110 lines
5.4 KiB
Markdown
110 lines
5.4 KiB
Markdown
# Development state
|
|
|
|
Checkpoint: 2026-09-14, end of day. Development is paused at a compilable
|
|
checkpoint; no commit was made.
|
|
|
|
## Branch and worktree
|
|
|
|
- Branch: `main`.
|
|
- `git status --short` reports the project files as untracked, including
|
|
`Cargo.toml`, `Cargo.lock`, `src/`, `tests/`, documentation, examples, and
|
|
packaging files. There is no useful committed baseline to compare against in
|
|
this checkout.
|
|
- Multiple agents have been working in the shared directory. Review all diffs
|
|
and ownership boundaries before committing; in particular, do not assume an
|
|
untracked file was created by this task or that a concurrent edit is final.
|
|
|
|
## Implemented and wired behavior
|
|
|
|
The current tree contains the following work, subject to integration review:
|
|
|
|
- Operational assets: MIT `LICENSE`, Linux-focused `README.md`, `.gitignore`,
|
|
client/server TOML examples, architecture/protocol/security/operations/
|
|
troubleshooting documents, an implementation checklist, and systemd client
|
|
and server templates.
|
|
- TLS/TCP transport primitives in `src/transport/tls_tcp.rs`: bounded
|
|
incremental/coalesced u16-big-endian framing, truncated/oversized-frame
|
|
handling, PEM/DER certificate and private-key loading, challenge-response
|
|
authentication, authenticated data/heartbeat/close framing, idle timeout,
|
|
and bounded shutdown.
|
|
- HTTP/3 support primitives in `src/transport/http3.rs`: CONNECT-UDP request
|
|
validation, QUIC varints, RFC 9297 HTTP Datagram context encoding, capsule
|
|
encoding, and project authentication messages. The module does not fake
|
|
CONNECT-UDP with POST or ordinary streams.
|
|
- Runtime orchestration in `src/transport/mod.rs`, `src/client/mod.rs`, and
|
|
`src/server/mod.rs` instantiates direct UDP, QUIC, and TLS/TCP connectors or
|
|
listeners. TLS backend creation occurs after the authenticated session is
|
|
established. HTTP/3 currently returns an explicit `Unsupported` result from
|
|
runtime selection because the actual h3 datagram adapter is not complete.
|
|
- The client and server start the Unix control server. Client reconnect and
|
|
reload commands currently cause a reconnect attempt; server shutdown is
|
|
handled by the encrypted listener paths, while direct-UDP/control lifecycle
|
|
still needs review.
|
|
- `h3-quinn` was enabled with its `datagram` feature; `tokio-rustls` and
|
|
`rustls-native-certs` were added for TLS runtime integration.
|
|
|
|
## Files changed in this work
|
|
|
|
Primary files touched by the operations/integration work are:
|
|
|
|
- `Cargo.toml`, `Cargo.lock`
|
|
- `src/transport/mod.rs`
|
|
- `src/transport/tls_tcp.rs`
|
|
- `src/transport/http3.rs`
|
|
- `src/client/mod.rs`
|
|
- `src/server/mod.rs`
|
|
- `tests/tls_tcp.rs`, `tests/http3.rs`, `tests/integration_transports.rs`
|
|
- `.gitignore`, `LICENSE`, `README.md`
|
|
- `examples/*`, `packaging/systemd/*`, and the other files under `docs/`
|
|
|
|
`src/transport/quic.rs` was edited by another concurrent agent and is outside
|
|
the TLS/integration ownership listed above. Preserve that ownership boundary
|
|
when resolving conflicts.
|
|
|
|
## Verification and current failures
|
|
|
|
- TOML examples were parsed successfully with Python `tomllib`.
|
|
- TLS/TCP focused tests passed: `cargo test --test tls_tcp --quiet` (7 tests).
|
|
- HTTP/3 focused tests passed: `cargo test --test http3 --quiet` (4 tests).
|
|
- `cargo check` passed after the transport integration edits.
|
|
- The TLS loopback integration test compiles but currently panics while
|
|
constructing a rustls configuration because no process-level crypto provider
|
|
is installed:
|
|
|
|
`Could not automatically determine process-level CryptoProvider from Rustls crate features.`
|
|
|
|
The runtime/test setup must explicitly install the `ring` provider (or enable
|
|
exactly one provider feature) before building rustls configurations.
|
|
- The supervisor's latest failure reprobe reports that the QUIC focused tests
|
|
now pass. Run the complete suite again after fixing the rustls provider; the
|
|
earlier complete-suite run had QUIC handshake-timeout failures before the
|
|
concurrent QUIC-agent fixes landed.
|
|
- Clippy has not reached a clean result. Existing included test/source modules
|
|
produce many dead-code and lint diagnostics, and integration code also needs
|
|
a final lint pass after the provider fix.
|
|
|
|
## Remaining gaps, prioritized
|
|
|
|
1. Fix and verify explicit rustls crypto-provider initialization, then run the
|
|
TLS loopback test and the complete test suite.
|
|
2. Finish a real h3 0.0.8/h3-quinn 0.0.10 HTTP/3 CONNECT-UDP datagram adapter,
|
|
or retain the explicit `Unsupported` path with a precise documented
|
|
dependency/API blocker. Do not substitute POST, capsules-only streams, or
|
|
ordinary HTTP request bodies for HTTP Datagrams.
|
|
3. Review runtime lifecycle semantics: direct-UDP control shutdown wiring,
|
|
actual file-backed config reload, client TLS heartbeat scheduling, and
|
|
authentication-error mapping so auto fallback stops on rejected credentials.
|
|
4. Run repository-wide formatting, tests, and clippy; inspect the shared
|
|
untracked tree and reconcile concurrent `quic.rs` changes before any commit.
|
|
|
|
## First three tasks tomorrow
|
|
|
|
1. Install/select the rustls `ring` provider once at runtime and in the
|
|
integration test setup; rerun TLS loopback plus `cargo test`.
|
|
2. Inspect the enabled h3-quinn datagram API and implement/test the smallest
|
|
standards-correct CONNECT-UDP client/server adapter; otherwise record the
|
|
exact unsupported API/dependency condition in the public docs.
|
|
3. Perform an end-to-end lifecycle review and repository-wide `fmt`, check,
|
|
test, and clippy pass, resolving only changes within each agent's ownership.
|
|
|