test(e2e): revoke a box or sign out, end to end (T23) by minimal-foundry[bot] · Pull Request #2610 · gominimal/minimal

minimal-foundry · 2026-10-26T08:41:49Z

T23 — Revoke a box or sign out, end to end

slice: S1
kind: integration
covers: none
size: M
est: 80 code, 120 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: min box audit <box> shows the revocation and the refusals that follow it
observability: one info log line per revocation and per logout, as the tasks emit them
layers:
- e2e:
- scripts/session-e2e.sh: one case: destroy a box, re-create it under its name, log out, sign in again, and see each refusal and admit
test: ./scripts/session-e2e.sh bep_revoke_and_sign_out_end_to_end
produces: none
consumes: none
proof: Destroy a box or log out, and every value naming it is refused within a m 8000 inute; a re-created box works, and a later sign-in revives nothing.
depends on:
- blocked by #2277
- blocked by #2278
- blocked by #2286

Proof

On a macOS host with a live Box Egress Proxy and a GitHub sign-in, 'E2E_BEP_LOGOUT=1 ./scripts/session-e2e.sh bep_revoke_and_sign_out_end_to_end' runs one box name through the full story. A destroyed box gets a revocation record within 60 s. The box re-created under its name gets a new id, and its own value is admitted. The destroyed box's value is refused (cross_box). After 'min auth logout' the box's next request is refused (github_sign_in_required) and the box keeps running. After 'min auth login --device' both old values stay refused with new refusal records, and a box started after the sign-in is admitted. 'min box audit' shows each step.

Notes from the agent: The case could not run its body here: the proxy runs on macOS only, so bep_live_gate records it NOT RUN on this Linux box. The macOS VM lane (or a person on a Mac) still owes the live evidence. The case needs a person: it signs the machine out, then runs 'min auth login --device' and tees its stderr so the person can enter the code. For this reason it is gated on E2E_BEP_LOGOUT=1, the same gate as the logout case, and it runs after that case in the whole-lane order. The check that a sign-in revives nothing expects the proxy to mark the refusal of a pre-logout reference as github_sign_in_required after a new sign-in. The redeemer returns no credential on an instance mismatch, so that is the expected marker, but no live run confirmed it. The observability line (one info log per revocation and logout) belongs to the tasks this one depends on. This case only greps bep.log for those lines on a failure.

Tests

line	exit	tail
`./scripts/session-e2e.sh bep_revoke_and_sign_out_end_to_end`	0	::group::destroy, re-create, log out and sign in again: each refusal and admit bep_revoke_and_sign_out_end_to_end: NOT RUN (the case signs this machine out of GitHub and asks for a sign-in code: set E2E_BEP_LOGOUT=1 to run it) ::endgroup:: session e2e: 1 case(s) NOT RUN: bep_revoke_and_sign_out_end_

Verify

min task run agent-verify exited 101 under rustc 1.98.1, which the repository does not pin (1.99.0 in rust-toolchain.toml); the PR is not a draft on that alone — CI, which honours the pin, is the gate.

toredEnv {
    |        ^^^^^^^^^^^^^
    |
    = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.98.0/index.html#must_use_candidate
help: add the attribute
    |
402 + #[must_use]
403 | pub fn deferring_env() -> StoredEnv {
    |

error: this method could have a `#[must_use]` attribute
    --> crates/boxes/src/core/compose.rs:1019:12
     |
1019 |     pub fn lifecycle_hooks_teardown(&self) -> impl DoubleEndedIterator<Item = &ProvenancedHook> {
     |            ^^^^^^^^^^^^^^^^^^^^^^^^
     |
     = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.98.0/index.html#must_use_candidate
help: add the attribute
     |
1019 ~     #[must_use]
1020 ~     pub fn lifecycle_hooks_teardown(&self) -> impl DoubleEndedIterator<Item = &ProvenancedHook> {
     |

