Repository navigation
T56 — Conditions closed, end to end #2544
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Conditions closed | M | needs care | standard | an agent | 220 (0 code, 220 tests) |
the residuals the arch left open at merge are done: git in a grant box sends a header the proxy substitutes, an operator rotates a running proxy's signing certificate and the box keeps pushing, a blocked
host_ipcohort sends no UDP 443, every store reference is checked at creation, and the CA deny set is the decided one. Its tasks re-cover requirements whose origin tasks merged with an arch condition held on a filed residual; the owner accepted that double coverage on 2026-10-24 so the residuals dispatch as one slice.
Covers:
- BEP-015, BEP-061, BEP-018, BEP-034
Layers:
- e2e:
- scripts/session-e2e.sh: one walk that runs the helper, rotation and cohort cases on a lane with a sign-in and E2E_BEP_PRIVATE_REPO, and records NOT RUN elsewhere (T82 — Run the Box Egress Proxy legs on the macOS lane #2500)
./scripts/session-e2e.sh bep_conditions_closed_end_to_end
Waits on:
- T50 — Ship a git credential helper in grant boxes so git sends a header the proxy substitutes #2531
- T51 — Rotate a running proxy's signing certificate through the control socket #2532
- T52 — A signing rotation under a running grant box keeps clone and push working, end to end #2533
- T53 — Enforce the host_ip cohort's blocked QUIC stance in the host-address ruleset #2534
- T54 — Call the store-rule checks from box creation and expansion #2535
- T55 — Replace the provisional CA deny set with the decided infrastructure deny set #2536
- T58 — Steer a dns or both box's credentialed names through the relay's gate in production #2538
- T59 — Sign store handles under the client's one local key from a host-keychain ClientKeyStore #2539
- T60 — Carry a store handle sealed as a store member kind #2540
- T61 — List each store reference with its authorities in min box spec #2541
- T62 — Give the proxy-binary resolver one owner shared by min secret and minvmd #2542
- T63 — Revoke or replace a registered client key at the proxy and bound the registry #2543
Plan block
### T56 — Conditions closed, end to end
slice: S9
kind: integration
covers: BEP-015, BEP-061, BEP-018, BEP-034
size: M
est: 0 code, 220 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: each e2e case prints PASS or NOT RUN with its gate, and the daemon log tail names the cohort flag changes
observability: none beyond the cases' own output
layers:
- e2e:
- scripts/session-e2e.sh: one walk that runs the helper, rotation and cohort cases on a lane with a sign-in and E2E_BEP_PRIVATE_REPO, and records NOT RUN elsewhere (#2500)
test: ./scripts/session-e2e.sh bep_conditions_closed_end_to_end
produces: none
consumes: none
proof: the residuals the arch left open at merge are done: git in a grant box sends a header the proxy substitutes, an operator rotates a running proxy's signing certificate and the box keeps pushing, a blocked `host_ip` cohort sends no UDP 443, every store reference is checked at creation, and the CA deny set is the decided one. Its tasks re-cover requirements whose origin tasks merged with an arch condition held on a filed residual; the owner accepted that double coverage on 2026-10-24 so the residuals dispatch as one slice.
depends on:
- blocked by T50
- blocked by T51
- blocked by T52
- blocked by T53
- blocked by T54
- blocked by T55
- blocked by T58
- blocked by T59
- blocked by T60
- blocked by T61
- blocked by T62
- blocked by T63
Generated by Claude Code
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 25, 2026
Done. #2604 merged.
branch
agent/2544-conditions-closed-end-to-end· epic #1501 · PR #26046b8bab00cc3b93a575a20f298954000dce3f04ca06865022Updated 2026-10-27T05:42:50.242Z.