build(deps): bump sysinfo to 0.40 by norrietaylor · Pull Request #2866 · gominimal/minimal

norrietaylor · 2026-11-03T16:33:52Z

sysinfo 0.40 makes System construction fallible: System::new() now returns Result<System, sysinfo::Error> (migration guide). No other method we call changed signature.

The three callers keep their 0.39 behaviour on an unsupported platform, where 0.39 returned an empty System:

minvmd/src/metrics.rs sample: returns None.
minimald/src/rpc.rs detect_resource_pool: returns None.
minvmd/src/cmd/config.rs HostCapacity::probe: reports 0 MiB, as an empty System did.

The MSRV comment in Cargo.toml now names 0.40, which still declares rust-version = 1.95. The lockfile change is sysinfo 0.39.6 → 0.40.1 and its getrandom 0.3.4 → 0.4.3.

This unblocks the dependabot cargo group, #2844, which bumped sysinfo without migrating these callers and fails to compile. Once this merges, @dependabot recreate on that PR will drop sysinfo from the group.

Tested on macOS: cargo clippy -p minvmd --all-targets -D warnings is clean, and minvmd's metrics::* and cmd::config::* tests pass. minimald is Linux-only, so CI covers it. Five unrelated minvmd tests (sock, net::answerer, bep_attach) fail locally, and none of them use sysinfo.

Summary by CodeRabbit

Bug Fixes
- Resource-pool detection and process metrics now gracefully report unavailable results when system information cannot be initialized.
- Host capacity reporting now safely uses zero for total memory when system information is unavailable, while retaining the existing logical-core reporting behavior.

Claude-Session: https://claude.ai/code/session_01NSAwDroXL6KqsSxUzdbZGw Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

A reap read the records and then sent the handover as a second message. A removal that began between the two left the name with no row while another retained box still had it. The manager now releases the reaped box's row, picks the successor among boxes not being removed, and registers it in one message. The reap and the prune return after both. The daemon log names the release (name-released) before the handover (name-handed-over), both with box ids. Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com>

…t session start and in `min ls` (#2830) * feat(minvmd): answer a node's collided mirror ports over control The host control socket answers a read-only mirror_collisions verb with the node's mirrored ports that collided with a holder on the host. The node mirror keeps the time each port first collided. * feat(minimal): show collided mirror ports in min ls and activate min ls prints a MIRROR PORTS row per VM whose host_ip box ports are held by another program on the host, and --json carries mirror_collisions per VM. min session activate of a host_ip box on a VM host prints the same sentence per port when it does not attach. * fix(minimal): show an unread VM's mirror ports as null in min ls Read each VM's collided mirror ports concurrently, and keep a failed read apart from an empty one: --json writes null for a VM with no answer and [] only for an answered empty read. * fix(minimal): name a VM host whose mirror ports were not read min ls printed nothing for a running VM host that gave no answer, so it looked the same as one with no collisions. It now prints one MIRROR PORTS row that says the VM did not report its ports. * fix(minimal): skip the mirror-port read on a native host A native host has no VM host daemon. The fallback listing's control socket there is minimald's, which does not serve the collided-port read, so min ls printed a false MIRROR PORTS row on every native host. * fix(minimal): name an unread VM host at activate, enter the span min session activate now prints the unread sentence that min ls prints when the VM host daemon gives no answer. The ListSessions span wraps the collided-port reads, and a native host's --json carries no mirror_collisions field. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com>

