Repository navigation
T126 — Keep a host-address grant box's minted id across a VM host daemon restart, so its destroy revokes it - #3064
Conversation
The VM host daemon now persists every minted host_ip box id, and the ids admitted with a credentialed lane, to box-host-ip-ids.json beside box-registry.json. A restarted daemon reloads them, so it still refuses to mint a used id, and the destroy of a grant box still revokes its id at the Box Egress Proxy (BEP-043). The reconcile also revokes a credentialed id whose box holds no rules once the VM no longer lists it.
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Approved: every review thread resolved at @norrietaylor resolved the last thread, which releases the approval this review had withheld. Nothing to do. |
There was a problem hiding this comment.
arch-review: CONDITIONS · 1 condition · the full ruling
The persisted ids and the destroy revocation after a restart conform to Gatehouse §6.10 line 839. One path does not. The new sweep in reconcile_host_ip_boxes runs only when the reconcile loop runs a pass. The loop skips every pass while holds_host_ip_boxes() is false. So a lone stopped grant box that the VM destroys writes no revocation. Line 839 says the revocation is written when the box is destroyed. Make the change in C1. It widens the gate to the credentialed ids and pins the gate in the two tests.
Ruled at 3015529 against gominimal/arch@7a86ec7bb3c0 by claude-opus-5-5.
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 2 unresolved threads — minimal-arch[bot] crates/minvmd/src/box_registry.rs:6796, minimal-arch[bot] crates/minvmd/src/box_registry.rs:14238. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
|
/revise Arch CONDITIONS at 3015529 (arch_rulings 991), condition C1. The reconcile loop in
Change nothing else. Keep each commit message line at 100 characters or fewer. Run the three T126 test lines. |
…t-address-grant-box-s-minted-id-across
holds_host_ip_boxes now also returns true while a credentialed id waits for its box's destroy. The reconcile loop then sweeps a lone stopped grant box, or a restarted daemon's reloaded ids, and revokes the id when the VM destroys the box. The tests pin the gate.
There was a problem hiding this comment.
arch-review: PASS · the full ruling
The compare makes holds_host_ip_boxes() return true while a credentialed id waits for its destroy. The reconcile loop now runs the sweep for a stopped grant box and for ids reloaded after a restart. The persisted ids keep the destroy-written revocation against an id that never returns, as Gatehouse §6.10 line 839 requires. The change conforms, and no condition is open.
Ruled at c52e9d4 against gominimal/arch@7a86ec7bb3c0 by claude-opus-5-5.
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 2 unresolved threads — minimal-arch[bot] crates/minvmd/src/box_registry.rs:6796, minimal-arch[bot] crates/minvmd/src/box_registry.rs:14244. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
|
Round 1 of 10 on a /revise note, pushed as
Verify Review threads the coder judged:
A host-address grant box destroyed after the VM host daemon restarted has its id revoked at the proxy, and Notes from the agent: Revise round 1: BoxRegistry::holds_host_ip_boxes() also returns true when HostIpIds::credentialed is not empty. It takes the ids' lock after the resident set's read lock, as on the register path. No code path takes the resident lock while it holds the ids lock. Both test assertions are added. Nothing else changed. |
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — every review thread is resolved; @norrietaylor closed the last one. The review of c52e9d402fd9 withheld this approval on the threads open then. Posted as a comment: the App cannot approve its own pull request; the check and the label carry it.
There was a problem hiding this comment.
Gate passed at c52e9d4 under the standing gate-4 rule.
T126 — Keep a host-address grant box's minted id across a VM host daemon restart, so its destroy revokes it
slice: S17
kind: task
covers: BEP-043
size: M
est: 100 code, 220 tests
executor: agent
difficulty: needs care
model: standard
diagnostics:
min box audit <box>for ahost_ipgrant box destroyed after a VM host daemon restart shows the revocation of its id, as it does with no restart between; the ids sit inbox-host-ip-ids.jsonbesidebox-registry.jsonin the VM host daemon's state dirobservability: the existing
bep-revocationthread's warning names the box id and the step that failed; a failed write of the id file is a warn line naming the path, as a failed write of the held names is; the reload logs one info line with the count of minted and credentialed ids it readlayers:
- persist:
- crates/minvmd/src/box_registry.rs:
HostIpIdsgainscredentialed, the minted ids admitted with a credentialed lane, in place of8000 stopped_credentialed, and a destroy revokes an id in it;idsandcredentialedpersist to a newHOST_IP_IDS_FILEbesideREGISTRY_FILEafter each change throughwrite_registry_file, andpersisting_toreloads them, so a reloaded id is held for the collision check and revoked at its box's destroy; an unusable file is set aside and reloads no id;reconcile_host_ip_boxesalso revokes each id incredentialedwhose box the guest list no longer holds, and drops it from the set, so a stopped grant box that the VM destroys with no retire from a client revokes its idtest: cargo nextest run -p minvmd restarted_registry_revokes_a_destroyed_grant_box_id
test: cargo nextest run -p minvmd restarted_registry_never_mints_an_id_it_minted_before
test: cargo nextest run -p minvmd a_stopped_grant_box_the_vm_destroyed_revokes_its_id
produces: none
consumes:
- the revocation of an ended host-address grant box
proof: A host-address grant box destroyed after the VM host daemon restarted has its id revoked at the proxy, and
min box auditshows the revocation.depends on:
- blocked by #3032
Proof
A host-address grant box that a person destroys after the VM host daemon restarts now has its id revoked at the Box Egress Proxy. The id and its credentialed lane are kept in box-host-ip-ids.json beside box-registry.json, so the restarted daemon sends revoke_box for that id. The revocation record that min box audit reads is then written. The tests show the revoke_box and forget_box lines reach the proxy after a reload.
Notes from the agent: HostIpIds.stopped_credentialed is replaced by credentialed, which holds each minted id admitted with a credentialed lane until its box is destroyed. A non-persisted credentialed_admit map holds the admit count of each credentialed id. The reconcile sweep uses it to skip an id that a client admitted after the mark, so a stale guest list cannot revoke a new box. A reloaded id has no entry, so the sweep treats it as older than the mark. The id file grows with each host_ip registration, because ids never shrinks (about 40 bytes for each id in JSON). The proof was checked with a stub control socket, not with a live proxy and min box audit. The reload info line and the warn line on a failed write are added as the observability line says.
Tests
cargo nextest run -p minvmd restarted_registry_revokes_a_destroyed_grant_box_idcargo nextest run -p minvmd restarted_registry_never_mints_an_id_it_minted_beforecargo nextest run -p minvmd a_stopped_grant_box_the_vm_destroyed_revokes_its_idVerify
min task run agent-verifyexited 100 under rustc 1.99.0, which the repository does not pin (1.99.1 in rust-toolchain.toml); the PR is not a draft on that alone — CI, which honours the pin, is the gate.Closes #3049