Repository navigation
feat(minimal): keep store rules under min --config-dir in step with bep serve (T92) - #2666
Conversation
…read A store rule read from a min --config-dir override reaches the handle only when bep serve, which reads the default config dir, holds the same rule. Otherwise min refuses the mint and names both locations (BEP-032).
…-rules-under-min-config-dir-in-step-wi
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Reviewed: no findings; approval withheld, 4 threads unresolved at APPROVE withheld: 4 unresolved threads — minimal-arch[bot] crates/minimal/src/mint.rs, minimal-arch[bot] crates/minimal/src/mint.rs, minimal-arch[bot] crates/bep/src/main.rs, minimal-foundry[bot] crates/minimal/src/mint.rs. Resolving the last thread releases the approval on this head. Resolve the open threads. Resolving the last one releases the approval on this head; no new review is required. Clobber: none seen. |
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The mint-time gate conforms to Gatehouse §6.10 line 842. min refuses a store handle unless bep serve holds the same rule, and every case that cannot decide refuses. One gap is open. proxy_rule copies the store_rule conversion from the bep binary, and the PR body leaves the move as later work with no issue. C1 tells you to file that issue and link it from proxy_rule and the PR body.
Ruled at 0f4bb3a against gominimal/arch@109541a48c31 by claude-opus-5-5.
proxy_rule in min copies store_rule in the bep binary. Each doc comment now names the other copy, so a change to one reaches both.
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The mint check conforms to Gatehouse §6.10 line 842. min refuses a store handle under a rule that bep serve does not hold. The new proxy_rule comment says that no issue tracks the copied store_rule conversion. A residual with no issue has no owner. File the issue and link it from both doc comments and the PR body (C1).
Ruled at 5b55cac against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 1 of 10 on a failed check suite, pushed as
Verify Review threads the coder judged:
A store rule written only under min --config-dir is refused at mint. The refusal says: "min did not mint a store handle for : bep serve reads store rules from , not from --config-dir ." A rule that bep serve holds in the same form, or an override that names the default config dir, is minted as before.Notes from the agent: Failed checks: the directive's log excerpts show only passing tests and the aggregator's exit 1. They do not name a failing test. At the branch head, after the merge of main, these runs pass: cargo nextest run -p minimal (784 passed), cargo nextest run -p bep -p boxes (825 passed), and cargo clippy -p minimal -p bep --all-targets -- -D warnings (clean). The doctests did not run, because this box has no rustdoc. I did not reproduce the CI failure, and I changed no code for it. The CI logs need a person to find the failing test. Thread C1: the real fix moves the store rule conversion into the bep library, for example crates/bep/src/handle.rs or crates/bep/src/store.rs. Those files are outside this task's layers. I cannot file an issue, because this session has no gh credential. A person must file the issue and put its URL in the proxy_rule doc comment and in the PR body. In this round, each copy's doc comment names the other copy. |
|
/revise Revise round on arch condition C1 at
Generated by Claude Code |
…-rules-under-min-config-dir-in-step-wi
Move store_rule into the bep library as StoreRule::from_config. bep serve and min's mint check now decide inject with one function, so the copy in mint.rs and its notes are gone. Give each cause of a store handle refusal under --config-dir its own text: an unread file, a refused rule, a deny rule and a rule that differs. Each names the file that bep serve reads.
There was a problem hiding this comment.
arch-review: PASS · the full ruling
The change conforms to Gatehouse §6.10 line 842. min refuses a store handle unless bep serve holds the same rule. The two now share one conversion, StoreRule::from_config, so min and redemption decide inject the same way. Every unread or different rule refuses, so the check fails closed. The one open item is the production caller of mint_store_handle. It must pass GlobalArgs.config_dir, and #2525 tracks it.
Ruled at e45320e against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 2 of 10 on a /revise note, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Review threads the coder judged:
A store rule written under min --config-dir is minted only when bep serve holds the same rule. Otherwise min refuses the mint and names the cause and the file that bep serve reads. There is one message each for: the rule exists only under --config-dir, the file that bep serve reads does not read, bep serve refuses its own rule, that rule is a deny rule, and that rule differs in the named fields. min and bep serve now convert a rule with one library function, StoreRule::from_config. Notes from the agent: Layer exception: crates/bep/src/handle.rs is outside T92's layers. The epic owner accepted it in the revise note, because StoreRule::from_config now lives there. Add a 'Layer exception' section to the PR body that names crates/bep/src/handle.rs. The runner writes the body, so I did not write it. I added one cause that the directive did not list: a rule that bep serve refuses when it reads it (BepRuleRefused). Without it, that case printed the '--config-dir' text, and that text was wrong for it. The deny and differs messages name the organization file as well when it exists, because the merged rule can take its fields or its deny action from that file. If the rule in the file bep serve reads has a different injection form, the differs message says 'a different header and basic_auth'. I did not run just clippy-strict. |
|
The runtime will not revise this pull request again on its own: the diff is +427/-29 (456 lines), past 3x the plan's estimate of 120 lines (est: 60 code, 60 tests, as #2620 reads now), at round 2 (the last trigger was a /revise note). A person decides now. Remove |
…-rules-under-min-config-dir-in-step-wi # Conflicts: # crates/bep/src/main.rs
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 4 unresolved threads — minimal-arch[bot] crates/minimal/src/mint.rs, minimal-arch[bot] crates/minimal/src/mint.rs, minimal-arch[bot] crates/bep/src/main.rs, minimal-foundry[bot] crates/minimal/src/mint.rs. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
There was a problem hiding this comment.
arch-review: PASS · the full ruling
This head is a merge of main into the PR. The PR's own change is the same as at e45320ef, which passed. The only conflict was the client_store_rules doc. The resolution keeps both the mint refusal and the T91 behaviour, and the code at this head matches the doc. BEP-032 conforms to Gatehouse §6.10 line 842. There are no conditions.