…#2841) * feat(mfile): carry entrypoint and lifetime in the box spec The spec gains an [execution] table with the box's lifetime and, for a box that does not run its login shell, its entrypoint argv. A v0 spec stored before the table existed reads with the entrypoint its type implies. * feat(minimald): start each box's entrypoint from its spec One launcher decision, LaunchSpec::entrypoint, reads the first process from the box's stored spec: the login shell, or the spec's argv. The actor reads the stored spec once, keeps its hold, and hands it to every launcher. A launch minted for an exec keeps the shell, because the exec runs the box's command. Each launch logs its entrypoint in a box.launch span. * fix(minimald): keep the shell on every launch of an exec-run box A task's run arrives over the exec channel. A hook launch or an attach can come before or after that exec, and a hook launch's gated first process starts at the next attach. Only the exec-minted launch held the shell, so a task box could run its task twi 10000 ce, and an attach got the task, not a shell. Every launch now says an exec carries the run, and the launcher starts the shell for it. * refactor(mfile): write box.lifetime and execution.exec in the spec Rename Lifetime::Persistent to UntilStopped, move the lifetime to [box] with a until_complete default for v0 specs, and serialize the entrypoint as execution.exec. List the argv shape as a v0 exception. * fix(minimald): refuse a launch whose stored spec cannot be read held_spec returns an error for unreadable spec bytes or a failed store read, and launch_host refuses with SpawnFailed instead of starting the shell. Mark run_by_exec as an interim that T43 (#2405) removes. * test(minimald): store a readable spec in the stopped-box record test A launch now refuses a stored spec it cannot read, so the test's placeholder bytes failed its ensure_host. Store a session spec instead. * docs(mfile): say that no launch reads the spec's lifetime yet A box ends when its entrypoint returns, whatever box.lifetime says. * fix(minimald): keep entrypoint arguments out of the launch log The box.launch span and its info event printed every argument of an argv entrypoint. An argument can carry a secret, so they now name the program (or the login shell) and the argument count only. A test pins that a secret-looking argument does not reach the log. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> Co-authored-by: Karl Godard <karl@minimal.dev>

…ec id (#2843) * feat(minimald-rpc): carry exec mode, timeout and exec id on the wire min://exec carries an argv with its mode (attached, tty or detached) and an optional timeout. min://exec/attach, min://exec/output and min://exec/wait name an exec by its UUIDv7 id. The box store places each exec's transcript beside the record and appends events by path. * feat(minimald): run box execs under an id, with a terminal or detached Every command for a box gets a UUIDv7 exec id, and a box that is not running refuses it with exit 2 naming its state. min://exec runs an argv with no shell: attached, on a daemon terminal, or detached with stdin closed. Tty and detached execs answer with their id at once, capture their output beside the box record, and keep their exit for min://exec/wait. An exec's own timeout stops it and records an exec_exited event with reason timeout, and the box keeps running. * style(minimald-rpc): format the exec id parse and its tests * fix(minimald): bound the wait after an exec timeout; drop reaped execs A command that survives the stop at its timeout no longer holds its wait open: the wait after the stop is bounded, then SIGKILLed and recorded as a timeout. Ended execs of a reaped box leave the exec map. * fix(minimald): exit 124 on exec timeout; wait reads stored exit An exec that its own timeout ends now exits 124, attached or detached. A wait on an exec that this daemon holds no entry for reads the box's stored exec_exited event, so a detached exec's exit code outlives a daemon restart. * fix(minimald): cap exec transcripts at 8 MiB and stream reads A detached exec now writes through a pipe and a pump, as a tty exec does, so the daemon can cap its transcript. Past the cap the transcript keeps a mark and the newest half of the cap, and the command keeps running. The output read and the attach replay copy the transcript in 64 KiB chunks, up to its length at the open, and the attach takes the terminal lock only to open the file and subscribe. * fix(minimald): bound tty exec input; no deadline past the clock A tty exec's terminal input went through an unbounded channel, so a program that never reads stdin let the daemon queue grow without limit. The terminal now holds typed input in a HeldInput with the attached path's bounds (EXEC_INPUT_HELD_MAX per exec, EXEC_INPUT_HELD_DAEMON_MAX for the daemon). Past either bound the chunk is dropped and the log says so once per exec. The exec's end releases what it held. An attached exec's timeout too large for the clock panicked after the spawn. timeout_deadline now uses checked_add and gives no deadline. Tests: unread tty input stays within the cap, a timeout of u64::MAX seconds runs the exec to its end, and an exec id from one box finds no exec, output or exit in another. * fix(minimald): wait on exec terminals in the runtime, not a thread The tty feed wrote to the terminal from a blocking thread. When the program never read its input, that write never returned, and each such exec left a blocking thread behind for good. The terminal and the detached pipe are now non-blocking and watched through AsyncFd, so the supervisor can stop the pump and the feed at the exec's end. Both stop on a closed state too, because tokio never clears it and a wait for it returns at once. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> Co-authored-by: Karl Godard <karl@minimal.dev>

A destroy removed the box that held a name's row and left the name with no row, while another retained box still had that name. The destroy now runs the same handover as a reap: the row goes to the running box with the name, else to the most recent creation. The destroy answers after the handover. The daemon log names the destroyed box and the successor, and the destroy span records the successor id or "none". Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com>

