Repository navigation
feat(bep): attribute a host-address redemption to its cohort and mark the audit - #2511
Conversation
A host_ip sender that presents a value naming another live host_ip box of this host is admitted as Attributed::Cohort. The decision now gives the audit marker cohort_attributed for that admission, and a flag for the connection span (BEP-028).
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Approved: no findings at Nothing to do. Clobber: none seen. |
There was a problem hiding this comment.
arch-review: CONDITIONS · 2 conditions · the full ruling
The decision admits a host_ip cohort redemption correctly. But the audit record does not carry the cohort_attributed marker. Gatehouse §6.10 line 823 says cohort-sourced redemptions carry that marker. Redeemer::redeem drops the attribution, and forward.rs line 573 writes the admit with no marker. C1 carries Decision::marker() through Verdict::Admit into the record and widens T37's layers. C2 proves the marker on the audit record itself.
Ruled at 0b777b3 against gominimal/arch@109541a48c31 by claude-opus-5-5.
The cohort test now asserts the cross_box case that its doc comment names. The cohort_attributed doc comment no longer says that a span records the flag, because no span records it yet.
|
Round 1 of 10 on the runtime's review findings, pushed as
Verify Review threads the coder judged:
Partly delivered. In crates/bep/src/redeem.rs, the decision admits a host_ip sender that presents a value naming another live host_ip box as Attributed::Cohort, and Decision::marker() gives cohort_attributed for it. The audit record that the forwarder writes does not carry the marker yet: redeemer.rs maps every admit to Verdict::Admit, and forward.rs line 573 records the admit with marker None. So Notes from the agent: The task is cut too narrow for its proof. The layers name only crates/bep/src/redeem.rs. To put the marker in the audit record, crates/bep/src/forward.rs needs Verdict::Admit to carry the marker and record it at line 573, and to add a cohort_attributed field to the box_connection span. crates/bep/src/redeemer.rs needs to pass decision.marker() into Verdict::Admit, and needs a send-based test on records[0].marker. I did not touch those files. A follow-up task that names forward.rs and redeemer.rs in its layers must do this work. This round: the test now asserts the own_ip-from-another-box cross_box case, and the cohort_attributed doc comment no longer claims that a span records the flag. |
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 4 unresolved threads — minimal-arch[bot] crates/bep/src/redeem.rs:378, minimal-arch[bot] crates/bep/src/redeem.rs, minimal-arch[bot] crates/bep/src/redeem.rs:1415, minimal-foundry[bot] crates/bep/src/redeem.rs. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
There was a problem hiding this comment.
arch-review: CONDITIONS · 1 condition · the full ruling
The redemption decision and the new own_ip test case conform to Gatehouse §6.10 step 2. The audit record still does not carry cohort_attributed. Forwarder::decide writes every admit with marker: None (crates/bep/src/forward.rs:573), but §6.10 line 823 says that cohort-sourced redemptions carry the marker. Make the change in C1: carry Decision::marker() through Verdict::Admit into the audit record, and test the written record. Alternatively, link an open issue for that wiring in the PR body. Then the ruling becomes PASS_WITH_CONDITIONS with a residual.
Ruled at 412f30e against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 2 of 10 on a failed check suite: the coder changed nothing. This round has no commit. Nothing that this round asks for is inside the task's layers. (1) cargo-deny fails on a new RUSTSEC vulnerability advisory (timing variability) in the ecdsa/rfc6979/primeorder chain that russh pulls in. It also warns that the ignore for RUSTSEC-2026-0009 in deny.toml matches no crate. This branch changes only crates/bep/src/redeem.rs, so the failure is in the dependency graph on the base branch. The fix goes in deny.toml or Cargo.lock, outside this task. (2) ci-success is the lane aggregator and runs Review threads the coder judged:
|
|
/revise Carry the cohort attribution into the audit record and the span (arch C1 and C2 on review 5636951737, re-stated at 412f30e in review thread 4366094746). The task's layers were too narrow for the requirement, so #2284 now has an audit layer naming the files:
Gatehouse §6.10 line 823: cohort-sourced redemptions carry Generated by Claude Code |
Verdict::Admit now carries the decision's marker and cohort flag. The forwarder writes the admitted audit record with that marker, so a host_ip cohort redemption is recorded cohort_attributed (BEP-028). It also records cohort_attributed on the box_connection span, which declares the field.
|
Round 3 of 10 on a /revise note, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Review threads the coder judged:
A host_ip box that redeems a value naming another live host_ip box is admitted. Its audit record now carries the marker cohort_attributed, so Notes from the agent: Out of layers: crates/bep/src/proxy.rs has one added line. It declares |
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The marker now reaches the audit record and the box_connection span, so BEP-028 conforms to Gatehouse §6.10 line 823. One gap remains. The BEP-028 verify filter host_ip_redemption_is_cohort_attributed selects only the decide() test, and that test does not read an audit record. The test that proves the audit half has a different name. Rename it as C1 says, and run the filter at this head.
