    on alktype; hand-rolled codecs are fine for trivial formats.
+13. **Access control** — scope-gate tunnel opens (`TUNNEL_OPEN_SCOPE`, shape
+    following alktty's `TTY_OPEN_SCOPE`); the channels path gets authorization
+    via `ChannelCore::register_openable`, which runs the ACL before the open
+    handler. Optionally consult `OwnershipProvider`
+    (`provider.owns(id_ref, kind, &id, "tunnel")` — the 4-arg shape).
 14. **Naming conventions** — Rust standard: `snake_case` for functions/variables/
     modules, `PascalCase` for types/traits, `SCREAMING_SNAKE_CASE` for constants.
 15. **Module structure** — one module per file under `src/`, re-exported from
-    `src/lib.rs`. Public API surface is `lib.rs` re-exports.
+    `src/lib.rs`. Public API surface is `lib.rs` re-exports. Producer half
+    (adapter / open-handler), consumer half (typed session/client), shared
+    wire/target-addressing modules; backends feature-gated and never imported
+    from shared/producer/consumer modules.
 
 ## Key Principles