* test(e2e): prove min ls and the box commands across two VMs Adds the ls_and_box_commands_tell_the_truth case: a stopped VM's boxes in min ls, the ADDRESS and EGRESS cells against min session policy, policy and forward without --vm, the unknown-box and stopped-VM refusals, both proxy ports after the preferred port frees, and the --public and out-of-range expose refusals. * test(e2e): record ls_and_box gates as NOT RUN, check declared rules The four gates of ls_and_box_commands_tell_the_truth now call not_run, so the lane summary names the case. A 'declared rules' EGRESS cell is now checked against the subnets rule row that min session policy prints, not only against an egress heading. * test(e2e): read the expose address past a trailing carriage return The ls_and_box case read the box's address from the in-box expose reply with an end-of-line anchor. A reply over the exec channel can end in a carriage return, which left the address empty. * test(e2e): brace lt_port before a bracket class in the expose read shellcheck reads $lt_port[[:space:]] as an array index (SC1087). The braces keep the same match and make the script lint-clean again. * fix(minimal): poll the owning VM in min net forward A forward to a box on another VM polled the selected VM for its session. That VM does not hold the box, so the forward closed on the first tick. Reconnect the poll to the owning VM, version-gated. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> Co-authored-by: Norrie Taylor <91171431+norrietaylor@users.noreply.github.com>

) * docs(spec): specify dns steering and the host_ip lane for spec 24 Add BEP-080 to BEP-087 so the default `dns` steering works for own_ip and host_ip boxes on a VM host, as architecture D6 and networking §5.4 require. - BEP-080, BEP-081: direct TLS to the proxy on port 443, routed by SNI, and admitting dns and both on a VM host (#2805). - BEP-082 to BEP-087: the host_ip lane: a host-side box id, the cohort proxy lane, cohort-attributed delivery with the named box's egress and audit subject, the in-effect rule, per-box steering, and the live proof. - BEP-015 gains a host_ip proxy_env case. - Security considerations states the cohort lane and per-box steering. * docs(spec): keep the first slice paragraph unchanged and move the host_ip e2e checks to BEP-087 * docs(spec): address review on the host_ip lane requirements - BEP-083: the cohort lane also admits TCP 443 at the proxy's address, the direct TLS path dns steering uses. - BEP-084: refuse and audit a cohort-attributed value that names no live host_ip box of this host. - BEP-086: cite NET-003's VM-backed resolver requirement, not NET-079. - BEP-087: the proxy_env case is its own sub-requirement. - Security considerations: BEP-083 and BEP-084 join the redemption invariant, and BEP-084 the egress invariant.

* feat(boxes): name a box's output log beside its record Adds LOG_FILE and BoxDir, the box's directory as code outside the store sees it: the log path, a lookup by id through the index, a log read by offset, and an event append for a writer that holds no DiskBox. * feat(minimald-rpc): add a streamed read of a box's output log * feat(minimald): log a box's output from its start The host appends every read from the box's terminal to its output log before it hands the bytes to an attached client, so the client is a second reader. A binding whose client closes its channel, drops its connection or is shed records a detached event, and the box runs on. * feat(minimald): serve a box's output log by its id ReadLog streams the log from a byte offset, and with follow sends new output until the box is reaped. A test shows that files written into the box's own directories reach neither the log nor the record. * fix(minimald): read a box's log on the blocking pool The followed log read polled the store with blocking std::fs calls on an async task. The find, the chunk reads and the retained check now run through spawn_blocking, so a slow disk does not hold a runtime worker. * fix(boxes): cap a box's output log and read it across a drop The log keeps a drop mark and the newest half past 8 MiB. A reader keeps its file open and moves to the replaced file with no byte sent twice. The read refuses a link or a file that is not regular. * fix(minimald): start no store box without its output log BoxOutputLog::open returns the open's error for a box in the store, and Host::build stops before the launch. The log writes through the capped store writer, and ReadLog keeps one reader for the whole stream. * fix(minimald): run detach hooks when a PTY client is lost A lost client already records a detached event. Its on_detach hooks now run too, so the event and the hooks agree. A test drives a box past the log cap. * style: format the log cap tests * docs(boxes): mark the 8 MiB log cap as not yet in the design The cap drops the start of a box's output past 8 MiB. That departs from architecture.md line 473. gominimal/arch#159 decides the bound. * docs(specs): record the interim 8 MiB box log cap in BOX The decision that logs a box's output from its start now states the 8 MiB cap, what the log keeps past it, and the arch#159 decision that removes the cap or changes BOX-155. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com>