Ruled at 2835db0 against gominimal/arch@109541a48c31 by claude-opus-5-5.
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 5 unresolved threads — minimal-arch[bot] crates/bep/src/redeem.rs:378, minimal-arch[bot] crates/bep/src/redeem.rs, minimal-arch[bot] crates/bep/src/redeem.rs:1415, minimal-foundry[bot] crates/bep/src/redeem.rs, minimal-arch[bot] crates/bep/src/redeem.rs:378. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
|
Revise round 2 ran against |
|
/revise One rename for arch C1 at 2835db0 (review thread 4366138662): the audit-half test in crates/bep/src/redeemer.rs is named Generated by Claude Code |
The spec's verify filter host_ip_redemption_is_cohort_attributed now selects the audit-record test too.
|
Round 4 of 10 on a /revise note, pushed as
Verify Review threads the coder judged:
A host-address box redeems a value that names another live host-address box. The proxy admits it, and its audit record carries the cohort_attributed marker. The spec's verify filter host_ip_redemption_is_cohort_attributed now selects both the decision test and the audit-record test. Notes from the agent: This round renames one test only: cohort_admit_is_recorded_cohort_attributed is now host_ip_redemption_is_cohort_attributed_in_the_audit_record. No other code changed. |
There was a problem hiding this comment.
arch-review: PASS · the full ruling
This head conforms to Gatehouse §6.10 line 823. A host_ip sender is admitted only for a live host_ip box of this host. The admitted audit record carries cohort_attributed, and the box_connection span carries the flag. The test rename lets the BEP-028 verify filter select the audit-record test, so the proof tests the cited rule. Update the ## Proof paragraph in the PR body. It still says the marker does not reach the audit log.
Ruled at 3106832 against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 5 of 10 on the runtime's review findings, pushed as
Verify Review threads the coder judged:
A host-address box that redeems a value naming another live host-address box is admitted, and its audit record (min box audit ) carries the cohort_attributed marker. The box_connection span records cohort_attributed only when the admit stands. Notes from the agent: Revise round 5: moved span.record("cohort_attributed", ...) in Flow::decide after substitute succeeds, so a refused substitution does not show the cohort flag on the span. |
There was a problem hiding this comment.
arch-review: PASS · the full ruling
This head conforms to Gatehouse §6.10 line 823. The only change since 31068320 moves the cohort_attributed span record after a successful substitution. The audit marker path does not change. The span flag now matches the audit record on a refused substitution. The PASS on the earlier head stands.
Ruled at 9c4bda7 against gominimal/arch@109541a48c31 by claude-opus-5-5.
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 6 unresolved threads — minimal-arch[bot] crates/bep/src/redeem.rs:378, minimal-arch[bot] crates/bep/src/redeem.rs, minimal-arch[bot] crates/bep/src/redeem.rs:1415, minimal-arch[bot] crates/bep/src/redeem.rs:378, minimal-arch[bot] crates/bep/src/redeemer.rs, …. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — every review thread is resolved; @norrietaylor closed the last one. The review of 9c4bda7c1615 withheld this approval on the threads open then. Posted as a comment: the App cannot approve its own pull request; the check and the label carry it.
There was a problem hiding this comment.
Babysitter verification at 9c4bda7, on the owner's decision after round 6 stalled (Revising since 06:01Z with no push).
- Arch ruled PASS at 9c4bda7 (check-run
arch-review). - All six review threads verified against the code and resolved: the admission marker rides
Verdict::Admitinto the audit record (redeemer.rs 361–365, forward.rs 570–587); thebox_connectionspan declares and recordscohort_attributedafter a successful substitution (proxy.rs 347, forward.rs 583); the send-based testhost_ip_redemption_is_cohort_attributed_in_the_audit_recordpins the record and is selected by the verify filter; the span flag stays unset on a refused substitution. - PR body Proof and Notes updated to describe this head: they said the marker did not reach the audit log, which rounds 3 to 5 fixed.
- Layer exception for proxy.rs stands as recorded in the body.
