Repository navigation
T126 — A host-address box's port that collides on the host is shown at session start and in min ls - #2830
Conversation
The host control socket answers a read-only mirror_collisions verb with the node's mirrored ports that collided with a holder on the host. The node mirror keeps the time each port first collided.
min ls prints a MIRROR PORTS row per VM whose host_ip box ports are held by another program on the host, and --json carries mirror_collisions per VM. min session activate of a host_ip box on a VM host prints the same sentence per port when it does not attach.
…ress-box-s-port-that-collides-on-the-h
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
There was a problem hiding this comment.
Babysitter review of 62dd7d2 against T126. The VM host daemon reports collided mirror ports over mirror_collisions. min ls adds one MIRROR PORTS row per VM that has any, --json carries mirror_collisions for each VM, and --raw pays no read. Activate prints the sentences on stderr only when it does not attach, so nothing lands before the shell paints (AGENTS.md healthy-start rule). The id on stdout stays the scripting contract. Each sentence names the port and says a host_ip box cannot open it, which is true for whichever box binds it. Nits, not blocking: the sentence starts lowercase ("port 8080 is held…"). The use super::*; in resolver.rs tests now sits after the new test. Activate runs right after create, before the box binds anything, so in practice it lists the VM's existing collisions.
|
Approved: no findings at Nothing to do. Clobber: none seen. |
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
This change reports the collided mirror ports from the host side, through a host-door verb that a guest cannot reach. That conforms to §7.1 lines 244 and 261. One gap is left. min ls changes a failed read of the VM host daemon into an empty list, so --json says mirror_collisions: [] when the CLI does not know. Line 254 does not allow a silent fallback. Make the change in C1: keep the read as an Option, and write null in --json when the CLI got no answer.
Ruled at 62dd7d2 against gominimal/arch@8640f85e193d by claude-opus-5-5.
…ress-box-s-port-that-collides-on-the-h
Read each VM's collided mirror ports concurrently, and keep a failed read apart from an empty one: --json writes null for a VM with no answer and [] only for an answered empty read.
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The change conforms to §7.1. The VM host daemon reports collided mirror ports on the host door only, as ports alone. min ls and min session activate show them. This head fixes --json: a VM with no answer is null, not []. The text table still skips that VM. A person then reads "no collisions" when the collisions are unknown, and line 261 requires the report in listings. Make the change in C1.
Ruled at 3860fbf against gominimal/arch@8640f85e193d by claude-opus-5-5.
|
/revise Arch C1 and one review finding on 62dd7d2.
Leave the activate hook as it is. The note about it on |
|
That Nothing to type again: the command gets a rocket when its round starts, or a refusal that names the reason. No round was counted for it yet. |
|
Round 1 of 10 on the runtime's review findings, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Review threads the coder judged:
With a host port already held, Notes from the agent: Round 1 changed only crates/minimal/src/cmd/list.rs. The test helper |
min ls printed nothing for a running VM host that gave no answer, so it looked the same as one with no collisions. It now prints one MIRROR PORTS row that says the VM did not report its ports.
A native host has no VM host daemon. The fallback listing's control socket there is minimald's, which does not serve the collided-port read, so min ls printed a false MIRROR PORTS row on every native host.
|
Round 2 of 10 on a /revise note, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Review threads the coder judged:
With a host port already held, a host_ip box listening on that port shows the collision in Notes from the agent: Note items 1 and 2 (Option<Vec> reads, null in --json, the doc comment, the None assertion, join_all) were already on the branch in 3860fbf, so this round adds no change for them. This round adds the arch C1 row for a running VM host with a control socket whose read gave no answer: |
|
Round 3 of 10 on a failed check suite, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. With a host port already held, a host_ip box listening on that port shows the collision in Notes from the agent: The failed |
There was a problem hiding this comment.
Babysitter review of 0f17977. Arch C1 is met. An unread VM is null in --json and gets a MIRROR PORTS row saying the VM did not report its ports. An answered empty read is []. The reads run together, and a native host makes none. The activate-hook note is accepted as a residual: min ls is the lasting surface.