…ent loss (#2850) * feat(minimald): end an until_complete box when its entrypoint returns The host loop now says whether a kill ended it. The actor watches each launch's loop and, when the entrypoint returned on its own and the spec sets lifetime = "until_complete", sets the record to exited with the exit code and records an exited event with reason "exit". The daemon does this whether or not a client is attached. Such a box raises no shell-exit prompt (BOX-038). A client that goes away never stops a box (BOX-015). * test(minimald): pin box ends on entrypoint return, not client loss Adds the actor tests for BOX-038 and BOX-015. The shell round trip now expects no prompt and an exited record. Tests about a box kept after its shell exits now create an until_stopped box. The rpc shutdown test no longer answers a prompt. * fix(minimald): retry the exited-record write when an entrypoint ends The host and the watch are gone by the time the write runs, so a single failed write left the box running with nothing in it. Retry it with a short backoff, and pin the retry with a test seam. * test(e2e): expect an exited box, not a prompt, when a shell exits The session-exit prompt is gone: exiting the shell ends the box, which stays listed as exited. The pty driver no longer answers a prompt. Each leg that exited a shell now checks the box is exited with code 0, and destroys it where it used to answer Delete. * docs(minimald): put the launch-record seam doc back on its module * test(e2e): resume the exited kept box before the exec into it An exec runs only in a running box. After the shell exits and the row is withdrawn, the leg now resumes the box with a pty 'min session attach', checks that it runs under the same id and that its row is back, and then runs the exec as before. * test(minimald): fail when the channel stays open after shell exit The wait loop ended on a timeout as well as on close, so the test passed even if the channel never closed. Panic on the timeout. * fix(minimald): end an exited box before a queued attach or exec A message queued beside a returned entrypoint ran first and launched a new host, so the entrypoint ran again and its exit was lost. Now only a stop or a destroy goes ahead of the exit, and ensure_host refuses a stopped or exited box. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com>

sysinfo 0.40 makes System construction fallible (System::new returns Result<System, sysinfo::Error>). The three callers keep their 0.39 behaviour on an unsupported platform: minvmd's metrics sample and minimald's resource-pool probe return None, and minvmd's host capacity probe reports zero memory. Unblocks the dependabot cargo group (#2844), which bumped sysinfo without migrating the callers.

coderabbitai · 2026-11-03T16:34:13Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Essentials
Run ID: 400cf083-443a-4ed5-a683-c1f1885aaf25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The workspace sysinfo dependency is upgraded from 0.39 to 0.40. Three callers now handle System::new() failure with caller-specific results.

Changes: sysinfo update and initialization handling

Layer / File(s)	Summary
sysinfo dependency version `Cargo.toml`	The workspace sysinfo dependency changes from 0.39 to 0.40. The MSRV comment now attributes the Rust 1.95 requirement to sysinfo 0.40.
System initialization handling `crates/minimald/src/rpc.rs`, `crates/minvmd/src/cmd/config.rs`, `crates/minvmd/src/metrics.rs`	`detect_resource_pool` and `sample` return `None` if `System::new()` fails. `HostCapacity::probe` reports zero total memory on failure. On success, it refreshes memory and converts the total to MiB, saturating at `u32::MAX` if conversion overflows.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: mitodrummer

Merge Risk: Minimal · previous review 7827c

No actionable regression was identified; the change is suitable for merge with normal build checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title "build(deps): bump sysinfo to 0.40" follows Conventional Commit format and names the main change: the sysinfo dependency upgrade from 0.39 to 0.40. The changeset also adapts three callers to…
Description check		The description covers the template's Summary and Testing sections. The Summary explains the change and why it is needed, and it links the migration guide and the blocked Dependabot PR `#2844`. The Test…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "build(deps): bump sysinfo to 0.40" follows Conventional Commit format and names the main change: the sysinfo dependency upgrade from 0.39 to 0.40. The changeset also adapts three callers to the fallible System::new(), which the title does not mention. That omission is expected for a title, so the check passes.

Full details: Description check

Explanation

The description covers the template's Summary and Testing sections. The Summary explains the change and why it is needed, and it links the migration guide and the blocked Dependabot PR #2844. The Testing section lists the clippy run and the passing test modules, but it does not paste the relevant output as the template asks. The Checklist is absent: it has no check for updated docs and no check for a BREAKING CHANGE footer. The description also does not state whether this change is breaking. The description is mostly complete, so the check passes, but the author should address the gaps noted in the resolution.