No code was pushed. Remaining red: ci-success on the base-branch cargo-deny advisory, fixed by #2517.
Generated by Claude Code
There was a problem hiding this comment.
arch-review: PASS · the full ruling
This head is a merge of main into the head that passed before. The PR's own diff did not change. The merge touches no file in crates/bep, and it does not touch BEP-028. The cohort attribution and the cohort_attributed audit marker still satisfy Gatehouse §6.10 line 823. The PASS carries forward to this head.
Ruled at c6c0b83 against gominimal/arch@109541a48c31 by claude-opus-5-5.
There was a problem hiding this comment.
Babysitter verification at c6c0b83. This head is GitHub's merge of main fa31776 onto 9c4bda7, which the earlier review covered; arch re-ruled PASS here and minimal-review approved the head as a base merge only. Zero open threads, every lane aggregator green. Squash title feat(bep): attribute a host-address redemption to its cohort and mark the audit passes commitlint.
Generated by Claude Code
There was a problem hiding this comment.
Babysitter approval at c6c0b83: every merge gate passes at this head (arch PASS, zero open threads, every lane aggregator green, bot resolutions re-verified). The one failing gate, no-implement-in-flight, is a stale runtime round the owner waived on 2026-10-24. Squash title feat(bep): attribute a host-address redemption to its cohort and mark the audit and the squashed message pass commitlint. Queued for squash merge.
Generated by Claude Code
T37 — Attribute a host-address redemption to its cohort and mark the audit
slice: S7
kind: task
covers: BEP-028
size: S
est: 100 code, 60 tests
executor: agent
difficulty: needs care
model: standard
diagnostics:
min box audit <box>shows a cohort redemption markedcohort_attributedobservability: the connection span gains the cohort flag
layers:
- decide:
- crates/bep/src/redeem.rs: admits a host-address sender presenting a value naming a live host-address box, marked
cohort_attributedtest: cargo nextest run -p bep host_ip_redemption_is_cohort_attributed
produces: none
consumes: none
proof: A host-address box redeems a value naming another live host-address box, and its audit record is marked cohort-attributed.
depends on:
- blocked by #2276
Proof
In crates/bep/src/redeem.rs, the redemption decision admits a host_ip sender that presents a value naming another live host_ip box of this host. The admission is Attributed::Cohort, and Decision::marker() gives
cohort_attributedfor it. The test host_ip_redemption_is_cohort_attributed shows this. It also shows that the same value is refused ascross_boxwhen the named box is outside the cohort, and that the expiry and revocation checks still apply. Rounds 3 to 5 carried the marker into the audit log: Verdict::Admit carries decision.marker(), the forwarder writes it on the admitted record, and host_ip_redemption_is_cohort_attributed_in_the_audit_record in redeemer.rs shows the record. The forwarder also records cohort_attributed on the box_connection span after the substitution succeeds.Notes from the agent: Before this task, decide() already admitted a cohort sender as Attributed::Cohort. This task adds Attributed::marker() (
cohort_attributedfor Cohort, None for OwnBox), Decision::marker() (the refusal marker or the attribution marker), Decision::cohort_attributed() as the span flag, and the named test. The only layer is redeem.rs, so I did not wire the marker into the audit record or the connection span. In redeemer.rs, Redeemer::redeem matchesDecision::Admit { .. }, and Verdict::Admit has no marker field. forward.rs and proxy.rs write the admitted audit Decision with no marker. A follow-up must carry decision.marker() through Verdict::Admit into the audit record. It must also record decision.cohort_attributed() on the connection span. Rounds 3 to 5 made that change (redeemer.rs, forward.rs, proxy.rs, under the audit layer the owner added to #2284), so the diagnostics line holds end to end at 9c4bda7. I ran clippy -p bep --all-targets with no warnings, and cargo fmt --check is clean.Tests
cargo nextest run -p bep host_ip_redemption_is_cohort_attributedVerify
min task run agent-verifypassed ([tasks.verify]).Layer exception
Round 3 (2835db0) touched crates/bep/src/proxy.rs, outside the layers the PR header lists: one
cohort_attributed = tracing::field::Emptyline in thebox_connectionspan declaration, plus the doc sentence that names the field. forward.rs records the field that proxy.rs declares, so the audit layer the owner added to #2284 for arch C1 cannot land without it. Accepted under the owner's layer-exception rule of 2026-10-19; #2284 and the plan now name proxy.rs in the audit layer.Closes #2284
Generated by Claude Code