glm-5.3-flash
0397194fe6
Untangles the 'host owns the resource and proxies on top' posture for tunnels: - Protocol-crate levels assume the resource is owned by the other side of the connection; alkcall's existing op-level ACL applies as-is. No new policy layer, target allowlists, or tunnel-specific ownership machinery. Proxy/overlay is a downstream (assembly-layer) concern (hub workers expose tunnels; hub overlays them per-ACL). - Discovery resolved: openable channels are operations (alkcall ADR-047), so the existing bidirectional ACL-filtered ops listing IS tunnel-resource discovery. A consumer learns a socks5/postgres/redis tunnel is available from the same listing it already uses for ops. - -D simplifies to 'just tunnel a socks5 connection': socks5 server lives on the producing side; target selection happens in the socks5 protocol, not tunnel params; the dynamic-target policy residue dissolves (socks5 resource ACL governs reachability). Residue for Phase 1: per-resource metadata in the ops listing (substrate type, name/description) — an alkcall ADR-047 interaction, not a new mechanism. OQ-TN-01 discovery residue and the hub-model residue list cross-linked accordingly.