Repository navigation
test(e2e): close the Box Egress Proxy round-three conditions in one walk (T94) - #2673
Conversation
Add bep_round_three_conditions_closed. It walks one case per residual of the third round: the spec's jti and quarantine text, the pre-flip UDP 443 leg on a real kernel, the QUIC block helper in min finalize-install and in uninstall, the minted id check with no proxy, the stranded box's client key, and a store rule widened under a running bep serve. Each case prints PASS or NOT RUN with its gate at the end of the walk. The --config-dir rule case is NOT RUN on every lane: box creation mints no store handle yet (#2525), so no min command reaches that check.
The spec states the refused start over an unreadable audit line under BEP-068, not BEP-041. The round-three spec case now reads it there.
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Approved: every review thread resolved at @norrietaylor resolved the last thread, which releases the approval this review had withheld. Nothing to do. |
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The walk conforms to Gatehouse §6.10 and networking §5.7. Each case asserts what the design line requires, and no product code changes. Four cases were NOT RUN on your lane: the pre-flip UDP 443 leg and the three live-proxy cases. A NOT RUN leg is open, and no CI lane runs this walk. C1 tells you how to close them: record a PASS run from each lane, or file one issue that names the four cases. The --config-dir case stays a residual on #2525.
Ruled at 208b4a5 against gominimal/arch@109541a48c31 by claude-opus-5-5.
r3_proxy_down and the store-rule case matched every '/bep serve ' process. They now match 'serve --listener' on this run's socket under $XDG_STATE_HOME, so a proxy from another checkout keeps running (T94).
|
Round 1 of 10 on the runtime's review findings, pushed as
Verify Review threads the coder judged:
A person can run ./scripts/session-e2e.sh bep_round_three_conditions_closed. It prints one PASS or NOT RUN row per round-three condition, and each NOT RUN row names its gate. On this Linux box, three rows PASS: the spec names the audit jti and the quarantine, min finalize-install names the QUIC block helper, and uninstall removes it. The kernel UDP 443 leg, the three live-proxy legs and the --config-dir leg print NOT RUN with their gates. So this branch does not yet deliver the whole proof. The kernel leg needs a lane with sudo and nft. The live-proxy legs need a macOS lane. The --config-dir leg waits on #2525. Notes from the agent: Revise round 1. Fixed the foundry finding: the new r3_proxy_pids helper matches 'serve --listener' on this run's socket under $XDG_STATE_HOME, the argument that minvmd passes to bep serve. r3_proxy_down and the store-rule case's before and after pid capture now use r3_proxy_pids. The older proof_bep_destroy_with_proxy_down_refuses_by_attachment (near line 12447) has the same pgrep '/bep serve ' pattern. It is not part of this task, so I did not change it, and it needs its own fix. The arch C1 threads ask for lane evidence or a filed C1 issue. I have no gh credential, so a person must file the issue and link it from the PR body. bash -n and shellcheck -S warning are clean. |
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The round-three cases have the shape that Gatehouse §6.10 and networking §5.3 give, and each case fails closed. The compare narrows the bep serve match to this run's proxy, and an empty match fails the case. Four cases did not run, and no CI lane calls the walk. A NOT RUN leg is open, not a pass. Do C1 in the PR body: give a PASS line or a filed issue for each NOT RUN case. The --config-dir case stays a residual on #2525.
Ruled at b3e7c41 against gominimal/arch@109541a48c31 by claude-opus-5-5.
The shell captures only stdout from the python check, so a sys.exit message on stderr left the error line with an empty reason.
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 6 unresolved threads — minimal-arch[bot] scripts/session-e2e.sh:13770, minimal-arch[bot] scripts/session-e2e.sh:14206, minimal-arch[bot] scripts/session-e2e.sh:14179, minimal-foundry[bot] scripts/session-e2e.sh:13907, minimal-foundry[bot] scripts/session-e2e.sh:13847, …. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 2 conditions · the full ruling
The compare changes only the error text of the finalize-install JSON check, and the gate stays as hard as before. The earlier ruling stands for the rest of the walk. Four legs did not run at this head, and section 5.3 and section 6.10 govern them. C1 is the pre-flip UDP 443 leg on a native Linux lane with sudo and nft. C2 is the three live-proxy cases on the macOS gvproxy lane. Issue #2525 owns the --config-dir half of BEP-032.
Ruled at f69ba56 against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 2 of 10 on the runtime's review findings, pushed as
Verify Review threads the coder judged:
The round-three walk runs each condition. On this Linux lane it shows PASS for the spec jti and quarantine text, for min finalize-install naming the QUIC block helper, and for uninstall removing it. It shows NOT RUN with the gate for the kernel UDP 443 case (no passwordless sudo), the three live-proxy cases (macOS only), and the --config-dir store rule case (#2525). Those cases still owe evidence from a lane that has their gate. When the finalize-install JSON check fails, its error line now shows the reason. Notes from the agent: Revise round 2: the python check in proof_bep_r3_finalize_install_names_quic_helper now prints its reason on stdout and exits 1. It also reports a report that is not valid JSON in the same way. I ran the failure path by hand with an empty items list and with invalid JSON, and both reasons reached the captured output. Two sys.exit("...") calls near line 1464 belong to another case outside this task, and I did not change them. |
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — every review thread is resolved; @norrietaylor closed the last one. The review of f69ba56adc6b withheld this approval on the threads open then. Posted as a comment: the App cannot approve its own pull request; the check and the label carry it.
