Repository navigation
S9 — Conditions closed #2530
Description
Slice
the residuals the arch left open at merge are done: git in a grant box sends a header the proxy substitutes, an operator rotates a running proxy's signing certificate and the box keeps pushing, a blocked host_ip cohort sends no UDP 443, every store reference is checked at creation, and the CA deny set is the decided one. Its tasks re-cover requirements whose origin tasks merged with an arch condition held on a filed residual; the owner accepted that double coverage on 2026-10-24 so the residuals dispatch as one slice.
Tasks:
- T50 — Ship a git credential helper in grant boxes so git sends a header the proxy substitutes #2531 — Ship a git credential helper in grant boxes so git sends a header the proxy substitutes
- T51 — Rotate a running proxy's signing certificate through the control socket #2532 — Rotate a running proxy's signing certificate through the control socket
- T52 — A signing rotation under a running grant box keeps clone and push working, end to end #2533 — A signing rotation under a running grant box keeps clone and push working, end to end
- T53 — Enforce the host_ip cohort's blocked QUIC stance in the host-address ruleset #2534 — Enforce the host_ip cohort's blocked QUIC stance in the host-address ruleset
- T54 — Call the store-rule checks from box creation and expansion #2535 — Call the store-rule checks from box creation and expansion
- T55 — Replace the provisional CA deny set with the decided infrastructure deny set #2536 — Replace the provisional CA deny set with the decided infrastructure deny set
- T58 — Steer a dns or both box's credentialed names through the relay's gate in production #2538 — Steer a dns or both box's credentialed names through the relay's gate in production
- T59 — Sign store handles under the client's one local key from a host-keychain ClientKeyStore #2539 — Sign store handles under the client's one local key from a host-keychain ClientKeyStore
- T60 — Carry a store handle sealed as a store member kind #2540 — Carry a store handle sealed as a store member kind
- T61 — List each store reference with its authorities in min box spec #2541 — List each store reference with its authorities in min box spec
- T62 — Give the proxy-binary resolver one owner shared by min secret and minvmd #2542 — Give the proxy-binary resolver one owner shared by min secret and minvmd
- T63 — Revoke or replace a registered client key at the proxy and bound the registry #2543 — Revoke or replace a registered client key at the proxy and bound the registry
- T64 — Leave the host_ip QUIC cohort when a box's shell exits on its own #2556 — Leave the host_ip QUIC cohort when a box's shell exits on its own
- T56 — Conditions closed, end to end #2544 — Conditions closed, end to end
Generated by Claude Code
Activity
norrietaylor commentedon Oct 31, 2026
Closing in the 2026-10-31 backlog triage: the work has shipped.
Evidence: All 14 sub-issues are closed (T50-T64: minimal#2531 through #2544 and #2556), including the end-to-end task T56 minimal#2544. Example: T50 merged as minimal#2547, and T53 merged as minimal#2553.
Two independent reviewers checked this closure; neither refuted it. Reopen if it's wrong.