Repository navigation
fix(minimald): name the range and refuse --public in min net expose (T109) - #2718
norrietaylor merged 5 commits into
Conversation
A port outside the box's --dynamic-range is refused with the range named, for allow and ask boxes alike, and an ask box refuses it before any prompt. min net expose --public is its own request and is refused because this host has no public surface. The host-refusal and port prompt texts stop naming the VM host daemon.
…pose-refusals-say-what-happened-and-na
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
…pose-refusals-say-what-happened-and-na
The native-daemon-e2e lane still matched the old wording, so it failed on the text this branch ships.
…pose-refusals-say-what-happened-and-na
|
Round 1 of 10 on a failed check suite, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Inside a box, Notes from the agent: Revise round 1. The native-daemon-e2e job failed because scripts/session-e2e.sh line 20960 still matched the old refusal text ( |
|
Approved: no findings at Nothing to do. Verdict APPROVE, posted as a comment: the App cannot review its own pull request; the check and the label carry it. Clobber: none seen. |
There was a problem hiding this comment.
arch-review: PASS · the full ruling
The change conforms to §6 and §7.1 of the networking design. The --public refusal is default-deny, and §6 lines 226–227 put public exposure on the roadmap. The out-of-range ask refusal comes before the prompt. The host-side gate in minvmd record_ask still refuses the port, so no check moves across the guest/host boundary. The refusal is audited locally through answer_expose, as §7.1 line 260 requires.
Ruled at 355708a against gominimal/arch@109541a48c31 by claude-opus-5-5.
There was a problem hiding this comment.
Babysitter review at 355708a3. I read the helper, channel, ports, policy and listener changes against T109's plan block. min net expose --public [<port>] now reaches the daemon as its own net-expose-public request and is refused with error: public exposure is not available on this host. Nothing was published., without asking the session (NET-145). An ask box with a range refuses a port outside it in dynamic_ingress_decision before any prompt is routed, and the refusal reads port <n> is outside this box's --dynamic-range <a>-<b>. Nothing was published. for both stances (NET-047). The host-refusal and prompt-round texts no longer name the VM host daemon, and an unreadable reply goes to the log rather than to the person. The dynamic ingress expose line gains the refused: public exposure and refused: out of range outcomes. The out-of-layer box_runtime/tests.rs hunk only updates pinned text and is recorded as a layer exception. No findings.
Generated by Claude Code
min net expose refusals say what happened and name the rangeThere was a problem hiding this comment.
Babysitter approval at 355708a: every merge gate passes at this head (arch PASS at 355708a, zero open threads, every lane aggregator green). Squash title fix(minimald): name the range and refuse --public in min net expose (T109) and the squashed message pass commitlint. Queued for squash merge.
Generated by Claude Code
…T109) (#2718) * fix(minimald): name the range and refuse --public in min net expose A port outside the box's --dynamic-range is refused with the range named, for allow and ask boxes alike, and an ask box refuses it before any prompt. min net expose --public is its own request and is refused because this host has no public surface. The host-refusal and port prompt texts stop naming the VM host daemon. * test(e2e): pin the new out-of-range expose refusal text The native-daemon-e2e lane still matched the old wording, so it failed on the text this branch ships. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> (cherry picked from commit 1bbd45c)
…release/0.7.0 The cherry-picked change names main's files, types and helpers. Release/0.7.0 predates the box renames and the helper-request spans, so the change lands in the release's own code: - main's box_actor/ports.rs is session.rs here. The ports hunks (the host refusal texts, the ask comment, the "refused: out of range" outcome) apply to session.rs, in the cherry-pick commit itself. - The release has no CHANNEL_METHODS list or channel_method span helper, so the net-expose-public arm joins handle without a list entry, and expose_public_refused_without_public_surface drops its channel_method assertion. The refusal text and info line it pins are unchanged. - expose_out_of_range_refusal_names_range uses sessions:: for boxes:: and SessionKeyPredicate for BoxKeyPredicate. The behaviour is #2718's: a port outside --dynamic-range is refused with the range named for allow and ask boxes, before any prompt, and min net expose --public is refused because the host has no public surface.
