Repository navigation
docs(specs): amend BEP-063 for client-key revocation, replacement and the bound (T71) - #2594
Conversation
Amend BEP-063 with sub-requirements for revocation by kid, the three-step replacement, the pending-revoke retry and the registry bound. Each one names an existing test. Move the refused-key verify line to the client-side test, and record the one-client-per-user question (gominimal/arch#144).
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Spec lint
Advisory. None of this blocks the merge; the review decides. Advisory, and never a merge gate. Linter: |
|
Approved: every review thread resolved at @norrietaylor resolved the last thread, which releases the approval this review had withheld. Nothing to do. |
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The new BEP-063 sub-requirements conform to Gatehouse §6.10 line 842. Each verify line names a test that exists, and the text matches the code. One statement is incomplete. A successful replacement revokes the refused key, so the client's own running boxes lose their store handles and sign-in references before they end. Section 6.10 line 839 says these work for the life of the box. Make the two spec edits in C1 to state this.
Ruled at 6a4e641 against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
/revise Round 1 of #2594, on the arch condition at 6a4e641 (PASS_WITH_CONDITIONS, C1, threads 4373914120 and 4373914123). No round is in flight. This is a spec-only change.
One commit, Conventional Commits subject, every body line at most 72 characters. Generated by Claude Code |
…063-for-client-key-revocation-replacem
A successful replacement revokes the refused key in step three, so this client's own running boxes lose the store handles and sign-in references signed under it. The order's guarantee holds only on the failure paths. The arch#144 entry now names this case beside the second-client case.
|
Round 1 of 10 on a /revise note, pushed as
Verify Review threads the coder judged:
Spec 24 states client-key revocation, replacement and the registry bound, each with a verify line that names an existing test. The replacement rationale now says that a successful replacement revokes the refused key, so this client's own running boxes lose their store handles and sign-in references. The gominimal/arch#144 entry names that case beside the second-client case. Notes from the agent: Revise round 1 is in commit 3922df7. just lint-prose did not run because vale is not installed on this box. I did not reply on or resolve the threads. The runtime posts the verdicts, and the reviewer resolves the threads. |
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The spec changes for BEP-063 match the code in crates/bep/src/control.rs and crates/minimal/src/mint.rs. Each verify line names a test that exists. Step three of the replacement and the registry bound end the references of running boxes. Gatehouse §6.10 line 839 says those references work for the life of the box. The spec now states this conflict and links gominimal/arch#144. When that issue rules, make the spec edit in C1. The change can merge with C1 open.
Ruled at 3922df7 against gominimal/arch@109541a48c31 by claude-opus-5-5.
A successful replacement revokes the refused key, so this client's own running boxes lose their store handles and sign-in references. The requirement text now says so, pending gominimal/arch#144.
|
Round 2 of 10 on the runtime's review findings, pushed as
Verify Review threads the coder judged:
Spec 24 states client-key revocation by kid, replacement in three steps with the pending-revoke retry, and the registry bound of 16 keys, each with a verify line that names an existing test. The replace clause now also says in its requirement text that this client's own running boxes lose the references signed under the revoked key, pending gominimal/arch#144. Notes from the agent: Revise round 2. The requirement text of the replace clause now states the loss and names gominimal/arch#144. The HTML comment now says that the verify test pins the loss: a_replaced_client_key_is_revoked_at_the_proxy asserts that a handle minted under the old key before the replacement no longer verifies after it, and after a proxy restart too. just lint-prose did not run, because vale is not installed on this box. |
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The spec amendment conforms to Gatehouse §6.10 line 842 for revocation by kid, the replacement order, the retry and the verify lines. The replacement still revokes the refused key, so this client's own running boxes lose their references before they end. Line 839 says those references work for the life of the box. This head states that loss in the EARS line and holds it open on gominimal/arch#144, so the merge can go ahead. Apply C1 when arch#144 rules.
Ruled at 3e3e5e7 against gominimal/arch@109541a48c31 by claude-opus-5-5.
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 6 unresolved threads — minimal-arch[bot] docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md, minimal-arch[bot] docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md, minimal-foundry[bot] docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md, minimal-arch[bot] docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md, minimal-arch[bot] docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:499, …. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
3e3e5e7 to
0263c63
Compare
…063-for-client-key-revocation-replacem
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
This head has the same tree as 3e3e5e7c, so the earlier ruling stands. Kid revocation, the pending-revoke retry and the registry bound conform to Gatehouse §6.10 lines 839 and 842. The replace clause revokes the refused key under a running box. Line 839 says the references work for the life of the box. The spec states that loss and links gominimal/arch#144, so the merge can go ahead. Make the C1 spec edit when arch#144 rules.
