Repository navigation
T20 — Record a revocation when a live box is destroyed and refuse its values within a minute #2277
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Revoke a box or sign out | L | needs care | strongest | an agent | 820 (380 code, 440 tests) |
After
min session destroy web, a value copied from web is refused within a minute, even if the proxy was down.
Covers:
- BEP-043
- BEP-067
- BEP-071
Layers:
- proxy:
- crates/bep/src/revoke.rs (new): revocations by box id, consulted before any resolution (BEP-071); its module line goes in the crate root beside the other modules
- crates/bep/src/control.rs: takes mint and revocation submissions and appends them to the one log
- crates/bep/src/proxy.rs:
AuditWriter::try_writereports an append failure torevoke_box, so a lost revocation record is logged as an error and never silent (widened 2026-10-25 per review finding 4369863226 on feat(bep): record a revocation when a live box is destroyed (T20) #2548) - crates/bep/src/redeemer.rs: the interim doc comments say that
revoke_boxon the control socket puts a revocation in force and that the one interim left is the empty set at start until T33 (T33 — Rotate audit segments with the chain carried across and revocations restored #2290);revokedis built withcrate::revoke::in_force_forfor this box only (widened 2026-10-25 per arch C2 and C3 on feat(bep): record a revocation when a live box is destroyed (T20) #2548) cargo nextest run -p bep prop_revocation_covers_exactly_its_boxcargo nextest run -p bep revoked_value_never_triggers_renewal
- client:
- crates/minimal/src/mint.rs: submits a
mintrecord per member - crates/minimal/src/tests.rs: the mint tests and their stub control servers live here, so the stubs answer the new
record_mintandrevoke_boxrequests and the revocation test sits beside them (widened 2026-10-25) - crates/minvmd/src/box_registry.rs: on a live box's destroy submits its revocation and sends
forget_boxover the control socket, so the proxy attributes the id to no live box (T41, T41 — Wire the redemption decision and each box's declared egress into bep serve #2483), completing the destroy when the proxy is down - crates/minvmd/src/cmd/run.rs: the supervisor start path sets the proxy control socket on the registry through
with_proxy_control, so only the daemon, never a test, sends revocations (widened 2026-10-25 per review finding 4369790164 on feat(bep): record a revocation when a live box is destroyed (T20) #2548) - crates/bep/src/main.rs: drops the box-egress interim from the
bep servestartup warning and thewirecomment if T14 has not already, since this task is the destroy half of that flip cargo nextest run -p minimal mint_and_destroy_append_audit_records
- crates/minimal/src/mint.rs: submits a
- e2e:
- scripts/session-e2e.sh: adds two cases
./scripts/session-e2e.sh bep_destroyed_box_values_refused_within_60s./scripts/session-e2e.sh bep_destroy_with_proxy_down_refuses_by_attachment
Waits on:
- T10 — Accept only box connections and terminate TLS for the module's hosts over HTTP/1.1 #2271
- T14 — Mint a sealed sign-in reference for each GitHub grant and register the box with the proxy #2273
- T19 — Clone, push and gh from a box with no token in it, end to end #2276
Plan block
### T20 — Record a revocation when a live box is destroyed and refuse its values within a minute
slice: S1
kind: task
covers: BEP-043, BEP-067, BEP-071
size: L
est: 380 code, 440 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: `min box audit <box>` shows the box's `revocation` record and each later refusal of its values
observability: one info log line per revocation recorded, naming the box id; one warn line when a destroy completes with the proxy unreachable
layers:
- proxy:
- crates/bep/src/revoke.rs (new): revocations by box id, consulted before any resolution (BEP-071); its module line goes in the crate root beside the other modules
- crates/bep/src/control.rs: takes mint and revocation submissions and appends them to the one log
- crates/bep/src/proxy.rs: `AuditWriter::try_write` reports an append failure to `revoke_box`, so a lost revocation record is logged as an error and never silent (widened 2026-10-25 per review finding 4369863226 on #2548)
- crates/bep/src/redeemer.rs: the interim doc comments say that `revoke_box` on the control socket puts a revocation in force and that the one interim left is the empty set at start until T33 (#2290); `revoked` is built with `crate::revoke::in_force_for` for this box only (widened 2026-10-25 per arch C2 and C3 on #2548)
test: cargo nextest run -p bep prop_revocation_covers_exactly_its_box
test: cargo nextest run -p bep revoked_value_never_triggers_renewal
- client:
- crates/minimal/src/mint.rs: submits a `mint` record per member
- crates/minimal/src/tests.rs: the mint tests and their stub control servers live here, so the stubs answer the new `record_mint` and `revoke_box` requests and the revocation test sits beside them (widened 2026-10-25)
- crates/minvmd/src/box_registry.rs: on a live box's destroy submits its revocation and sends `forget_box` over the control socket, so the proxy attributes the id to no live box (T41, #2483), completing the destroy when the proxy is down
- crates/minvmd/src/cmd/run.rs: the supervisor start path sets the proxy control socket on the registry through `with_proxy_control`, so only the daemon, never a test, sends revocations (widened 2026-10-25 per review finding 4369790164 on #2548)
- crates/bep/src/main.rs: drops the box-egress interim from the `bep serve` startup warning and the `wire` comment if T14 has not already, since this task is the destroy half of that flip
test: cargo nextest run -p minimal mint_and_destroy_append_audit_records
- e2e:
- scripts/session-e2e.sh: adds two cases
test: ./scripts/session-e2e.sh bep_destroyed_box_values_refused_within_60s
test: ./scripts/session-e2e.sh bep_destroy_with_proxy_down_refuses_by_attachment
produces:
- crates/bep/src/revoke.rs
consumes:
- crates/bep/src/control.rs
- crates/minimal/src/mint.rs
proof: After `min session destroy web`, a value copied from web is refused within a minute, even if the proxy was down.
depends on:
- blocked by #2271
- blocked by #2273
- blocked by #2276
Generated by Claude Code
Reacted by minimal-foundry
Activity
docs(bep): mark the redeemer's interims and their flip issues
norrietaylor commentedon Oct 22, 2026
One layer line added so that T41's arch condition has an owner: on a live box's destroy,
crates/minvmd/src/box_registry.rsalso sendsforget_boxover the proxy's control socket, so the proxy attributes the id to no live box from then on (#2486 gives the socket and the request). The create side,register_box, is T14 #2273's.Generated by Claude Code
docs(bep): name the box egress creators in the serve warning
fix(bep): take the root's validity end only from a known creation time
docs(minimal): say a Ctrl-C leaves a grant box at the proxy
feat(minimal): mint sealed GitHub sign-in references and register the…
feat(bep): wire the redemption decision and each box's declared egres…
minimal-foundry commentedon Oct 24, 2026
Done. #2548 merged.
branch
agent/2277-record-a-revocation-when-a-live-box-is-destroyed· epic #1501 · PR #25480c3fed8892318d86562911274617924f0e70286ad5cd0e95431f4bd7e12752426acd8cdcUpdated 2026-10-25T19:40:02.055Z.