Resolution

Optional improvements: paste the relevant clippy and test output in the Testing section, as the template asks. Add the Checklist section and mark each item. State whether the docs need updates. Confirm that the change is not breaking, or add a BREAKING CHANGE footer. The PR title already uses the Conventional Commit form, which the template requires.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 2 functions across 3 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

Generate docstrings

Commit to this branch
Create a new PR

Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the system’s call,
Then notes when memory reads are small.
A version hops from nine to ten,
Two probes return None again.
The host records zero on a miss,
And bounds its memory count like this.}

CodeRabbit Verify

Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

Source mode: Auto

Repository: Unavailable

Branch: Unavailable

File: No configuration file from this repository applied

Commit: Unavailable

Layers: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: `27965f3f-165a-4cf3-81c9-364684369d00`

Commits

Reviewing files that changed from the base of the PR and between `f6fcbab` and `7827c34`.

Files ignored due to path filters: 1

`Cargo.lock` is excluded by `!**/*.lock`

Files selected for processing: 4

`Cargo.toml`

`crates/minimald/src/rpc.rs`

`crates/minvmd/src/cmd/config.rs`

`crates/minvmd/src/metrics.rs`

Included review availability: This review used your included allowance. 1 included review remains after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

minimal-foundry · 2026-11-03T16:35:32Z

Approved: no findings at 7827c34c526a.

Nothing to do.

Clobber: none seen.

minimal-foundry

`minimal-review` — approved

Verdict APPROVE — No findings.

Panel: 3 of 3 personas ran (correctness, security, supply-chain).

github-actions · 2026-11-03T17:09:31Z

Spec lint

docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md — 15 finding(s)

docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:117: P004 BEP-003 names test 'bep_second_box_needs_no_sign_in', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:174: P004 BEP-007 names test 'bep_box_env_holds_sealed_value_only', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:218: P004 BEP-011 names test 'bep_root_ca_present_in_box_trust_store', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:234: P004 BEP-012 names test 'bep_proxy_env_and_no_proxy_are_set', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:290: P004 BEP-015 names test 'bep_git_and_gh_against_private_repo', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:341: P004 BEP-080 names test 'direct_tls_on_443_routes_by_sni', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:354: P004 BEP-081 names test 'vm_host_admits_dns_and_both_for_own_ip_and_host_ip', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:361: P004 BEP-082 names test 'host_ip_box_registration_mints_a_creation_unique_id', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:370: P004 BEP-083 names test 'host_ip_cohort_reaches_proxy_while_a_member_declares_a_lane', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:378: P004 BEP-084 names test 'cohort_delivery_names_no_box', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:392: P004 BEP-085 names test 'detail_pane_shows_a_host_ip_lane_in_effect_on_a_vm_host', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:397: P004 BEP-086 names test 'host_ip_grant_box_steered_names_resolve_to_proxy', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:406: P004 BEP-087 names test 'bep_host_ip_git_and_gh_under_dns_steering', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:718: P004 BEP-043 names test 'bep_destroyed_box_values_refused_within_60s', which was not found in the repository
docs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.md:727: P004 BEP-044 names test 'bep_logout_refuses_every_reference_at_next_request', which was not found in the repository

docs/specs/29-spec-box-local-first/29-spec-box-local-first.md — 38 finding(s)

docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:98: P004 BOX-007 names test 'self_as_name_is_exit3', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:190: P004 BOX-028 names test 'hooks_on_resume_reruns_on_activate', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:201: P004 BOX-037 names test 'until_complete_timeout_terms_then_kills_box_and_execs_reason_timeout', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:250: P004 BOX-046 names test 'type_noun_tables_are_boxes_sugar', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:257: P004 BOX-048 names test 'defaults_merge_lists_union_scalars_replace', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:262: P004 BOX-049 names test 'flat_per_entry_keys_and_legacy_keys_keep_meaning', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:266: P004 BOX-050 names test 'legacy_session_table_reads_as_defaults_session_with_hint', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:273: P004 BOX-165 names test 'no_session_entry_expands_implicit_default_session', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:280: P004 BOX-051 names test 'legacy_defaults_task_keys_with_hint', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:284: P004 BOX-052 names test 'legacy_params_reads_as_args_with_hint', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:288: P004 BOX-054 names test 'interactive_task_exit3_names_session', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:292: P004 BOX-059 names test 'box_type_resolves_to_builtin_root', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:301: P004 BOX-061 names test 'expanded_spec_violating_constraint_exit3_names_type_and_layer', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:306: P004 BOX-156 names test 'derived_type_loosening_constraint_exit3_names_type_key_parent', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:311: P004 BOX-160 names test 'admission_refuses_spec_breaching_builtin_root_constraint_exit3', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:315: P004 BOX-062 names test 'constraint_never_adds_package_port_or_egress', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:320: P004 BOX-063 names test 'session_and_task_entries_expand_and_validate', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:327: P004 BOX-064 names test 'expansion_order_and_merge_rules', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:332: P004 BOX-065 names test 'expansion_is_byte_identical_across_runs', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:337: P004 BOX-066 names test 'invalid_key_exit3_names_key_and_layer', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:341: P004 BOX-161 names test 'expansion_reports_layer_and_type_per_value_outside_spec_bytes', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:352: P004 BOX-071 names test 'projection_is_the_6_3_2_field_set', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:366: P004 BOX-072 names test 'projection_digest_mismatch_refuses_create', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:371: P004 BOX-073 names test 'unenrolled_evaluates_no_policy', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:375: P004 BOX-074 names test 'get_version_reports_expander_version', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:382: P004 BOX-145 names test 'example_expansion_matches_golden_vectors', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:386: P004 BOX-076 names test 'sections_follow_box_toml_with_nested_egress', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:408: P004 BOX-079 names test 'network_mode_legacy_spelling_hint_and_canonical_value', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:412: P004 BOX-157 names test 'flat_egress_keys_hint_and_canonical_nested_keys', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:416: P004 BOX-080 names test 'network_bep_secrets_passed_unchanged', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:423: P004 BOX-081 names test 'broker_secret_unenrolled_exit5', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:427: P004 BOX-085 names test 'params_accepted_and_rendered', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:467: P004 BOX-151 names test 'stop_exec_ends_process_group', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:472: P004 BOX-152 names test 'exec_events_carry_principal_argv_pty_code', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:477: P004 BOX-153 names test 'exec_disabled_refuses_exit5', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:484: P004 BOX-140 names test 'unenrolled_operations_over_file_mode_trust', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:488: P004 BOX-141 names test 'store_secret_passed_through_unenrolled', which was not found in the repository
docs/specs/29-spec-box-local-first/29-spec-box-local-first.md:492: P004 BOX-142 names test 'enrolled_and_unenrolled_expansion_identical', which was not found in the repository

Advisory. None of this blocks the merge; the review decides.

Advisory, and never a merge gate. Linter: gominimal/foundry@fb5932b8, spec format: How Minimal Writes Specs.

mitodrummer and others added 11 commits November 2, 2026 18:59

fix(deps): bump pulldown-cmark to 0.13.6 for RUSTSEC-2026-0433 (#2846)

1aa79ab

Claude-Session: https://claude.ai/code/session_01NSAwDroXL6KqsSxUzdbZGw Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

norrietaylor requested a review from a team as a code owner November 3, 2026 16:33

minimal-foundry Bot approved these changes Nov 3, 2026

View reviewed changes

minimal-foundry Bot added the review:approved minimal-review approved the current head label Nov 3, 2026

coderabbitai Bot approved these changes Nov 3, 2026

View reviewed changes

norrietaylor changed the base branch from main to dependabot/cargo/cargo-1faa5e5e04 November 3, 2026 17:06

Merge branch 'dependabot/cargo/cargo-1faa5e5e04' into fix/sysinfo-0.40

b3eca1e

norrietaylor merged commit 12e12ad into dependabot/cargo/cargo-1faa5e5e04 Nov 3, 2026
3 checks passed

norrietaylor deleted the fix/sysinfo-0.40 branch November 3, 2026 17:07

minimal-foundry Bot mentioned this pull request Nov 3, 2026

build(deps): bump the cargo group across 1 directory with 22 updates #2844

Open

Navigation Menu

Repository navigation

build(deps): bump sysinfo to 0.40 - #2866

build(deps): bump sysinfo to 0.40#2866
norrietaylor merged 12 commits into
dependabot/cargo/cargo-1faa5e5e04from
fix/sysinfo-0.40

Uh oh!

Review skipped

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Uh oh!

Summary by CodeRabbit

Uh oh!

Uh oh!

Review skipped

CodeRabbit Verify

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

minimal-review — approved

Uh oh!

Uh oh!

Spec lint

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

`minimal-review` — approved