Two thousand lines with a published answer

Where we are

The console works. It just cannot talk to anything yet.

Phases 0 through 3 and phase 9 are landed: a native window on macOS and on Wayland, one immediate-mode toolkit, the museum interface with selection and per-node results, navigation, and the SD-card ledger with a real pty behind it.

Six buttons in the verb bar are absent rather than greyed — Observe, Control, Terminal, Exchange, Send, Message — because their transports do not exist. The status line says 6 not built rather than offering something that would fail. Phase 4 is the first step toward that number going down.

The argument for doing it now

SSH and TLS want the same arithmetic

This is the structural fact that makes the rest of the plan tractable. Write the primitives once and the second protocol is a wire format rather than a cryptosystem.

  crypto.rs   the primitives          ~2000   ← phase 4
       │
       ├── ssh.rs    transport, auth, channels   ~1400   phase 5
       │       └── sftp.rs   SFTP v3              ~600   phase 6
       │
       └── tls.rs    TLS 1.3, one suite          ~1100   phase 7
               └── rdp.rs    the RDP client      ~2200   phase 8

  Terminal ── ssh.rs        Exchange ── sftp.rs
  Send     ── sftp.rs       Control  ── rdp.rs / rfb.rs

The specification already exists

Nothing here is a judgement call

There is normally an argument at the start of a crypto module about which algorithms to support. That argument already happened, and it is committed.

src/profile.rs — written two phases early, at the request to lock the fleet down — is the whitelist, versioned, and it is already the thing that renders the node's sshd block. It names exactly one algorithm per slot. So phase 4 has no design space: the list of functions to write is a list somebody already reviewed, and a test called nothing_weak_is_on_any_list fails the build if it grows something with sha1, cbc, rc4, ssh-rsa, ecdsa or eighteen other tokens in it.

Why it is the lowest risk, not the highest

Every line has a published answer

It is the largest single module in the plan, and it is the one least likely to go wrong — because unlike an RDP client negotiating with a server nobody here has run, every function in it has a known-correct output that somebody else wrote down.

A module where every line is checked against a vector somebody else published is either right or obviously wrong. That is a different risk profile from the rest of the wire, where correctness means agreeing with a live server about an ambiguous specification. Budget the time for phase 4; do not budget the worry.

The discipline

Constant time, or it is decoration

A reviewer should be able to read crypto.rs looking for exactly two things: a branch that depends on a secret, and a table index that depends on a secret. Neither may exist. Concretely —

• Field arithmetic over 2²⁵⁵−19 in 5×51-bit limbs, with no conditional reduction. The carry chain runs the same way every time regardless of the value.
• Authentication tags compared by OR-accumulating a difference across all sixteen bytes, never by an early-returning loop. A comparison that stops at the first wrong byte tells an attacker how many bytes were right.
• AES is bitsliced, not tabulated. A textbook T-table AES is a cache-timing oracle. The slower version is the only one worth writing.

The deliverable

What "done" means for phase 4

Stated rather than glossed

The risk that does not go away