Repository navigation
T13 — Mint every box's id in the VM host and take it only from there - #2759
mitodrummer merged 8 commits into
Conversation
The in-VM daemon asks the VM host daemon for the id of each box it creates, over the report door, with a new `mint_box_id` verb. The host answers with the id its registration minted for the box's row, or a fresh UUIDv7 for a box with no row. The guest files the record under that id, and ignores any box id the create request carries. A native host still mints in its own store (BOX-001, BOX-002).
The new VM-lane test creates a box with a box id in the request and checks that the box comes back with a fresh UUIDv7, never the request's id (BOX-002). The connect and create steps move into helpers that the exec test shares.
…-box-s-id-in-the-vm-host-and-take-it-o
|
/revise The maintainer accepted the three out-of-layer edits (crates/minimal-client/src/box_registration.rs, crates/minimald/src/rpc.rs, crates/minimald/src/store.rs); keep them, and keep within the layers plus those three files. Fix the real-VM regression CI found in |
|
That Nothing to type again: the command gets a rocket when its round starts, or a refusal that names the reason. No round was counted for it yet. |
The in-VM daemon now takes every box id from the guest report door, which only the supervisor (minvmd run) binds. A bare minvmd boot has no door, so every create in this harness was refused on the KVM lane.
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Round 1 of 10 on a failed check suite, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. A box that the in-VM daemon creates carries the id that the VM host daemon (minvmd run) minted. The VM harness minimald_session_integration now boots under that daemon, so on the KVM lane vm_host_mints_box_id_before_in_vm_create shows the box id is a fresh UUIDv7 from the VM host, not the id in the create request. Notes from the agent: Cause of the failed test-kvm check: the CI log excerpt did not show the failed test, so I found the cause by reading the code. minimald_session_integration booted the VM with a bare |
A create whose box id minvmd did not mint returned an io::Error of kind Other, which the CreateSession handler maps to an internal error and answers by closing the channel. The client then read an empty reply (EOF) with no cause, as minimald_exec_over_bridge saw on the KVM lane. The refusal is now a typed error the handler answers with its text, and the text names what happened. The new in-process tests drive the create over the socket against a report door that serves the mint and against no door, and both get a reply. The VM harness now prints a refused create's text.
…-box-s-id-in-the-vm-host-and-take-it-o
|
Round 2 of 10 on a /revise note, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. A box created in the VM carries the id that minvmd minted. When minvmd gives no id, the create gets a reply that says why, in place of a closed connection. Notes from the agent: Cause of the EOF: when the mint failed, the create returned an io::Error of kind Other. serve_create_session (rpc.rs) maps that kind to ConnectionError::Internal and drops the channel with no reply. The CI log points at the harness line from e2652e7 (run_session_exec called at line 192). That version booted the VM with a bare |
|
Reviewed: 1 finding, none blocking at Address the comments on the diff. Clobber: none seen in the mint path. |
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The change conforms to architecture.md line 499. minvmd mints every box id on a VM guest. The in-VM daemon ignores the id in the request and refuses the create when minvmd does not give an id. One proof is open. The VM test vm_host_mints_box_id_before_in_vm_create did not run. It also passes when the guest mints its own UUIDv7. Make it read minvmd's mint record, and run it in the vm lane (C1).
Ruled at afba317 against gominimal/arch@42d214dc8ac8 by claude-opus-5-5.
The mint verb took the switch address from the in-VM daemon's client. A second create that named another box's address took that box's id. The VM host daemon now refuses a second mint for one row. The VM test now reads the supervisor's minvmd.log for the mint record, so a box id that the in-VM store minted no longer passes it. The create refusals now say what to do next, and the one for a missing id no longer names minvmd or splices a transport error.
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 2 conditions · the full ruling
BOX-002 conforms on this head. minvmd mints every VM box id, and the guest create fails closed without that id. The new row claim stops a guest client from taking another row's id. The VM test now reads minvmd's own log, so it proves line 499 of architecture.md. Two items are open. C1: run the deferred VM test and record its result. C2: correct the mint_box_id doc comment, which still says a mint changes nothing.
Ruled at 8969d21 against gominimal/arch@42d214dc8ac8 by claude-opus-5-5.
|
Round 3 of 10 on the runtime's review findings, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Review threads the coder judged:
A box created in the VM carries the id that the VM host daemon minted. The VM test now also finds the supervisor's 'minted the box id for an in-VM create' log record with that box_id, so an id that the in-VM store minted fails it. The VM host daemon gives one row's id to one create only. Notes from the agent: Deferred: cargo nextest run -p minvmd vm_host_mints_box_id_before_in_vm_create (lane: vm). I did not run it on this box. The C1 thread asks for it to run on this head in the vm lane. crates/minimald/src/store.rs is outside the task's layers. An earlier round of this branch changed it, and thread PRRT_kwDOPdfcxM6yGhTs points at it, so this round changed only its refusal text. The one-claim set in control.rs is a process static. A minvmd restart forgets it, but a restart also drops rows that are not reloaded. just clippy-strict was not run. |
|
/revise One fix for minimal-review thread PRRT_kwDOPdfcxM6yG1vt (MEDIUM) and arch C2 together. Keep within the layers plus the three accepted files. The VM host claims a row's id on the first Then rewrite the |
The in-VM daemon now sends one token per create on every mint attempt. The VM host records the token with the row's claim. A repeat ask with the same token gets the same id, so a lost or late reply no longer turns a healthy create into a refusal. An ask with another token, or none, for a claimed row is still refused.
