Repository navigation
T42 — Start every box's entrypoint from its spec through one launcher - #2841
mitodrummer merged 10 commits into
Conversation
The spec gains an [execution] table with the box's lifetime and, for a box that does not run its login shell, its entrypoint argv. A v0 spec stored before the table existed reads with the entrypoint its type implies.
One launcher decision, LaunchSpec::entrypoint, reads the first process from the box's stored spec: the login shell, or the spec's argv. The actor reads the stored spec once, keeps its hold, and hands it to every launcher. A launch minted for an exec keeps the shell, because the exec runs the box's command. Each launch logs its entrypoint in a box.launch span.
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Approved: no findings at Nothing to do. Clobber: none seen. |
There was a problem hiding this comment.
arch-review: CONDITIONS · 4 conditions · the full ruling
The launcher shape conforms: one decision from the stored spec feeds both launchers. The stored spec keys do not match the design's box.toml. The design keeps lifetime in [box] with until_stopped, and names the entrypoint [execution] exec (architecture.md lines 837–842 and 1095–1096). C1 and C2 rename them before these bytes persist. A launch that cannot read the stored spec must refuse, not start the shell (C3). The exec-minted shell is an interim and needs a filed issue (C4).
Ruled at eaa268a against gominimal/arch@8640f85e193d by claude-opus-5-5.
A task's run arrives over the exec channel. A hook launch or an attach can come before or after that exec, and a hook launch's gated first process starts at the next attach. Only the exec-minted launch held the shell, so a task box could run its task twice, and an attach got the task, not a shell. Every launch now says an exec carries the run, and the launcher starts the shell for it.
There was a problem hiding this comment.
arch-review: CONDITIONS · 4 conditions · the full ruling
The spec still writes lifetime under [execution] as persistent. The design keeps it at [box] lifetime with until_stopped (lines 837-842, 1186). Make the change in C1. The entrypoint key is entrypoint, but the design key is [execution] exec (line 1096). Make the change in C2. The new run_by_exec: true on every launch stops a task from running twice, but it is an interim with no issue (C3). An unreadable stored spec starts the shell, so refuse the launch (C4, line 19).
Ruled at f39db70 against gominimal/arch@8640f85e193d by claude-opus-5-5.
|
Round 1 of 10 on the runtime's review findings, pushed as
Verify Review threads the coder judged:
A session box starts the same login shell as before. That shell now comes from the box's stored spec, through LaunchSpec::entrypoint, the one launcher decision. The daemon log has a box.launch span for each launch, and the span names the entrypoint. A task box also keeps its shell on every launch, because its run still arrives over the exec channel, so the task runs one time only. Notes from the agent: Revise round 1. Thread 1 is valid. The per-launch for_exec flag became LaunchSpec::run_by_exec, and launch_host sets it on every launch. The reason is that |
|
/revise arch at f39db70, all in the layers. C1: crates/mfile/src/spec.rs: rename C2: spec.rs C3: mark C4: The |
…y-box-s-entrypoint-from-its-spec-throu
Rename Lifetime::Persistent to UntilStopped, move the lifetime to [box] with a until_complete default for v0 specs, and serialize the entrypoint as execution.exec. List the argv shape as a v0 exception.
held_spec returns an error for unreadable spec bytes or a failed store read, and launch_host refuses with SpawnFailed instead of starting the shell. Mark run_by_exec as an interim that T43 (#2405) removes.
There was a problem hiding this comment.
arch-review: PASS · the full ruling
This head resolves the earlier conditions. The lifetime is box.lifetime with until_complete and until_stopped, as section Box Spec lines 837-842 say. The entrypoint is execution.exec, and the argv shape is a listed v0 exception under #2410. A stored spec that the daemon cannot read now refuses the launch, and the launch does not fall back to the shell. The run_by_exec interim states its flip condition and #2405. Before T43 flips that constant, make the argv launch honour pty_enabled and remove the arguments from the box.launch span. The summary gives the design lines.
