Repository navigation
Revoke a host_ip box's minted id at the Box Egress Proxy when the box ends #2865
Description
Residual of T117 (#2854, PR #2861), from the arch ruling on a51b299 (condition C3). Epic #1501.
Gap
A4F9
register_host_ip_box in minvmd mints a box id for a host_ip grant box (BEP-082). When an own-address box ends, minvmd sends revoke_box and then forget_box to the Box Egress Proxy (spawn_revocation, crates/minvmd/src/box_registry.rs near line 5093, BEP-043). A host_ip box ends through retire_host_ip_box. That call is keyed by session, has no link to the minted id, and sends no revocation. host_ip_ids keeps the id until the VM host daemon restarts.
Effect
After a host_ip grant box ends, its sealed values are not revoked at the proxy, and the proxy keeps its registration. Nothing can redeem a value under that id until T119 (#2855) delivers cohort-attributed connections. T119 must not land without this fix.
Done when
When a host_ip box with a minted id is retired or destroyed, minvmd revokes and forgets that id at the proxy, exactly as an own-address box is revoked, and host_ip_ids stops treating the id as live. A test retires a host_ip grant box and asserts that the proxy got revoke_box for its id.
Design: Gatehouse §6.10 v1.24 line 839 ("a box revocation — written when the box is destroyed … names an id that never returns").
Activity
norrietaylor commentedon Nov 5, 2026
The fix is planned as task T123, #3032, in epic #1501. T119 (#2855) and T122 (#2858) are now blocked by #3032. This issue stays open until #3032 lands.
norrietaylor commentedon Nov 6, 2026
Done by T123 (#3034), which revokes a host_ip grant box's minted id at the Box Egress Proxy when the box is destroyed, and T126 (#3064), which keeps the id across a VM host daemon restart.