…2718) T109. A port outside the box's --dynamic-range is refused with the range named, for allow and ask boxes alike, and an ask box refuses it before any prompt. min net expose --public is its own request and is refused because this host has no public surface. The host-refusal and port prompt texts stop naming the VM host daemon, and the session e2e script pins the new out-of-range text. Backport of #2718, folded from #2729. Adapted to the line: - main's box_actor/ports.rs hunks land in session.rs. - The line has no CHANNEL_METHODS list or channel_method helper, so the net-expose-public arm joins impl SessionChannel in env.rs without a list entry, and expose_public_refused_without_public_surface drops its channel_method assertion. The refusal text and log lines it pins are unchanged. - boxes:: becomes sessions:: and BoxKeyPredicate becomes SessionKeyPredicate. (cherry picked from commit 1bbd45c)
T109 —
min net exposerefusals say what happened and name the rangeslice: S17
kind: task
covers: NET-145, NET-047
size: M
est: 160 code, 240 tests
executor: agent
difficulty: routine
model: standard
diagnostics: a refused
min net exposeprints its reason on stderr inside the box and exits 1; the daemon's existingdynamic ingress exposeinfo line names the box, the port as given, the outcome and the reason, in the daemon logmin bugalready collectsobservability: the existing
dynamic ingress exposeinfo line, one per request, gains the outcomesrefused: public exposureandrefused: out of rangewith the requested port and the box's rangelayers:
- in-box-helper:
- crates/minimald/src/env_min_helper.sh:
min net exposerecognises--publicbefore the port and sends it as its own request, never as the port string;min net expose --publicwith or without a port reaches the daemon as a public request- crates/minimald/src/env.rs: the expose channel answers a public request with
error: public exposure is not available on this host. Nothing was published.and exits 1, publishing nothing, local or public; printed by the in-boxmin net expose --public [<port>]on every host this spec binds; replaces today'serror: '--public' is not a port numbertest: cargo nextest run -p minimald expose_public_refused_without_public_surface
- range-refusal:
- crates/minimald/src/box_actor/ports.rs: an ask-stance request for a port outside the box's range is refused before any prompt is routed, so no prompt is shown; the host-refusal texts stop naming the VM host daemon and the port prompt (
the port is outside the --dynamic-range the VM host daemon holds for this boxbecomesthe port is outside this box's --dynamic-range)- crates/minimald/src/net/policy.rs: the out-of-range refusal reads
port 4500 is outside this box's --dynamic-range 3000-3999. Nothing was published.with the requested port and the box's range filled in, for an allow-stance and an ask-stance box alike, printed by the in-boxmin net expose <port>aserror: …with exit 1- crates/minimald/src/net/listeners.rs: the prompt round's failures read without the VM host daemon's name (
the port prompt was refused: …and the deadline and unexpected-reply texts becomethe request to open the port was refused: …,… did not get an answer in time,… got an answer it could not read)- crates/minimald/src/box_actor/tests.rs: pins the range refusal text for both stances, that no prompt is routed for an out-of-range ask, and that no mapping is left behind
test: cargo nextest run -p minimald expose_out_of_range_refusal_names_range
test: cargo nextest run -p minimald expose_rejected_leaves_no_partial_mapping
produces: none
consumes: none
proof: Inside a box,
min net expose --public 3000says public exposure is not available on this host, andmin net expose 4500on a box started with--dynamic-range 3000-3999names that range; neither publishes anything.Proof
Inside a box,
min net expose --public 3000(ormin net expose --publicwith no port) printserror: public exposure is not available on this host. Nothing was published.and exits 1, and the session is never asked to publish. On a box started with--dynamic-range 3000-3999,min net expose 4500printserror: port 4500 is outside this box's --dynamic-range 3000-3999. Nothing was published.and exits 1, for an allow box and an ask box alike. An ask box shows no prompt for it, and no mapping is left.Notes from the agent: Out of scope: crates/minimald/src/box_runtime/tests.rs. Its test vm_ask_host_refusals_are_publish_failures pins two host-refusal texts that the task changes (
outside the --dynamic-rangeandnot registered with the VM host daemon). I changed only those two expected strings so the test follows the new texts. Design: the ask-stance range check is in net/policy.rsdynamic_ingress_decision. It returns OutOfRange for an ask box with a range when the port is outside it, so box_actor/ports.rs never calls route_ask for it. An ask box with no range still goes to the prompt as before. The public request travels as a new channel methodnet-expose-public%<port or empty>. env.rs answers it without asking the session. listeners.rs: the unexpected-reply texts no longer print the Debug form of the reply. It goes to a warn log line. The report_port deadline error is rewritten tothe request to open the port did not get an answer in time. The shared report_exchange deadline text, which other verbs use, did not change. I did not change theUsage: min net expose <port>help line, so it does not advertise --public. NET-145 is not in the spec excerpt, so the exact texts come from task.md. Extra runs: 80 related tests passed, and one fullcargo nextest run -p minimaldpassed 1156 tests.Layer exception
crates/minimald/src/box_runtime/tests.rsis outside T109's layers. Its testvm_ask_host_refusals_are_publish_failurespins the refusal text that the in-layer change rewrote:outside the --dynamic-rangebecomesoutside this box's --dynamic-range, andnot registered with the VM host daemonbecomesnot registered on the host. The hunk updates those two pinned strings only. It changes no behaviour of its own.Tests
cargo nextest run -p minimald expose_public_refused_without_public_surfacecargo nextest run -p minimald expose_out_of_range_refusal_names_rangecargo nextest run -p minimald expose_rejected_leaves_no_partial_mappingVerify
min task run agent-verifypassed ([tasks.verify]).Base
The base branch moved while the coder worked; it was merged in before the tests ran.
Out of scope
These files are outside the task's
layers:, so this PR is a draft:crates/minimald/src/box_runtime/tests.rsCloses #2695
Generated by Claude Code