There was a problem hiding this comment.
arch-review: CONDITIONS · 1 condition · the full ruling
min ls now names a running VM host that does not report its collided ports. This conforms to §7.1 lines 254 and 261. min session activate still uses unwrap_or_default() on the same read, so an unread VM host prints nothing at session start. Section 7.1 line 261 requires the report at session start, and line 254 forbids a silent fallback. Make the change in C1. Then print the unread line on activate and update the test that pins the empty result.
Ruled at 0f17977 against gominimal/arch@8640f85e193d by claude-opus-5-5.
min session activate now prints the unread sentence that min ls prints when the VM host daemon gives no answer. The ListSessions span wraps the collided-port reads, and a native host's --json carries no mirror_collisions field.
There was a problem hiding this comment.
arch-review: PASS · the full ruling
This head conforms to §7.1. A VM host that did not answer the collided-port read is now named at activate, as min ls already names it. So no read failure looks like a VM with no collisions (line 254, line 261). The verb stays on the host door, after the peer uid check, and its reply carries ports only (line 244). One doc comment is out of date: read_mirror_collisions says the caller prints nothing on a failed read. Correct it when you next touch the file. It is not a condition.
Ruled at bb43339 against gominimal/arch@8640f85e193d by claude-opus-5-5.
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 5 unresolved threads — minimal-arch[bot] crates/minimal/src/resolver.rs, minimal-arch[bot] crates/minimal/src/resolver.rs:4988, minimal-foundry[bot] crates/minimal/src/cmd/boxes/create.rs:2714, minimal-foundry[bot] crates/minimal/src/cmd/list.rs:694, minimal-foundry[bot] crates/minimal/src/cmd/list.rs:691. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
|
/revise Arch C1 and two review findings on 0f17977.
Run this task's test lines. |
|
That Nothing to type again: the command gets a rocket when its round starts, or a refusal that names the reason. No round was counted for it yet. |
|
Round 4 of 10 on the runtime's review findings, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Review threads the coder judged:
With a host port already held, a host_ip box that listens on that port shows the collision in min ls and in the min session activate output, and each names the port. When the VM host does not answer the read, both surfaces say that the VM did not report, and they do not show an empty list. Notes from the agent: Revise round 4. The unread sentence is now one function, mirror_collision_unread_sentence, in resolver.rs. min ls and activate print it with the same words. A native host's --json no longer carries mirror_collisions. The ListSessions span now wraps the collided-port reads through .instrument. The activate read still runs once, directly after activation, and it reads the whole node. The task specifies both: the control verb carries ports only, and the sentence says 'a host_ip box', not 'this box'. |
|
Round 5 of 10 on a /revise note: the coder changed nothing. No change this round. The branch head bb43339 already addresses the three items in the note, which cites 0f17977. (1) print_mirror_collisions prints mirror_collision_unread_sentence() for a failed read and for a None socket. mirror_collision_unread_row in list.rs uses the same helper, and the test expects that line for absent.sock and None. The call in create.rs still runs only when the activation does not attach. (2) The collided-port reads in cmd_ls run under .instrument(span) on the ListSessions span. (3) insert_mirror_collisions adds no field when no read happened, and ls_shows_mirror_collisions checks that a native --json listing has no mirror_collisions key. All three test lines pass at the head. |
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — every review thread is resolved; @norrietaylor closed the last one. The review of bb433394f5c0 withheld this approval on the threads open then. Posted as a comment: the App cannot approve its own pull request; the check and the label carry it.
There was a problem hiding this comment.
Babysitter review of bb43339. Arch C1 is met: activate prints the unread sentence for a VM host that gave no answer, the same as min ls. The span is instrumented, and a native or --raw listing adds no mirror_collisions key. The arch review is PASS at this head. The activate-timing note stays as an accepted residual.