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The compare conforms to architecture.md line 499. minvmd still mints every VM box's id, and a retry of one create now gets the same row id. Another create, or an ask with no token, is still refused, so the claim fails closed. One leg is open. The VM-lane test that reads minvmd's own mint record did not run. Run it through just test-vm and record the result, as C1 says.
Ruled at f1f5d90 against gominimal/arch@42d214dc8ac8 by claude-opus-5-5.
|
Round 4 of 10 on a /revise note, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Review threads the coder judged:
A box in the VM carries the VM host's minted id. A retry of the same create after a lost or late mint reply now gets that same id, and a different create that asks for a claimed row is still refused. Notes from the agent: MintBoxIdRequest has a new optional create_token field. The guest's mint_box_id makes one UUIDv4 token per call and sends it on every attempt. claim_row_box_id in minvmd stores the token with the claim. It accepts a repeat ask only when the token is present and equal. An ask with no token for a claimed row is refused, so an older guest keeps the old fail-closed behaviour. The mint_box_id doc comment now says what the arch thread asked. Deferred: cargo nextest run -p minvmd vm_host_mints_box_id_before_in_vm_create (lane: vm). This box cannot run it, and I did not run it this round. clippy -p minimald-rpc -p minimald -p minvmd --all-targets is clean. I did not run just clippy-strict. |
There was a problem hiding this comment.
Reviewed at f1f5d90. The request's box_id is dropped on every host. A VM guest takes its id only from minvmd, through an idempotent per-create claim that fails closed, and a native host mints in the store. The VM leg passed in CI test-kvm. Non-blocking follow-ups are in the walk ledger: the claim goes to the first asker rather than the registrant (same-user crafted request in the register-to-create gap), and the standing snapshot is taken before the claim lock in claim_row_box_id.
T13 — Mint every box's id in the VM host and take it only from there
slice: S3
kind: task
covers: BOX-002
size: M
est: 320 code, 240 tests
executor: agent
difficulty: unknown ground
model: strongest
diagnostics: guest's daemon log names passed id
observability: guest's create span carries minted id
layers:
- vm-host:
- crates/minvmd/src/control.rs: passes the minted id
- crates/minvmd/tests/minimald_session_integration.rs: tests
test (deferred: vm): cargo nextest run -p minvmd vm_host_mints_box_id_before_in_vm_create
- guest:
- crates/minimald/src/box_manager.rs: id only from VM host
- crates/minimald/src/box_manager/tests.rs: tests
- crates/minimald/src/env.rs: in-box id from record
- crates/minimald/src/net/listeners.rs: carry the minted id over the guest<->host report channel
- crates/minimald-rpc/src/lib.rs: the message or reply field that carries the id
- crates/minimald/src/box_actor/tests.rs: fixtures hand the id over the VM host's channel
test: cargo nextest run -p minimald guest_create_ignores_a_client_supplied_box_id
produces: none
consumes: none
proof: A box in the VM carries the VM host's minted id.
depends on:
- blocked by #2394
Proof
A box created in the VM now carries the id that the VM host daemon (minvmd) minted. The in-VM minimald asks minvmd for the id over the guest report door with the new mint_box_id verb, and files the record under the answer. A box with a host row gets its registration's id, so the record id, the record's box_id and the host row name one id. A box with no row gets a fresh UUIDv7 from minvmd. A box id in the create request is ignored on every host. The guest log line "took the box id the VM host daemon minted" names the id that minvmd passed, and the box.create span records it as box_id.
Notes from the agent: Deferred:
cargo nextest run -p minvmd vm_host_mints_box_id_before_in_vm_create(lane: vm). (Since run: it passed in CI test-kvm at f1f5d90, see Tests, and it reads minvmd's own mint record.) The file is gated on cfg(minvmd_libkrun), so I compiled a temporary ungated copy once withcargo clippy -p minvmd --test <copy>(exit 0) and deleted the copy. The test checks that the created id is a UUIDv7 and differs from the request's box id. It does not read minvmd's log line.Files outside the layers, each needed to compile or to file under a handed id:
StoreHandle::create_under(record, id), which keeps the same collision refusal and text. "Run the command again." holds for a handed id too: on a failed create the client withdraws its row, and the next run registers a new row with a new id.crates/minimald/src/env.rs needs no change. The in-box id already comes from the record (launcher
with_session_id(record id)), and the record id is now the minted id.Design facts for the next task:
Tests
cargo nextest run -p minimald guest_create_ignores_a_client_supplied_box_idcargo nextest run -p minvmd vm_host_mints_box_id_befo 7589 re_in_vm_create(vm lane, CItest-kvmat f1f5d90,MINVMD_E2E=1, job)PASS [ 4.590s] (20/39) minvmd::minimald_session_integration vm_host_mints_box_id_before_in_vm_create·Summary [ 292.474s] 39 tests run: 39 passed, 0 skippedVerify
min task run agent-verifypassed ([tasks.verify]).Base
The base branch moved while the coder worked and was merged in before the tests ran. These files changed on BOTH sides since the branch point — read them first, because a rewrite from a stale reading can undo a merge without a conflict:
crates/minimald/src/box_actor/tests.rscrates/minimald/src/net/listeners.rsDeferred
None. The vm-lane leg ran in CI
test-kvmat f1f5d90 and is in the Tests table.Out of scope
These files are outside the task's
layers:, so this PR is a draft:crates/minimal-client/src/box_registration.rscrates/minimald/src/rpc.rscrates/minimald/src/store.rsCloses #2397
Undrafted by the maintainer: the three edits outside the layers (crates/minimal-client/src/box_registration.rs, crates/minimald/src/rpc.rs, crates/minimald/src/store.rs) are accepted. They carry the new
MintBoxIdmessage and file a record under the VM host's id.