Ruled at 862558a against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
A merge of main before round 1, not counted against the cap (1 of 3), pushed as Resolved conflicts in:
Verify Outside the task's
Converted to a draft: something above needs a person before review. A store rule written only under min --config-dir is refused at mint, and the refusal names the file that bep serve reads. A rule that bep serve also reads is minted. Notes from the agent: This round resolved the merge conflict with main in the client_store_rules doc comment in crates/bep/src/main.rs. The resolution keeps this branch's sentence about the min refusal in place of the #2620 link. It takes main's sentence that the root's names and the admitted CONNECT set follow the rules at each CONNECT (StoreAdmission), so the #2618 restart limit is gone. The merge commit is 862558a. cargo clippy -p bep --all-targets is clean. scripts/session-e2e.sh and crates/bep/src/proxy.rs in the merge commit come from main, not from this task. |
|
The runtime will not revise this pull request again on its own: the diff is +427/-29 (456 lines), past 3x the plan's estimate of 120 lines (est: 60 code, 60 tests, as #2620 reads now), at round 1 (the last trigger was a conflict with the base branch). A person decides now. Remove |
There was a problem hiding this comment.
Own review at 862558a. min refuses to mint a store handle under a rule that bep serve will not hold, and the refusal names the cause. The cause can be: the rule exists only under --config-dir, the config bep serve reads does not parse, bep serve refuses or denies the rule, or the rule differs there in the named fields. The StoreRuleConfig to StoreRule conversion now lives once, in bep::handle::StoreRule::from_config. The mint check and redemption call it, so they cannot disagree on inject (Gatehouse §6.10 line 842).
Generated by Claude Code
There was a problem hiding this comment.
Babysitter approval at 862558a: every merge gate passes at this head (arch PASS at 862558a, zero open threads, every lane aggregator green). Squash title feat(minimal): keep store rules under min --config-dir in step with bep serve (T92) and the squashed message pass commitlint. Queued for squash merge.
Generated by Claude Code
T92 — Keep store rules under min --config-dir in step with bep serve
slice: S12
."kind: task
covers: BEP-032
size: S
est: 60 code, 60 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: when min would mint under a rule bep serve does not read, it refuses: "min did not mint a store handle for : bep serve reads store rules from , not from --config-dir
observability: none: the refusal prints to the person running min, and min logs nothing for a mint.
layers:
- config:
- crates/minimal/src/mint.rs: a store handle under a rule that exists only below a
--config-diroverride is refused with the diagnostics text, or the override reaches bep serve; the choice is the implementer's and the arch review's (#2620)- crates/bep/src/main.rs: the
client_store_rulesdoc names the behaviour in place of the #2620 linktest: cargo nextest run -p minimal a_store_rule_under_config_dir_is_minted_only_when_bep_reads_it
produces: none
consumes: none
proof: A store rule written under min --config-dir is either read by bep serve or refused at mint with the reason.
depends on:
- blocked by #2599
- blocked by #2257
Proof
A store rule written under min --config-dir is now either the same rule that bep serve reads from the default config dir, and min mints the handle, or min refuses the mint with: "min did not mint a store handle for : bep serve reads store rules from , not from --config-dir
."Notes from the agent: I chose the refusal path, not passing the override to bep serve. mint_store_handle takes a new config_dir argument and checks it before it signs. The check passes when the override resolves to the same config.toml that bep serve reads. It also passes when bep serve holds an identical rule after the merge with the organization file and the deny set. A deny rule, a rule in another form, or a bep config that does not read is refused. mint_store_handle still has no production caller (#2525), so the future caller must pass GlobalArgs.config_dir. proxy_rule in mint.rs repeats the StoreRuleConfig to StoreRule conversion that bep's main.rs store_rule does, because that function is in the bep binary and not in its library. A later task can move it into the library so there is one conversion. Clippy flagged eight arguments on mint_store_handle, so I added an expect attribute. The mint:: tests in minimal (12) pass. The refusal text is the text that the task's diagnostics line gives. It uses the product nouns min, bep serve and --config-dir.
Layer exception
The epic owner accepted this file outside T92's layers on 2026-10-27, for arch condition C1, which asked that the epic file no residual:
crates/bep/src/handle.rs:StoreRule::from_configis now the oneStoreRuleConfigtoStoreRuleconversion.bep serveandmin's mint check both call it, so they decideinjectwith the same code (Gatehouse §6.10 line 842).Tests
cargo nextest run -p minimal a_store_rule_under_config_dir_is_minted_only_when_bep_reads_itVerify
min task run agent-verifyexited 100 under rustc 1.99.0, which the repository does not pin (1.99.1 in rust-toolchain.toml); the PR is not a draft on that alone — CI, which honours the pin, is the gate.Base
The base branch moved while the coder worked; it was merged in before the tests ran.
Closes #2620
Generated by Claude Code