Repository navigation
T78 — Register an own-address box with the VM host daemon whenever the CLI talks to one, macOS included - #1852
Conversation
The gates that decide whether the host is VM-backed — the box registration, the control-socket path the destroy and Ctrl-C withdrawals and the start-line read resolve through, and the VM name the start line prints — keyed on `use_minvmd()`, which is true only under an explicit `--provider local-minvmd`. On macOS minvmd is the only backend and no invocation carries the flag, so every one of those gates read a flagless macOS host as native: its own-address boxes registered no row with the VM host daemon, a destroy or Ctrl-C had no control socket to withdraw through, and the session-start line named no VM (NET-081's macOS half, NET-076's line beside it). Every gate now keys on `client::client_provider_kind(..)`, the same rule the socket resolution and the fabric display already turn on — stated once as `daemon_provider_kind`, with the gates parameterized on the kind so the macOS combination the flag cannot express (kind `Minvmd`, no flag) is testable on any host. A registration that cannot be made — an unresolvable provider dir, a refusal, the deadline — now ends the activation with its cause instead of degrading to a warning beside a box that created unregistered: a box with no host-side row runs with its declared egress applied nowhere, so the session does not start half-admitted. The registration and the withdrawal each log one info line naming the box and its switch address, beside the daemon-side records a bundle already carries.
…n-own-address-box-with-the-vm-host-dae
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
/revise Round 1. Scope: finish T78 within its plan layers only (crates/minimal/src/cmd/session.rs, crates/minimal/src/cmd/mod.rs, crates/minimal/src/cmd/list.rs, scripts/session-e2e.sh), plus the one assertion in crates/minimal/src/tests.rs that ask 4 names. Keep the product-code re-keying as it stands; do not touch other files.
Run every plan test line and report each exit. The e2e line needs a VM-backed host; if the executor has none, say so rather than reporting the environment failure as the case's result. The PR body is edited by hand; do not rewrite it. |
Round 1 of the T78 pull request asked for two things the gate test did not do: its premise asserted the rule by calling the rule (`daemon_provider_kind` against the very `client_provider_kind` it forwards to), and every gate it proved was driven by handing the kind in directly — so a call site that pre-gated on `use_minvmd()` again would still pass it. The rule is now stated as an expectation about the kinds — a flagless `GlobalArgs` resolves to `Minvmd` on a host with no native backend and `Minimald` elsewhere, and `--provider local-minvmd` resolves to `Minvmd` — and the activation path itself is driven flagless, end to end, against the same stand-ins the refused-registration test uses: a VM host daemon behind the provider dir the flagless kind names, a real daemon behind the ssh socket that same kind resolves. On a host whose only backend is minvmd the registration, the create's carried addresses, and the session-start line all happen with no flag at all, which is exactly what a gate reading the flag would skip; elsewhere the same invocation is asserted to ask the VM host for nothing. The session-start output now carries the registration's own line (the task's diagnostics clause): one stderr line naming the VM host daemon the box registered with and its switch address, beside the `tracing::info!` line the registration already writes. `walked_proxy_port_reported_at_start_and_in_ls` asserted `--provider local-minimald` names no VM, which `client_provider_kind` makes false on macOS; its expectation is now the platform's, and the native-line comparison runs where the native backend exists.
Add the own_ip_box_registers_with_the_vm_host_without_a_provider_flag case (T78's e2e layer), wired into the named-case dispatch, the usage text and the whole-lane order right after `restart`. Four halves, each asserted through the VM host daemon's OWN file log — minvmd runs on the host even when the sessions live inside its VM, so `minvmd_log_lines` reads on every VM-backed lane, macOS included, where no --provider flag is ever passed: - create: a bare own_ip box's registration record names the box and the address pair it allocated, and the session-start line names the same switch address; - destroy: the withdrawal record names the same pair; - Ctrl-C: a backgrounded activate is interrupted inside the guard's window — the trigger is the deny-all announcement the CLI prints to stderr immediately before arming it, with 64 MiB of fixture bulk holding the activation in the window — and the withdrawal record, the CLI's abort marker, exit 130 and the session's absence from `min ls` all follow; - declared egress: the declared row registers host-side, and the undeclared destination the bare box completed in the same run is refused (hard-failed on an answer, a reset or a fast failure), with the host gate's own drop record echoed where the frame reached it. A native host has no VM host daemon to register with, so the case skips there with the reason, and it restarts the daemon first so its own activation autospawns one pinned to `warn,minvmd=info` — the INFO records every assertion reads are dropped by the lane's `warn`.
