Repository navigation
T24 — Renew an expiring sign-in once at the proxy #2279
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Overnight boxes keep GitHub access | L | needs care | strongest | an agent | 770 (350 code, 420 tests) |
A box running past the token's 8 hours still clones and pushes, renewed once at the proxy, with no new sign-in.
Covers:
- BEP-069
Layers:
- renew:
- crates/bep/src/signin.rs: renews from the refresh material when the token has expired or expires within 5 minutes, writing the item update-only before first use
- crates/bep/src/forward.rs: one renewal in flight per item, the others waiting for its outcome; refuses when the write fails or the item is gone
cargo nextest run -p bep an_expiring_sign_in_is_renewed_at_the_proxycargo nextest run -p bep concurrent_redemptions_share_one_renewalcargo nextest run -p bep renewal_not_persisted_is_refusedcargo nextest run -p bep renewal_finding_item_deleted_refuses_and_creates_nothingcargo nextest run -p bep a_sign_in_with_time_to_live_is_not_renewedcargo nextest run -p bep unrenewable_sign_in_refuses_with_sign_in_required
- client:
- crates/minimal/src/cmd/auth.rs: reads only the item's metadata after sign-in
cargo nextest run -p minimal client_never_presents_or_refreshes_the_token
Waits on:
Plan block
### T24 — Renew an expiring sign-in once at the proxy
slice: S2
kind: task
covers: BEP-069
size: L
est: 350 code, 420 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: `min box audit <box>` shows each renewal as its own record, and a sign-in that cannot renew as a refusal marked `github_sign_in_required`
observability: one info log line per renewal naming the account and the new expiry, and one warn line when GitHub refuses it
layers:
- renew:
- crates/bep/src/signin.rs: renews from the refresh material when the token has expired or expires within 5 minutes, writing the item update-only before first use
- crates/bep/src/forward.rs: one renewal in flight per item, the others waiting for its outcome; refuses when the write fails or the item is gone
- crates/bep/src/redeemer.rs: `BoxRedeemer::credential` no longer refuses an item whose standing is `Live` but expired; it hands the item to the renewal path (widened 2026-10-24)
- crates/bep/src/main.rs: wires a GitHub token-endpoint client into the proxy, with the app's client id and the client secret embedded at build time through `option_env!("MINIMAL_GITHUB_APP_CLIENT_SECRET")`, as `min`'s `BUILT_IN_SECRET` is; no launcher passes it at run time (widened 2026-10-24; wording per arch C3 on #2518)
- crates/bep/src/audit.rs: `Kind::Renewal` (serde `renewal`), the renewal's own audit record kind (added 2026-10-24 per arch C2 on #2518)
- crates/minimal/src/cmd/box_audit.rs: maps `Kind::Renewal` to `renewal` in the kind match (added 2026-10-24 per arch C2 on #2518)
test: cargo nextest run -p bep an_expiring_sign_in_is_renewed_at_the_proxy
test: cargo nextest run -p bep concurrent_redemptions_share_one_renewal
test: cargo nextest run -p bep renewal_not_persisted_is_refused
test: cargo nextest run -p bep renewal_finding_item_deleted_refuses_and_creates_nothing
test: cargo nextest run -p bep a_sign_in_with_time_to_live_is_not_renewed
test: cargo nextest run -p bep unrenewable_sign_in_refuses_with_sign_in_required
- client:
- crates/minimal/src/cmd/auth.rs: reads only the item's metadata after sign-in
test: cargo nextest run -p minimal client_never_presents_or_refreshes_the_token
produces: none
consumes: none
proof: A box running past the token's 8 hours still clones and pushes, renewed once at the proxy, with no new sign-in.
depends on:
- blocked by #2276
Generated by Claude Code
Reacted by minimal-foundry
Activity
docs(bep): mark the redeemer's interims and their flip issues
feat(bep): wire the redemption decision and each box's declared egres…
minimal-foundry commentedon Oct 24, 2026
Done. #2518 merged.
branch
agent/2279-renew-an-expiring-sign-in-once-at-the-proxy· epic #1501 · PR #2518f0b22ddff05fc6aff8583d05Updated 2026-10-25T02:30:43.085Z.