Repository navigation
T149 — A native host-address box's network view says host exposures do not apply - #2958
Conversation
On a native host, a host-address box runs in the host's network namespace, so no gate applies the host exposures table to it (NET-160). The network view of `min session policy` now says so.
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Approved: every review thread resolved at @norrietaylor resolved the last thread, which releases the approval this review had withheld. Nothing to do. |
There was a problem hiding this comment.
arch-review: PASS · the full ruling
The change conforms to §7.1 Lanes, line 253. That line says the table is not applied to a native host-address box, and min session policy says so in place of a list of exposures. The new row in format_policy does this, and the test pins the text. The key fabric.is_none() is the native host exactly, because the only caller sets fabric from HostKind::Minvmd. No conditions.
Ruled at 107a601 against gominimal/arch@7a86ec7bb3c0 by claude-opus-5-5.
|
/revise Round 1 has read Revising since 00:10Z with no commit, so this replaces it. Answer the open thread at |
…ost-address-box-s-network-view-says-ho
format_policy keyed the row on fabric being None, but None only means no switch fabric is named. format_policy_on_host takes an explicit native_host input, and min session policy sets it from the daemon's host kind.
…ost-address-box-s-network-view-says-ho
There was a problem hiding this comment.
arch-review: PASS · the full ruling
The change conforms to §7.1 Lanes, line 253. The row now keys on the host kind, not on fabric. HostKind::Minimald is the design's native node: minimald on the host OS with no VM. The baseline PASS on 107a601d stands for the rest of the change.
Ruled at 353695a against gominimal/arch@7a86ec7bb3c0 by claude-opus-5-5.
|
Round 1 of 10 on a /revise note, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Review threads the coder judged:
On a native host, Notes from the agent: Revise round 1. The directive asked for the fix in crates/minimal/src/cmd/session.rs. That file is outside the task's layers, and I touched it for this reason only: the call site now passes native_host from daemon_host_kind. format_policy keeps its signature and passes native_host = false. Because of this, the callers in tests/cli.rs and src/tests.rs stay unchanged and no longer render the row. The new format_policy_on_host takes the explicit input. cargo clippy -p minimal --all-targets reported no warnings or errors. The directive asked me to resolve the thread. My instructions do not let me resolve threads, so the reviewer must do it. |
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — every review thread is resolved; @norrietaylor closed the last one. The review of 353695ae3646 withheld this approval on the threads open then. Posted as a comment: the App cannot approve its own pull request; the check and the label carry it.
There was a problem hiding this comment.
< 8BD0 /div>Reviewed against T149's plan block. format_policy_on_host takes the host kind from the caller, so the row no longer infers a native host from a missing fabric. native_host_ip_network_view_says_host_exposures_do_not_apply covers native, VM, no fabric and own-address, and arch-review passes on this head.
T149 — A native host-address box's network view says host exposures do not apply
slice: S21
kind: task
covers: NET-160
size: S
est: 30 code, 60 tests
executor: agent
difficulty: routine
model: light
diagnostics: a person reads the row in the output of
min session policy <box>observability: the change prints a row and emits no signal
layers:
- cli:
- crates/minimal/src/cmd/boxes/policy.rs:
format_policyprints, for a host-address box on a native host, the rowhost exposures not applied: this box shares the host's networkin place of a list of exposures; it is true because a native host-address box runs in the host's network namespace, where no gate applies the table (design §7.1 Lanes, NET-079);native_host_ip_network_view_says_host_exposures_do_not_applypins the texttest: cargo nextest run -p minimal native_host_ip_network_view_says_host_exposures_do_not_apply
produces: none
consumes: none
proof: On a native host, the network view of a host-address box says the host's exposures table does not apply to it.
Proof
On a native host,
min session policy <box>for a host-address box now prints the rowhost exposures not applied: this box shares the host's networkin its egress block. A VM-backed host-address box and an own-address box do not print this row.Notes from the agent: format_policy has no explicit native-host argument, and the caller in crates/minimal/src/cmd/session.rs is outside the layers. So the row keys on
network == HostNet && fabric.is_none(). Both callers setfabricto None exactly when the daemon host kind is not Minvmd, that is, on a native host. A comment in format_policy records this. If a future caller passes None for a VM-backed host, the row will print there wrongly, so an explicit native flag is a candidate for a later task. The JSON rendering (write_policy_json) is unchanged, because the task names only the text row. Before this change, the view printed no list of exposures for any box, so the row is an addition and replaces nothing. I also ran the two existing policy_render tests (2 passed) and rustfmt --check on the file (clean).Tests
cargo nextest run -p minimal native_host_ip_network_view_says_host_exposures_do_not_applyVerify
min task run agent-verifyexited 100 under rustc 1.99.0, which the repository does not pin (1.99.1 in rust-toolchain.toml); the PR is not a draft on that alone — CI, which honours the pin, is the gate.Closes #2938