…ress-box-s-port-that-collides-on-the-h # Conflicts: # crates/minimal/src/cmd/list.rs
There was a problem hiding this comment.
arch-review: PASS · the full ruling
The change still conforms to §7.1. This head only merges main. The list.rs conflict resolution passes the new proxy-port reads through to the listing and keeps the MIRROR PORTS rows and the mirror_collisions JSON field as they were. The host-door read in control.rs is unchanged, and the new proxy_ports verb does not match it. The PASS on bb433394 carries to this head.
Ruled at 237f3de against gominimal/arch@8640f85e193d by claude-opus-5-5.
|
A merge of main before round 6, not counted against the cap (1 of 3), pushed as Resolved conflicts in:
Verify Outside the task's
Converted to a draft: something above needs a person before review. With a host port already held, a host_ip box that listens on that port shows the collision in Notes from the agent: This round resolved the merge conflict with main in crates/minimal/src/cmd/list.rs. cmd_ls now reads both the collided mirror ports (T126) and the hostname proxy ports (NET-154). format_ls_across_vms_with_mirrors_on takes a new vm_proxy_ports slice and renders through format_ls_across_vms_with_proxy_ports_on. Thus the --json output and the table carry both. The function now has 8 arguments, so it carries an #[expect(clippy::too_many_arguments)] with a reason. clippy -p minimal --all-targets is clean. The other files in the merge commit come from main and are not changes from this task. |
* fix(deps): bump pulldown-cmark to 0.13.6 for RUSTSEC-2026-0433 (#2846) Claude-Session: https://claude.ai/code/session_01NSAwDroXL6KqsSxUzdbZGw Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(minimald): hand a reaped name over in one manager step (#2842) A reap read the records and then sent the handover as a second message. A removal that began between the two left the name with no row while another retained box still had it. The manager now releases the reaped box's row, picks the successor among boxes not being removed, and registers it in one message. The reap and the prune return after both. The daemon log names the release (name-released) before the handover (name-handed-over), both with box ids. Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * T126 — A host-address box's port that collides on the host is shown at session start and in `min ls` (#2830) * feat(minvmd): answer a node's collided mirror ports over control The host control socket answers a read-only mirror_collisions verb with the node's mirrored ports that collided with a holder on the host. The node mirror keeps the time each port first collided. * feat(minimal): show collided mirror ports in min ls and activate min ls prints a MIRROR PORTS row per VM whose host_ip box ports are held by another program on the host, and --json carries mirror_collisions per VM. min session activate of a host_ip box on a VM host prints the same sentence per port when it does not attach. * fix(minimal): show an unread VM's mirror ports as null in min ls Read each VM's collided mirror ports concurrently, and keep a failed read apart from an empty one: --json writes null for a VM with no answer and [] only for an answered empty read. * fix(minimal): name a VM host whose mirror ports were not read min ls printed nothing for a running VM host that gave no answer, so it looked the same as one with no collisions. It now prints one MIRROR PORTS row that says the VM did not report its ports. * fix(minimal): skip the mirror-port read on a native host A native host has no VM host daemon. The fallback listing's control socket there is minimald's, which does not serve the collided-port read, so min ls printed a false MIRROR PORTS row on every native host. * fix(minimal): name an unread VM host at activate, enter the span min session activate now prints the unread sentence that min ls prints when the VM host daemon gives no answer. The ListSessions span wraps the collided-port reads, and a native host's --json carries no mirror_collisions field. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * T42 — Start every box's entrypoint from its spec through one launcher (#2841) * feat(mfile): carry entrypoint and lifetime in the box spec The spec gains an [execution] table with the box's lifetime and, for a box that does not run its login shell, its entrypoint argv. A v0 spec stored before the table existed reads with the entrypoint its type implies. * feat(minimald): start each box's entrypoint from its spec One launcher decision, LaunchSpec::entrypoint, reads the first process from the box's stored spec: the login shell, or the spec's argv. The actor reads the stored spec once, keeps its hold, and hands it to every launcher. A launch minted for an exec keeps the shell, because the exec runs the box's command. Each launch logs its entrypoint in a box.launch span. * fix(minimald): keep the shell on every launch of an exec-run box A task's run arrives over the exec channel. A hook launch or an attach can come before or after that exec, and a hook launch's gated first process starts at the next attach. Only the exec-minted launch held the shell, so a task box could run its task twice, and an attach got the task, not a shell. Every launch now says an exec carries the run, and the launcher starts the shell for it. * refactor(mfile): write box.lifetime and execution.exec in the spec Rename Lifetime::Persistent to UntilStopped, move the lifetime to [box] with a until_complete default for v0 specs, and serialize the entrypoint as execution.exec. List the argv shape as a v0 exception. * fix(minimald): refuse a launch whose stored spec cannot be read held_spec returns an error for unreadable spec bytes or a failed store read, and launch_host refuses with SpawnFailed instead of starting the shell. Mark run_by_exec as an interim that T43 (#2405) removes. * test(minimald): store a readable spec in the stopped-box record test A launch now refuses a stored spec it cannot read, so the test's placeholder bytes failed its ensure_host. Store a session spec instead. * docs(mfile): say that no launch reads the spec's lifetime yet A box ends when its entrypoint returns, whatever box.lifetime says. * fix(minimald): keep entrypoint arguments out of the launch log The box.launch span and its info event printed every argument of an argv entrypoint. An argument can carry a secret, so they now name the program (or the login shell) and the argument count only. A test pins that a secret-looking argument does not reach the log. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> Co-authored-by: Karl Godard <karl@minimal.dev> * T30 — Run a command in a box with a terminal or detached, under an exec id (#2843) * feat(minimald-rpc): carry exec mode, timeout and exec id on the wire min://exec carries an argv with its mode (attached, tty or detached) and an optional timeout. min://exec/attach, min://exec/output and min://exec/wait name an exec by its UUIDv7 id. The box store places each exec's transcript beside the record and appends events by path. * feat(minimald): run box execs under an id, with a terminal or detached Every command for a box gets a UUIDv7 exec id, and a box that is not running refuses it with exit 2 naming its state. min://exec runs an argv with no shell: attached, on a daemon terminal, or detached with stdin closed. Tty and detached execs answer with their id at once, capture their output beside the box record, and keep their exit for min://exec/wait. An exec's own timeout stops it and records an exec_exited event with reason timeout, and the box keeps running. * style(minimald-rpc): format the exec id parse and its tests * fix(minimald): bound the wait after an exec timeout; drop reaped execs A command that survives the stop at its timeout no longer holds its wait open: the wait after the stop is bounded, then SIGKILLed and recorded as a timeout. Ended execs of a reaped box leave the exec map. * fix(minimald): exit 124 on exec timeout; wait reads stored exit An exec that its own timeout ends now exits 124, attached or detached. A wait on an exec that this daemon holds no entry for reads the box's stored exec_exited event, so a detached exec's exit code outlives a daemon restart. * fix(minimald): cap exec transcripts at 8 MiB and stream reads A detached exec now writes through a pipe and a pump, as a tty exec does, so the daemon can cap its transcript. Past the cap the transcript keeps a mark and the newest half of the cap, and the command keeps running. The output read and the attach replay copy the transcript in 64 KiB chunks, up to its length at the open, and the attach takes the terminal lock only to open the file and subscribe. * fix(minimald): bound tty exec input; no deadline past the clock A tty exec's terminal input went through an unbounded channel, so a program that never reads stdin let the daemon queue grow without limit. The terminal now holds typed input in a HeldInput with the attached path's bounds (EXEC_INPUT_HELD_MAX per exec, EXEC_INPUT_HELD_DAEMON_MAX for the daemon). Past either bound the chunk is dropped and the log says so once per exec. The exec's end releases what it held. An attached exec's timeout too large for the clock panicked after the spawn. timeout_deadline now uses checked_add and gives no deadline. Tests: unread tty input stays within the cap, a timeout of u64::MAX seconds runs the exec to its end, and an exec id from one box finds no exec, output or exit in another. * fix(minimald): wait on exec terminals in the runtime, not a thread The tty feed wrote to the terminal from a blocking thread. When the program never read its input, that write never returned, and each such exec left a blocking thread behind for good. The terminal and the detached pipe are now non-blocking and watched through AsyncFd, so the supervisor can stop the pump and the feed at the exec's end. Both stop on a closed state too, because tokio never clears it and a wait for it returns at once. