---
id: tunnels/review-core-crates
name: Mid-phase review — producer + consumer halves before the local feature
status: pending
depends_on: [tunnels/consumer-session]
scope: moderate
risk: low
impact: phase
level: review
tags: [review, injection-point]
---

## Description

Review injection point (SDD §Review Injection — "high-risk tasks: review
before proceeding"): `tunnels/producer-open-op` and
`tunnels/consumer-session` are the two `risk: high, impact: phase` tasks
and the crate's wire/API surface. Review them BEFORE
`tunnels/local-socket-halves` and `tunnels/end-to-end-suite` build
against the shapes — a wire or API mistake found here costs one task's
rework; found later it costs three.

### Checklist (focused — the full gate is `tunnels/review-impl`)

1. Wire conformance of what landed (params/codec/open-op vs wire.md +
   ADR-001/003) — the one-way-door check.
2. The pump handler shape: `pump_bidi` inline, JoinHandle tracks the
   data plane (R-02) — the POC's hang-bug class must be structurally
   absent.
3. Teardown matrix of `TunnelSession` — close/join/Drop soundness, no
   leaks (the W3 class).
4. No substrate types outside `src/local/`-to-be; no hand-rolled
   two-pump loops; no side-channel handoff.
5. Integration tests green + repeat-run stable (3×).

Deliverable: findings inline here (Notes/Summary); criticals block the
downstream tasks (Safe Exit); majors create remediation notes for
`tunnels/review-impl` to re-check.

## Acceptance Criteria

- [ ] The 5 checklist items each with a verdict
- [ ] Criticals (if any) resolved before proceeding; majors logged

## References

- docs/architecture/ (the spec set under review)
- docs/sdd_process.md §Review Injection

## Notes

> Agent fills during implementation.

## Summary

> Agent fills this on completion.