Ruled at 3b5a63f against gominimal/arch@8640f85e193d by claude-opus-5-5.
|
Round 2 of 10 on a /revise note, pushed as
Verify Review threads the coder judged:
A session starts the same shell, launched from its spec. The spec now writes box.lifetime (until_complete or until_stopped) and execution.exec. A box whose stored spec cannot be read is refused at launch, with a message that names Notes from the agent: Round 2 addresses C1 to C4 from the note. C1: Lifetime::Persistent is now Lifetime::UntilStopped, and lifetime moved to DocBox as box.lifetime with a serde default of until_complete. C2: the entrypoint key is execution.exec, and the module doc lists the argv shape and the omitted shell key as a v0 exception that #2410 ends. C3: the comment above run_by_exec in launch_host and the LaunchSpec::run_by_exec doc name the interim and its flip condition, T43 (#2405). The old comment about an exec that carries the run is replaced. I found no |
A launch now refuses a stored spec it cannot read, so the test's placeholder bytes failed its ensure_host. Store a session spec instead.
There was a problem hiding this comment.
arch-review: PASS · the full ruling
This head changes one test fixture since the PASS on 3b5a63f. The launch now refuses an unreadable stored spec, so the test stores a real BoxSpec. The test still proves that a stopped box keeps its record and spec until the reap (architecture.md line 21). The change conforms. Also, correct the PR body: it still says that an unreadable spec starts the shell.
Ruled at a532982 against gominimal/arch@8640f85e193d by claude-opus-5-5.
|
Round 3 of 10 on a failed check suite, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Review threads the coder judged:
A session starts the same shell, launched from its spec. A box filed with no spec also starts the shell. A box whose stored spec cannot be read is refused with a message that names Notes from the agent: The failed |
|
/revise The maintainer accepts one test file outside the layers: crates/minimald/src/box_manager/tests.rs. CI |
A box ends when its entrypoint returns, whatever box.lifetime says.
There was a problem hiding this comment.
arch-review: PASS · the full ruling
This push adds two doc comments in crates/mfile/src/spec.rs and changes no code. The comments say that no launch reads box.lifetime yet. That is true at this head. The a532982d ruling stands. The run_by_exec interim stays filed as #2405.
Ruled at 4350b29 against gominimal/arch@8640f85e193d by claude-opus-5-5.
|
/revise One item, minimal-review PRRT_kwDOPdfcxM6ytdHa: the |
|
That Nothing to type again: the command gets a rocket when its round starts, or a refusal that names the reason. No round was counted for it yet. |
|
Round 4 of 10 on a /revise note, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Review threads the coder judged:
A session starts the same shell, launched from its spec. A launch whose stored spec cannot be read is refused, and the stopped-box record test now stores a real session spec and passes. Notes from the agent: The fixture fix that the note asks for was already at the branch head in a532982. It stores BoxSpec::for_session serialized with serde_json_lenient::to_vec, the same way a create writes it. No other test in box_manager/tests.rs calls store_spec. That test now passes. No production code changed for C4. This round adds only a doc comment in crates/mfile/src/spec.rs, a file in the layers, to answer the open Lifetime thread. |
The box.launch span and its info event printed every argument of an argv entrypoint. An argument can carry a secret, so they now name the program (or the login shell) and the argument count only. A test pins that a secret-looking argument does not reach the log.
|
Round 5 of 10 on a /revise note, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Review threads the coder judged:
A session starts the same shell, launched from its spec. The daemon log names each launch by its program (or the login shell) and its argument count, and never prints an argument. Notes from the agent: Revise round 5: the Display impl on LaunchEntrypoint is gone, so no format string can print the argv by accident. LaunchEntrypoint::log_name and arg_count replace it. The span and the info event moved into a new box_runtime::launch_span helper, so the test can capture them directly. The new test name extends the T42 test-line filter, so the existing test line runs it. cargo clippy -p minimald --all-targets is clean. The cargo-deny failure (RUSTSEC-2026-0433) is out of scope, as the note says. |
There was a problem hiding this comment.
arch-review: PASS · the full ruling
The new commit keeps entrypoint arguments out of the launch log. The log names the program and the argument count only. The design says that secret values are never written into logs (architecture.md line 79). The earlier PASS stands for the rest of the change. The run_by_exec interim stays a residual in issue #2405.
