Repository navigation
T1 — Create the bep crate with the GitHub module and the sealed envelope #2258
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Clone, push and gh from a box with no token in it | M | needs care | standard | an agent | 460 (300 code, 160 tests) |
A sealed member fails to open when any bound field differs, and
api.github.comrejects it as a credential.
Covers:
- BEP-006
- BEP-027
Layers:
- crate:
- Cargo.toml: adds
crates/bepto the members - Cargo.lock: the new crate and its dependencies
- crates/bep/Cargo.toml (new): the crate, its seal dependencies and
proptestas a dev-dependency - crates/bep/src/lib.rs (new): module lines
- crates/bep/src/module.rs (new): the GitHub module's v1 host set at port 443, identifier, version and the fixed deny set
- crates/bep/src/seal.rs (new): the envelope of BEP-006, in a form GitHub never accepts as a token
cargo nextest run -p bep sealed_context_binds_box_host_module_version_expirycargo nextest run -p bep --run-ignored ignored-only sealed_value_rejected_by_github
- Cargo.toml: adds
Plan block
### T1 — Create the bep crate with the GitHub module and the sealed envelope
slice: S0
kind: task
covers: BEP-006, BEP-027
size: M
est: 300 code, 160 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: an envelope that fails to open names the bound field that differed (box id, host, module, host-set version, mode or expiry) in the error the proxy logs, never the value
observability: a failed open names the bound field that differed, which the proxy logs per failed redemption, never the value
layers:
- crate:
- Cargo.toml: adds `crates/bep` to the members
- Cargo.lock: the new crate and its dependencies
- crates/bep/Cargo.toml (new): the crate, its seal dependencies and `proptest` as a dev-dependency
- crates/bep/src/lib.rs (new): module lines
- crates/bep/src/module.rs (new): the GitHub module's v1 host set at port 443, identifier, version and the fixed deny set
- crates/bep/src/seal.rs (new): the envelope of BEP-006, in a form GitHub never accepts as a token
test: cargo nextest run -p bep sealed_context_binds_box_host_module_version_expiry
test: cargo nextest run -p bep --run-ignored ignored-only sealed_value_rejected_by_github
produces:
- crates/bep/src/module.rs
- crates/bep/src/seal.rs
consumes: none
proof: A sealed member fails to open when any bound field differs, and `api.github.com` rejects it as a credential.
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 19, 2026
Done. #2346 merged.
branch
agent/2258-create-the-bep-crate-with-the-github-module-and· epic #1501 · PR #2346e88b8509f2d13cb4187b9e086933f51c782201918dc271abUpdated 2026-10-19T20:32:01.743Z.