Repository navigation
<
8000
link rel="modulepreload" href="https://github.githubassets.com/assets/fhi-7a633016e960b921.js" crossorigin="anonymous" />
T83 — Give bep serve the client's store rules so a store member is admitted #2599
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Round-two conditions closed | M | unknown ground | strongest | an agent | 280 (140 code, 140 tests) |
A box's request to a
[secret-store-rules]rule's registered upstream, sent through a runningbep serve, reaches that upstream with the stored key in the rule's injection form.
Covers:
- BEP-032
Layers:
- rules:
- crates/bep/src/main.rs:
bep servegets the client's[secret-store-rules]with the BEP-034 refusals applied and gives them toBoxRedeemer::with_rules; the rules' authorities joinregistered_unionand the admitted set, less the deny set; the three interim notes that still name T25 (T25 — Read client-owned store rules and refuse rules in the deny set #2280) are removed (T83 — Give bep serve the client's store rules so a store member is admitted #2599); how the rules reachbep serve(a read of the user-levelconfig.toml, or a control-socket op thatminsends) is this task's choice, left to the implementer and the arch review by the epic owner on 2026-10-26 - crates/bep/src/redeemer.rs: the
factsdoc names the rulesbep servegives in place of the interim note - crates/bep/Cargo.toml:
bepdepends onboxesandpathsto read and check the client's rules (layer amended 2026-10-26: the arch review on feat(bep): give bep serve the client's store rules so a store member is admitted (T83) #2614 accepted this delivery) - Cargo.lock: regenerated for the new
bepdependencies - crates/boxes/src/client/config.rs: one function merges the user and organization
[secret-store-rules]with the action floor and the deny check, forminandbep(arch C2 on feat(bep): give bep serve the client's store rules so a store member is admitted (T83) #2614) - crates/minimal/src/config.rs:
mincalls that merge in place of its own (arch C2 on feat(bep): give bep serve the client's store rules so a store member is admitted (T83) #2614) cargo nextest run -p bep serve_admits_a_store_member_under_the_clients_rule
- crates/bep/src/main.rs:
Waits on:
- SP1 — Do Claude Code and an MCP client send a sealed handle unmodified? #2257
- T67 — Inject store values in bep serve #2586
- T25 — Read client-owned store rules and refuse rules in the deny set #2280
Plan block
### T83 — Give bep serve the client's store rules so a store member is admitted
slice: S10
kind: task
covers: BEP-032
size: M
est: 140 code, 140 tests
executor: agent
difficulty: unknown ground
model: strongest
diagnostics: a CONNECT to an authority that no module and no store rule admits stays refused `off_module` in `min box audit`, and a store handle with no matching rule stays refused `store_handle_invalid`
observability: one info log line at start naming the count of store rules `bep serve` holds, never a value
layers:
- rules:
- crates/bep/src/main.rs: `bep serve` gets the client's `[secret-store-rules]` with the BEP-034 refusals applied and gives them to `BoxRedeemer::with_rules`; the rules' authorities join `registered_union` and the admitted set, less the deny set; the three interim notes that still name T25 (#2280) are removed (#2599); how the rules reach `bep serve` (a read of the user-level `config.toml`, or a control-socket op that `min` sends) is this task's choice, left to the implementer and the arch review by the epic owner on 2026-10-26
- crates/bep/src/redeemer.rs: the `facts` doc names the rules `bep serve` gives in place of the interim note
- crates/bep/Cargo.toml: `bep` depends on `boxes` and `paths` to read and check the client's rules (layer amended 2026-10-26: the arch review on #2614 accepted this delivery)
- Cargo.lock: regenerated for the new `bep` dependencies
- crates/boxes/src/client/config.rs: one function merges the user and organization `[secret-store-rules]` with the action floor and the deny check, for `min` and `bep` (arch C2 on #2614)
- crates/minimal/src/config.rs: `min` calls that merge in place of its own (arch C2 on #2614)
test: cargo nextest run -p bep serve_admits_a_store_member_under_the_clients_rule
produces: none
consumes: none
proof: A box's request to a `[secret-store-rules]` rule's registered upstream, sent through a running `bep serve`, reaches that upstream with the stored key in the rule's injection form.
depends on:
- blocked by #2257
- blocked by #2586
- blocked by #2280
Generated by Claude Code
Reacted by minimal-foundry
Activity
Merge branch 'main' into agent/2586-inject-store-values-in-bep-serve
[-]Give bep serve the client's [secret-store-rules] so a store member is admitted (BEP-032)[/-][+]T83 — Give bep serve the client's store rules so a store member is admitted[/+]minimal-foundry commentedon Oct 26, 2026
Done. #2614 merged.
branch
agent/2599-give-bep-serve-the-client-s-store-rules-so-a-sto· epic #1501 · PR #26149cec7683cd6267f8755555884780629cfa907834836178d980c242fa928681a2Updated 2026-10-27T03:39:53.599Z.