Ruled at b4b1f75 against gominimal/arch@8640f85e193d by claude-opus-5-5.
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — every review thread is resolved; @mitodrummer closed the last one. The review of b4b1f7592ebe withheld this approval on the threads open then. Posted as a comment: the App cannot approve its own pull request; the check and the label carry it.
There was a problem hiding this comment.
Reviewed at b4b1f75. Specs already on disk still read: an absent execution is the type's implied entrypoint and an absent box.lifetime is until_complete. Every launch goes through launch_host with the held spec, and a shell box starts exactly as before. The only new refusal is an unreadable stored spec (arch C4). The launch log carries only the program and the argument count. Follow-ups are in the walk ledger: serde error text in the spec-read warning can echo a value, and create should validate the spec as strictly as launch does.
There was a problem hiding this comment.
arch-review: PASS · the full ruling
This head merges main into the branch and changes none of the branch's own content. The merge brings in #2842 and #2846. They do not touch the spec or the launch path. The ruling on b4b1f759 stands. The run_by_exec interim stays a residual on #2405.
Ruled at f92ca7e against gominimal/arch@7a86ec7bb3c0 by claude-opus-5-5.
* fix(deps): bump pulldown-cmark to 0.13.6 for RUSTSEC-2026-0433 (#2846) Claude-Session: https://claude.ai/code/session_01NSAwDroXL6KqsSxUzdbZGw Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(minimald): hand a reaped name over in one manager step (#2842) A reap read the records and then sent the handover as a second message. A removal that began between the two left the name with no row while another retained box still had it. The manager now releases the reaped box's row, picks the successor among boxes not being removed, and registers it in one message. The reap and the prune return after both. The daemon log names the release (name-released) before the handover (name-handed-over), both with box ids. Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * T126 — A host-address box's port that collides on the host is shown at session start and in `min ls` (#2830) * feat(minvmd): answer a node's collided mirror ports over control The host control socket answers a read-only mirror_collisions verb with the node's mirrored ports that collided with a holder on the host. The node mirror keeps the time each port first collided. * feat(minimal): show collided mirror ports in min ls and activate min ls prints a MIRROR PORTS row per VM whose host_ip box ports are held by another program on the host, and --json carries mirror_collisions per VM. min session activate of a host_ip box on a VM host prints the same sentence per port when it does not attach. * fix(minimal): show an unread VM's mirror ports as null in min ls Read each VM's collided mirror ports concurrently, and keep a failed read apart from an empty one: --json writes null for a VM with no answer and [] only for an answered empty read. * fix(minimal): name a VM host whose mirror ports were not read min ls printed nothing for a running VM host that gave no answer, so it looked the same as one with no collisions. It now prints one MIRROR PORTS row that says the VM did not report its ports. * fix(minimal): skip the mirror-port read on a native host A native host has no VM host daemon. The fallback listing's control socket there is minimald's, which does not serve the collided-port read, so min ls printed a false MIRROR PORTS row on every native host. * fix(minimal): name an unread VM host at activate, enter the span min session activate now prints the unread sentence that min ls prints when the VM host daemon gives no answer. The ListSessions span wraps the collided-port reads, and a native host's --json carries no mirror_collisions field. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * T42 — Start every box's entrypoint from its spec through one launcher (#2841) * feat(mfile): carry entrypoint and lifetime in the box spec The spec gains an [execution] table with the box's lifetime and, for a box that does not run its login shell, its entrypoint argv. A v0 spec stored before the table existed reads with the entrypoint its type implies. * feat(minimald): start each box's entrypoint from its spec One launcher decision, LaunchSpec::entrypoint, reads the first process from the box's stored spec: the login shell, or the spec's argv. The actor reads the stored spec once, keeps its hold, and hands it to every launcher. A launch minted for an exec keeps the shell, because the exec runs the box's command. Each launch logs its entrypoint in a box.launch span. * fix(minimald): keep the shell on every launch of an exec-run box A task's run arrives over the exec channel. A hook launch or an attach can come before or after that exec, and a hook launch's gated first process starts at the next attach. Only the exec-minted launch held the shell, so a task box could run its task twice, and