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> Co-authored-by: Karl Godard <karl@minimal.dev> * fix(minimald): hand a destroyed box's name to the next holder (#2849) A destroy removed the box that held a name's row and left the name with no row, while another retained box still had that name. The destroy now runs the same handover as a reap: the row goes to the running box with the name, else to the most recent creation. The destroy answers after the handover. The daemon log names the destroyed box and the successor, and the destroy span records the successor id or "none". Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * T114 — `min ls` and the box commands tell the truth, end to end (#2839) * test(e2e): prove min ls and the box commands across two VMs Adds the ls_and_box_commands_tell_the_truth case: a stopped VM's boxes in min ls, the ADDRESS and EGRESS cells against min session policy, policy and forward without --vm, the unknown-box and stopped-VM refusals, both proxy ports after the preferred port frees, and the --public and out-of-range expose refusals. * test(e2e): record ls_and_box gates as NOT RUN, check declared rules The four gates of ls_and_box_commands_tell_the_truth now call not_run, so the lane summary names the case. A 'declared rules' EGRESS cell is now checked against the subnets rule row that min session policy prints, not only against an egress heading. * test(e2e): read the expose address past a trailing carriage return The ls_and_box case read the box's address from the in-box expose reply with an end-of-line anchor. A reply over the exec channel can end in a carriage return, which left the address empty. * test(e2e): brace lt_port before a bracket class in the expose read shellcheck reads $lt_port[[:space:]] as an array index (SC1087). The braces keep the same match and make the script lint-clean again. * fix(minimal): poll the owning VM in min net forward A forward to a box on another VM polled the selected VM for its session. That VM does not hold the box, so the forward closed on the first tick. Reconnect the poll to the owning VM, version-gated. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> Co-authored-by: Norrie Taylor <91171431+norrietaylor@users.noreply.github.com> * docs(spec): specify dns steering and the host_ip lane for spec 24 (#2851) * docs(spec): specify dns steering and the host_ip lane for spec 24 Add BEP-080 to BEP-087 so the default `dns` steering works for own_ip and host_ip boxes on a VM host, as architecture D6 and networking §5.4 require. - BEP-080, BEP-081: direct TLS to the proxy on port 443, routed by SNI, and admitting dns and both on a VM host (#2805). - BEP-082 to BEP-087: the host_ip lane: a host-side box id, the cohort proxy lane, cohort-attributed delivery with the named box's egress and audit subject, the in-effect rule, per-box steering, and the live proof. - BEP-015 gains a host_ip proxy_env case. - Security considerations states the cohort lane and per-box steering. * docs(spec): keep the first slice paragraph unchanged and move the host_ip e2e checks to BEP-087 * docs(spec): address review on the host_ip lane requirements - BEP-083: the cohort lane also admits TCP 443 at the proxy's address, the direct TLS path dns steering uses. - BEP-084: refuse and audit a cohort-attributed value that names no live host_ip box of this host. - BEP-086: cite NET-003's VM-backed resolver requirement, not NET-079. - BEP-087: the proxy_env case is its own sub-requirement. - Security considerations: BEP-083 and BEP-084 join the redemption invariant, and BEP-084 the egress invariant. * T10 — Log a box's output from its start, out of the box's reach (#2852) * feat(boxes): name a box's output log beside its record Adds LOG_FILE and BoxDir, the box's directory as code outside the store sees it: the log path, a lookup by id through the index, a log read by offset, and an event append for a writer that holds no DiskBox. * feat(minimald-rpc): add a streamed read of a box's output log * feat(minimald): log a box's output from its start