Repository navigation
T11 — Validate the upstream before substituting, pass unsealed requests through, and stream responses #2272
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Clone, push and gh from a box with no token in it | L | needs care | strongest | an agent | 700 (400 code, 300 tests) |
An upstream that fails validation receives nothing, an unsealed request passes unchanged, and responses stream.
Covers:
- BEP-030
- BEP-055
- BEP-N01
Layers:
- forward:
- crates/bep/src/forward.rs (new): upstream TLS validated against the host store before forwarding (BEP-055), substitution on admit, passthrough (BEP-030), chunked relay (BEP-N01)
- crates/bep/src/proxy.rs: hands each parsed request to the decision and the forwarder
- crates/bep/src/lib.rs: module line
cargo nextest run -p bep unsealed_request_passes_through_and_is_auditedcargo nextest run -p bep prop_upstream_tls_validated_before_substitutioncargo nextest run -p bep upstream_tls_failure_is_refused_and_auditedcargo nextest run -p bep plaintext_request_to_credentialed_host_is_refusedcargo nextest run -p bep streamed_response_is_not_buffered
Waits on:
- T8 — Parse requests strictly and forward a canonical head over HTTP/1.1 #2261
- T10 — Accept only box connections and terminate TLS for the module's hosts over HTTP/1.1 #2271
Plan block
### T11 — Validate the upstream before substituting, pass unsealed requests through, and stream responses
slice: S0
kind: task
covers: BEP-030, BEP-055, BEP-N01
size: L
est: 400 code, 300 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: a refused upstream is audited `upstream_tls_invalid` or `upstream_not_tls`, and a passthrough carrying its own credential `foreign_credential`, each shown by `min box audit <box>`
observability: the connection span gains the upstream's validation outcome and the substitution decision, never the credential
layers:
- forward:
- crates/bep/src/forward.rs (new): upstream TLS validated against the host store before forwarding (BEP-055), substitution on admit, passthrough (BEP-030), chunked relay (BEP-N01)
- crates/bep/src/proxy.rs: hands each parsed request to the decision and the forwarder
- crates/bep/src/lib.rs: module line
test: cargo nextest run -p bep unsealed_request_passes_through_and_is_audited
test: cargo nextest run -p bep prop_upstream_tls_validated_before_substitution
test: cargo nextest run -p bep upstream_tls_failure_is_refused_and_audited
test: cargo nextest run -p bep plaintext_request_to_credentialed_host_is_refused
test: cargo nextest run -p bep streamed_response_is_not_buffered
produces:
- crates/bep/src/forward.rs
consumes:
- crates/bep/src/proxy.rs
- crates/bep/src/upstream.rs
proof: An upstream that fails validation receives nothing, an unsealed request passes unchanged, and responses stream.
depends on:
- blocked by #2261
- blocked by #2271
Reacted by minimal-foundry
Activity
fix(bep): name the relay and store-rule interims, fix the https refusal
minimal-foundry commentedon Oct 21, 2026
Done. #2481 merged.
branch
agent/2272-validate-the-upstream-before-substituting-pass-u· epic #1501 · PR #24816a7ba7aed0349592ebd967fda237d6f06a66bb6432a6cdaaUpdated 2026-10-21T23:03:43.432Z.
feat(bep): accept only box connections and terminate TLS for the modu…