Repository navigation
T58 — Steer a dns or both box's credentialed names through the relay's gate in production #2538
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Conditions closed | L | needs care | standard | an agent | 560 (260 code, 300 tests) |
In a running daemon with the proxy stopped, a dns-steered box resolving github.com gets SERVFAIL and never a real address; once the listener is live the same lookup gets the proxy's address; on a native host, which runs no proxy, a steered name always gets SERVFAIL.
Covers:
- BEP-062, BEP-078
Layers:
- host:
- crates/minimald-rpc/src/lib.rs: a
BoxControlRequest::ProxyListeningask and itsBoxControlReply::ProxyListening { listening }answer, admitted on the guest reports door besideRowStanding(re-planned 2026-10-25 by the epic owner: the listener state lives in minvmd on the host and the guest relay cannot linkbep_host, so it asks over the report door) - crates/minvmd/src/control.rs: the guest reports door answers
ProxyListeningfrom the proxy'slisteningflag, and answersfalsewhen no proxy runs - crates/minvmd/src/cmd/run.rs: hands
BepProxy::listeningto the control server so the guest door can read it cargo nextest run -p minvmd guest_door_answers_proxy_listening
- crates/minimald-rpc/src/lib.rs: a
- relay:
- crates/minimald/src/net/listeners.rs:
proxy_listeningasks over the report door the wayhost_row_standingdoes;None(a native host, which runs no proxy, or a door that does not answer within its deadline) reads as not live, so steered names fail closed with SERVFAIL - crates/minimald/src/net/dns.rs:
ProxyListenerStaterefreshes fromproxy_listeningwith a short cached answer; theallow(dead_code)interim goes - crates/minimald/src/net/dns_gate.rs: the
allow(dead_code)interims onwith_steeringgo, and the comment stops naming T113 — Admit dns and both steering where the host's switch resolves box names #2523 - crates/minimald/src/net/switch.rs:
BoxGate::for_sessioncallsDnsGate::with_steering(policy, <credential module hosts>, <proxy address on the switch>, <shared ProxyListenerState>)for every box whose steering resolves todnsorboth - crates/minimald/src/net/gvproxy_network.rs: passes the shared
ProxyListenerStateand the control channel it asks over intoBoxGate::for_session - scripts/session-e2e.sh: in
bep_dns_steering_fails_closed_end_to_end, leg 1'sknown_gapfor the steered A lookup becomes an::error::line andds_fail, andds_a_gapwith its known-gap branch goes, so the leg is a hard assertion of Networking §5.3 line 147 once steering is wired (arch C1 on test(minimald): prove DNS steering fails closed end to end (T32) #2550, widened 2026-10-25) cargo nextest run -p minimald a_dns_steered_box_gets_servfail_while_the_proxy_is_downcargo nextest run -p minimald a_steered_name_resolves_to_the_proxy_once_its_listener_is_livecargo nextest run -p minimald a_native_host_steered_name_gets_servfail
- crates/minimald/src/net/listeners.rs:
Waits on:
Implements the filed residual #2523; those issues close with this task and do not block it.
Plan block
### T58 — Steer a dns or both box's credentialed names through the relay's gate in production
slice: S9
kind: task
covers: BEP-062, BEP-078
size: L
est: 260 code, 300 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: with the proxy stopped, a dns-steered box resolving github.com gets SERVFAIL, and the daemon log names the box and the name once per minute
observability: one info line when the proxy's listener is reported live and the steered names resolve to it again
layers:
- host:
- crates/minimald-rpc/src/lib.rs: a `BoxControlRequest::ProxyListening` ask and its `BoxControlReply::ProxyListening { listening }` answer, admitted on the guest reports door beside `RowStanding` (re-planned 2026-10-25 by the epic owner: the listener state lives in minvmd on the host and the guest relay cannot link `bep_host`, so it asks over the report door)
- crates/minvmd/src/control.rs: the guest reports door answers `ProxyListening` from the proxy's `listening` flag, and answers `false` when no proxy runs
- crates/minvmd/src/cmd/run.rs: hands `BepProxy::listening` to the control server so the guest door can read it
test: cargo nextest run -p minvmd guest_door_answers_proxy_listening
- relay:
- crates/minimald/src/net/listeners.rs: `proxy_listening` asks over the report door the way `host_row_standing` does; `None` (a native host, which runs no proxy, or a door that does not answer within its deadline) reads as not live, so steered names fail closed with SERVFAIL
- crates/minimald/src/net/dns.rs: `ProxyListenerState` refreshes from `proxy_listening` with a short cached answer; the `allow(dead_code)` interim goes
- crates/minimald/src/net/dns_gate.rs: the `allow(dead_code)` interims on `with_steering` go, and the comment stops naming #2523
- crates/minimald/src/net/switch.rs: `BoxGate::for_session` calls `DnsGate::with_steering(policy, <credential module hosts>, <proxy address on the switch>, <shared ProxyListenerState>)` for every box whose steering resolves to `dns` or `both`
- crates/minimald/src/net/gvproxy_network.rs: passes the shared `ProxyListenerState` and the control channel it asks over into `BoxGate::for_session`
- scripts/session-e2e.sh: in `bep_dns_steering_fails_closed_end_to_end`, leg 1's `known_gap` for the steered A lookup becomes an `::error::` line and `ds_fail`, and `ds_a_gap` with its known-gap branch goes, so the leg is a hard assertion of Networking §5.3 line 147 once steering is wired (arch C1 on #2550, widened 2026-10-25)
test: cargo nextest run -p minimald a_dns_steered_box_gets_servfail_while_the_proxy_is_down
test: cargo nextest run -p minimald a_steered_name_resolves_to_the_proxy_once_its_listener_is_live
test: cargo nextest run -p minimald a_native_host_steered_name_gets_servfail
produces: none
consumes: none
proof: In a running daemon with the proxy stopped, a dns-steered box resolving github.com gets SERVFAIL and never a real address; once the listener is live the same lookup gets the proxy's address; on a native host, which runs no proxy, a steered name always gets SERVFAIL.
depends on:
- blocked by T30
Generated by Claude Code
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 25, 2026
Done. #2567 merged.
branch
agent/2538-steer-a-dns-or-both-box-s-credentialed-names-thr· epic #1501 · PR #2567cd36401c060b1ac1Updated 2026-10-26T01:52:37.299Z.
norrietaylor commentedon Oct 25, 2026
Re-planned on 2026-10-25 by the epic owner's decision. The last run reported that the layers could not work:
ProxyListenerStateis in minimald,bep_hostruns in minvmd on the host behind the switch crate'sstack-peerfeature, and the guest relay cannot link it. The new layers carry the listener state over the guest reports door, the wayRowStandingalready works: minimald-rpc gains aProxyListeningask, minvmd's guest door answers it fromBepProxy::listening, and the relay'sproxy_listeningreadsNone(no answer, or a native host that runs no proxy) as not live, so steered names fail closed with SERVFAIL. The relay caches the answer briefly.crates/switch/src/bep_host.rsis no longer a layer. Size moves from M to L (260 code, 300 tests), with a native-host test and a minvmd guest-door test added.needs-humanis removed so the runtime walks T58 again.Generated by Claude Code