an attach got the task, not a shell. Every launch now says an exec carries the run, and the launcher starts the shell for it. * refactor(mfile): write box.lifetime and execution.exec in the spec Rename Lifetime::Persistent to UntilStopped, move the lifetime to [box] with a until_complete default for v0 specs, and serialize the entrypoint as execution.exec. List the argv shape as a v0 exception. * fix(minimald): refuse a launch whose stored spec cannot be read held_spec returns an error for unreadable spec bytes or a failed store read, and launch_host refuses with SpawnFailed instead of starting the shell. Mark run_by_exec as an interim that T43 (#2405) removes. * test(minimald): store a readable spec in the stopped-box record test A launch now refuses a stored spec it cannot read, so the test's placeholder bytes failed its ensure_host. Store a session spec instead. * docs(mfile): say that no launch reads the spec's lifetime yet A box ends when its entrypoint returns, whatever box.lifetime says. * fix(minimald): keep entrypoint arguments out of the launch log The box.launch span and its info event printed every argument of an argv entrypoint. An argument can carry a secret, so they now name the program (or the login shell) and the argument count only. A test pins that a secret-looking argument does not reach the log. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> Co-authored-by: Karl Godard <karl@minimal.dev> * T30 — Run a command in a box with a terminal or detached, under an exec id (#2843) * feat(minimald-rpc): carry exec mode, timeout and exec id on the wire min://exec carries an argv with its mode (attached, tty or detached) and an optional timeout. min://exec/attach, min://exec/output and min://exec/wait name an exec by its UUIDv7 id. The box store places each exec's transcript beside the record and appends events by path. * feat(minimald): run box execs under an id, with a terminal or detached Every command for a box gets a UUIDv7 exec id, and a box that is not running refuses it with exit 2 naming its state. min://exec runs an argv with no shell: attached, on a daemon terminal, or detached with stdin closed. Tty and detached execs answer with their id at once, capture their output beside the box record, and keep their exit for min://exec/wait. An exec's own timeout stops it and records an exec_exited event with reason timeout, and the box keeps running. * style(minimald-rpc): format the exec id parse and its tests * fix(minimald): bound the wait after an exec timeout; drop reaped execs A command that survives the stop at its timeout no longer holds its wait open: the wait after the stop is bounded, then SIGKILLed and recorded as a timeout. Ended execs of a reaped box leave the exec map. * fix(minimald): exit 124 on exec timeout; wait reads stored exit An exec that its own timeout ends now exits 124, attached or detached. A wait on an exec that this daemon holds no entry for reads the box's stored exec_exited event, so a detached exec's exit code outlives a daemon restart. * fix(minimald): cap exec transcripts at 8 MiB and stream reads A detached exec now writes through a pipe and a pump, as a tty exec does, so the daemon can cap its transcript. Past the cap the transcript keeps a mark and the newest half of the cap, and the command keeps running. The output read and the attach replay copy the transcript in 64 KiB chunks, up to its length at the open, and the attach takes the terminal lock only to open the file and subscribe. * fix(minimald): bound tty exec input; no deadline past the clock A tty exec's terminal input went through an unbounded channel, so a program that never reads stdin let the daemon queue grow without limit. The terminal now holds typed input in a HeldInput with the attached path's bounds (EXEC_INPUT_HELD_MAX per exec, EXEC_INPUT_HELD_DAEMON_MAX for the daemon). Past either bound the chunk is dropped and the log says so once per exec. The exec's end releases what it held. An attached exec's timeout too large for the clock panicked after the spawn. timeout_deadline now uses checked_add and gives no deadline. Tests: unread tty input stays within the cap, a timeout of u64::MAX seconds runs the exec to its end, and an exec id from one box finds no exec, output or exit in another. * fix(minimald): wait on exec terminals in the runtime, not a thread The tty feed wrote to the terminal from a blocking thread. When the program never read its input, that write never returned, and each such exec left a blocking thread behind for good. The terminal and the detached pipe are now non-blocking and watched through AsyncFd, so the supervisor can stop the pump and the feed at the exec's end. Both stop on a closed state too, because tokio never clears it and a wait for it returns at once. