Repository navigation
T41 — Wire the redemption decision and each box's declared egress into bep serve #2483
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Clone, push and gh from a box with no token in it | L | needs care | strongest | an agent | 800 (400 code, 400 tests) |
A request carrying a sealed member from a registered box inside its declared egress reaches the upstream with the credential in place, and the same request from another box, or to a host the box did not declare, is refused before anything goes upstream.
Covers:
- BEP-019
- BEP-020
- BEP-022
- BEP-025
Layers:
- registry:
- crates/bep/src/boxes.rs (new): per box id, the declared egress authorities and the
own_iporhost_ipstance, registered over the control socket at creation and removed at destroy - crates/bep/src/control.rs: a
RegisterBoxrequest carrying the box id, its declared egress and its stance, and aForgetBoxrequest - crates/bep/src/lib.rs: module line
cargo nextest run -p bep registered_box_egress_is_read_per_requestcargo nextest run -p bep forgotten_box_is_refused_no_live_box
- crates/bep/src/boxes.rs (new): per box id, the declared egress authorities and the
- decide:
- crates/bep/src/redeemer.rs (new): the
forward::Redeemeroverredeem::decide: opens the sealed value under the proxy key, verifies the handle against the registered client keys, resolves a sign-in reference to the member's credential from the Keychain item, takes attribution and the declared egress from the registry, and passes the revocations in force - crates/bep/src/forward.rs:
Unwiredstays the test default; the serving proxy installs the real redeemer cargo nextest run -p bep sealed_member_is_redeemed_within_declared_egresscargo nextest run -p bep cross_box_value_is_refused_cross_boxcargo nextest run -p bep prop_serve_redeems_iff_decide_admits
- crates/bep/src/redeemer.rs (new): the
- serve:
- crates/bep/src/main.rs:
bep serveinstalls the redeemer throughProxy::with_redeemerand gives the proxy the control registry; theNoSigningKeydoc and the startupwarn!say that Implement CaKey for the keychain-held root and signing CA keys (BEP-013) #2440 alone gates leaf signing now that the decision is wired cargo nextest run -p bep serve_installs_the_redeemer_and_registry
- crates/bep/src/main.rs:
Waits on:
- T1 — Create the bep crate with the GitHub module and the sealed envelope #2258
- T4 — Decide redemption as one pure function over host key, attribution and member bounds #2260
- T7 — Verify signed handles against the client's registered key and the current rule #2270
- T10 — Accept only box connections and terminate TLS for the module's hosts over HTTP/1.1 #2271
- T11 — Validate the upstream before substituting, pass unsealed requests through, and stream responses #2272
- T12 — Sign in to GitHub with min auth and keep the sign-in in one keychain item #2263
Why this task exists: T11 (#2272, pull request #2481) gave bep its forwarder, and the arch review of that pull request ruled that the interim in main.rs, which names #2272 as its lift, must point at the issue that wires the real redeemer and each box's declared egress. Until this lands, bep serve installs forward::Unwired, which refuses every sealed value as undecryptable and declares no egress for any box, and NoSigningKey answers every admitted CONNECT with 502. Added to the epic at the person's decision on 2026-10-21; the layers are the babysitter's cut and the planner may re-cut them.
Plan block
### T41 — Wire the redemption decision and each box's declared egress into bep serve
slice: S0
kind: task
covers: BEP-019, BEP-020, BEP-022, BEP-025
size: L
est: 400 code, 400 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: `min box audit <box>` shows each redemption's admit with the member identifier and each refusal with its check marker (`undecryptable`, `cross_box`, `outside_declared_egress`, `host_mismatch`), never the credential; a box whose declared egress the proxy has not registered is refused `outside_declared_egress`
observability: one info log line when `bep serve` installs the redeemer naming the registry path, and one debug line per registered box naming its id and the count of its declared authorities, never a credential
layers:
- registry:
- crates/bep/src/boxes.rs (new): per box id, the declared egress authorities and the `own_ip` or `host_ip` stance, registered over the control socket at creation and removed at destroy
- crates/bep/src/control.rs: a `RegisterBox` request carrying the box id, its declared egress and its stance, and a `ForgetBox` request
- crates/bep/src/lib.rs: module line
test: cargo nextest run -p bep registered_box_egress_is_read_per_request
test: cargo nextest run -p bep forgotten_box_is_refused_no_live_box
- decide:
- crates/bep/src/redeemer.rs (new): the `forward::Redeemer` over `redeem::decide`: opens the sealed value under the proxy key, verifies the handle against the registered client keys, resolves a sign-in reference to the member's credential from the Keychain item, takes attribution and the declared egress from the registry, and passes the revocations in force
- crates/bep/src/forward.rs: `Unwired` stays the test default; the serving proxy installs the real redeemer
test: cargo nextest run -p bep sealed_member_is_redeemed_within_declared_egress
test: cargo nextest run -p bep cross_box_value_is_refused_cross_box
test: cargo nextest run -p bep prop_serve_redeems_iff_decide_admits
- serve:
- crates/bep/src/main.rs: `bep serve` installs the redeemer through `Proxy::with_redeemer` and gives the proxy the control registry; the `NoSigningKey` doc and the startup `warn!` say that #2440 alone gates leaf signing now that the decision is wired
test: cargo nextest run -p bep serve_installs_the_redeemer_and_registry
produces: none
consumes:
- crates/bep/src/redeem.rs
- crates/bep/src/forward.rs
- crates/bep/src/handle.rs
- crates/bep/src/signin.rs
- crates/bep/src/seal.rs
- crates/bep/src/control.rs
proof: A request carrying a sealed member from a registered box inside its declared egress reaches the upstream with the credential in place, and the same request from another box, or to a host the box did not declare, is refused before anything goes upstream.
depends on:
- blocked by T1
- blocked by T4
- blocked by T7
- blocked by T10
- blocked by T11
- blocked by T12
Generated by Claude Code
Reacted by minimal-foundry
Activity
fix(bep): check each box's declared egress on a passthrough
[-]Wire the redemption decision and each box's declared egress into bep serve[/-][+]T41 — Wire the redemption decision and each box's declared egress into bep serve[/+]minimal-foundry commentedon Oct 21, 2026
Done. #2486 merged.
branch
agent/2483-wire-the-redemption-decision-and-each-box-s-decl· epic #1501 · PR #24863b7b6452afa333e3035de36cd140c0959f8d941fUpdated 2026-10-22T02:32:46.731Z.
feat(bep): validate the upstream, pass unsealed requests through, and…