Repository navigation
test(e2e): close the round-one arch conditions end to end (T56) - #2604
Conversation
Add bep_conditions_closed_end_to_end, which runs the git credential helper, signing rotation and host_ip cohort cases and prints PASS or NOT RUN with its gate for each. Add bep_host_ip_cohort_blocks_udp_443: under its own classifier install, a quic443 = "block" box blocks UDP 443 for the cohort, and the block lifts when it leaves. not_run now records each gate, so the walk can name it.
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Approved: every review thread resolved at @norrietaylor resolved the last thread, which releases the approval this review had withheld. Nothing to do. |
There was a problem hiding this comment.
arch-review: CONDITIONS · 2 conditions · the full ruling
The cohort case tests §5.3 line 150 correctly, but no lane runs it. It is in the named dispatch only, and it is not in the whole-lane order. On CI it records NOT RUN when a gate misses, but proof_host_ip_deny_all fails there. A NOT RUN leg is open, so T56 does not yet prove the cohort block. Add the case to the whole-lane order (C1). Make a missing gate on CI a failure (C2).
Ruled at e165543 against gominimal/arch@109541a48c31 by claude-opus-5-5.
Place proof_bep_host_ip_cohort_blocks_udp_443 in the whole-lane order, after proof_host_ip_deny_all and before the daemon-fetch proof, so a native lane runs it. On CI a missing classifier gate is now a lane fault, as in proof_host_ip_deny_all. Off CI and on a VM lane it stays NOT RUN.
|
Round 1 of 10 on a failed check suite, pushed as
Verify Review threads the coder judged:
A person can run ./scripts/session-e2e.sh bep_conditions_closed_end_to_end. It runs the git credential helper, signing rotation and host_ip cohort cases, and prints PASS or NOT RUN with its gate for each. A native lane's whole walk now also runs the cohort UDP 443 block case. On this box all three cases are NOT RUN, so this branch does not show the residuals closed live. That evidence is still owed by the macOS lane with a sign-in and E2E_BEP_PRIVATE_REPO, and by a native CI lane that can load the classifier table. The store-reference check at creation and the CA deny set have their own unit tests in crates/bep, which earlier tasks added. Notes from the agent: The failed checks: the directive's log excerpt for the 'tests' job shows only passing nextest lines and the job cleanup, not the test that failed. No Rust test reads scripts/session-e2e.sh, and this branch changes only that script, so I did not find a cause in this diff. ci-linux-native-success is the lane aggregator and fails because 'tests' failed. A re-run of the job, or the full job log, is needed to name the failing test. shellcheck -S warning reports nothing on the script. |
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 3 unresolved threads — minimal-foundry[bot] scripts/session-e2e.sh:24828, minimal-arch[bot] scripts/session-e2e.sh:24827, minimal-arch[bot] scripts/session-e2e.sh:12913. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The compare closes the baseline's gaps. The host_ip cohort case now runs in the native lane order, and a missing classifier gate fails on CI. The case proves the §5.3 line 150 rule: the cohort is blocked with an active reject while one member blocks, and the block lifts when it leaves. The helper and rotation legs (BEP-015, BEP-061) are NOT RUN on every lane, because no lane sets E2E_BEP_PRIVATE_REPO. C1 holds them open on #2500, so the change can merge.
Ruled at 207e19e against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 2 of 10 on a failed check suite: the coder changed nothing. No change this round, on purpose. Failed checks: (1) The Review threads the coder judged:
|
|
/revise Round 3 of #2604, on the red
Generated by Claude Code |
…-closed-end-to-end
Launch a throwaway host-address box first, as proof_host_ip_deny_all does, so box A is created against a per_box fact. cq_fail now prints the launch records too. The cgroup.procs counts read wc -l from a redirect, which shellcheck 0.9.0 asks for (SC2002).
…-closed-end-to-end
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 4 unresolved threads — minimal-foundry[bot] scripts/session-e2e.sh:25005, minimal-arch[bot] scripts/session-e2e.sh:25004, minimal-arch[bot] scripts/session-e2e.sh:13052, minimal-arch[bot] scripts/session-e2e.sh:13332. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The compare changes only the cohort case's setup and diagnostics. The warm-up box adds an assertion and relaxes no gate, because each launch re-reads the host. The cohort case still proves §5.3 line 150 as an active reject, in the whole lane. The BEP-015 and BEP-061 legs still record NOT RUN on every lane. C1 holds them open on #2500 until the macOS lane records PASS for both.
