Repository navigation
T11 — Choose a network posture on a stock install, end to end - #1745
norrietaylor merged 3 commits into
Conversation
A new session e2e case, network_posture_from_stock_install: a real
install.sh run into a fresh HOME (the loopback-publish proof's mock
bucket, minus its system-package half) drives the installed pair
through every posture the command line can choose.
- the chooser is findable: --network and --ingress in
'min session activate --help' and in the CLI reference, and the
hyphenated spellings still parse, each printing the one-line
rename hint (no-net driven for real, host-net and own-ip at the
parser); the current spellings print no hint
- a none box accepts attach (a real pty attach) and reaches
nothing: one interface (lo), no default route, the host's own
listener refused fast, the internet unreachable
- the stock posture (host_ip) completes an outbound request
- from the fresh install, --network own_ip --ingress answers on
the host loopback and that box reaches out through the switch
the installer shipped (gated on /dev/net/tun, the one thing an
own-IP box cannot do without)
Each step prints the command and its exit status; every failure
carries the install log, the help capture and the daemon log tail.
A host whose boxes cannot exec degrades by observed fact; on CI or a
VM lane a tripped exec gate fails.
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Approved: no findings at Nothing to do. Clobber: none: |
The workspace suite's shellcheck gate (crates/common/tests/shell_lint.rs driving scripts/lint-shell.sh) red-flagged the new network-posture case: six info-level findings, all about the HOME/MINIMAL_BIN/PATH swaps. - SC2030/SC2031: each stock-install proof swaps HOME and PATH inside its own ( .. ) subshell on purpose — the lane's env must stay untouched — and shellcheck reads the later references as relying on a subshell change. Merge each pair of exports into one command, silence the code at both ends, and say why: the change dying with the subshell is the point, and the install's PATH read is meant to see the lane's PATH. - SC2086: E2E_MINIMAL_ARGS must word-split, as the file already notes at every other mnl call site.
|
Round 1 of 10 on a failed check suite, pushed as
Verify The red check is addressed at its cause: scripts/session-e2e.sh is shellcheck-clean again, so the ci-linux-native Notes from the agent: Revise round: the failed check was ci-linux-native-success via its |
|
/revise resolve conflicts |
|
Round 2 of 10 on a /revise note, pushed as Resolved conflicts in:
Verify On the branch, main's proxy_refuses_like_direct proof and this task's network_posture_from_stock_install proof both live in scripts/session-e2e.sh and both run by name or in the whole-lane order, with the usage text listing every case and the dispatch accepting both; the merged script shellchecks clean, and ./scripts/session-e2e.sh network_posture_from_stock_install still proves the stock-install posture end to end (exit 0). Notes from the agent: Revise round 2, directive = 'resolve conflicts'. The merge of origin/main (a909897, the additive proxy-parity proof) conflicted with the branch only in the dispatch's usage text; resolved by keeping both sides' case lists (network_posture_from_stock_install from the branch, proxy_refuses_like_direct from main) on two wrapped echo lines, and completed the merge as 4507520 (chore(e2e), per docs/commit-conventions.md). main's change is purely additive (proof function, PAR_* seed teardown lines, two dispatch lines), so the auto-merged rest needed no hand resolution; bash -n and shellcheck pass, and the merged teardown carries both proofs' cleanup. The task's test line ran twice (once with output, once for exit): exit 0. On this host the proof's own gate skips the in-box halves (no /dev/net/tun, minimald cannot spawn a sandbox here) — the help/reference/hints halves that CAN run here all asserted green; on CI/VM lanes the script fails instead of skipping, so the box halves still get their lane evidence. Deferred: none. Next task should know: no other path touched, .github/ untouched. |
T11 — Choose a network posture on a stock install, end to end
slice: S2
kind: integration
covers: none
size: M
est: 60 code, 160 tests
executor: agent
difficulty: routine
model: standard
diagnostics: the bundle from the run carries the install log, the help output and the daemon log
observability: the case prints each step with the command and its exit status
layers:
- e2e:
- scripts/session-e2e.sh: adds the case network_posture_from_stock_install
test: ./scripts/session-e2e.sh network_posture_from_stock_install
produces: none
consumes: none
proof:
--networkand--ingressshow in help and the reference with hints for the old spellings; from a fresh install--network own_ip --ingress 8080:8080answers at127.0.0.1:8080; anonebox accepts attach and reaches nothing; the lanes prove a session reaches the network.depends on:
- blocked by #1627
- blocked by #1614
- blocked by #1615
- blocked by #1633
- blocked by #1634
Proof
--networkand--ingressshow inmin session activate --helpand in docs/reference/cli-min.md, and the old hyphenated spellings still parse with a one-line hint naming the current spelling (proven on the installed pair from a real install.sh run). From that fresh install the case now proves the whole chooser: anonebox accepts a real pty attach and reaches nothing (one interface, no default route, the host's own listener refused fast, the internet unreachable), the stockhost_ipbox completes an outbound request, and--network own_ip --ingress 8080:8080answers on the host loopback while its box reaches out through the switch the installer shipped. The in-box halves assert on the CI native lane; on a host that cannot run boxes the case degrade-skips them by the observed fact and still asserts everything that needs no box.Notes from the agent: Single-file change, the layer's only file. Environment on this box: boxes' exec relaunch dies (hakoniwa /etc bind-remount EPERM — mount inside unprivileged user namespaces is denied on this kernel entirely, verified with a direct bind-remount in a userns) and /dev/net/tun is absent, so the committed run here exercised the install/help/reference/hint halves and degraded at the exec gate (the proxy case's skip-on-dev-host, fail-on-CI convention) rather than asserting the in-box behavior; the own-IP half skipped on the tap gate and the bucket shipped no switch row, which the installer log was asserted to record. The in-box steps (none-box probes and pty attach, both outbound probes, the own-IP ingress answer) ride the landed proofs' patterns verbatim (session exec, socat responder, e2e-attach-pty with E2E_PTY_ANSWER=keep, the tolerant outbound shape) and were reviewed, not executed here; they run fully on the CI native lane, which runs the whole script with no argument as a user with userns mounts and has /dev/net/tun. bash -n and shellcheck -S warning are clean. The case is wired into all three dispatch …[truncated]
Tests
./scripts/session-e2e.sh network_posture_from_stock_installVerify
min task run agent-verifypassed ([tasks.verify]).Closes #1644