Repository navigation
8000
T67 — Inject store values in bep serve #2586
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Round-two conditions closed | M | needs care | strongest | an agent | 280 (120 code, 160 tests) |
A box's request to a store rule's registered upstream leaves
bep servewith the stored key in the registered form, and the box never holds the key.
Covers:
- BEP-032
Layers:
- redeem:
- crates/bep/src/redeemer.rs:
BoxRedeemeroverridesRedeemer::redeem_referenceand returnsRedeemed::Storefor an admitted store member (Gatehouse §6.10 line 849, redemption step 4), with theheadercheck still beforeredeemruns - crates/bep/src/proxy.rs: the
bep servepath callsFlow::with_store(Arc::new(HostStore))where it builds eachFlow - crates/bep/src/forward.rs: the two interim notes on
redeem_referenceandwith_store(T67 — Inject store values in bep serve #2586) are removed cargo nextest run -p bep serve_injects_a_stored_key_for_an_admitted_store_member
- crates/bep/src/redeemer.rs:
Waits on:
- SP1 — Do Claude Code and an MCP client send a sealed handle unmodified? #2257
- T28 — Inject a stored key in the registered form, read from the Keychain per request #2292
Plan block
### T67 — Inject store values in bep serve
slice: S10
kind: task
covers: BEP-032
size: M
est: 120 code, 160 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: an admitted store reference that the serve path cannot read is refused as `store_item_unreadable` in `min box audit`, never forwarded without the key
observability: one debug line per store injection naming the store and identifier, never the value
layers:
- redeem:
- crates/bep/src/redeemer.rs: `BoxRedeemer` overrides `Redeemer::redeem_reference` and returns `Redeemed::Store` for an admitted store member (Gatehouse §6.10 line 849, redemption step 4), with the `header` check still before `redeem` runs
- crates/bep/src/proxy.rs: the `bep serve` path calls `Flow::with_store(Arc::new(HostStore))` where it builds each `Flow`
- crates/bep/src/forward.rs: the two interim notes on `redeem_reference` and `with_store` (#2586) are removed
test: cargo nextest run -p bep serve_injects_a_stored_key_for_an_admitted_store_member
produces: none
consumes: none
proof: A box's request to a store rule's registered upstream leaves `bep serve` with the stored key in the registered form, and the box never holds the key.
depends on:
- blocked by #2257
- blocked by #2292
Generated by Claude Code
Reacted by minimal-foundry
Activity
fix(bep): refuse a framing header as an injection target
norrietaylor commentedon Oct 26, 2026
The epic owner added this residual to the plan on 2026-10-26 as
T67(slice S10). Its body is now the rendered task. The residual text it replaces is kept below.Residual text
Residual from T28 #2574, arch C1 (ruling), epic #1501. The interim notes in
crates/bep/src/forward.rspoint to #2280, which is closed, so this issue now owns the work.#2574 makes the forwarder inject a stored key in the registered form.
bep servedoes not inject a store value yet, so the T28 proof holds in the forwarder only. BEP-032 stays open until redemption step 4 runs inbep serve.What closes this
crates/bep/src/redeemer.rs:BoxRedeemeroverridesRedeemer::redeem_referenceand returnsRedeemed::Storefor an admitted store member (Gatehouse §6.10 line 849, redemption step 4). Theheadercheck stays beforeredeemruns.crates/bep/src/proxy.rs: thebep servepath callsFlow::with_store(Arc::new(HostStore)).crates/bep/src/forward.rs(onredeem_referenceandwith_store) are deleted.bep servetest injects a stored key for an admitted store member.Generated by Claude Code
[-]Inject store values in bep serve: BoxRedeemer redeem_reference and Flow::with_store (BEP-032)[/-][+]T67 — Inject store values in bep serve[/+]minimal-foundry commentedon Oct 26, 2026
Done. #2597 merged.
branch
agent/2586-inject-store-values-in-bep-serve· epic #1501 · PR #2597Updated 2026-10-26T09:51:25.849Z.
feat(bep): inject a stored key in its registered form per request (T2…