Repository navigation
T126 — Keep a host-address grant box's minted id across a VM host daemon restart, so its destroy revokes it #3049
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Host-address boxes reach GitHub | M | needs care | standard | an agent | 320 (100 code, 220 tests) |
A host-address grant box destroyed after the VM host daemon restarted has its id revoked at the proxy, and
min box auditshows the revocation.
Layers:
- persist:
- crates/minvmd/src/box_registry.rs:
HostIpIdsgainscredentialed, the minted ids admitted with a credentialed lane, in place ofstopped_credentialed, and a destroy revokes an id in it;idsandcredentialedpersist to a newHOST_IP_IDS_FILEbesideREGISTRY_FILEafter each change throughwrite_registry_file, andpersisting_toreloads them, so a reloaded id is held for the collision check and revoked at its box's destroy; an unusable file is set aside and reloads no id;reconcile_host_ip_boxesalso revokes each id incredentialedwhose box the guest list no longer holds, and drops it from the set, so a stopped grant box that the VM destroys with no retire from a client revokes its id cargo nextest run -p minvmd restarted_registry_revokes_a_destroyed_grant_box_idcargo nextest run -p minvmd restarted_registry_never_mints_an_id_it_minted_beforecargo nextest run -p minvmd a_stopped_grant_box_the_vm_destroyed_revokes_its_id
- crates/minvmd/src/box_registry.rs:
Waits on:
Plan block
### T126 — Keep a host-address grant box's minted id across a VM host daemon restart, so its destroy revokes it
slice: S17
kind: task
covers: BEP-043
size: M
est: 100 code, 220 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: `min box audit <box>` for a `host_ip` grant box destroyed after a VM host daemon restart shows the revocation of its id, as it does with no restart between; the ids sit in `box-host-ip-ids.json` beside `box-registry.json` in the VM host daemon's state dir
observability: the existing `bep-revocation` thread's warning names the box id and the step that failed; a failed write of the id file is a warn line naming the path, as a failed write of the held names is; the reload logs one info line with the count of minted and credentialed ids it read
layers:
- persist:
- crates/minvmd/src/box_registry.rs: `HostIpIds` gains `credentialed`, the minted ids admitted with a credentialed lane, in place of `stopped_credentialed`, and a destroy revokes an id in it; `ids` and `credentialed` persist to a new `HOST_IP_IDS_FILE` beside `REGISTRY_FILE` after each change through `write_registry_file`, and `persisting_to` reloads them, so a reloaded id is held for the collision check and revoked at its box's destroy; an unusable file is set aside and reloads no id; `reconcile_host_ip_boxes` also revokes each id in `credentialed` whose box the guest list no longer holds, and drops it from the set, so a stopped grant box that the VM destroys with no retire from a client revokes its id
test: cargo nextest run -p minvmd restarted_registry_revokes_a_destroyed_grant_box_id
test: cargo nextest run -p minvmd restarted_registry_never_mints_an_id_it_minted_before
test: cargo nextest run -p minvmd a_stopped_grant_box_the_vm_destroyed_revokes_its_id
produces: none
consumes:
- the revocation of an ended host-address grant box
proof: A host-address grant box destroyed after the VM host daemon restarted has its id revoked at the proxy, and `min box audit` shows the revocation.
depends on:
- blocked by #3032
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Nov 5, 2026
Done. #3064 merged.
branch
agent/3049-keep-a-host-address-grant-box-s-minted-id-across· epic #1501 · PR #3064dd733f7aUpdated 2026-11-05T21:57:53.981Z.