Repository navigation
T15 — Show the root fingerprint, the upstream set, steering and the full marker in min box spec #2267
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Clone, push and gh from a box with no token in it | L | routine | standard | an agent | 760 (400 code, 360 tests) |
min box specon the demo box shows the root fingerprint, the four GitHub hosts marked full, and proxy_env steering.
Covers:
- BEP-038
- BEP-057
Layers:
- cli:
- crates/minimal/src/cli.rs: the
min boxnoun withspec - crates/minimal/src/cmd/mod.rs: dispatch and module line
- crates/minimal/src/cmd/box_spec.rs (new): the BEP-038 rows: root fingerprint, upstreams with the
fullmarker, steering, store references, the QUIC flag - crates/minimal/src/config.rs: reads
[secrets] acknowledge_full_breadth_unenrolledfrom the user and organization client configuration cargo nextest run -p minimal box_spec_renders_ca_upstreams_steering_and_referencescargo nextest run -p minimal box_spec_marks_full_breadth_membercargo nextest run -p minimal box_spec_flags_allowed_quic_stance_on_grant_boxcargo nextest run -p minimal acknowledged_narrow_grant_renders_full
- crates/minimal/src/cli.rs: the
- spec:
- crates/boxes/src/core/bep.rs: the BEP-057 refusal and the
quic443stance - crates/mfile/src/lib.rs: ignores a project's acknowledgement with a warning
cargo nextest run -p boxes prop_narrow_scopes_unenrolled_need_acknowledgementcargo nextest run -p boxes project_acknowledgement_is_ignored_with_warning
- crates/boxes/src/core/bep.rs: the BEP-057 refusal and the
Waits on:
- T2 — Hold the proxy's keys non-exportable in the host keychain and publish their public halves #2259
- T13 — Refuse GitHub grants at activation that the box or the un-enrolled host cannot honour #2264
Plan block
### T15 — Show the root fingerprint, the upstream set, steering and the full marker in min box spec
slice: S0
kind: task
covers: BEP-038, BEP-057
size: L
est: 400 code, 360 tests
executor: agent
difficulty: routine
model: standard
diagnostics: `min box spec` prints `root CA <sha256 fingerprint>`, one `grant github:user-token full` row per grant with its upstream hosts, `steering proxy_env`, and, where the stance is allowed on a grant box, `quic443 allowed (HTTP/3 bypasses the proxy)`, pinned by box_spec_renders_ca_upstreams_steering_and_references
observability: one debug log line per render naming the box and whether the published root was found
layers:
- cli:
- crates/minimal/src/cli.rs: the `min box` noun with `spec`
- crates/minimal/src/cmd/mod.rs: dispatch and module line
- crates/minimal/src/cmd/box_spec.rs (new): the BEP-038 rows: root fingerprint, upstreams with the `full` marker, steering, store references, the QUIC flag
- crates/minimal/src/config.rs: reads `[secrets] acknowledge_full_breadth_unenrolled` from the user and organization client configuration
test: cargo nextest run -p minimal box_spec_renders_ca_upstreams_steering_and_references
test: cargo nextest run -p minimal box_spec_marks_full_breadth_member
test: cargo nextest run -p minimal box_spec_flags_allowed_quic_stance_on_grant_box
test: cargo nextest run -p minimal acknowledged_narrow_grant_renders_full
- spec:
- crates/boxes/src/core/bep.rs: the BEP-057 refusal and the `quic443` stance
- crates/mfile/src/lib.rs: ignores a project's acknowledgement with a warning
test: cargo nextest run -p boxes prop_narrow_scopes_unenrolled_need_acknowledgement
test: cargo nextest run -p boxes project_acknowledgement_is_ignored_with_warning
produces:
- crates/minimal/src/cmd/box_spec.rs (entry point)
consumes:
- crates/boxes/src/core/bep.rs
- crates/bep/src/publish.rs
proof: `min box spec` on the demo box shows the root fingerprint, the four GitHub hosts marked full, and proxy_env steering.
depends on:
- blocked by #2259
- blocked by #2264
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 20, 2026
Done. #2443 merged.
branch
agent/2267-show-the-root-fingerprint-the-upstream-set-steer· epic #1501 · PR #244356a334a62bcdb12d44ebeb71Updated 2026-10-20T15:02:39.484Z.