Repository navigation
T119 — Deliver cohort connections and redeem them for the named box - #3065
norrietaylor merged 6 commits into
Conversation
While a resident host_ip box declares a credentialed upstream, the node address holds a share of the proxy pool. Its deliveries carry the reserved cohort id, never a member's id (BEP-084).
A request on a host_ip cohort delivery is checked against the egress of the live host_ip box its sealed value names, and audited under that box. A value naming no such box is refused cohort_misattributed (BEP-084).
…hort-connections-and-redeem-them-for-t
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Approved: every review thread resolved at @norrietaylor resolved the last thread, which releases the approval this review had withheld. Nothing to do. |
…hort-connections-and-redeem-them-for-t
There was a problem hiding this comment.
arch-review: PASS · the full ruling
The change conforms to Gatehouse §6.10 line 823. A cohort delivery carries the reserved cohort id and no member id. The proxy checks the egress of the box that the value names, and the audit record names that box. A value that names no live host_ip box of this host is refused cohort_misattributed. The gate admits only cohort-marked frames from the node address to the proxy, so the new pool share does not open the proxy to the node plane. The edit to crates/bep/src/forward.rs is outside the task's layers but stays in the crate that owns the audit record. That is not a design deviation.
Ruled at d07139a against gominimal/arch@7a86ec7bb3c0 by claude-opus-5-5.
The audit subject of a cohort delivery came from a second read of the cohort, after the verdict's own read. A box that ended or started between the two reads gave a record that named a different box than the verdict. redeem_attributed now gives the subject from the same facts as the verdict.
…hort-connections-and-redeem-them-for-t
There was a problem hiding this comment.
arch-review: PASS · the full ruling
This change conforms to Gatehouse §6.10 line 823. The new commit takes the audit subject from the same cohort read as the verdict. Thus the record always names the box that the verdict was reached for, as the cohort_attributed audit sentence requires. The delivery files did not change since the PASS on d07139a, and that ruling stands for them. No conditions.
Ruled at 632683e against gominimal/arch@7a86ec7bb3c0 by claude-opus-5-5.
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 2 unresolved threads — minimal-foundry[bot] crates/bep/src/redeemer.rs, minimal-foundry[bot] crates/bep/src/redeemer.rs. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
|
Round 1 of 10 on the runtime's review findings, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Review threads the coder judged:
A request from a host-address box through the proxy is admitted for the box its sealed value names and checked against that box's egress. min box audit shows the request in that box's audit log, marked cohort_attributed. The record now always names the box the verdict was reached for. Notes from the agent: Revise round 1. crates/bep/src/forward.rs is not in the task's layers. An earlier round of this PR touched it to add the audit-subject hook. This round replaces the trait method audit_subject with redeem_attributed, which returns the subject with the verdict from one facts() call. No test pins the race between two cohort reads, because the cohort snapshot cannot be changed between the calls from a test without a hook. The existing subject tests still pass. |
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — every review thread is resolved; @norrietaylor closed the last one. The review of 632683e59ca6 withheld this approval on the threads open then. Posted as a comment: the App cannot approve its own pull request; the check and the label carry it.
There was a problem hiding this comment.
Gate passed at 632683e under the standing gate-4 rule.
T119 — Deliver cohort connections and redeem them for the named box
slice: S17
kind: task
covers: BEP-084
size: L
est: 260 code, 360 tests
executor: agent
difficulty: unknown ground
model: strongest
diagnostics:
min box audit <box>shows a host-address box's requests markedcohort_attributedunder the box the sealed value names, with that box's egress verdictobservability: the proxy's existing audit record carries the attribution,
boxorcohort, and the subject box id it was evaluated forlayers:
- delivery:
- crates/switch/src/bep_host.rs: while the cohort's lane is open, the node address holds a share of the connection pool,
box_id_for_sourceanswers the cohort for it, and the delivery header carries the reserved cohort id, never a member's id- crates/minvmd/src/box_registry. 8000 rs: the
box_id_for_sourceimpl answers the cohort for the node address while a lane member is resident- crates/minvmd/src/cmd/run.rs: the second
box_id_for_sourceimpl answers the same- crates/bep/src/listener.rs: the header doc and its parse name the reserved cohort id, which maps to
Attribution::HostIpCohorttest: cargo nextest run -p switch cohort_delivery_names_no_box
- redeem:
- crates/bep/src/redeemer.rs: under
Attribution::HostIpCohortthe egress re-check and the audit subject read the box the sealed value names, which must be a livehost_ipbox of this host; a value naming anown_ipbox, an ended box or a box of another host is refused and auditedcohort_misattributedtest: cargo nextest run -p bep cohort_redemption_uses_named_box_egress_and_subject
test: cargo nextest run -p bep cohort_value_naming_no_live_host_ip_box_is_refused
produces:
- cohort-attributed delivery
consumes:
- the cohort's proxy lane at the host gate
- the revocation of an ended host-address grant box
proof: A host-address box's request through the proxy is admitted for the box its sealed value names, checked against that box's egress, and recorded in that box's audit log as cohort-attributed.
depends on:
- blocked by #2854
- blocked by #3032
Proof
A host_ip box's request through the proxy on a VM host arrives under the reserved cohort id (ffffffffffffffffffffffffffffffff), never a member's id. The proxy admits it for the live host_ip box that its sealed value names, and checks it against that box's declared egress. The audit record names that box as its subject and carries the marker cohort_attributed, so
min box audit <box>lists it under that box. A value that names an own_ip box, an ended box or another host's box is refused, and the refusal is recorded as cohort_misattributed.Notes from the agent: Out of layers: crates/bep/src/forward.rs. The audit record's subject comes from Flow::record in forward.rs, not from redeemer.rs, so the proof was not possible inside the layers. The change is the smallest that I found. It adds a default trait method Redeemer::audit_subject, which returns the flow's box, and Flow::record_for. The sealed-value branch and inject_store now record under that subject. BoxRedeemer overrides audit_subject for cohort deliveries.
Design: the reserved cohort id is [0xff; 16] (switch::bep_host::COHORT_BOX_ID, mirrored as bep::listener::COHORT_BOX_ID and COHORT_BOX_ID_TEXT). It is the max UUID, which a UUIDv7 mint never gives. BepBoxSource has a new default method, cohort_source(). It gives the node address while a resident host_ip box declares a credentialed upstream (RegisteredBoxes), and only while the acceptor listens (CredentialedBoxes). The pool gives that address a share. Its deliveries carry COHORT_BOX_ID whatever box_id_for_source answers. Both impls also answer COHORT_BOX_ID for the node address while the lane is open.
The redeemer applies the new rules only to cohort deliveries. The older path, where a member id with the HostIp stance arrives, keeps its behaviour (cross_box), so the existing proptest is unchanged. For a cohort delivery, Redeemer::egress (the forwarder's plain pre-check) gives the union of the live host_ip boxes' egress, which is the reach of the…[truncated]
Tests
cargo nextest run -p switch cohort_delivery_names_no_boxcargo nextest run -p bep cohort_redemption_uses_named_box_egress_and_subjectcargo nextest run -p bep cohort_value_naming_no_live_host_ip_box_is_refusedVerify
min task run agent-verifypassed ([tasks.verify]).Base
The base branch moved while the coder worked; it was merged in before the tests ran.
Out of scope
These files are outside the task's
layers:, so this PR is a draft:crates/bep/src/forward.rsCloses #2855
Residuals
host_ipboxes' egress. The owner accepted the union for this task. The issue decides how that check meets the per-box gate inside the VM (networking §7.1 line 253).