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> Co-authored-by: Karl Godard <karl@minimal.dev> * fix(minimald): hand a destroyed box's name to the next holder (#2849) A destroy removed the box that held a name's row and left the name with no row, while another retained box still had that name. The destroy now runs the same handover as a reap: the row goes to the running box with the name, else to the most recent creation. The destroy answers after the handover. The daemon log names the destroyed box and the successor, and the destroy span records the successor id or "none". Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * T114 — `min ls` and the box commands tell the truth, end to end (#2839) * test(e2e): prove min ls and the box commands across two VMs Adds the ls_and_box_commands_tell_the_truth case: a stopped VM's boxes in min ls, the ADDRESS and EGRESS cells against min session policy, policy and forward without --vm, the unknown-box and stopped-VM refusals, both proxy ports after the preferred port frees, and the --public and out-of-range expose refusals. * test(e2e): record ls_and_box gates as NOT RUN, check declared rules The four gates of ls_and_box_commands_tell_the_truth now call not_run, so the lane summary names the case. A 'declared rules' EGRESS cell is now checked against the subnets rule row that min session policy prints, not only against an egress heading. * test(e2e): read the expose address past a trailing carriage return The ls_and_box case read the box's address from the in-box expose reply with an end-of-line anchor. A reply over the exec channel can end in a carriage return, which left the address empty. * test(e2e): brace lt_port before a bracket class in the expose read shellcheck reads $lt_port[[:space:]] as an array index (SC1087). The braces keep the same match and make the script lint-clean again. * fix(minimal): poll the owning VM in min net forward A forward to a box on another VM polled the selected VM for its session. That VM does not hold the box, so the forward closed on the first tick. Reconnect the poll to the owning VM, version-gated. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> Co-authored-by: Norrie Taylor <91171431+norrietaylor@users.noreply.github.com> * docs(spec): specify dns steering and the host_ip lane for spec 24 (#2851) * docs(spec): specify dns steering and the host_ip lane for spec 24 Add BEP-080 to BEP-087 so the default `dns` steering works for own_ip and host_ip boxes on a VM host, as architecture D6 and networking §5.4 require. - BEP-080, BEP-081: direct TLS to the proxy on port 443, routed by SNI, and admitting dns and both on a VM host (#2805). - BEP-082 to BEP-087: the host_ip lane: a host-side box id, the cohort proxy lane, cohort-attributed delivery with the named box's egress and audit subject, the in-effect rule, per-box steering, and the live proof. - BEP-015 gains a host_ip proxy_env case. - Security considerations states the cohort lane and per-box steering. * docs(spec): keep the first slice paragraph unchanged and move the host_ip e2e checks to BEP-087 * docs(spec): address review on the host_ip lane requirements - BEP-083: the cohort lane also admits TCP 443 at the proxy's address, the direct TLS path dns steering uses. - BEP-084: refuse and audit a cohort-attributed value that names no live host_ip box of this host. - BEP-086: cite NET-003's VM-backed resolver requirement, not NET-079. - BEP-087: the proxy_env case is its own sub-requirement. - Security considerations: BEP-083 and BEP-084 join the redemption invariant, and BEP-084 the egress invariant. * T10 — Log a box's output from its start, out of the box's reach (#2852) * feat(boxes): name a box's output log beside its record Adds LOG_FILE and BoxDir, the box's directory as code outside the store sees it: the log path, a lookup by id through the index, a log read by offset, and an event append for a writer that holds no DiskBox. * feat(minimald-rpc): add a streamed read of a box's output log * feat(minimald): log a box's output from its start The host appends every read from the box's terminal to its output log before it hands the bytes to an attached client, so the client is a second reader. A binding whose client closes its channel, drops its connection or is shed records a detached event, and the box runs on. * feat(minimald): serve a box's output log by its id ReadLog streams the log from a byte offset, and with follow sends new output until the box is reaped. A test shows that files written into the box's own directories reach neither the log nor the record. * fix(minimald): read a box's log on the blocking pool The followed log read polled the store with blocking std::fs calls on an async task. The find, the chunk reads and the retained check now run through spawn_blocking, so a slow disk does not hold a runtime worker. * fix(boxes): cap a box's output log and read it across a drop The log keeps a drop mark and the newest half past 8 MiB. A reader keeps its file open and moves to the replaced file with no byte sent twice. The read refuses a link or a file that is not regular. * fix(minimald): start no store box without its output log BoxOutputLog::open returns the open's error for a box in the store, and Host::build stops before the launch. The log