Ruled at a268042 against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 3 of 10 on a /revise note, pushed as
Verify On a lane with a sign-in, E2E_BEP_PRIVATE_REPO and a classifier-capable host, ./scripts/session-e2e.sh bep_conditions_closed_end_to_end walks the helper, rotation and cohort cases. Elsewhere it prints NOT RUN with the gate for each case. This round makes the cohort case warm the daemon's per-box fact with a throwaway box before box A, and its failure output now shows the launch records. This box ran no case past its gate, so the cases themselves are not proved here. Notes from the agent: Revise round 3. Item 1: the merge of main was already on the branch (95c6328), and origin/main has no commits past it. Item 2: both SC2002 lines now read |
|
Revise round 2 ran against |
|
/revise Round 4 of #2604, on the red The failure. The cause. A session box launches on its first exec, not at
Generated by Claude Code |
A session box launches on its first exec, not at activate. The cohort case now runs one exec, with one retry, in box A and box B before it greps their launch record or stance change. cq_fail also prints the case's stderr files.
…-closed-end-to-end # Conflicts: # scripts/session-e2e.sh
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The compare adds one exec in each cohort box before the case reads the daemon log. It also prints the case's stderr files on a failure. Both make the BEP-018 proof stronger, and neither relaxes a gate. The ruling on a2680427 stands for the rest. C1 keeps the three e2e legs open until each one prints PASS on its lane. The PR body still says the cohort case is in the named-case dispatch only. That is stale. Update it to say the case runs in the whole-lane order.
Ruled at 9c35508 against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 4 of 10 on a /revise note, pushed as Resolved conflicts in:
Verify Review threads the coder judged:
On a native lane with the classifier, the cohort case now runs a first exec in box A and in box B before it reads their launch record and stance change, so box A's launch record exists when the case reads it. When the case fails, it prints its stderr files, the activate stderr included. Notes from the agent: Round 4 addresses only the directive's items 1 and 2. Box A and box B each get |
|
Revise round 2 ran against |
|
Round 5 of 10 on the runtime's review findings: the coder changed nothing. Revise round 5: no code change. Both open threads ask for something this session cannot deliver with a commit. This box has no sudo, no nft, no VM, no GitHub sign-in and no E2E_BEP_PRIVATE_REPO. So I could not run any of the three cases, and I report no PASS for them. The PASS for the cohort case is owed by the native Linux CI lane. The PASS for the helper and rotation cases is owed by the macOS VM lane with a sign-in and E2E_BEP_PRIVATE_REPO (#2500). The cohort case stays in the whole-lane order. Thread PRRT_kwDOPdfcxM6wJtCu (arch C1) asked for that placement, and it was answered valid in round 2. Review threads the coder judged:
|
|
/revise Round 5 of #2604, on the red The failure.
Generated by Claude Code |
A host-address box's socket is in the host netns, so the reject runs in the local OUTPUT hook and socat's send fails with Operation not permitted. Also assert that box A's own leaf is in the refused set, and dump those log records on failure.
|
Round 6 of 10 on a /revise note, pushed as
Verify On a native lane with nft and passwordless sudo, the cohort case now accepts the reject as the host netns reports it. Box A's probe fails at once with 'Operation not permitted' or 'Connection refused' in under 2000 ms. The case also asserts that the daemon log records box A's own leaf added to the set that is refused UDP 443, so a silent drop cannot pass. The helper and rotation cases still need a lane with a sign-in and E2E_BEP_PRIVATE_REPO. Notes from the agent: Round 6. Item 1: cq_rejected accepts 'Operation not permitted' or 'Connection refused' and keeps rc != 0 and ms < 2000. cq_not_rejected refuses both strings. Item 2: after box B joins, the case polls the daemon log (up to 10 s) for "added a host-address box's own leaf to the set that is refused UDP 443" with box A's box_id (crates/minimald/src/net/classifier.rs log_set_change). cq_fail dumps the tail of those records. Item 3: the cq_probe comment, the case header and both ::error:: texts now name 'Operation not permitted'. Item 4: no daemon or ruleset code changed. This box has no nft, so the cohort case records NOT RUN here. The new assertion is unverified until native-daemon-e2e runs it. |
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 7 unresolved threads — minimal-foundry[bot] scripts/session-e2e.sh:25311, minimal-arch[bot] scripts/session-e2e.sh:25310, minimal-arch[bot] scripts/session-e2e.sh:13316, minimal-arch[bot] scripts/session-e2e.sh:13636, minimal-arch[bot] scripts/session-e2e.sh:13642, …. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The compare changes only the cohort probe, and it conforms to §5.7 line 218. The probe now accepts EPERM, because the reject runs in the local OUTPUT hook. The new check on box A's leaf in the refused set, together with the pinned reject verb, still tells a reject from a drop. All three legs of the walk are still NOT RUN. C1 keeps them open. Record the ci-linux-native result for the cohort case on this head. The helper and rotation legs stay on #2500.
Ruled at 83231b3 against gominimal/arch@109541a48c31 by claude-opus-5-5.
