8000 T77 — Run the real-Keychain proof of min secret on a Mac · Issue #2562 · gominimal/minimal · GitHub
[go: up one dir, main page]
Skip to content

T77 — Run the real-Keychain proof of min secret on a Mac #2562

New issue
New issue
Closed
Closed
T77 — Run the real-Keychain proof of min secret on a Mac#2562
Labels
executor:humanHand-guided; an agent must not pick this upkind:taskA task the plan skill rendered; the body carries ## Taskmodel:standardA standard model: work that needs care, or routine work that is largesize:SUnder 200 net lines; one PR

Description

@norrietaylor
norrietaylor
opened on Oct 25, 2026

Task

slice size difficul 8000 ty model who estimated lines
macOS lane proofs S routine standard a person 60 (0 code, 60 tests)

On a Mac, min secret set stores a key in the real Keychain with access control that lets the proxy read it without a prompt, and the case records OK.

Covers:

  • BEP-050
  • BEP-051

Layers:

Waits on:

Plan block 
### T77 — Run the real-Keychain proof of min secret on a Mac
  slice: S11
  kind: task
  covers: BEP-050, BEP-051
  size: S
  est: 0 code, 60 tests
  executor: human
  difficulty: routine
  model: standard
  diagnostics: the case prints PASS or NOT RUN with its gate
  observability: the case output, posted on gominimal/minimal#2562
  layers:
    - mac:
      - crates/bep/src/store.rs: run on a Mac against `main`, unchanged; `min secret set`, `list` and `rm` run against the login Keychain and the transcript is posted on gominimal/minimal#2562
      test: cargo nextest run -p bep --run-ignored ignored-only host_store_set_list_rm_round_trip
  produces: none
  consumes: none
  proof: On a Mac, `min secret set` stores a key in the real Keychain with access control that lets the proxy read it without a prompt, and the case records OK.
  depends on:
    - blocked by gominimal/minimal#2287
    - blocked by gominimal/minimal#2785

Generated by Claude Code

Activity

  1. norrietaylor
    added
    kind:featureA new feature or capability. Applied by the inbox-route classifier.
    on Oct 25, 2026

  2. norrietaylor commented on Oct 26, 2026

    @norrietaylor
    norrietaylor
    on Oct 26, 2026 – with Claude
    MemberAuthor

    The epic owner added this residual to the plan on 2026-10-26 as T77 (slice S11). Its body is now the rendered task. The residual text it replaces is kept below.

    Residual text

    Residual from T26 #2522, arch C1 (review threads 4369434893, 4369550479, 4369645885, 4369856969), epic #1501. Filed under the epic owner's 2026-10-25 decision to merge the PR and run its macOS legs later against main, on the manual macOS lane of #2500. Linux runners record these legs NOT RUN because bep serve runs on macOS only (bep_live_gate in scripts/session-e2e.sh).

    What closes this

    • On a Mac, cargo nextest run -p bep host_store_set_list_rm_round_trip --run-ignored only passes, proving the BEP-051 ACL gives the proxy a prompt-free read and prompts every other program (architecture line 513).
    • min secret set, min secret list and min secret rm run against the login Keychain, and parse_dump reads the real security dump-keychain -a output; the transcript is posted here.

    Generated by Claude Code

  3. norrietaylor
    changed the title [-]Run the real-Keychain proof of min secret on a Mac (BEP-050, BEP-051)[/-] [+]T77 — Run the real-Keychain proof of min secret on a Mac[/+] on Oct 26, 2026
  4. norrietaylor
    added
    kind:taskA task the plan skill rendered; the body carries ## Task
    size:SUnder 200 net lines; one PR
    model:standardA standard model: work that needs care, or routine work that is large
    executor:humanHand-guided; an agent must not pick this up
    and removed
    kind:featureA new feature or capability. Applied by the inbox-route classifier.
    on Oct 26, 2026
  5. norrietaylor
    added a parent issue on Oct 26, 2026
  6. norrietaylor
    marked this as blocked on Oct 26, 2026
  7. norrietaylor
    marked this as blocking on Oct 26, 2026

  8. norrietaylor commented on Nov 4, 2026

    @norrietaylor
    norrietaylor
    on Nov 4, 2026
    MemberAuthor

    T77 run on a Mac (macOS 26.7, arm64) at b7d5ce10, with target/debug first on PATH.

    $ cargo nextest run -p bep host_store_set_list_rm_round_trip --run-ignored only --no-capture
after set: [ItemInfo { id: "minimal-round-trip-20341", proxy_access: true }]
after set again: [ItemInfo { id: "minimal-round-trip-20341", proxy_access: true }]
after remove: []
PASS [  39.121s] (1/1) bep store::tests::host_store_set_list_rm_round_trip

$ min secret set t77-proof-24089      (value on stdin)
t77-proof-24089
$ min secret list
t77-proof-24089
  store:                 keychain
  upstream:              none (no [secret-store-rules] rule)
  injection:             none
  consent:               none
  proxy reads it freely: yes, <repo>/target/debug/bep
$ min secret rm t77-proof-24089
Removed t77-proof-24089 from the keychain store.

    parse_dump read the real security dump-keychain -a output, which includes SecACLCopySimpleContents errors on stderr for other items.

    Limits of this proof:

    • It reads the access list, which names the proxy as the one application with decrypt. It did not observe a read by the proxy, or a prompt for another program. T82's bep_store_reference_end_to_end covers the read.
    • It used a debug bep. With the installed bep.app, min secret set fails. That is gominimal/inbox#1199, which blocks T102.

    Generated by Claude Code

  9. norrietaylor
    closed this as completedon Nov 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    executor:humanHand-guided; an agent must not pick this upkind:taskA task the plan skill rendered; the body carries ## Taskmodel:standardA standard model: work that needs care, or routine work that is largesize:SUnder 200 net lines; one PR

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions
      0