Repository navigation
T84 — Keep a replaced client key verifying until the boxes minted under it end #2605
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Round-two conditions closed | M | unknown ground | strongest | an agent | 320 (160 code, 160 tests) |
After a client key replacement, a box created under the old key keeps redeeming its store handles and sign-in references until it ends, and the registry bound never drops a key that a running box uses.
Covers:
- BEP-063
Layers:
- keep:
- crates/bep/src/control.rs:
replace_client_keykeeps a key registered while a running box's store handles or sign-in references are signed under it, and revokes it when the last such box ends; the bound drops the least recently registered key that no running box uses, and refuses the registration when every key is in use (owner ruling on gominimal/arch#144, 2026-10-26; T84 — Keep a replaced client key verifying until the boxes minted under it end #2605) - crates/minimal/src/mint.rs: the replacement keeps its pending-revoke file and lock, and a bound refusal fails the creation with the diagnostics text
- crates/bep/src/main.rs: the test literals of the registration record set its new
box_idfield (layer amended 2026-10-26 after round 1 of feat(bep): keep a replaced client key verifying until its boxes end (T84) #2615) - crates/minimal/src/tests.rs: the test inventory names the new verify tests in place of
a_replaced_client_key_is_revoked_at_the_proxy(layer amended 2026-10-26 after round 1 of feat(bep): keep a replaced client key verifying until its boxes end (T84) #2615) - docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md: the BEP-063 replace and bound sub-requirements state the keep and the in-use bound, name the two verify tests below, drop their known-gap notes, and the pending-revoke comment says the client removes the file (arch C1 on docs(specs): amend BEP-063 for client-key revocation, replacement and the bound (T71) #2594)
cargo nextest run -p minimal a_replaced_client_key_keeps_verifying_until_its_boxes_endcargo nextest run -p bep the_registry_bound_never_drops_a_key_a_running_box_uses
- crates/bep/src/control.rs:
Waits on:
- T63 — Revoke or replace a registered client key at the proxy and bound the registry #2543
- T71 — Amend BEP-063 for client-key revocation, replacement and the registry bound #2578
- assumes OQ3 (the mint reads the root certificate's own expiry, and the root is generated with a fixed default validity in one constant that gominimal/arch#85's ruling replaces)
Plan block
### T84 — Keep a replaced client key verifying until the boxes minted under it end
slice: S10
kind: task
covers: BEP-063
size: M
est: 160 code, 160 tests
executor: agent
difficulty: unknown ground
model: strongest
diagnostics: when every registered client key is in use and the bound refuses a registration, the box creation fails with this text on stderr: "min did not create the box: the Box Egress Proxy already holds 16 client keys, and running boxes use each one. A key is freed when the last box created under it ends."
observability: one info log line when a kept key is retired, naming its `kid`
layers:
- keep:
- crates/bep/src/control.rs: `replace_client_key` keeps a key registered while a running box's store handles or sign-in references are signed under it, and revokes it when the last such box ends; the bound drops the least recently registered key that no running box uses, and refuses the registration when every key is in use (owner ruling on gominimal/arch#144, 2026-10-26; #2605)
- crates/minimal/src/mint.rs: the replacement keeps its pending-revoke file and lock, and a bound refusal fails the creation with the diagnostics text
- crates/bep/src/main.rs: the test literals of the registration record set its new `box_id` field (layer amended 2026-10-26 after round 1 of #2615)
- crates/minimal/src/tests.rs: the test inventory names the new verify tests in place of `a_replaced_client_key_is_revoked_at_the_proxy` (layer amended 2026-10-26 after round 1 of #2615)
- docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md: the BEP-063 replace and bound sub-requirements state the keep and the in-use bound, name the two verify tests below, drop their known-gap notes, and the pending-revoke comment says the client removes the file (arch C1 on #2594)
test: cargo nextest run -p minimal a_replaced_client_key_keeps_verifying_until_its_boxes_end
test: cargo nextest run -p bep the_registry_bound_never_drops_a_key_a_running_box_uses
produces: none
consumes: none
proof: After a client key replacement, a box created under the old key keeps redeeming its store handles and sign-in references until it ends, and the registry bound never drops a key that a running box uses.
depends on:
- assumes OQ3 (the mint reads the root certificate's own expiry, and the root is generated with a fixed default validity in one constant that gominimal/arch#85's ruling replaces)
- blocked by #2543
- blocked by #2578
Generated by Claude Code
Reacted by minimal-foundry
Activity
[-]Keep a replaced client key verifying until the boxes minted under it end (BEP-063, arch#144)[/-][+]T84 — Keep a replaced client key verifying until the boxes minted under it end[/+]docs(specs): link #2605 and the arch#144 ruling in BEP-063 gaps
docs(specs): link #2605 and the arch#144 ruling in BEP-063 gaps
minimal-foundry commentedon Oct 26, 2026
Done. #2615 merged.
branch
agent/2605-keep-a-replaced-client-key-verifying-until-the-b· epic #1501 · PR #26153620c1c97fb08d1418d0d6bf3458c87a653ebaceUpdated 2026-10-26T19:17:11.108Z.
docs(specs): amend BEP-063 for client-key revocation, replacement and…