There was a problem hiding this comment.
Babysitter review at f69ba56a. I read the walk bep_round_three_conditions_closed in scripts/session-e2e.sh and checked it against the T94 plan block. Each round-three condition has a case that prints PASS or NOT RUN with its gate. The three cases that can run on a native box (spec text for BEP-039/041/068, min finalize-install --show naming the QUIC block helper, uninstall removing the helper and its sudoers rule) pass in the Tests line. The pre-flip UDP 443 case runs the T87 root test, and the minimald-root-integration job on this head passed it under sudo. The two LOW findings are fixed: r3_proxy_pids scopes the kill to this run's proxy socket, and the QUIC helper check prints its reason on stdout. The three macOS live-proxy cases are held on #2500 and #2657, and the --config-dir case on #2525. The PR body records each one under "Arch conditions". No further findings.
Generated by Claude Code
There was a problem hiding this comment.
Babysitter approval at f69ba56: every merge gate passes at this head (arch PASS at f69ba56, zero open threads, every lane aggregator green). Squash title test(e2e): close the Box Egress Proxy round-three conditions in one walk (T94) and the squashed message pass commitlint. Queued for squash merge.
Generated by Claude Code
T94 — Round-three conditions closed, end to end
slice: S12
kind: integration
covers: BEP-039, BEP-041, BEP-018, BEP-070, BEP-063, BEP-032
size: M
est: 0 code, 200 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: each case prints PASS or NOT RUN with its gate
observability: none beyond the cases' own output
layers:
- e2e:
- scripts/session-e2e.sh: one walk over the round-three conditions; NOT RUN where its gate is missing
test: ./scripts/session-e2e.sh bep_round_three_conditions_closed
produces: none
consumes: none
proof: The third round of residuals is done: the spec names the audit jti and the quarantine, a real kernel rejects a blocked cohort's pre-flip UDP 443 socket, min finalize-install names the QUIC block helper and uninstall removes it, a minted id is checked with no proxy running, a stranded box frees its client key, a widened store rule and a min --config-dir rule reach bep serve without a restart. Its tasks re-cover requirements whose origin tasks merged with an arch condition held on a filed residual; the owner accepted that double coverage on 2026-10-26 so the residuals dispatch as slices.
depends on:
- blocked by #2600
- blocked by #2613
- blocked by #2606
- blocked by #2607
- blocked by #2616
- blocked by #2617
- blocked by #2618
- blocked by #2620
- blocked by #2631
- blocked by #2257
- assumes OQ3 (the mint reads the root certificate's own expiry, and the root is generated with a fixed default validity in one constant that gominimal/arch#85's ruling replaces)
Proof
A person can run ./scripts/session-e2e.sh bep_round_three_conditions_closed. The walk prints PASS or NOT RUN with its gate for each round-three condition. On this native Linux box, three cases passed. The spec names the audit jti in BEP-039, the quarantine directory in BEP-041, and the refused start that names bep serve --quarantine-unreadable in BEP-068. min finalize-install --show lists the QUIC block helper. The installer uninstall names the helper and its sudoers rule, and its remedy removes both. Four cases are written but did not run here. They are the pre-flip UDP 443 leg on a real kernel (it needs passwordless sudo and nft), the minted id check with no proxy, the stranded box client key, and the widened store rule without a restart (these three need the macOS lane with gvproxy and a GitHub sign-in). The --config-dir rule case is NOT RUN on every lane, so the proof is not fully delivered for that half.
Notes from the agent: The min --config-dir rule half of the proof is not delivered end to end. mint_store_handle has no caller in box creation (crates/minimal/src/mint.rs says so, #2525), so no min command reaches the check that refuses a --config-dir rule. The case bep_r3_config_dir_rule_reaches_bep_serve records NOT RUN with that reason on every lane. Its unit tests in mint.rs still pin the check. On this box, the pre-flip UDP 443 case was NOT RUN (no sudo). The three live-proxy cases were NOT RUN (not macOS). Nobody has run them yet. The macOS lane with gvproxy and a sign-in must run them before anyone trusts them. Design notes for the reviewer: (1) The pre-flip case runs the T87 root integration test (cargo nextest run -p minimald --test netns_root_integration --run-ignored only) from the e2e and keeps that test's own NOT RUN gate. On a native lane, that compiles the minimald test binary. (2) The minted-id case kills bep serve and plants a new audit segment in ~/.minimal/bep/audit with one line that does not parse. It expects minvmd to refuse t…[truncated]
Arch conditions at
f69ba56anft: theminimald-root-integrationjob (122564124380) atf69ba56aprintedPASS [6.756s] (20/20) minimald::netns_root_integration a_blocked_cohort_rejects_a_pre_flip_udp_443_socket. The e2e case runs the same test.bepin the macOS CI testbed). These cases print NOT RUN until the macOS lane runs them.min --config-dirrule reachesbep serveTests
./scripts/session-e2e.sh bep_round_three_conditions_closedVerify
min task run agent-verifypassed ([tasks.verify]).Closes #2640
Generated by Claude Code