error: this function has a `#[must_use]` attribute with no message, but returns a type already marked as `#[must_use]`
    --> crates/boxes/src/core/primitives.rs:1085:5
     |
1085 |     pub fn as_sandbox_path(&self) -> &SandboxRelPath {
     |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     |
help: remove `must_use`
    --> crates/boxes/src/core/primitives.rs:1084:5
     |
1084 |     #[must_use]
     |     ^^^^^^^^^^^
     = note: alternatively, you may add an explicit reason to the `must_use` attribute
     = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.98.0/index.html#double_must_use
     = note: `-D clippy::double-must-use` implied by `-D warnings`
     = help: to override `-D warnings` add `#[allow(clippy::double_must_use)]`

error: this function has a `#[must_use]` attribute with no message, but returns a type already marked as `#[must_use]`
    --> crates/boxes/src/core/primitives.rs:1302:5
     |
1302 |     pub fn host_path(&self) -> &HostAbsPath {
     |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     |
help: remove `must_use`
    --> crates/boxes/src/core/primitives.rs:1301:5
     |
1301 |     #[must_use]
     |     ^^^^^^^^^^^
     = note: alternatively, you may add an explicit reason to the `must_use` attribute
     = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.98.0/index.html#double_must_use

error: this function has a `#[must_use]` attribute with no message, but returns a type already marked as `#[must_use]`
    --> crates/boxes/src/core/primitives.rs:1309:5
     |
1309 |     pub fn destination(&self) -> &SandboxRelPath {
     |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     |
help: remove `must_use`
    --> crates/boxes/src/core/primitives.rs:1308:5
     |
1308 |     #[must_use]
     |     ^^^^^^^^^^^
     = note: alternatively, you may add an explicit reason to the `must_use` attribute
     = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.98.0/index.html#double_must_use

error: could not compile `boxes` (lib) due to 6 previous errors
warning: build failed, waiting for other jobs to finish...

Base

The base branch moved while the coder worked; it was merged in before the tests ran.

Residuals

T96 — Run bep_revoke_and_sign_out_end_to_end live on a Mac #2655: the live run of bep_revoke_and_sign_out_end_to_end on a Mac with a GitHub sign-in (arch C1). It needs a person to enter the device code, so no unattended lane runs it.

Closes #2291

Generated by Claude Code

Destroy a grant box, re-create it under its name, log out and sign in again, and check each refusal and admit in 'min box audit'.

…ox-or-sign-out-end-to-end

coderabbitai · 2026-10-26T08:41:56Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: bb2e7a96-6eba-4afe-b5cf-cff3fd9ddcae

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

minimal-foundry · 2026-10-26T08:43:26Z

Approved: no findings at 1570de3c2c1d.

Nothing to do.

Verdict APPROVE, posted as a comment: the App cannot review its own pull request; the check and the label carry it.

Clobber: none: the change only adds code.

minimal-foundry

`minimal-review` — approved

Verdict APPROVE — No findings.

Panel: 3 of 3 personas ran (correctness, security, supply-chain).

minimal-arch

arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling

The new case asserts each design line for destroy, re-create, logout and re-login, and its checks are hard. Gatehouse §6.10 lines 823 and 839 govern it. The leg ran NOT RUN on this lane, and a NOT RUN leg is open. C1 asks for the macOS live transcript, or for an issue that owns the run, named in the PR body as a residual. With that, the change conforms.

_{Ruled at 1570de3 against gominimal/arch@109541a48c31 by claude-opus-5-5.}

minimal-foundry · 2026-10-26T09:01:12Z

Round 1 of 10 on a failed check suite: the coder changed nothing. Failed check 'tests': the directive's log excerpt shows only passing tests and the job cleanup. It does not name the failing test. This branch changes only scripts/session-e2e.sh. That path triggers the whole workspace suite through the scripts/** filter. I ran every Rust test that reads scripts/ (shell_lint, package_version, installer_stop_signal), and they pass. I also ran the tests for the code the base merge brought in (minimald box_runtime, minimal secret and config), and they pass. I did not run the whole workspace suite, because no test: line names it. I found no failure to fix, so I changed nothing. A person must read the full job log for the failing test name, or re-run the job if the failure was a flake. 'ci-linux-native-success' is the lane aggregator. It fails because 'tests' failed. The review thread asks for a macOS run of the case and a posted transcript, or a filed issue. This session has no Mac, no person at the device flow and no gh credential, so it can d…[truncated]

