Module ident 

Ident (RFC 1413) server.

One query, one reply, close. The client sends <server-port> , <client-port> and the server answers either a USERID line or one of four ERROR tokens.

Three properties this loop is responsible for, none of which live in actions.rs:

1. INVALID-PORT is decided here, in Rust, with no LLM call. A port outside 1..=65535 is a parse verdict, not a judgement anyone should be asked to make. The model never sees a malformed query.
2. The port pair on the wire is the pair that arrived. RFC 1413 §3 has the client match a reply to its query by that pair, so a reply carrying a different one is unmatchable — to the client, indistinguishable from no reply. enforce_port_pair rewrites the model’s answer if it echoed the pair wrongly, and says so at WARN.
3. Nothing is silent. Ident has an error frame, so this is not the deliberate-silence class the root CLAUDE.md describes for ARP/OSPF/DHCP: an LLM outage, a model that answers with nothing, and an action that fails to execute all produce ERROR : UNKNOWN-ERROR. That is also the correct fail-closed answer, because it asserts nothing about any user — unlike a USERID line, which is a positive claim about an account.

The distinction an outage would otherwise erase is kept in the log, the way src/server/radius/ keeps it: decision=model_reject is the model refusing, decision=model_silent is the model answering with nothing, and decision=fail_closed_llm_error is the backend being unreachable. All three look identical on the wire because RFC 1413 gives them one token; grep decision= to tell them apart. No error text ever reaches the peer.

NetGet consults no OS state. See actions.rs — the model invents every userid.

Modules

actions

Ident (RFC 1413) protocol actions.

Structs

IdentServer

Constants

MAX_QUERY_BYTES

RFC 1413 §5 caps a query line at 1000 characters. A peer that sends more without a newline is not speaking ident; cap the buffer rather than growing it for them.