Repository navigation
T13 — Refuse GitHub grants at activation that the box or the un-enrolled host cannot honour #2264
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Clone, push and gh from a box with no token in it | L | needs care | strongest | an agent | 880 (400 code, 480 tests) |
Activating a grant box whose egress omits a GitHub host exits 3 naming each missing host.
Covers:
- BEP-008
- BEP-009
- BEP-010
- BEP-016
- BEP-017
- BEP-056
Layers:
- spec:
- crates/boxes/src/core/bep.rs (new):
steering(defaultdns),proxy_env,no_proxy,quic443and the GitHub grants; the BEP-008, 009, 010, 017 and 056 refusals - crates/boxes/src/core/mod.rs: module line
- crates/boxes/src/lib.rs:
CredentialedUpstreamcarries the settings, defaulting so an empty declaration reads as before - crates/boxes/Cargo.toml:
proptestas a dev-dependency - Cargo.lock: the dev-dependency edge
cargo nextest run -p boxes prop_grant_host_set_outside_egress_is_exit_3cargo nextest run -p boxes prop_none_mode_with_grant_is_exit_3cargo nextest run -p boxes steering_off_with_grant_warns_and_injects_no_cacargo nextest run -p boxes steering_off_with_proxy_env_is_refusedcargo nextest run -p boxes steering_defaults_to_dnscargo nextest run -p boxes prop_dns_steering_without_resolver_is_exit_3cargo nextest run -p boxes prop_installation_mode_unenrolled_is_exit_3
- crates/boxes/src/core/bep.rs (new):
- read:
- crates/mfile/src/lib.rs: reads
[session.network.bep]and[session.secrets]from the project's[session]table - crates/minimal/src/cmd/session.rs: validates before the create, passing the module's host set
- crates/minimal/src/main.rs: maps the refusal to exit 3
cargo nextest run -p minimal activation_refuses_grant_before_create_with_exit_3
- crates/mfile/src/lib.rs: reads
Waits on:
Plan block
### T13 — Refuse GitHub grants at activation that the box or the un-enrolled host cannot honour
slice: S0
kind: task
covers: BEP-008, BEP-009, BEP-010, BEP-016, BEP-017, BEP-056
size: L
est: 400 code, 480 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: a refused activation exits 3 and prints, for a missing host, "This box declares a GitHub grant, but its egress does not allow: <hosts>. Add them to egress.allow_dns_hosts." on stderr, pinned by prop_grant_host_set_outside_egress_is_exit_3
observability: one debug log line per activation refusal naming the rule and the fields
layers:
- spec:
- crates/boxes/src/core/bep.rs (new): `steering` (default `dns`), `proxy_env`, `no_proxy`, `quic443` and the GitHub grants; the BEP-008, 009, 010, 017 and 056 refusals
- crates/boxes/src/core/mod.rs: module line
- crates/boxes/src/lib.rs: `CredentialedUpstream` carries the settings, defaulting so an empty declaration reads as before
- crates/boxes/Cargo.toml: `proptest` as a dev-dependency
- Cargo.lock: the dev-dependency edge
test: cargo nextest run -p boxes prop_grant_host_set_outside_egress_is_
8000
exit_3
test: cargo nextest run -p boxes prop_none_mode_with_grant_is_exit_3
test: cargo nextest run -p boxes steering_off_with_grant_warns_and_injects_no_ca
test: cargo nextest run -p boxes steering_off_with_proxy_env_is_refused
test: cargo nextest run -p boxes steering_defaults_to_dns
test: cargo nextest run -p boxes prop_dns_steering_without_resolver_is_exit_3
test: cargo nextest run -p boxes prop_installation_mode_unenrolled_is_exit_3
- read:
- crates/mfile/src/lib.rs: reads `[session.network.bep]` and `[session.secrets]` from the project's `[session]` table
- crates/minimal/src/cmd/session.rs: validates before the create, passing the module's host set
- crates/minimal/src/main.rs: maps the refusal to exit 3
test: cargo nextest run -p minimal activation_refuses_grant_before_create_with_exit_3
produces:
- crates/boxes/src/core/bep.rs
consumes:
- crates/bep/src/module.rs
proof: Activating a grant box whose egress omits a GitHub host exits 3 naming each missing host.
depends on:
- blocked by #2258
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 19, 2026
Done. #2365 merged.
branch
agent/2264-refuse-github-grants-at-activation-that-the-box· epic #1501 · PR #2365f55c8be1e6a84d10ae41b819Updated 2026-10-20T02:52:33.406Z.