Repository navigation
T121 — Steer a host-address grant box's lookups and admit dns on a VM host #2857
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Host-address boxes reach GitHub | L | unknown ground | strongest | an agent | 720 (340 code, 380 tests) |
On a Mac, a host-address grant box with no steering line resolves github.com to the proxy and clones through it, while a host-address box with no grant resolves github.com to GitHub's real address.
Covers:
- BEP-081
- BEP-086
Layers:
- resolver:
- crates/minimald/src/net/provider.rs: a
host_ipbox with a credentialed upstream anddnsorbothsteering gets a resolver plan that names the steering answerer; every otherhost_ipbox keeps the resolver it has today - crates/minimald/src/net/dns.rs: a steering answerer in the guest's namespace answers the box's module host set with the proxy's address, NODATA for AAAA, HTTPS and SVCB, SERVFAIL while the listener is down, and forwards every other name to the node's resolver
- crates/minimald/src/net/classifier.rs: the box's cgroup leaf may reach the steering answerer's port, and no other leaf may
cargo nextest run -p minimald host_ip_grant_box_steered_names_resolve_to_proxycargo nextest run -p minimald host_ip_lookup_outside_a_steered_box_resolves_real
- crates/minimald/src/net/provider.rs: a
- activation:
- crates/minimal/src/cmd/boxes/create.rs:
host_resolves_box_namesis true on a VM host forown_ipandhost_ipboxes, so BEP-017 refusesdnsandbothonly on a host with no VM - crates/minimal/src/cmd/box_spec.rs: the preview reads the same host fact for
host_ip cargo nextest run -p minimal vm_host_admits_dns_and_both_for_own_ip_and_host_ip
- crates/minimal/src/cmd/boxes/create.rs:
Waits on:
- T116 — Carry dns-steered TLS to the proxy on port 443 #2805
- T119 — Deliver cohort connections and redeem them for the named box #2855
- T120 — Treat the proxy lane as in effect for a host-address box on a VM host #2856
Plan block
### T121 — Steer a host-address grant box's lookups and admit dns on a VM host
slice: S17
kind: task
covers: BEP-081, BEP-086
size: L
est: 340 code, 380 tests
executor: agent
difficulty: unknown ground
model: strongest
diagnostics: `min box spec <entry> --network host_ip` on a Mac shows `steering = "dns"` resolved and no refusal; inside a host-address grant box `getent hosts github.com` prints the proxy's address, and inside a host-address box with no grant it prints GitHub's real address
observability: the steering answerer's debug line for a steered answer names the box and the steered name, as the switch's DNS gate does for an `own_ip` box
layers:
- resolver:
- crates/minimald/src/net/provider.rs: a `host_ip` box with a credentialed upstream and `dns` or `both` steering gets a resolver plan that names the steering answerer; every other `host_ip` box keeps the resolver it has today
- crates/minimald/src/net/dns.rs: a steering answerer in the guest's namespace answers the box's module host
8000
set with the proxy's address, NODATA for AAAA, HTTPS and SVCB, SERVFAIL while the listener is down, and forwards every other name to the node's resolver
- crates/minimald/src/net/classifier.rs: the box's cgroup leaf may reach the steering answerer's port, and no other leaf may
test: cargo nextest run -p minimald host_ip_grant_box_steered_names_resolve_to_proxy
test: cargo nextest run -p minimald host_ip_lookup_outside_a_steered_box_resolves_real
- activation:
- crates/minimal/src/cmd/boxes/create.rs: `host_resolves_box_names` is true on a VM host for `own_ip` and `host_ip` boxes, so BEP-017 refuses `dns` and `both` only on a host with no VM
- crates/minimal/src/cmd/box_spec.rs: the preview reads the same host fact for `host_ip`
test: cargo nextest run -p minimal vm_host_admits_dns_and_both_for_own_ip_and_host_ip
produces:
- per-box dns steering for a host-address box
consumes:
- the in-effect rule for a host-address lane
- cohort-attributed delivery
proof: On a Mac, a host-address grant box with no steering line resolves github.com to the proxy and clones through it, while a host-address box with no grant resolves github.com to GitHub's real address.
depends on:
- blocked by #2805
- blocked by #2855
- blocked by #2856
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Nov 5, 2026
Done. #3079 merged.
branch
agent/2857-steer-a-host-address-grant-box-s-lookups-and-adm· epic #1501 · PR #3079575d2115e295ac3eUpdated 2026-11-06T16:57:03.765Z.