Repository navigation
T66 — Register a box on the host and hand it its addresses #1711
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Escape into the VM reaches only the declared union | M | needs care | strongest | an agent | 420 (280 code, 140 tests) |
On a VM-backed host, activate registers the new box with the VM host daemon on the host, the VM host daemon allocates the box's switch and loopback addresses into its table and hands them back, and the in-VM daemon attaches the box with the handed switch address and selects none.
Covers:
- NET-138 (the allocate-and-hand sub-requirement)
Layers:
- vmhost:
- crates/minvmd/src/control.rs (new): the host-side control socket the client registers a box on and reads its addresses from
- crates/minvmd/src/box_registry.rs: a registration fills the box's row from the client's expanded spec and allocates its switch and loopback addresses from the helper's slice
- crates/minvmd/src/lib.rs: declares the control module
cargo nextest run -p minvmd box_addresses_allocated_on_host_and_handed_to_daemon
- cli:
- crates/minimal/src/cmd/session.rs: on a VM-backed host, activate registers the new box (id, name, ingress rules, egress rules) with the VM host daemon over its control socket, receives the box's switch and loopback addresses, and passes them in the session create request
cargo nextest run -p minimal activate_registers_box_with_vm_host
- daemon:
- crates/minimald-rpc/src/lib.rs: the session create request carries the handed switch and loopback addresses
- crates/minimald/src/net/gvproxy_network.rs: an own-address attach configures the tap with the handed address and selects none
cargo nextest run -p minimald own_ip_attach_uses_handed_address
Waits on:
Plan block
### T66 — Register a box on the host and hand it its addresses
slice: S9
kind: task
covers: NET-138
size: M
est: 280 code, 140 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: the bundle's VM host daemon log names each registration with the box id and the addresses allocated; the daemon log names the handed address at attach
observability: one info log line per registration with the box id and its two addresses; one debug line per attach naming the handed address
layers:
- vmhost:
- crates/minvmd/src/control.rs (new): the host-side control socket the client registers a box on and reads its addresses from
- crates/minvmd/src/box_registry.rs: a registration fills the box's row from the client's expanded spec and allocates its switch and loopback addresses from the helper's slice
- crates/minvmd/src/lib.rs: declares the control module
test: cargo nextest run -p minvmd box_addresses_allocated_on_host_and_handed_to_daemon
- cli:
- crates/minimal/src/cmd/session.rs: on a VM-backed host, activate registers the new box (id, name, ingress rules, egress rules) with the VM host daemon over its control socket, receives the box's switch and loopback addresses, and passes them in the session create request
test: cargo nextest run -p minimal activate_registers_box_with_vm_host
- daemon:
- crates/minimald-rpc/src/lib.rs: the session create request carries the handed switch and loopback addresses
- crates/minimald/src/net/gvproxy_network.rs: an own-address attach configures the tap with the handed address and selects none
test: cargo nextest run -p minimald own_ip_attach_uses_handed_address
produces:
- crates/minvmd/src/control.rs
consumes:
- crates/minvmd/src/box_registry.rs
proof: On a VM-backed host, activate registers the new box with the VM host daemon on the host, the VM host daemon allocates the box's switch and loopback addresses into its table and hands them back, and the in-VM daemon attaches the box with the handed switch address and selects none.
depends on:
- blocked by #1640
Reacted by minimal-foundry
Activity
fix(minvmd): admit in-plan sources no row holds until T66 supplies rows
fix(minvmd): pin the unregistered-source flip green and say what the …
norrietaylor commentedon Oct 1, 2026
Deferral pointer: #1775 (surface
own_ip_enforcementat session start and as a node attribute) is blocked by this task. When T66 flips the gate default to in-force, #1775 readsper_boxfrom the gate mode; thedead_codeexpectation incrates/minvmd/src/net/egress_gate.rsmoves fromInForcetoAnnouncedwith the flip, andunregistered_sources_dropped_when_default_in_forcebecomes the proof of the shipped default (see #1764, Proof).T36 — Apply per-box source-addressed rules outside the VM from a host…
minimal-foundry commentedon Oct 1, 2026
Done. #1789 merged.
branch
agent/1711-register-a-box-on-the-host-and-hand-it-its-addre· epic #1437 · PR #1789Updated 2026-10-28T06:17:32.453Z.
test(minvmd): make the spoofer's lane green where the switch is absent
T41 — Bound a root-in-VM spoofer to the resident union (#1792)
fix(minvmd): attribute each switch retract to its publication's address
T63 — Gate the switch's publish verbs on the host and hand the node i…
test(e2e): assert the made-up lease's beyond-union admit as the gap
T42 — Escape into the VM reaches only the declared union, end to end (g…
T89 — Drop a source no box holds at the VM host's gate, whatever the …