From e00b075752d3c87d90041ced7b9aeafa2b65d6cb Mon Sep 17 00:00:00 2001 From: kuddev Date: Sat, 19 Sep 2026 20:23:26 +0800 Subject: [PATCH] docs(ssh): clarify native agent cancellation limits --- docs/architecture-decisions.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/docs/architecture-decisions.md b/docs/architecture-decisions.md index 1a249df..325a146 100644 --- a/docs/architecture-decisions.md +++ b/docs/architecture-decisions.md @@ -890,13 +890,19 @@ settings files. cutoff; logs and final diagnostics report returned and offered counts. A server that stops offering public-key authentication ends the agent step. Partial success skips further public keys and continues to the second factor. -- **Budgets:** Connection and identity enumeration share at most 1.5 seconds per - endpoint and 3 seconds in total. Public selector reads have a separate 1 second +- **Budgets:** Async connection and identity enumeration share a deadline of + 1.5 seconds per endpoint and 3 seconds in total. Public selector reads have a separate 1 second budget and 64 KiB per regular file. Signing may need user confirmation, so it uses the existing 300 second formal authentication budget. Confirmation time does not consume a later endpoint's discovery allowance. Test Connection and unattended jump authentication retain a 12 second authentication limit, with an agent-specific diagnostic if it expires during that step. +- **Native cancellation limit:** The locked Pageant 0.2.1 window-message transport + calls synchronous `SendMessageA` from an async worker. A caller deadline cannot + preempt that native call or reclaim a worker blocked by an unresponsive legacy + provider. The named-pipe busy case is cancellable and separately tested. A + stronger guarantee for the legacy transport requires an upstream or native + adapter change; protocol timeout tests alone do not establish that guarantee. - **Failure and cancellation:** Unavailable, empty and rejected agents are safe fallback results; partial success and authenticated are separate outcomes. Signer, session-channel and signing-timeout errors propagate immediately. The