Repository navigation
T117 — Give a host-address grant box an id and open the proxy lane to its cohort #2854
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Host-address boxes reach GitHub | L | unknown ground | strongest | an agent | 880 (400 code, 480 tests) |
On a Mac, a GitHub grant box started with
--network host_ipis created with a box id and reaches the proxy's listener, and after it ends, a host-address box with no grant cannot reach the proxy's address.
Covers:
- BEP-082
- BEP-083
Layers:
- registry:
- crates/minvmd/src/control.rs:
RegisterBoxaccepts ahost_ipbox and returns a creation-unique box id with no switch address - crates/minvmd/src/box_registry.rs: a
host_ipregistration records the minted id with no row in the address table, and its revocation check is the one anown_ipid takes cargo nextest run -p minvmd host_ip_box_registration_mints_a_creation_unique_id
- crates/minvmd/src/control.rs:
- client:
- crates/minimal-client/src/box_registration.rs:
register_box_for_activationregisters ahost_ipbox on a VM host when its spec declares a credentialed upstream, and still returnsNonefor one that declares none - crates/minimal/src/cmd/boxes/create.rs:
proxy_box_factsgets the minted id for ahost_ipgrant box, so theNotServedrefusal prints only where no proxy serves the host cargo nextest run -p minimal host_ip_grant_box_on_vm_host_is_not_refused_as_unserved
- crates/minimal-client/src/box_registration.rs:
- rpc:
- crates/minimald-rpc/src/lib.rs:
HostIpBoxRequestcarries whether the box declares a credentialed upstream - crates/minimald-rpc/src/tests.rs: a round-trip test pins the new field and its default for an older client
cargo nextest run -p minimald-rpc host_ip_box_request_carries_the_lane_declaration
- crates/minimald-rpc/src/lib.rs:
- client:
- crates/minimal-client/src/attach.rs:
AdmitHostIpBoxsends the lane declaration, and the admission completes before the box's first process starts, not after the create cargo nextest run -p minimal-client host_ip_admission_carries_the_lane_and_waits_for_the_answer
- crates/minimal-client/src/attach.rs:
- gate:
- crates/minvmd/src/box_registry.rs:
HostIpBoxRulescarries the lane bit, and the cohort's lane is the union of its resident members' bits - crates/minvmd/src/net/egress_gate.rs:
host_ip_verdictadmits the cohort address to the proxy's listener port and to TCP 443 at the proxy's address while the cohort's lane is open, and drops it asProxyLanewhile it is closed cargo nextest run -p minvmd host_ip_cohort_reaches_proxy_while_a_member_declares_a_lanecargo nextest run -p minvmd host_ip_cohort_proxy_lane_dropped_without_a_declaring_member
- crates/minvmd/src/box_registry.rs:
Plan block
### T117 — Give a host-address grant box an id and open the proxy lane to its cohort
slice: S17
kind: task
covers: BEP-082, BEP-083
size: L
est: 480 code, 580 tests
executor: agent
difficulty: unknown ground
model: strongest
diagnostics: `min box show <box>` shows the host-minted box id of a `host_ip` grant box, and `min box audit <box>` reads its records by that id; a `host_ip` grant box on a VM host is no longer refused with "no Box Egress Proxy serves boxes on this machine"; `min session policy <box>` shows the credentialed-upstream row for a `host_ip` grant box, and the gate's drop log names `ProxyLane` for a cohort connection while no resident member declares a lane
observability: the existing info line of each registration names the box id, the network mode and whether a switch address was allocated, and the gate's existing debug line for a host-address verdict names the lane state of the cohort and the count of members that declare one
layers:
- registry:
- crates/minvmd/src/control.rs: `RegisterBox` accepts a `host_ip` box and returns a creation-unique box id with no switch address; `mint_box_id_reply` answers that id when `host_ip_name` names the registration, claimed by one `create_token` as `claim_row_box_id` claims a row's id, another token refused, and a name with no registration keeps the fresh mint
- crates/minvmd/src/box_registry.rs: a `host_ip` registration records the minted id with its registration name and no row in the address table, answers a lookup by that name, and its revocation check is the one an `own_ip` id takes
test: cargo nextest run -p minvmd host_ip_box_registration_mints_a_creation_unique_id
- client:
- crates/minimal-client/src/box_registration.rs: `register_box_for_activation` registers a `host_ip` box on a VM host when its spec declares a credentialed upstream, and still returns `None` for one that declares none
- crates/minimal/src/cmd/boxes/create.rs: `proxy_box_facts` gets the minted id for a `host_ip` grant box, so the `NotServed` refusal prints only where no proxy serves the host
test: cargo nextest run -p minimal host_ip_grant_box_on_vm_host_is_not_refused_as_unserved
- rpc:
- crates/minimald-rpc/src/lib.rs: `HostIpBoxRequest` carries whether the box declares a credentialed upstream, and `MintBoxIdRequest` carries `host_ip_name`, defaulted and skipped when absent
- crates/minimald-rpc/src/tests.rs: a round-trip test pins the new field and its default for an older client
test: cargo nextest run -p minimald-rpc host_ip_box_request_carries_the_lane_declaration
- client:
- crates/minimal-client/src/attach.rs: `AdmitHostIpBox` sends the lane declaration, and the admission completes before the box's first process starts, not after the create
test: cargo nextest run -p minimal-client host_ip_admission_carries_the_lane_and_waits_for_the_answer
- gate:
- crates/minvmd/src/box_registry.rs: `HostIpBoxRules` carries the lane bit, and the cohort's lane is the union of its resident members' bits
- crates/minvmd/src/net/egress_gate.rs: `host_ip_verdict` admits the cohort address to the proxy's listener port and to TCP 443 at the proxy's address while the cohort's lane is open, and drops it as `ProxyLane` while it is closed
test: cargo nextest run -p minvmd host_ip_cohort_reaches_proxy_while_a_member_declares_a_lane
test: cargo nextest run -p minvmd host_ip_cohort_proxy_lane_dropped_without_a_declaring_member
- identity:
- crates/minimald/src/box_manager.rs: the box id mint for a `HostNet` box with no box addresses sends its creation name as `host_ip_name`, so the record takes the registration's id
test: cargo nextest run -p minvmd host_ip_box_record_takes_the_registration_id
produces:
- the cohort's proxy lane at the host gate
consumes: none
proof: On a Mac, a GitHub grant box started with `--network host_ip` is created with a box id and reaches the proxy's listener, and after it ends, a host-address box with no grant cannot reach the proxy's address.
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Nov 2, 2026
Done. #2861 merged.
branch
agent/2854-give-a-host-address-grant-box-an-id-and-open-the· epic #1501 · PR #286100134fe164679bb94d0153a20ebc07fce73e4c4236c133c0a8e7bce0c2a65afa3a35e3b29e0d12df4d376ff63ef406afUpdated 2026-11-04T23:16:27.174Z.