Repository navigation
T97 — Accept source = "store" with store and id in a box spec's grant #2656
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Round-four residuals closed | M | needs care | standard | an agent | 400 (160 code, 240 tests) |
A box spec that declares a store reference as source = "store" with store and id mints and redeems it, and
min box speclists it with its authorities.
Covers:
- BEP-032
Layers:
- grant:
- crates/boxes/src/core/bep.rs:
GrantSourceacceptssource = "store"withstoreandid, andstore_references()reads store references from that form, not from brokerscopes(T97 — Accept source = "store" with store and id in a box spec's grant #2656) - scripts/session-e2e.sh: the seed of
proof_bep_store_reference_end_to_endwritessource = "store",store = "keychain"andid, and the# Interim spelling:comment goes cargo nextest run -p boxes a_store_grant_parses_store_and_id
- crates/boxes/src/core/bep.rs:
- review:
- crates/minimal/src/cmd/box_spec.rs:
renderreads each store row fromboxes::core::bep::store_references()of thesource = "store"form, not fromgrant.scopes; its test builds the reference in that form (widened 2026-10-31, owner, T97 — Accept source = "store" with store and id in a box spec's grant #2656 noop) cargo nextest run -p minimal box_spec_lists_store_references_with_their_authorities
- crates/minimal/src/cmd/box_spec.rs:
- create:
- crates/minimal/src/cmd/boxes/create.rs: the tests of
accept_store_referencesbuild store references assource = "store"withstoreandid(widened 2026-10-31, owner, T97 — Accept source = "store" with store and id in a box spec's grant #2656 noop) cargo nextest run -p minimal store_reference_without_rule_is_refused_at_creationcargo nextest run -p minimal store_rule_outside_egress_exits_3
- crates/minimal/src/cmd/boxes/create.rs: the tests of
Waits on:
- T29 — Keychain secrets by reference, end to end #2294
- SP1 — Do Claude Code and an MCP client send a sealed handle unmodified? #2257
Plan block
### T97 — Accept source = "store" with store and id in a box spec's grant
slice: S13
kind: task
covers: BEP-032
size: M
est: 160 code, 240 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: a store reference spelled with `source = "store"` and no `store` or `id` is refused with text that names the missing field
observability: none: the parse runs inside `min` box creation, which logs no line for a grant
layers:
- grant:
- crates/boxes/src/core/bep.rs: `GrantSource` accepts `source = "store"` with `store` and `id`, and `store_references()` reads store references from that form, not from broker `scopes` (#2656)
- scripts/session-e2e.sh: the seed of `proof_bep_store_reference_end_to_end` writes `source = "store"`, `store = "keychain"` and `id`, and the `# Interim spelling:` comment goes
test: cargo nextest run -p boxes a_store_grant_parses_store_and_id
- review:
- crates/minimal/src/cmd/box_spec.rs: `render` reads each store row from `boxes::core::bep::store_references()` of the `source = "store"` form, not from `grant.scopes`; its test builds the reference in that form (widened 2026-10-31, owner, #2656 noop)
test: cargo nextest run -p minimal box_spec_lists_store_references_with_their_authorities
- create:
- crates/minimal/src/cmd/boxes/create.rs: the tests of `accept_store_references` build store references as `source = "store"` with `store` and `id` (widened 2026-10-31, owner, #2656 noop)
test: cargo nextest run -p minimal store_reference_without_rule_is_refused_at_creation
test: cargo nextest run -p minimal store_rule_outside_egress_exits_3
produces: none
consumes: none
proof: A box spec that declares a store reference as source = "store" with store and id mints and redeems it, and `min box spec` lists it with its authorities.
depends on:
- blocked by #2294
- blocked by #2257
Generated by Claude Code
Reacted by minimal-foundry
Activity
[-]GrantSource: accept source = "store" with store and id, and take store references out of broker scopes[/-][+]T97 — Accept source = "store" with store and id in a box spec's grant[/+]feat(bep): name the store and identifier on the box_connection span
minimal-foundry commentedon Oct 30, 2026
Done. #2774 merged.
branch
agent/2656-accept-source-store-with-store-and-id-in-a-box-s· epic #1501 · PR #277439656640517ca48cb173b93a919b9510250b70c5Updated 2026-10-31T07:55:07.220Z.
test(e2e): prove Keychain secrets by reference end to end (gominimal#…