The host appends every read from the box's terminal to its output log before it hands the bytes to an attached client, so the client is a second reader. A binding whose client closes its channel, drops its connection or is shed records a detached event, and the box runs on. * feat(minimald): serve a box's output log by its id ReadLog streams the log from a byte offset, and with follow sends new output until the box is reaped. A test shows that files written into the box's own directories reach neither the log nor the record. * fix(minimald): read a box's log on the blocking pool The followed log read polled the store with blocking std::fs calls on an async task. The find, the chunk reads and the retained check now run through spawn_blocking, so a slow disk does not hold a runtime worker. * fix(boxes): cap a box's output log and read it across a drop The log keeps a drop mark and the newest half past 8 MiB. A reader keeps its file open and moves to the replaced file with no byte sent twice. The read refuses a link or a file that is not regular. * fix(minimald): start no store box without its output log BoxOutputLog::open returns the open's error for a box in the store, and Host::build stops before the launch. The log writes through the capped store writer, and ReadLog keeps one reader for the whole stream. * fix(minimald): run detach hooks when a PTY client is lost A lost client already records a detached event. Its on_detach hooks now run too, so the event and the hooks agree. A test drives a box past the log cap. * style: format the log cap tests * docs(boxes): mark the 8 MiB log cap as not yet in the design The cap drops the start of a box's output past 8 MiB. That departs from architecture.md line 473. gominimal/arch#159 decides the bound. * docs(specs): record the interim 8 MiB box log cap in BOX The decision that logs a box's output from its start now states the 8 MiB cap, what the log keeps past it, and the arch#159 decision that removes the cap or changes BOX-155. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * T9 — End a box when its entrypoint returns, never for idleness or client loss (#2850) * feat(minimald): end an until_complete box when its entrypoint returns The host loop now says whether a kill ended it. The actor watches each launch's loop and, when the entrypoint returned on its own and the spec sets lifetime = "until_complete", sets the record to exited with the exit code and records an exited event with reason "exit". The daemon does this whether or not a client is attached. Such a box raises no shell-exit prompt (BOX-038). A client that goes away never stops a box (BOX-015). * test(minimald): pin box ends on entrypoint return, not client loss Adds the actor tests for BOX-038 and BOX-015. The shell round trip now expects no prompt and an exited record. Tests about a box kept after its shell exits now create an until_stopped box. The rpc shutdown test no longer answers a prompt. * fix(minimald): retry the exited-record write when an entrypoint ends The host and the watch are gone by the time the write runs, so a single failed write left the box running with nothing in it. Retry it with a short backoff, and pin the retry with a test seam. * test(e2e): expect an exited box, not a prompt, when a shell exits The session-exit prompt is gone: exiting the shell ends the box, which stays listed as exited. The pty driver no longer answers a prompt. Each leg that exited a shell now checks the box is exited with code 0, and destroys it where it used to answer Delete. * docs(minimald): put the launch-record seam doc back on its module * test(e2e): resume the exited kept box before the exec into it An exec runs only in a running box. After the shell exits and the row is withdrawn, the leg now resumes the box with a pty 'min session attach', checks that it runs under the same id and that its row is back, and then runs the exec as before. * test(minimald): fail when the channel stays open after shell exit The wait loop ended on a timeout as well as on close, so the test passed even if the channel never closed. Panic on the timeout. * fix(minimald): end an exited box before a queued attach or exec A message queued beside a returned entrypoint ran first and launched a new host, so the entrypoint ran again and its exit was lost. Now only a stop or a destroy goes ahead of the exit, and ensure_host refuses a stopped or exited box. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * build(deps): bump sysinfo to 0.40 sysinfo 0.40 makes System construction fallible (System::new returns Result<System, sysinfo::Error>). The three callers keep their 0.39 behaviour on an unsupported platform: minvmd's metrics sample and minimald's resource-pool probe return None, and minvmd's host capacity probe reports zero memory. Unblocks the dependabot cargo group (#2844), which bumped sysinfo without migrating the callers. --------- Co-authored-by: Karl Godard <karl@minimal.dev> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com>
