Repository navigation
S0 — Clone, push and gh from a box with no token in it #2248
Description
Slice
proxy_env steering, the GitHub v1 host set (Gatehouse §6.10 Module host sets: github.com, api.github.com, uploads.github.com, codeload.github.com; pre-signed content hosts such as release-assets.githubusercontent.com stay ordinary egress) as the one module, a sealed reference to the device-flow min auth login sign-in, redemption with every check, the local audit log with its one-shot min box audit <box> read, and min box spec showing the CA and the upstream set. The demo box declares github:user-token, the honest spelling of a full member, so the slice also exercises min box spec's full marker (BEP-038). Keychain references with min secret, dns steering, the browser sign-in flow, min box audit --follow and --parent, audit segment rotation, signing-CA rotation, the PAC recipe and host_ip cohort handling are later slices.
Tasks:
- T1 — Create the bep crate with the GitHub module and the sealed envelope #2258 — Create the bep crate with the GitHub module and the sealed envelope
- T2 — Hold the proxy's keys non-exportable in the host keychain and publish their public halves #2259 — Hold the proxy's keys non-exportable in the host keychain and publish their public halves
- T3 — Issue leaf certificates under a name-constrained root and a keychain-held signing CA #2265 — Issue leaf certificates under a name-constrained root and a keychain-held signing CA
- T4 — Decide redemption as one pure function over host key, attribution and member bounds #2260 — Decide redemption as one pure function over host key, attribution and member bounds
- T5 — Refuse authorities outside both host sets, off-port connections, and expired or revoked values #2266 — Refuse authorities outside both host sets, off-port connections, and expired or revoked values
- T6 — Pin the request authority, re-check the box's egress, and admit only when every check passes #2268 — Pin the request authority, re-check the box's egress, and admit only when every check passes
- T7 — Verify signed handles against the client's registered key and the current rule #2270 — Verify signed handles against the client's registered key and the current rule
- T8 — Parse requests strictly and forward a canonical head over HTTP/1.1 #2261 — Parse requests strictly and forward a canonical head over HTTP/1.1
- T9 — Append hash-chained audit records the proxy alone writes #2262 — Append hash-chained audit records the proxy alone writes
- T10 — Accept only box connections and terminate TLS for the module's hosts over HTTP/1.1 #2271 — Accept only box connections and terminate TLS for the module's hosts over HTTP/1.1
- T11 — Validate the upstream before substituting, pass unsealed requests through, and stream responses #2272 — Validate the upstream before substituting, pass unsealed requests through, and stream responses
- T12 — Sign in to GitHub with min auth and keep the sign-in in one keychain item #2263 — Sign in to GitHub with min auth and keep the sign-in in one keychain item
- T13 — Refuse GitHub grants at activation that the box or the un-enrolled host cannot honour #2264 — Refuse GitHub grants at activation that the box or the un-enrolled host cannot honour
- T14 — Mint a sealed sign-in reference for each GitHub grant and register the box with the proxy #2273 — Mint a sealed sign-in reference for each GitHub grant and deliver it into the box
- T15 — Show the root fingerprint, the upstream set, steering and the full marker in min box spec #2267 — Show the root fingerprint, the upstream set, steering and the full marker in min box spec
- T16 — Put the interception root in the box's trust store #2274 — Put the interception root in the box's trust store
- T40 — Point the box at the proxy #2334 — Point the box at the proxy
- T17 — Read one box's audit trail with min box audit #2269 — Read one box's audit trail with min box audit
- T18 — Run the proxy beside gvproxy so git and gh reach GitHub from a box #2275 — Run the proxy beside gvproxy so git and gh reach GitHub from a box
- T19 — Clone, push and gh from a box with no token in it, end to end #2276 — Clone, push and gh from a box with no token in it, end to end
Activity
norrietaylor commentedon Oct 31, 2026
Closing in the 2026-10-31 backlog triage: the work has shipped.
Evidence: All 23 tasks closed COMPLETED, including #2276 (T19 e2e), #2483, #2488 and #2437. Supporting PRs merged: #2497 (start BEP beside gvproxy) and #2504.
Two independent reviewers checked this closure; neither refuted it. Reopen if it's wrong.