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — every review thread is resolved; @norrietaylor closed the last one. The review of 83231b37dc75 withheld this approval on the threads open then. Posted as a comment: the App cannot approve its own pull request; the check and the label carry it.
There was a problem hiding this comment.
Own review at 83231b3. bep_conditions_closed_end_to_end walks the helper, rotation and cohort cases, and the cohort case is in the whole-lane order. On the ci-linux-native lane at this head it PASSed. Box A alone waited 3 s. Beside box B with quic443 = "block", A's send failed in 3 ms with EPERM, which is the local OUTPUT-hook reject. The daemon logged A's own leaf added to the refused set, which tells the reject from a drop. After B left, A sent again. With CI set, a missing classifier gate fails the lane. The helper and rotation legs need the macOS VM lane with a sign-in, and they are held on #2500 (T82), as the arch ruling at 83231b3 allows.
Generated by Claude Code
There was a problem hiding this comment.
Babysitter approval at 83231b3: every merge gate passes at this head (arch PASS at 83231b3, zero open threads, every lane aggregator green). Squash title test(e2e): close the round-one arch conditions end to end (T56) and the squashed message pass commitlint. Queued for squash merge.
Generated by Claude Code
T56 — Conditions closed, end to end
slice: S9
kind: integration
covers: BEP-015, BEP-061, BEP-018, BEP-034
size: M
est: 0 code, 220 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: each e2e case prints PASS or NOT RUN with its gate, and the daemon log tail names the cohort flag changes
observability: none beyond the cases' own output
layers:
- e2e:
- scripts/session-e2e.sh: one walk that runs the helper, rotation and cohort cases on a lane with a sign-in and E2E_BEP_PRIVATE_REPO, and records NOT RUN elsewhere (#2500)
test: ./scripts/session-e2e.sh bep_conditions_closed_end_to_end
produces: none
consumes: none
proof: the residuals the arch left open at merge are done: git in a grant box sends a header the proxy substitutes, an operator rotates a running proxy's signing certificate and the box keeps pushing, a blocked
host_ipcohort sends no UDP 443, every store reference is checked at creation, and the CA deny set is the decided one. Its tasks re-cover requirements whose origin tasks merged with an arch condition held on a filed residual; the owner accepted that double coverage on 2026-10-24 so the residuals dispatch as one slice.depends on:
- blocked by T50
- blocked by T51
- blocked by T52
- blocked by T53
- blocked by T54
- blocked by T55
- blocked by T58
- blocked by T59
- blocked by T60
- blocked by T61
- blocked by T62
- blocked by T63
Proof
A person can run ./scripts/session-e2e.sh bep_conditions_closed_end_to_end. It runs the git credential helper case (a grant box clones and pushes, so git sent a header the proxy substituted), the signing rotation case (the box keeps pushing after bep --rotate-signing), and a new host_ip cohort case. In the cohort case, a quic443 = "block" box makes UDP 443 from every host-address box get ICMP port unreachable, and the block lifts when that box leaves. At the end the walk prints PASS or NOT RUN with its gate for each case. The daemon log tail names the cohort stance changes. The store-reference check at creation and the CA deny set are not part of this walk. Their own tasks (T50 to T63) carry the tests for them.
Notes from the agent: On this box all three cases recorded NOT RUN: no E2E_BEP_PRIVATE_REPO, the proxy lane is macOS only, and there is no nft for the classifier install. So no case body ran here. The new cohort case (bep_host_ip_cohort_blocks_udp_443) is unverified, and it needs a native Linux host with nft, ip and passwordless sudo. The helper and rotation cases need the macOS VM lane with a sign-in and E2E_BEP_PRIVATE_REPO. No lane runs all three cases at once, because the proxy runs on macOS only and the cohort block runs only in a native daemon's classifier. Each case gates on its own facts, and the cohort case needs no sign-in. (Round 1 put the cohort case in the named-case dispatch only. Round 2 also added it to the whole-lane order, after
proof_host_ip_deny_all, as arch C1 asked, so theci-linux-nativelane runs it.) not_run now also records each gate in E2E_NOT_RUN_WHY, so the walk can print it. The cohort case declares quic443 = "block" for the blocking member and does not use a grant box. This follows the precedent of bep_dns_steering_fails_closed_end_to_end, and on Linux it needs no sign-in. The rotation case header still says that no box ships a git credential helper until #2499 lands. That comment can be stale, and I did not change it.Tests
./scripts/session-e2e.sh bep_conditions_closed_end_to_endci-linux-nativenative-daemon-e2eat83231b37, whole-lane order (https://github.com/gominimal/minimal/actions/runs/40439201715/job/121975209521)Verify
min task run agent-verifyexited 101 under rustc 1.98.1, which the repository does not pin (1.99.0 in rust-toolchain.toml); the PR is not a draft on that alone — CI, which honours the pin, is the gate.Closes #2544
Generated by Claude Code