Review threads the coder judged:

👎 invalid — scripts/session-e2e.sh:12863: No code change can close this. The gate is correct: the case signs the machine out of GitHub and needs a person to enter the device code, so it must not run unattended. The open item is a manual run of 'E2E_BEP_LOGOUT=1 ./scripts/session-e2e.sh bep_revoke_and_sign_out_end_to_end' on a Mac, or an iss

norrietaylor

Own review at 1570de3. proof_bep_revoke_and_sign_out_end_to_end walks one box name through destroy, re-create, min auth logout and min auth login --device. It checks each refusal and admit in min box audit: the old value refused cross-box, github_sign_in_required after the logout, and a box started after the new sign-in redeems. It runs only with E2E_BEP_LOGOUT=1, because it signs the machine out and needs a person at the device flow. Otherwise bep_live_gate records it NOT RUN. The values are never printed. The live Mac run is filed as #2655 (arch C1).

Generated by Claude Code

norrietaylor

Babysitter approval at 1570de3: every merge gate passes at this head (arch PASS at 1570de3, zero open threads, every lane aggregator green). Squash title test(e2e): revoke a box or sign out, end to end (T23) and the squashed message pass commitlint. Queued for squash merge.

Generated by Claude Code

minimal-foundry Bot added 2 commits October 26, 2026 08:40

test(e2e): revoke a box and sign out, end to end in one case (T23)

870c02d

Destroy a grant box, re-create it under its name, log out and sign in again, and check each refusal and admit in 'min box audit'.

Merge remote-tracking branch 'origin/main' into agent/2291-revoke-a-b…

1570de3

…ox-or-sign-out-end-to-end

minimal-foundry Bot requested a review from a team as a code owner October 26, 2026 08:41

minimal-foundry Bot mentioned this pull request Oct 26, 2026

T23 — Revoke a box or sign out, end to end #2291

Closed

minimal-foundry Bot mentioned this pull request Oct 26, 2026

Local box egress proxy — sealed GitHub credentials and host-store secrets without Gatehouse #1501

Open

minimal-foundry Bot commented Oct 26, 2026

View reviewed changes

minimal-foundry Bot added the review:approved minimal-review approved the current head label Oct 26, 2026

minimal-arch Bot approved these changes Oct 26, 2026

View reviewed changes

Comment thread scripts/session-e2e.sh Resolved

This was referenced Oct 27, 2026

T95 — Stop node_port_assigned_on_host_and_handed_to_daemon racing a parallel test for its port #2653

Closed

T96 — Run bep_revoke_and_sign_out_end_to_end live on a Mac #2655

Open

norrietaylor reviewed Oct 27, 2026

View reviewed changes

norrietaylor changed the title ~~T23 — Revoke a box or sign out, end to end~~ test(e2e): revoke a box or sign out, end to end (T23) Oct 27, 2026

norrietaylor approved these changes Oct 27, 2026

View reviewed changes

norrietaylor added this pull request to the merge queue Oct 27, 2026

Merged via the queue into main with commit f16806a Oct 27, 2026
40 of 42 checks passed

norrietaylor deleted the agent/2291-revoke-a-box-or-sign-out-end-to-end branch October 27, 2026 01:55

Navigation Menu

Repository navigation

test(e2e): revoke a box or sign out, end to end (T23) - #2610

test(e2e): revoke a box or sign out, end to end (T23)#2610
norrietaylor merged 2 commits into
mainfrom
agent/2291-revoke-a-box-or-sign-out-end-to-end

Uh oh!

Review skipped

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Uh oh!

T23 — Revoke a box or sign out, end to end

Proof

Tests

Verify

Base

Residuals

Uh oh!

Review skipped

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

minimal-review — approved

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`minimal-review` — approved