Repository navigation
feat(bep): name the kid when a store handle is refused as unknown_key (T70) - #2592
Conversation
The store handle checked debug line now carries the header kid for an unknown_key refusal, so an operator can see which client key the proxy does not hold (T70, BEP-063).
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Approved: no findings at Nothing to do. Verdict APPROVE, posted as a comment: the App cannot review its own pull request; the check and the label carry it. Clobber: none seen. |
There was a problem hiding this comment.
arch-review: PASS · the full ruling
This change conforms to Gatehouse §6.10 line 842. An unknown-key handle is still refused and audited as store_handle_invalid, and jti does not change. The kid goes only into the debug line. The design does not name fields for that line, and the value is escaped. The test proves the refusal and the new field. There are no conditions.
Ruled at 82cb748 against gominimal/arch@109541a48c31 by claude-opus-5-5.
There was a problem hiding this comment.
Own review at 82cb748: the kid is read from the unverified header only when verify fails with UnknownKey, it is logged escaped (?kid), and the test pins both the named line and its absence for a bad signature. No findings.
Generated by Claude Code
There was a problem hiding this comment.
Babysitter approval at 82cb748: every merge gate passes at this head (arch PASS at 82cb748, zero open threads, every lane aggregator green). Squash title feat(bep): name the kid when a store handle is refused as unknown_key (T70) and the squashed message pass commitlint. Queued for squash merge.
Generated by Claude Code
T70 — Name the kid when a store handle is refused as unknown_key
slice: S10
kind: task
covers: BEP-063
size: S
est: 20 code, 60 tests
executor: agent
difficulty: routine
model: standard
diagnostics: the
store handle checkedlog line names the handle's headerkidwhen the handle is refused asunknown_keyobservability: the existing debug line gains the
kidlayers:
- handle:
- crates/bep/src/handle.rs:
read()puts the headerkidin thestore handle checkedline for anunknown_keyrefusal; thestore_handle_invalidaudit marker andjtistay as they aretest: cargo nextest run -p bep an_unknown_key_refusal_names_the_kid
produces: none
consumes: none
proof: A store handle signed under a key the proxy does not hold is refused, and the log line names that key's
kid.depends on:
- assumes OQ3 (the mint reads the root certificate's own expiry, and the root is generated with a fixed default validity in one constant that gominimal/arch#85's ruling replaces)
- blocked by #2543
Generated by Claude Code
Proof
A store handle signed under a key the proxy does not hold is refused as store_handle_invalid, and its
store handle checkeddebug line now reads outcome=unknown_key with kid="<that key's kid>". The test an_unknown_key_refusal_names_the_kid shows this and also shows that a bad_signature refusal carries no kid.Notes from the agent: The kid comes from the unverified header, so it is logged escaped (Debug), the same as store and id. Only an unknown_key refusal logs the kid. The store_handle_invalid audit marker and the jti stay as they were. cargo clippy -p bep --all-targets and cargo fmt --check are clean.
Tests
cargo nextest run -p bep an_unknown_key_refusal_names_the_kidVerify
min task run agent-verifypassed ([tasks.verify]).Closes #2580