…n-own-address-box-with-the-vm-host-dae
|
Round 1 of 10 on a /revise note, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. At this branch, a flagless own-address activation on a VM-backed host — as on macOS, where no --provider is ever passed — registers its box with the VM host daemon: session-start stderr carries a BOX REGISTRATION line naming the VM host daemon and its VM plus the switch address, minvmd's own file log records the row on create and its withdrawal on destroy and on a Ctrl-C mid-activation, a box whose declared egress allow-list is registered host-side is refused the undeclared destination the bare box completed in the same run, and a registration refusal stops the session start with its cause instead of leaving the box unregistered — and the session e2e's own named case drives all of it, asserted through the VM host daemon's records rather than the CLI's output. Notes from the agent: The e2e line was run on this box and exited 0 via the case's native-host skip (its clear message is the transcript above); the VM-backed halves of the case could not execute here: this executor is native Linux with no /dev/kvm, no minvmd and no gvproxy, so its first real pass owes to the macOS runner and the KVM lane in CI. To run the line at all I had to build the CLI/daemon pair the harness gates on (cargo build --locked -p minimal --bin min -p minimald --bin minimald, the harness's own documented fallback — its PATH gate found the in-session |
…n-own-address-box-with-the-vm-host-dae
The KVM lane's first run of the own-address-box proof failed at its destroy half: the poll looked only for the INFO record the daemon writes when the creator's withdrawal request finds the row. On a live switch that is a race the design blesses — the box's sandbox teardown drops its per-box shuttle connection, the host egress gate reports the address its admitted frames were attributed to, and the drainer removes the row with no record of its own (NET-133: a box's row goes with its shuttle connection; NET-138 names both triggers) — so the CLI's request then finds no row, and the daemon answers the goal state with a DEBUG record the pinned `warn,minvmd=info` filter dropped. The proof now takes either record (box_row_end_record), pins its daemon one level deeper at `warn,minvmd=debug` so that answer is read, checks every withdrawal against the switch address its registration allocated, and dumps the destroy's own output plus the daemon log tail when no record appears, so a real failure names its cause from CI alone.
…n-own-address-box-with-the-vm-host-dae # Conflicts: # scripts/session-e2e.sh
|
Round 2 of 10 on a failed check suite, pushed as Resolved conflicts in:
Verify Outside the task's
Converted to a draft: something above needs a person before review. On a VM-backed host reached without a provider flag, as on macOS, an own-address box registers with the VM host daemon when it is created and withdraws when it is destroyed or interrupted — its row's end asserted through the daemon's own record, taking whichever of the design's two writers ended it — its declared egress is applied at the host gate, and a registration failure stops the session start with its cause instead of leaving the box unregistered. The gates-keyed and registration-failure halves are held by the two passing unit tests; the register/withdraw/declared-egress halves are asserted by the flagless e2e case, whose KVM-lane false failure (the directive's failed check) this round removes: the proof pinned only the creator's INFO record while the design (NET-133, NET-138) also ends a row through the host egress gate's attachment-end drainer, whose answer the proof now reads too. Notes from the agent: Directive round 2 addressed the failed checks ci-linux-kvm-success/test-kvm (run 37101416592, job 111142275103): its one failing annotation was the case's destroy half — 'the VM host daemon's log carries no withdrawal record for box e2e-box-reg after min session destroy'. Cause: the poll accepted only the INFO record withdraw_and_reply writes when the creator's request finds the row (crates/minvmd/src/control.rs), but on a live switch the destroy's sandbox teardown drops the box's per-box shuttle connection, the host egress gate reports the address its admitted frames were attributed to, and the withdrawal drainer (crates/minvmd/src/box_registry.rs spawn_withdrawal_drainer, which logs nothing) removes the row first — NET-133/NET-138 bless both writers — so the CLI's request then finds no row and the daemon answers the goal state with a DEBUG record the pinned warn,minvmd=info filter dropped. Fix, all inside the e2e layer the task names: a box_row_end_record helper that takes either record (message literals matched against control.rs's INFO and DE…[truncated] |
|
/review |
|
Approved: no findings at Nothing to do. Verdict APPROVE, posted as a comment: the App cannot review its own pull request; the check and the label carry it. Clobber: none: |
… the e2e The VM host daemon's registration line now carries the declared egress as the row received it. The T78 e2e case asserts the declared box's record names the switch address session start reported and every declared allow-list entry.
