Repository navigation
docs(specs): record runtime ports in the host table within the host-held grant - #1898
Merged
Merged
Conversation
…eld grant NET-138 said the client records a port the attached human answered yes to under ask. The client attaches through a terminal and never sees the answer, and only the in-VM daemon observes a listener. The in-VM daemon now reports each runtime port, and the helper records it only inside the dynamic_ingress stance and range the host-side creator registered with the row. A report outside that grant is refused and leaves no partial mapping. The guest-report exclusion now names declared ports, so runtime ports are the one report the table takes.
Contributor
|
Warning Review limit reached
This review includes 1 billable file and costs up to $0.25.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 31 minutes for your next included review. View limit detailsLimit details: You’ve used all 2 included reviews currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (1)
Comment |
Contributor
Spec lint
Advisory. None of this blocks the merge; the review decides. Advisory, and never a merge gate. Linter: |
Member
Author
|
Amended in 1af5846 to meet the three conditions from the design review:
The "not a rule change" claim now cites Gatehouse §6.11's single node-asserted input instead of standing on its own. |
norrietaylor
marked this pull request as ready for review
October 3, 2026 17:04
norrietaylor
enabled auto-merge
October 3, 2026 17:04
Contributor
|
Approved: no findings at Nothing to do. Clobber: none: |
norrietaylor
marked this pull request as draft
October 3, 2026 17:08
auto-merge was automatically disabled
October 3, 2026 17:08
Pull request was converted to draft
The host now holds the pending-ask book, so the premise that only the in-VM daemon sees an answer is gone. List every runtime port a row admits, state the cap and rate as the working values the code fixes, and name the host audit writers.
…ement The ask rule is the security property of the runtime-port path, so state it as a requirement with its own proof, not only in annotations.
norrietaylor
marked this pull request as ready for review
October 6, 2026 05:42
mitodrummer
approved these changes
Oct 6, 2026
This was referenced Oct 6, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Oct 7, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
NET-138 on main still says "IF the in-VM daemon reports … a port … keep it out of the table", and its note says the client records the ports the attached human answered yes to under
ask. Neither matches the code on main. The VM host daemon (minvmd) records runtime ports reported by the in-VM daemon inside the row's host-held grant, and it holds the pending-ask book itself.This change makes the spec describe that behaviour:
dynamic_ingress = allow, listen-published ports (NET-016/017) and portsmin net exposepublishes (NET-044); underask, ports the attached human answered yes to (NET-045). Every runtime port lies inside the row's range.allowports: the in-VM daemon reports each one. The helper records it only inside the stance and range the host-side creator registered with the row. A report selects inside that grant and never changes a rule (design §7.6).askports: the in-VM daemon's report only raises the question. The host holds the pending ask, offers it to attached host clients with facts read from the host row, records the first answer and audits it. Anaskport enters the row only on a yes the host recorded, and a guest report underaskis refused.allowgrant, or raise an ask that the offer names by the sibling's host-row facts.allowadmits a port inside the range.askadmits one only after the attached human's yes recorded by the host (NET-045).denystance,askstance, absent range, port outside the range), or for a row the table does not hold, is refused, and the in-VM publish unwinds with no partial mapping (NET-047).RUNTIME_PORT_CAP= 256 runtime ports per row andROW_ADMIT_RATE_PER_SECOND= 10 recorded admit reports per trailing second per row. A re-admit of a held port and a withdrawal count toward neither. A host-recordedaskyes is bounded by the ask queue and the dialog, not by the cap or rate.crates/minvmd/src/control.rsappends toaudit/box-admissions.logfor each recordedallowport (admit_report_and_reply→append_audit_copy) and for each ask event, the outcome included (serve_guest_ask→audit_ask). A refusedallowreport is a warn line in the daemon log, not an audit line, and the spec says so.Plan
T84 #1897 implements this. It takes over T54's dropped CLI layer and covers T53's allow path, T54's yes answer, and T22's listen-publish on VM-backed hosts. Every
verif 8000 ytarget names a test on main:admit_report_recorded_within_host_grant,admit_report_refused_outside_range_or_under_denyandadmit_report_refused_past_row_cap_or_rateincrates/minvmd/src/box_registry.rs.Lint
just lint-proseon the spec: main has 579 errors and 293 warnings. This branch has 588 and 296. The added alerts are the patterns every requirement block already carries: theverify:line (STE "verify", noun string, test-name spelling) and STE sentence length on the EARS sentences. Vale does not lint the annotation comments.