Repository navigation
net expose: publish runtime ports for self-allocated boxes on a native host #1870
Description
Gap
On a native (un-enrolled) host, a box that allocates its own address has no box_addresses in its record. min net expose inside such a box is therefore always refused, even when its dynamic_ingress is allow (#1865, T53). NET-044 ("allow means publish") is unmet for these boxes until this lands. Design §7.1 has un-enrolled boxes self-allocate their addressing, so this is the main group of degraded-mode boxes.
Ask
- Give the session actor the box's published address for a self-allocated native box.
- Get it through the hostname registry's per-session published address (design §7.1, the namespace-mirror rule), not through the switch lease. Leases are per-spawn and must not key forwards.
SwitchClient::leases()has no session key, and the registry's map is private today. - Then publish runtime exposures there with the same bind discipline the declared ports use.
- Test: on a native host,
min net exposein a self-allocated box underdynamic_ingress = allowpublishes at the registered address and lists it inmin session policy.
Until this lands, T53 refuses with its own typed error saying the box has no published address for runtime exposure. It is deliberately distinct from a policy deny.
Activity