Repository navigation
T59 — Sign store handles under the client's one local key from a host-keychain ClientKeyStore #2539
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Conditions closed | L | needs care | strongest | an agent | 500 (260 code, 240 tests) |
Two box creations register one client key with the proxy, and a key the proxy refuses is replaced and registered before the mint.
Covers:
- BEP-063
Layers:
- key-store:
- crates/minimal/src/mint.rs: a host-keychain
ClientKeyStorebackend behind the existing key-store seam holds the client's one local signing key (macOS Keychain; the Linux host behind the same seam), and theInterim:notes andexpect(dead_code)reasons that name Sign store handles under the client's one local key from a host-keychain ClientKeyStore (Gatehouse §6.10 line 842) #2524 go - crates/minimal/src/cmd/boxes/create.rs:
mint_grantsreadslocal_client_keyover that store and signs the store handle and the grant registrations with it, neverClientKey::generate()per box - crates/bep/src/control.rs: the module doc stops naming Sign store handles under the client's one local key from a host-keychain ClientKeyStore (Gatehouse §6.10 line 842) #2524; the registry keeps one key per client
cargo nextest run -p minimal two_creations_register_one_client_keycargo nextest run -p minimal a_refused_client_key_is_replaced_and_registered_before_the_mint
- crates/minimal/src/mint.rs: a host-keychain
Waits on:
- T27 — Mint store handles and keep the client's key registered across proxy restarts #2288
- assumes OQ3 (the mint reads the root's validity end from the published identity, and the root is generated with a fixed default validity in one constant that gominimal/arch#85's ruling replaces)
Implements the filed residual #2524; those issues close with this task and do not block it.
Plan block
### T59 — Sign store handles under the client's one local key from a host-keychain ClientKeyStore
slice: S9
kind: task
covers: BEP-063
size: L
est: 260 code, 240 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: `min box spec` names the client key's identifier under the grant, and the proxy log records one registration per client, not one per box
observability: one info line at first use naming the registered key identifier
layers:
- key-store:
- crates/minimal/src/mint.rs: a host-keychain `ClientKeyStore` backend behind the existing key-store seam holds the client's one local signing key (macOS Keychain; the Linux host behind the same seam), and the `Interim:` notes and `expect(dead_code)` reasons that name #2524 go
- crates/minimal/src/cmd/boxes/create.rs: `mint_grants` reads `local_client_key` over that store and signs the store handle and the grant registrations with it, never `ClientKey::generate()` per box
- crates/bep/src/control.rs: the module doc stops naming #2524; the registry keeps one key per client
test: cargo nextest run -p minimal two_creations_register_one_client_key
test: cargo nextest run -p minimal a_refused_client_key_is_replaced_and_registered_before_the_mint
produces: none
consumes: none
proof: Two box creations register one client key with the proxy, and a key the proxy refuses is replaced and registered before the mint.
depends on:
- blocked by T27
- assumes OQ3
Generated by Claude Code
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 25, 2026
Done. #2557 merged.
branch
agent/2539-sign-store-handles-under-the-client-s-one-local· epic #1501 · PR #2557e072e19a42866ea1Updated 2026-10-25T16:02:15.468Z.