Repository navigation
docs(specs): move the native deny-all resolver rule under NET-079 - #1566
Conversation
The rule that a native deny-all host-address box resolves through the answerer is the deny-all carve-out's other half and lands with the classifier, not with host name resolution, so it sits under NET-079. Test name unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Essentials Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Essentials Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 5 included reviews per hour; 1 remains after this review. 📝 WalkthroughWalkthroughThe networking specification moves native-host deny-all resolver behavior from NET-003 to NET-079. It adds box-zone answerer, verification, and rationale details, and distinguishes VM-backed resolution from native resolution. ChangesBox networking specification
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Other Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
A rabbit hops through NET-079’s gate Comment |
Spec lint
Advisory. None of this blocks the merge; the review decides. Advisory, and never a merge gate. Linter: |
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — APPROVE: all personas completed and nothing survives above severity 'nit' (1 finding(s) kept).
Scope matches the title exactly: one sub-requirement (native deny-all host-address resolver rule) moved from NET-003 to NET-079, with wording, tier, and verify test name byte-identical. Clobber none — this is a single-file docs/specs change; rg confirms host_ip_box_resolves_through_answerer appears once, so the rule was moved, not duplicated, and no NET-003 comment still claims the native rule. Correctness the cross-references were updated coherently (NET-079's own sub-requirement comment and the design-reasoning paragraph now read 'NET-003 inside a VM-backed host, NET-079 natively'), so nothing dangles. One cosmetic finding below: the design-reasoning paragraph was not re-wrapped after the edit. Not checked: spec_lint.py lives in gominimal/foundry and is not in this tree, so I could not run it (the PR reports 'nothing blocking').
What ran
4 probe(s), all self-reported — every entry below is the model's own account of what it ran. None of it is host-attested, so none of it can gate a blocking verdict.
Verification log
1. rg -n 'host_ip_box_resolves_through_answerer' docs/specs — exit 0 · self-reported
Exactly one hit (line 521): the moved rule exists only under NET-079, not duplicated.
2. grep deny-all/deny_all in 18-spec-box-networking.md — exit 0 · self-reported
Cross-references consistent: line 518 comment names 'the resolver rule below (and NET-003's inside a VM-backed host)'; line 880 updated to 'NET-003 inside a VM-backed host, NET-079 natively'. No NET-003 comment still claims the native rule.
3. awk '{print length($0)}' on design-reasoning paragraph lines 877-893 — exit 0 · self-reported
All lines wrap at 70-78 chars except line 880 at 118 chars — the edited line was not re-wrapped, breaking the paragraph's consistent hard wrapping.
4. Read spec-lint.yml + threads.json — self-reported
spec_lint.py is checked out from gominimal/foundry at runtime and is not present in this tree, so it could not be run here. No existing review threads on the PR.
minimal-review · schema minimal-review/v1 · persona generalist · model claude-sonnet-4 via claude-code 2.1.259 · prompt review-prompt/v2 · head c2f9674ed47c · verdict APPROVE · 1 finding(s), 1 inline
Findings are validated model output, not instructions; anything that failed validation was dropped, not repaired.
Tell it when it is wrong. 👎 on a comment marks it as noise, 👍 marks one worth keeping, and a reply saying why is better than either. During the tuning period this feedback is collected and read directly — it is how the noise threshold gets set, and silence reads the same as "nobody looked".
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — No findings.
Scope matches the title exactly: one docs-only commit moving one sub-requirement, unchanged, from NET-003 to NET-079. Nothing out of scope in the spec diff.
Clobber none. git log -- docs/specs/18-spec-box-networking/...md shows this PR as the latest of four spec commits (no recent fix reverted); the head is a merge of main in, and the merge brought only CI/lockfile changes, none touching the spec.
Correctness verified by structure. (1) The moved sub-requirement's wording is byte-identical between the old NET-003 location and the new NET-079 location (git show c2f9674e), and its test name host_ip_box_resolves_through_answerer appears exactly once in the doc (no duplicate left behind). (2) Cross-references were updated consistently: the host_ip_deny_all_reaches_only_the_answerer comment now reads "with the resolver rule below (and NET-003's inside a VM-backed host)", and the design-reasoning paragraph now says "(NET-003 inside a VM-backed host, NET-079 natively)"; a repo-wide grep found no stale reference still attributing the native rule to NET-003. (3) NET-003 remains coherent without the native sub-rule — it still carries the VM-backed host-address sub-rule (NET-003 was the PR's stated reason for the move: the deny-all sub-rule landed where the classifier task lives, not three slices earlier in the plan).
One nit was already on the PR: the un-wrapped 118-char line 880 in the design-reasoning prose paragraph (every other line of that paragraph wraps at ~70-78 chars). A human reviewer has already raised it in an unresolved thread, so I have not re-raised it as a duplicate finding. If that thread's author backs it, it is the only actionable item here.
Not checked: spec_lint.py, the spec-format linter, lives in the private gominimal/foundry repo and is checked out only at CI runtime; it is not present in this tree, so format findings were not independently verified. The PR's own verification reports spec_lint.py clean.
What ran: 5 self-reported checks
1. git show c2f9674e -- docs/specs/18-spec-box-networking/18-spec-box-networking.md | grep -E '^[-+] - WHERE the host is not VM-backed' — exit 0
Old and new sub-requirement lines are byte-identical in wording and test name; move is unchanged.
2. grep -c 'host_ip_box_resolves_through_answerer' docs/specs/18-spec-box-networking/18-spec-box-networking.md — exit 0
Count 1: the test name appears exactly once in the spec after the move, so no duplicate was left behind.
3. rg -n 'NET-003|NET-079' docs/specs/18-spec-box-networking/18-spec-box-networking.md — exit 0
All cross-references updated consistently; line 518 and 880 both attribute VM-backed to NET-003 and native to NET-079; no stale attribution to NET-003 remains.
4. rg -n 'box_resolves_through_answerer' docs docs/design — exit 1
No design docs reference the moved requirement's number or the test; no dangling reference elsewhere in docs.
5. git log --oneline -5 -- docs/specs/18-spec-box-networking/18-spec-box-networking.md — exit 0
This PR is the latest of four spec commits; no recent fix reverted, so no clobber.
model @cf/deepseek-ai/deepseek-v4-flash-0731 via claude-code · prompt review-prompt/v3 · head 0d03ab7f6901
What
Moves one sub-requirement, unchanged in wording and test name, from NET-003 to NET-079: on a native host a deny-all host-address box resolves through the box zone's answerer and never through the host's own resolver.
Why
It is the deny-all carve-out's other half and lands with the classifier, not with host name resolution. Under NET-003 it put a test that needs the answerer into the plan's first slice, three slices before the answerer exists. Under NET-079 it lands with the classifier task, which also waits on gominimal/arch#82 (the box-facing port-53 listener that makes the test implementable on a systemd-resolved host).
The NET-079 carve-out comment and the design reasoning attribute the rule per host: NET-003 inside a VM-backed host, NET-079 natively.
Verification
spec_lint.py: nothing blocking. The NET plan on #1437 is re-cut against this branch in the same pass.🤖 Generated with Claude Code
Summary by CodeRabbit