Ruled at 0263c63 against gominimal/arch@109541a48c31 by claude-opus-5-5.
The client writes the file after it registers the replacement and before the keychain keeps it. Also state the running-box loss that the registry bound causes, pending gominimal/arch#144.
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The new pending-revoke wording matches local_client_key_at() in crates/minimal/src/mint.rs. The new statement of the registry-bound loss is correct. A key that the replacement revokes, or that the bound drops, still ends the handles of a running box. Gatehouse §6.10 line 839 says those handles work for the life of the box. The spec parks this under gominimal/arch#144, so C1 from the baseline stays open as a filed residual. Amend BEP-063 when arch#144 rules.
Ruled at 0c00b02 against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 3 of 10 on the runtime's review findings, pushed as
Verify Review threads the coder judged:
Spec 24 BEP-063 states revocation by kid, the three-step replacement with the pending-revoke retry, and the registry bound of 16. Each one has a verify line that names an existing test. The pending-revoke requirement now says when the client writes the file, and that matches local_client_key_at. The bound's comment and the gominimal/arch#144 entry now state the loss to running boxes. Notes from the agent: Round 3. The pending-revoke requirement now says the replacement is revoked again from the file that names its kid. Its comment says the client writes the file after step one and before step two, as mint.rs does. I added the running-box loss to the registry-bound comment and to the NEEDS CLARIFICATION entry for gominimal/arch#144. The two arch threads that ask for a change after arch#144 rules need nothing yet, because that issue has not ruled. just lint-prose did not run because vale is not installed on this box. |
There was a problem hiding this comment.
arch-review: CONDITIONS · 1 condition · the full ruling
The commit a698353 names #2605 and the arch#144 ruling for both known gaps. This closes the earlier condition. The merge of main brings in bep serve --max-client-keys (T69). The bound comment at line 502 still says the proxy binary has no setting for the bound. That is now false, and the spec misstates how the registry in Gatehouse §6.10 line 842 is bounded. Make the edit in C1. Then the change conforms.
Ruled at 9031b38 against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 7 of 10 on a /revise note, pushed as
Verify Review threads the coder judged:
Spec 24 states client-key revocation, replacement and the registry bound, each with a verify line that names an existing test. The known gaps in the replace and bound sub-requirements now link #2605 and the gominimal/arch#144 ruling comment. Notes from the agent: Round 7 changed only the two comments. The SHALL statements and verify lines are unchanged. I was not able to run |
9031b38 to
d29def8
Compare
|
/revise Round 8 of #2594, on arch condition C1 at 9031b38 (CONDITIONS). No round is in flight. Spec-only. I reworded one commit body for commitlint and force-pushed, with the tree unchanged, so fetch the branch first. The merge of main brought in T69 (#2593):
Generated by Claude Code |
T69 added the flag. The comment under the registry bound still said the proxy binary has no setting for it. State the flag, its default, the refusal below 1 and the test that pins them.
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 6 unresolved threads — minimal-foundry[bot] docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md, minimal-foundry[bot] docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md, minimal-arch[bot] docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md, minimal-arch[bot] docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md, minimal-foundry[bot] docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:502, …. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
There was a problem hiding this comment.
arch-review: CONDITIONS · 2 conditions · the full ruling
Two BEP-063 sub-requirements state the current code and not the design. The replace clause revokes every other key, and the bound drops the least recent key. Both end the handles of a running box. Gatehouse §6.10 line 839 says these handles work for the life of the box. Restore the design text and name the tests that will exist, as C1 and C2 say. Issue #2605 then carries the code.
Ruled at d29def8 against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 8 of 10 on a /revise note, pushed as
Verify Review threads the coder judged:
Spec 24 states client-key revocation, replacement and the registry bound, each with a verify line that names an existing test. The comment under the registry bound now says that Notes from the agent: Round 8 changed one clause in the BEP-063 registry-bound comment and nothing else. The #2605 and arch#144 links are unchanged. I was not able to run |
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The compare corrects the bound note. bep serve --max-client-keys exists, it defaults to KeyBound::DEFAULT_MAX_KEYS (16), and serve_passes_its_key_bound_to_the_control_socket tests it. Every other verify line names a test that exists at head. The replacement and bound sub-requirements still end the references of a running box. Gatehouse §6.10 line 839 keeps those references for the life of the box. The spec declares that gap and links #2605, so C1 stays open as a filed residual.
Ruled at acecdcd against gominimal/arch@109541a48c31 by claude-opus-5-5.