writes through the capped store writer, and ReadLog keeps one reader for the whole stream. * fix(minimald): run detach hooks when a PTY client is lost A lost client already records a detached event. Its on_detach hooks now run too, so the event and the hooks agree. A test drives a box past the log cap. * style: format the log cap tests * docs(boxes): mark the 8 MiB log cap as not yet in the design The cap drops the start of a box's output past 8 MiB. That departs from architecture.md line 473. gominimal/arch#159 decides the bound. * docs(specs): record the interim 8 MiB box log cap in BOX The decision that logs a box's output from its start now states the 8 MiB cap, what the log keeps past it, and the arch#159 decision that removes the cap or changes BOX-155. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * T9 — End a box when its entrypoint returns, never for idleness or client loss (#2850) * feat(minimald): end an until_complete box when its entrypoint returns The host loop now says whether a kill ended it. The actor watches each launch's loop and, when the entrypoint returned on its own and the spec sets lifetime = "until_complete", sets the record to exited with the exit code and records an exited event with reason "exit". The daemon does this whether or not a client is attached. Such a box raises no shell-exit prompt (BOX-038). A client that goes away never stops a box (BOX-015). * test(minimald): pin box ends on entrypoint return, not client loss Adds the actor tests for BOX-038 and BOX-015. The shell round trip now expects no prompt and an exited record. Tests about a box kept after its shell exits now create an until_stopped box. The rpc shutdown test no longer answers a prompt. * fix(minimald): retry the exited-record write when an entrypoint ends The host and the watch are gone by the time the write runs, so a single failed write left the box running with nothing in it. Retry it with a short backoff, and pin the retry with a test seam. * test(e2e): expect an exited box, not a prompt, when a shell exits The session-exit prompt is gone: exiting the shell ends the box, which stays listed as exited. The pty driver no longer answers a prompt. Each leg that exited a shell now checks the box is exited with code 0, and destroys it where it used to answer Delete. * docs(minimald): put the launch-record seam doc back on its module * test(e2e): resume the exited kept box before the exec into it An exec runs only in a running box. After the shell exits and the row is withdrawn, the leg now resumes the box with a pty 'min session attach', checks that it runs under the same id and that its row is back, and then runs the exec as before. * test(minimald): fail when the channel stays open after shell exit The wait loop ended on a timeout as well as on close, so the test passed even if the channel never closed. Panic on the timeout. * fix(minimald): end an exited box before a queued attach or exec A message queued beside a returned entrypoint ran first and launched a new host, so the entrypoint ran again and its exit was lost. Now only a stop or a destroy goes ahead of the exit, and ensure_host refuses a stopped or exited box. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * build(deps): bump sysinfo to 0.40 sysinfo 0.40 makes System construction fallible (System::new returns Result<System, sysinfo::Error>). The three callers keep their 0.39 behaviour on an unsupported platform: minvmd's metrics sample and minimald's resource-pool probe return None, and minvmd's host capacity probe reports zero memory. Unblocks the dependabot cargo group (#2844), which bumped sysinfo without migrating the callers. --------- Co-authored-by: Karl Godard <karl@minimal.dev> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com>
T42 — Start every box's entrypoint from its spec through one launcher
slice: S2
kind: enablement
covers: none
size: L
est: 380 code, 300 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: daemon log names each launch's entrypoint
observability: one span per launch
layers:
- spec:
- crates/mfile/src/spec.rs: entrypoint, lifetime, terminal flag
test: cargo nextest run -p mfile spec_carries_entrypoint_lifetime_and_terminal_flag
- runtime:
- crates/minimald/src/box_runtime/launcher.rs: one launcher from the spec
- crates/minimald/src/box_runtime.rs: runs what the launcher starts
- crates/minimald/src/box_runtime/mock.rs: mock launches from spec
- crates/minimald/src/box_actor.rs: hands spec over, keeps hold
- crates/minimald/src/box_actor/host.rs: launch_host passes the spec
- crates/minimald/src/box_actor/launcher.rs: session_launcher variants take the spec
- crates/minimald/src/box_actor/tests.rs: tests
- crates/minimald/src/box_runtime/tests.rs: tests
test: cargo nextest run -p minimald launcher_starts_session_and_task_entrypoints_from_spec
test: cargo nextest run -p minimald actor_hands_stored_spec_to_launcher_and_keeps_hold
produces: none
consumes:
- crates/mfile/src/spec.rs
proof: A session starts the same shell, launched from its spec.
