Repository navigation
T18 — Run the proxy beside gvproxy so git and gh reach GitHub from a box #2275
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Clone, push and gh from a box with no token in it | L | unknown ground | strongest | an agent | 500 (280 code, 220 tests) |
From a box holding only a sealed member, git clone, git push and gh api succeed against a private repository.
Covers:
- BEP-015
Layers:
- host:
- crates/minvmd/src/cmd/run.rs: starts
bep servebeside gvproxy with the per-boot token in production, the stub staying test-only cargo nextest run -p minvmd proxy_is_started_with_the_per_boot_token
- crates/minvmd/src/cmd/run.rs: starts
- ship:
- justfile: builds and signs the bep binary beside minvmd
- crates/minimal/src/diag/collect.rs: collects the proxy log and the audit segments
cargo nextest run -p minimal bundle_collects_the_proxy_log_and_audit_segments
- e2e:
- scripts/session-e2e.sh: adds the case; the T14 and T42 legs and the three T16 grant legs record NOT RUN off macOS until this task starts
bep serve, and must each record a pass on the macOS lane against the live proxy (residuals filed here from feat(minimal): mint sealed GitHub sign-in references and register the box with the proxy #2490, feat(minimald): deliver each GitHub grant's sealed value into its variable in the box #2491 and feat(minimald): put the proxy's root certificate in a grant box's trust store #2495) ./scripts/session-e2e.sh bep_git_and_gh_against_private_repo./scripts/session-e2e.sh bep_second_box_needs_no_sign_in./scripts/session-e2e.sh bep_box_env_holds_sealed_value_only
- scripts/session-e2e.sh: adds the case; the T14 and T42 legs and the three T16 grant legs record NOT RUN off macOS until this task starts
Waits on:
- T2 — Hold the proxy's keys non-exportable in the host keychain and publish their public halves #2259
- T11 — Validate the upstream before substituting, pass unsealed requests through, and stream responses #2272
- T14 — Mint a sealed sign-in reference for each GitHub grant and register the box with the proxy #2273
- T16 — Put the interception root in the box's trust store #2274
- T40 — Point the box at the proxy #2334
- T41 — Wire the redemption decision and each box's declared egress into bep serve #2483
- T42 — Deliver each sealed value into its grant's environment variable in the box #2488
Plan block
### T18 — Run the proxy beside gvproxy so git and gh reach GitHub from a box
slice: S0
kind: task
covers: BEP-015
size: L
est: 280 code, 220 tests
executor: agent
difficulty: unknown ground
model: strongest
diagnostics: the support bundle carries the proxy's log tail and the audit log segments, collected beside the VM host daemon's log
observability: one info log line when the VM host daemon starts the proxy, naming its socket and pid, and one warn line when it exits
layers:
- host:
- crates/minvmd/src/cmd/run.rs: starts `bep serve` beside gvproxy with the per-boot token in production, the stub staying test-only
test: cargo nextest run -p minvmd proxy_is_started_with_the_per_boot_token
- ship:
- justfile: builds and signs the bep binary beside minvmd
- crates/minimal/src/diag/collect.rs: collects the proxy log and the audit segments
test: cargo nextest run -p minimal bundle_collects_the_proxy_log_and_audit_segments
- e2e:
- scripts/session-e2e.sh: adds the case; the T14 leg `bep_second_box_needs_no_sign_in` records NOT RUN on every lane until this task starts `bep serve` (do not change that leg to pass without a proxy); the T16 grant legs `bep_root_ca_present_in_box_trust_store`, the grant half of `bep_root_ca_absent_from_box_without_credentialed_upstream` and `bep_trust_env_points_at_bundle_and_root` record NOT RUN off macOS the same way; the macOS passes against the live proxy that #2490 (arch C1) and #2495 (arch C2) filed here moved to #2500 (arch C3 on #2497)
test: ./scripts/session-e2e.sh bep_git_and_gh_against_private_repo
test: ./scripts/session-e2e.sh bep_second_box_needs_no_sign_in
test: ./scripts/session-e2e.sh bep_box_env_holds_sealed_value_only
produces: none
consumes:
- crates/bep/src/main.rs
- crates/bep/src/forward.rs
proof: From a box holding only a sealed member, git clone, git push and gh api succeed against a private repository.
depends on:
- blocked by #2259
- blocked by #2272
- blocked by #2273
- blocked by #2274
- blocked by #2334
- blocked by #2483
- blocked by #2488
Generated by Claude Code
Reacted by minimal-foundry
Activity
test(e2e): name the task that starts the proxy in the NOT RUN reason
norrietaylor commentedon Oct 22, 2026
Residual from T14 #2490, filed here by the babysitter on 2026-10-22.
The arch review of #2490 at 23ce9a4 passed with one condition (C1, ruling 119728566762): the e2e leg
bep_second_box_needs_no_sign_ininscripts/session-e2e.shrecords NOT RUN on every lane, because nothing startsbep serveuntil this task runs the proxy beside gvproxy. Once this task lands, the macOS lane must record a pass of that leg against the live proxy. The leg must not be changed to pass without a proxy.This task's e2e layer now carries the leg as a second test line, in the issue body and in the epic's plan comment.
Generated by Claude Code
feat(minimal): mint sealed GitHub sign-in references and register the…
norrietaylor commentedon Oct 22, 2026
Second residual from the epic, filed here by the babysitter on 2026-10-22, from T42 #2491.
The arch review of #2491 at 8c381bc (ruling 119981772885, C4) requires the e2e leg
bep_box_env_holds_sealed_value_onlyinscripts/session-e2e.shto run and pass; at that head it records NOT RUN on every lane for the same reason as T14's leg: nothing startsbep serveuntil this task runs the proxy beside gvproxy. Once this task lands, the macOS lane must record a pass of both legs against the live proxy. Neither leg may be changed to pass without a proxy.This task's e2e layer now carries the second leg as a test line too, in the issue body and in the epic's plan comment.
Generated by Claude Code
norrietaylor commentedon Oct 23, 2026
Residual filed from T16 #2495, arch condition C2: the three grant legs of BEP-011 (
bep_root_ca_present_in_box_trust_store, the grant half ofbep_root_ca_absent_from_box_without_credentialed_upstream, andbep_trust_env_points_at_bundle_and_root) record NOT RUN off macOS, and on macOS until a live proxy runs beside gvproxy, which is this task. Thee2elayer'sscripts/session-e2e.shline in the plan block and in this body now names them beside the T14 and T42 legs: each must record a pass on the macOS lane against the live proxy when this task lands.Generated by Claude Code
minimal-foundry commentedon Oct 23, 2026
Done. #2497 merged.
branch
agent/2275-run-the-proxy-beside-gvproxy-so-git-and-gh-reach· epic #1501 · PR #24978e6c4aac0887138665d6bbe09bef47588e2f4d91b8cdccd081fe9ebd9ba361d107714c59256fa59cUpdated 2026-10-24T00:56:57.153Z.
norrietaylor commentedon Oct 23, 2026
Plan amendment from T18 #2497, arch condition C3 at a5547ff: the macOS passes against the live proxy that T14 #2490 (arch C1) and T16 #2495 (arch C2) filed on this task moved to #2500, which owns a macOS lane with
bepin its testbed, a sign-in andE2E_BEP_PRIVATE_REPO. The e2e layer line in this body and in the plan block now says so. The legs still record NOT RUN off that lane, and that leg must not change to pass without a proxy. Estimates and tests are unchanged.The arch review also filed #2498 (the release artefacts ship no
bep) and #2499 (no box ships a git credential helper) as residuals of this task.Generated by Claude Code