T126 — A host-address box's port that collides on the host is shown at session start and in
min lsslice: S18
kind: task
covers: NET-138
size: M
est: 180 code, 240 tests
executor: agent
difficulty: routine
model: standard
diagnostics:
min lsnames each mirrored port that collided, so a person reads the collision in the listing and in the session-start output, not only in the minvmd logobservability: the existing minvmd warn line per collision stays; the control verb's reply count of collisions is a field on the ListSessions span
layers:
- host:
- crates/minvmd/src/box_registry.rs:
NodeMirror::collisions()feeds a per-node list of collided ports with the time each was first seen, cleared when the port 8000 binds or the box ends- crates/minvmd/src/control.rs: a read-only control verb returns the node's collided mirror ports to the host CLI; it carries ports only, no address, path or box name
test: cargo nextest run -p minvmd mirror_collisions_reported_over_control
- cli:
- crates/minimal/src/cmd/list.rs: when a VM reports collided mirror ports,
min lsprints one row per VM:MIRROR PORTS: <vm> port <p> is held by another program on this machine, so a host_ip box cannot open it here(one port per sentence);--jsoncarriesmirror_collisions: [<port>, ...]per VM- crates/minimal/src/resolver.rs:
min session activateof ahost_ipbox on a VM host prints the same sentence for each collided port, after activation and outside an interactive attachtest: cargo nextest run -p minimal ls_shows_mirror_collisions
test: cargo nextest run -p minimal activate_names_collided_mirror_ports
produces: none
consumes: none
proof: With a host port already held, a
host_ipbox listening on that port shows the collision inmin lsand in the activate output, naming the port.depends on:
- blocked by #2699
Proof
When another program holds a host port and a host_ip box on a VM host listens on that port,
min lsprintsMIRROR PORTS: <vm> port <p> is held by another program on this machine, so a host_ip box cannot open it here.andmin ls --jsoncarriesmirror_collisions: [<p>]for that VM.min session activateof a host_ip box without --attach prints the same sentence for each collided port after the box id. The tests prove this against a real minvmd control socket and a fake one. No end-to-end run against a live VM was made.Notes from the agent: Out of layers: crates/minimal/src/cmd/boxes/create.rs has one new call to crate::resolver::print_mirror_collisions after
println!("{id}"). The activate print site lives there, and resolver.rs alone cannot make activate print. The call runs only for a host_ip (HostNet) box on a minvmd host, and only when --attach is not given, so no line prints before an interactive shell.Wire design: the new
mirror_collisionsverb is not a BoxControlRequest variant. A new variant needs crates/minimald-rpc, which is outside the layers. control.rs instead defines HostReadRequest and MirrorCollisionsReply, answers the line before the shared parse on the host door only, and exportsminvmd::control::read_mirror_collisionsfor the CLI (minimal already depends on minvmd). A follow-up can move the verb into minimald-rpc. The guest door falls through to the usual parse refusal.box_registry.rs:
collidedis now a BTreeMap<u16, Instant> with the time of the first collision. A newcollisions_since()exposes it. The existing clearing paths stay: bind, stop notice, and every end of the binds (box end, range probe failure, node end).Observability: cmd_ls records the total count on a
ListSessionsinfo span fieldmirror_collisions. The minvmd warn line per collision stays unchanged.Printed text: the task fixes the sentence
port <p> is held by another program on this machine, so a host_ip box cannot open it here. I copie…[truncated]Tests
cargo nextest run -p minvmd mirror_collisions_reported_over_controlcargo nextest run -p minimal ls_shows_mirror_collisionscargo nextest run -p minimal activate_names_collided_mirror_portsVerify
min task run agent-verifyexited 100 under rustc 1.99.0, which the repository does not pin (1.99.1 in rust-toolchain.toml); the PR is not a draft on that alone — CI, which honours the pin, is the gate.Base
The base branch moved while the coder worked; it was merged in before the tests ran.
Out of scope
These files are outside the task's
layers:, so this PR is a draft:crates/minimal/src/cmd/boxes/create.rsCloses #2799