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The compare fixes one rationale comment. It now says that the client removes the pending-revoke file after a successful revoke, and revoke_others in crates/minimal/src/mint.rs does this. The rest of BEP-063 keeps the baseline ruling. Client-key replacement and the registry bound still end the store handles of a running box. Gatehouse §6.10 line 839 keeps those handles working for the life of the box. The spec states this as a known gap, and #2605 owns it. C1 is that residual.
Ruled at 44ea298 against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 9 of 10 on the runtime's review findings, pushed as
Verify Review threads the coder judged:
Spec 24 BEP-063 states client-key revocation by kid, the three-step replacement with the pending-revoke retry, and the registry bound. Each has a verify line that names a test that exists on this branch. The retry comment now says the client removes the pending-revoke file when the revoke succeeds, as revoke_others in crates/minimal/src/mint.rs does. Notes from the agent: Round 9 changes one comment in the spec. The four minimal-arch threads (C1, C2) are judged invalid: the task's proof requires each verify line to name an existing test and to state what the code does today. An earlier round accepted a finding that a verify line naming a missing test made the proof false. #2605 owns the change of the requirement and its tests, and the spec links it as a known gap with the arch#144 ruling. If the planner wants the target behaviour in the SHALL now, the task proof must change first. |
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 2 unresolved threads — minimal-arch[bot] docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:494, minimal-arch[bot] docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:502. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
There was a problem hiding this comment.
Own review at 44ea298. The spec states BEP-063 as the code does it today: register, keep, revoke by kid, the pending-revoke retry the client clears, and the --max-client-keys bound. Each line names a test that exists. The running-box loss is a known gap that links the arch#144 ruling and #2605 (T84), which owns the fix and edits these lines. No other findings.
Generated by Claude Code
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — every review thread is resolved; @norrietaylor closed the last one. The review of 44ea298036bb withheld this approval on the threads open then. Posted as a comment: the App cannot approve its own pull request; the check and the label carry it.
There was a problem hiding this comment.
Babysitter approval at 44ea298: every merge gate passes at this head (arch PASS at 44ea298, zero open threads, every lane aggregator green). Squash title docs(specs): amend BEP-063 for client-key revocation, replacement and the bound (T71) and the squashed message pass commitlint. Queued for squash merge.
Generated by Claude Code
|
The merge-queue run for this PR (run 40295417981, Generated by Claude Code |
T71 — Amend BEP-063 for client-key revocation, replacement and the registry bound
slice: S10
kind: task
covers: BEP-063
size: S
est: 0 code, 60 tests
executor: agent
difficulty: routine
model: standard
diagnostics: none, a spec change
observability: none: a spec change writes no log line
layers:
- spec:
- docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md: the BEP-063 sub-requirements and the
[NEEDS CLARIFICATION]entry that #2578 lists (revocation bykid, replacement in three steps with the pending-revoke retry, the registry bound, the verify-line move, the rationale at line 475, gominimal/arch#144)test: cargo nextest run -p minimal a_replaced_client_key_is_revoked_at_the_proxy
produces: none
consumes: none
proof: Spec 24 states client-key revocation, replacement and the registry bound, each with a verify line that names an existing test.
depends on:
- assumes OQ3 (the mint reads the root certificate's own expiry, and the root is generated with a fixed default validity in one constant that gominimal/arch#85's ruling replaces)
- blocked by #2543
Generated by Claude Code
Proof
Spec 24 now has BEP-063 sub-requirements for client-key revocation by kid, the three-step replacement, the pending-revoke retry and the registry bound. Each one has a verify line that names an existing test: a_revoked_client_key_no_longer_verifies_a_store_handle, a_replaced_client_key_is_revoked_at_the_proxy, a_replaced_client_key_is_revoked_at_the_proxy_after_a_failed_revoke and the_registry_never_holds_more_keys_than_its_bound.
Notes from the agent: I did not have the text of #2578 or gominimal/arch#144. I wrote the arch#144 open-question entry from the one-client-per-socket-owner assumption in crates/bep/src/control.rs, and it also says the 16-key bound has no ruling. Check that entry against the issue. The verify-line move: the refused-key sub-requireme 8000 nt now names the minimal test a_refused_client_key_is_replaced_and_registered_before_the_mint. The bep test a_client_key_this_program_is_refused_is_replaced proves only that a second key goes in beside the first. The rationale change: the comment under BEP-063 now says that a kid revocation ends every handle signed under the key. The frontmatter
updated:is now 2026-10-26. just lint-prose did not run because vale is not installed on this box.Tests
cargo nextest run -p minimal a_replaced_client_key_is_revoked_at_the_proxyVerify
min task run agent-verifyexited 101 under rustc 1.98.1, which the repository does not pin (1.99.0 in rust-toolchain.toml); the PR is not a draft on that alone — CI, which honours the pin, is the gate.Closes #2578