Repository navigation
feat(minimal): list each store reference with its authorities in min box spec (T61) - #2569
Conversation
Each store row in min box spec now prints the upstream authorities that the matching [secret-store-rules] rule registers. A reference with no matching rule says so.
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Approved: every review thread resolved at @norrietaylor resolved the last thread, which releases the approval this review had withheld. Nothing to do. |
There was a problem hiding this comment.
arch-review: PASS · the full ruling
The change conforms to Gatehouse §6.10 line 849. min box spec now lists each store reference with the authorities that its [secret-store-rules] rule registers. The rules come from the reader and the matcher that box create uses, so the listing matches the minted handle. The task names BEP-063, but the requirement that this change delivers is BEP-038. Correct that label in the plan. No condition.
Ruled at 23782d9 against gominimal/arch@109541a48c31 by claude-opus-5-5.
A rule with action = "deny" can keep an upstream. The row printed that upstream, so it implied the box can redeem the reference. The row now says the rule denies the reference and lists no authorities.
There was a problem hiding this comment.
arch-review: PASS · the full ruling
The new commit shows a deny store ru
8000
le as denied in min box spec, and it lists no authorities for that rule. A denied reference gets no authority, so the row is now exact. Gatehouse §6.10 line 849 requires this exact listing. The rest of the ruling on 23782d94 stands. No conditions.
Ruled at da81692 against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 1 of 10 on the runtime's review findings, pushed as
Verify Review threads the coder judged:
Notes from the agent: Revise round 1: the one finding holds. config.rs keeps a non-empty upstream on a rule that the merge sets to deny (the "shared" case in its tests), so the old row implied the box can redeem the reference. Ask-action rules still print their authorities, because an ask can be answered yes. cargo clippy -p minimal --all-targets shows no warnings in minimal. |
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — every review thread is resolved; @norrietaylor closed the last one. The review of da8169260e6a withheld this approval on the threads open then. Posted as a comment: the App cannot approve its own pull request; the check and the label carry it.
There was a problem hiding this comment.
Babysitter approval at da81692: every merge gate passes at this head (arch PASS at da81692, zero open threads, every lane aggregator green). Squash title feat(minimal): list each store reference with its authorities in min box spec (T61) and the squashed message pass commitlint. Queued for squash merge.
Generated by Claude Code
T61 — List each store reference with its authorities in min box spec
slice: S9
kind: task
covers: BEP-063
size: S
est: 60 code, 80 tests
executor: agent
difficulty: routine
model: standard
diagnostics:
min box spec <box>lists each store reference the box declares with the authorities its rule registersobservability: none beyond the printed listing
layers:
- spec:
- crates/minimal/src/cmd/box_spec.rs: prints each store reference under the grant with the authorities the matching store rule registers
test: cargo nextest run -p minimal box_spec_lists_store_references_with_their_authorities
produces: none
consumes: none
proof:
min box specon a box with one store reference prints the reference and the authorities its rule registers.depends on:
- blocked by T27
- assumes OQ3
Generated by Claude Code
Proof
min box specon a box that declares one store reference, such askeychain:claude, printsstore keychain:claude CLAUDE upstream api.anthropic.com, .... The list is the authorities that the matching [secret-store-rules] rule registers. A reference with no matching rule printsno rule in [secret-store-rules] in config.toml.Notes from the agent: The command reads the merged user and organization store rules through read_client_config_and_store_rules, and only when the project declares a store reference. That reader fails closed on an organization config that does not parse, as box creation does. A matching rule with an empty upstream prints
no upstream registered. This is the deny rule that the reader adds for an item whose rules are all refused. The old row textno hosts registeredis gone. No doc or script pinned that text. clippy -p minimal --all-targets reports no warning in box_spec.rs. The warnings it prints are in other crates and existed before this change.Tests
cargo nextest run -p minimal box_spec_lists_store_references_with_their_authoritiesVerify
min task run agent-verifyexited 101 under rustc 1.98.1, which the repository does not pin (1.97.0 in rust-toolchain.toml); the PR is not a draft on that alone — CI, which honours the pin, is the gate.Closes #2541