depends on:
- blocked by #2388
- blocked by #23 8000 93
- blocked by #2395
Proof
A session starts the same shell as before, and the launch now reads it from the box's stored spec: the spec's entrypoint is the login shell, and LaunchSpec::entrypoint is the one decision the real and mock launchers both start from. The daemon log shows a box.launch span and the line "launching the box's entrypoint from its spec" with entrypoint=login shell for each session launch.
Notes from the agent: The spec gains an [execution] table: lifetime (until_complete or persistent) and, for an argv entrypoint, entrypoint. A shell entrypoint leaves the key out. The terminal flag is the existing io.pty_enabled. A v0 spec stored before [execution] existed reads with the entrypoint its type implies (session: shell, task: min task run ) and until_complete. BOX_SPEC_VERSION stays 0. A task's entrypoint is
min task run <name>, the in-box command its exec runs today. Behaviour choice to keep tasks working: a launch that ensure_host mints for an exec (for_exec = true) starts the shell, because the TaskRun exec still runs the task itself. If the launcher started the task argv there, the task would run twice. Consequence: today no production launch starts a task's argv right after it is created. A non-interactive task box launched by an attach, or a hook launch that an attach later releases, starts/usr/bin/min task run <name>in place of bash. To make the task's launch the run itself, exec.rs and the client must change (outside these layers). Lifetime is carried and stored but nothing enforces it yet (BOX-037/BOX-038 are other tasks). Interactive tasks still get no spec, so they start the shell as before. An unreadable stored spec on a plain launch logs a warning and starts the shell. A resume still refuses such a spec as before. just clippy-strict was not run.Tests
cargo nextest run -p mfile spec_carries_entrypoint_lifetime_and_terminal_flagcargo nextest run -p minimald launcher_starts_session_and_task_entrypoints_from_speccargo nextest run -p minimald actor_hands_stored_spec_to_launcher_and_keeps_holdVerify
min task run agent-verifypassed ([tasks.verify]).Closes #2399
Residuals
run_by_exec: true(crates/minimald/src/box_actor/host.rslaunch_host) is an interim. Until a task's run moves from the exec channel onto the box's entrypoint, no production launch starts a task spec's argv. That move is T43, T43 — Run a task as a task box that returns its exit code #2405, which removes the constant.Current behaviour (supersedes the round-1 notes above)
box.lifetime:until_complete(the default for a v0 spec stored without it) oruntil_stopped.persistentis gone (arch C1).execution.exec, and a shell entrypoint leaves the key out (arch C2).run_by_execis an interim until T43 (T43 — Run a task as a task box that returns its exit code #2405) moves a task's run onto the box's entrypoint (arch C3, listed under Residuals).min session destroy. It doesn't log and start the shell. A box filed with no spec still starts the shell (arch C4).stopped_box_record_readable_until_reapedinstead of a placeholder.