Repository navigation
<
8000
link rel="modulepreload" href="https://github.githubassets.com/assets/fhi-7a633016e960b921.js" crossorigin="anonymous" />
T54 — Call the store-rule checks from box creation and expansion #2535
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Conditions closed | M | needs care | standard | an agent | 460 (240 code, 220 tests) |
A box spec that references a host-store secret is refused at creation when no rule matches or the rule's upstream is outside the box's egress, and an ask rule prompts on a terminal and denies without one.
Covers:
- BEP-034, BEP-035, BEP-036
Layers:
- create:
- crates/minimal/src/cmd/boxes/create.rs: reads the rules through
read_client_config_and_store_rules, callscheck_store_referencesfor every host-store reference the spec declares andstore_consentforaskrules, and passes the accepted rules to the proxy registration - crates/minimal/src/config.rs:
read_client_configno longer drops the rules on the creation path cargo nextest run -p minimal store_reference_without_rule_is_refused_at_creationcargo nextest run -p minimal store_rule_outside_egress_exits_3cargo nextest run -p minimal ask_rule_without_a_terminal_denies
- crates/minimal/src/cmd/boxes/create.rs: reads the rules through
Waits on:
- T13 — Refuse GitHub grants at activation that the box or the un-enrolled host cannot honour #2264
- T25 — Read client-owned store rules and refuse rules in the deny set #2280
Implements the filed residual #2516; those issues close with this task and do not block it.
Plan block
### T54 — Call the store-rule checks from box creation and expansion
slice: S9
kind: task
covers: BEP-034, BEP-035, BEP-036
size: M
est: 240 code, 220 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: a refused store reference exits 3 with the rule and the reason on stderr; an `ask` rule without a terminal prints the denial
observability: one info log line per creation naming the store references checked and their outcome
layers:
- create:
- crates/minimal/src/cmd/boxes/create.rs: reads the rules through `read_client_config_and_store_rules`, calls `check_store_references` for every host-store reference the spec declares and `store_consent` for `ask` rules, and passes the accepted rules to the proxy registration
- crates/minimal/src/config.rs: `read_client_config` no longer drops the rules on the creation path
test: cargo nextest run -p minimal store_reference_without_rule_is_refused_at_creation
test: cargo nextest run -p minimal store_rule_outside_egress_exits_3
test: cargo nextest run -p minimal ask_rule_without_a_terminal_denies
produces: none
consumes:
- crates/boxes/src/core/bep.rs
proof: A box spec that references a host-store secret is refused at creation when no rule matches or the rule's upstream is outside the box's egress, and an ask rule prompts on a terminal and denies without one.
depends on:
- blocked by T13
- blocked by T25
Generated by Claude Code
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 25, 2026
Done. #2552 merged.
branch
agent/2535-call-the-store-rule-checks-from-box-creation-and· epic #1501 · PR #2552c3a2309bfd88e027Updated 2026-10-25T10:30:06.094Z.