T78 — Register an own-address box with the VM host daemon whenever the CLI talks to one, macOS included
slice: S9
kind: task
covers: NET-081, NET-076
size: M
est: 180 code, 320 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: the session-start output and the daemon log carry one line naming the VM host daemon a box registered with, or the registration failure and its cause, so a bundle shows whether a macOS own-address box has a host row
observability: one info line per box at registration and at withdrawal naming the box and its switch address; one error line at session start when registration fails
layers:
- cli:
- crates/minimal/src/cmd/session.rs: the gates that decide whether the host is VM-backed (own-address registration, the control-socket path the start-line read and destroy withdrawal use) key on
client::client_provider_kind(..) == ProviderKind::Minvmd, the rule the fabric display already uses, never onuse_minvmd(), which is true only under an explicit--provider local-minvmdand so false on macOS where minvmd is the only backend; a registration failure is surfaced at session start and the session does not fall back to running unregistered- crates/minimal/src/cmd/mod.rs: the Ctrl-C cleanup withdraws through the same re-keyed gate
- crates/minimal/src/cmd/list.rs: the
min lsfallback keys on 8000 the same ruletest: cargo nextest run -p minimal vm_backed_gates_key_on_the_provider_kind_not_the_flag
test: cargo nextest run -p minimal registration_failure_is_surfaced_at_session_start
- e2e:
- scripts/session-e2e.sh: adds the case own_ip_box_registers_with_the_vm_host_without_a_provider_flag: run with no provider flag, an own-address box registers on create and withdraws on destroy and on Ctrl-C, and a box with a declared allow-list is refused an undeclared destination at the host gate
test: ./scripts/session-e2e.sh own_ip_box_registers_with_the_vm_host_without_a_provider_flag
produces: none
consumes:
- crates/minimal/src/cmd/session.rs
proof: On a VM-backed host reached without a provider flag, as on macOS, an own-address box registers with the VM host daemon when it is created and withdraws when it is destroyed or interrupted, its declared egress is applied at the host gate, and a registration failure stops the session start with its cause instead of leaving the box unregistered.
Proof
On a VM-backed host reached without a provider flag, as on macOS, an own-address box registers with the VM host daemon when it is created and withdraws when it is destroyed or interrupted, its declared egress is applied at the host gate, and a registration failure stops the session start with its cause instead of leaving the box unregistered.
Changes
min lsfallback) keys onclient_provider_kindthroughdaemon_provider_kind, never onuse_minvmd().BOX REGISTRATION:stderr line is printed at session start. The CLI's register and withdraw records moved from debug to info.crates/minimal/src/tests.rs, changed under revise ask 4, so its assertion holds on macOS.Tests
cargo nextest run -p minimal vm_backed_gates_key_on_the_provider_kind_not_the_flag: PASS, ci-linux-nativetestsjob 111151430770 at09012960. On Linux this test cannot catch a revert touse_minvmd(), because a flagless call already resolves to minimald there. The macOS e2e case below is the guard.cargo nextest run -p minimal registration_failure_is_surfaced_at_session_start: PASS, same job../scripts/session-e2e.sh own_ip_box_registers_with_the_vm_host_without_a_provider_flag: PASS on the macOSe2elane (job 111152443559), run with no provider flag. minvmd's log shows the registration, the destroy withdrawal, the Ctrl-C withdrawal, and the declared refusal. It also passes on the Linux KVMtest-kvmlane, which runs with the flag. The round-0 "exit 1" row was an executor-environment failure.Verify
The lane aggregators were green at
09012960: ci-success, ci-linux-native-success, ci-linux-kvm-success, ci-macos-success and ci-shell-installer-success. The branch has since been refreshed (see Base), and the lanes re-run on the new head.Base
Main
1de96cd9was merged at780e9f0d. Main gained #1853 (control-socket peer-uid check) and #1805 (T48 deny-all) since the last tested base, both on this PR's path. The macOS e2e lane must pass again on this tree before merge, because merge-queue builds run only the macOS aggregator.Review fix after the architecture review
472c85b0: the VM host daemon's registration line now carries the declared egress as the row received it. The e2e case asserts that the declared box's record names the switch address session start reported, and every declared allow-list entry. This substitutes for reading the row over the control socket, which has no read verb on main until T65 (#1813) lands.box_addresses_allocated_on_host_and_handed_to_daemonasserts the same field: PASS locally (just test, macOS scope).Follow-ups
on_activate, leaves the host row to the drainer, because the withdrawal guard is armed only after create (session.rs:852). Carried to #1873.host_side_rules_applied_outside_vm.Closes #1837