Repository navigation
T10 — Prove a session reaches the network as its own case - #1720
norrietaylor merged 1 commit into
Conversation
The guest-egress proof becomes the `session_outbound_request` case (NET-107): after the cold activate, an outbound request from inside the session must complete, and a lane whose switch is lost fails the case — it already fails when no host answers any attempt, so the rename is what gives NET-107 its named verify line. The case now prints each host tried with its outcome (host, HTTP code, and the attempt it answered on) instead of only a summary. The RUST_LOG default admits `minimald::exec=info`, so the daemon's file log carries one record per exec naming the command: when the case fails, the `min bug` bundle's daemon-log tail carries the probe's exec lines. The directive names a daemon module, so the CLI's stdout stays quiet for the session-id extraction.
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Approved: no findings at Nothing to do. Verdict APPROVE, posted as a comment: the App cannot review its own pull request; the check and the label carry it. Clobber: none: |
|
Babysitter review against T10's plan block (one layer,
No findings. Merge after the lanes, minimal-review and CodeRabbit conclude. |
There was a problem hiding this comment.
Babysitter review against T10's plan block: the guest-egress proof is now the session_outbound_request case with the plan's observability and diagnostics, the rename has no references outside the script, native and macOS lanes green. minimal-review approved with no findings, CodeRabbit posted, no threads. Squash auto-merge set; it lands when the KVM lane concludes.
T10 — Prove a session reaches the network as its own case
slice: S2
kind: task
covers: NET-107
size: M
est: 0 code, 100 tests
executor: agent
difficulty: routine
model: standard
diagnostics: the bundle's daemon log tail carries the session's exec lines for the probe
observability: the case prints each host tried and the outcome
layers:
- e2e:
- scripts/session-e2e.sh: the guest egress proof becomes the case session_outbound_request, run after cold activate
test: ./scripts/session-e2e.sh session_outbound_request
produces: none
consumes: none
proof: Running the session end-to-end script with the outbound case reaches a public host from inside a session, and a lane whose switch is lost fails that case.
depends on:
- blocked by #1627
Proof
Running the session end-to-end script with the outbound case reaches a public host from inside a session (both probe hosts answered HTTP 200 on the first attempt after a cold activate), and a lane whose switch is lost fails that case — the case exits 1 when every host fails every attempt, the shape a switchless boot produces (no NAT, no DNS).
Notes from the agent: Change is confined to scripts/session-e2e.sh (the layer's only file): proof_guest_egress renamed to proof_session_outbound_request and wired into the dispatch (whole-lane order and the standalone case list + usage), with the case header/comment updated; the guest_egress case name is gone, and no caller in the repo invoked it by name. Observability: the case now prints each host tried with its outcome (host, HTTP code, attempt). Diagnostics: the RUST_LOG default becomes warn,minimald::exec=info so the daemon's file log carries the one INFO record per accepted exec naming the command (target minimald::exec); verified from a failing run's
min bugbundle, whose daemon-log tail carried the probe's curl exec lines. The bundle (not fail()'s state-dir find, whose -name '.log' glob misses the dated minimald.log. files) is what carries the daemon log tail; the comments say so. Failure semantics: during verification on this box every attempt failed with a nested-sandbox EPERM (see below) and the case exited 1 with the ::error:: — the same all-hosts-fail path a switchless boot takes. Environment: this checkout box is itself a minimal session box, and its $HOME is /tmp — a tmpfs the OUTER session created — so the daemon's sandbox spawn EPERMs remounting its rootfs bind read-only (reproduced standalone: bind+ro-remount under that tmpfs is refused; the same op succeeds on a host-owned ext4 mount). The lane's real hosts (CI native runner, a laptop) have $HOME on the host fs, where the case passes; my two passing runs set HOME=/work/build-cache/e2e-home (a host-owned ext4 bind) for exactly that reason and …[truncated]Tests
./scripts/session-e2e.sh session_outbound_requestVerify
min task run agent-verifypassed ([tasks.verify]).Closes #1634