Repository navigation
T152 — host.min.internal reaches only the design's openings, end to end - #3028
norrietaylor merged 3 commits into
Conversation
Add the session e2e case host_exposures_follow_the_table. On a VM lane it serves a marker on the host loopback, and checks four flows to host.min.internal at that port: - a box that names the host is refused while no entry opens the port; - the case adds a [host-exposures] entry, and the same box reaches it; - a box that does not name the host is refused while the entry holds; - the case removes the entry, and the next flow is refused. Each request prints its target, curl exit and HTTP status. The two host gate refusals are asserted from minvmd's log on the host. A native lane reports the case NOT RUN.
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Approved: every review thread resolved at @norrietaylor resolved the last thread, which releases the approval this review had withheld. Nothing to do. |
There was a problem hiding this comment.
arch-review: CONDITIONS · 3 conditions · the full ruling
The case maps onto §7.1 lines 248 to 251, and it is in the right place. The revocation leg cannot pass on a run shorter than a minute. The gate logs one host-alias line per source and rule per 60 s, and the same box already logged a line in the leg before the entry. C1 gives two fixes: a separate box for the first leg, or a 61 s wait. The only leg is NOT RUN at this head, and C2 asks for a green VM-lane run. The two proof gaps in the PR body need a filed issue (C3).
Ruled at 77c6dae against gominimal/arch@7a86ec7bb3c0 by claude-opus-5-5.
…nternal-reaches-only-the-design-s-open
minvmd logs one host-alias refusal per source and rule per 60 s, so the same box's refusal after the entry is removed wrote no new line on a fast run. The case now waits until 61 s pass since the first refusal.
|
Round 1 of 10 on a failed check suite, pushed as
Verify Review threads the coder judged:
On a KVM or macOS VM lane with MINVMD_GVPROXY_BIN set, the case shows that a box that names host.min.internal is refused at a port that no [host-exposures] entry opens. The same box reaches the marker while the entry is in force, and a box that does not name the host is refused. The first box is refused again after the entry is removed, and minvmd logs each refusal at the host gate with its rule. The node-plane baseline half is not driven end to end. The minvmd unit test host_alias_admits_baseline_for_node_plane_only carries it. This session did not observe the VM run. Notes from the agent: Revise round 1. Fixed C1: the last leg now waits until 61 s pass since the first refusal, because minvmd's DropLimiter logs one line per source and rule per 60 s. I could not run the case here: this box has no /dev/kvm and no MINVMD_GVPROXY_BIN, so the test line exits 0 with the case NOT RUN. The directive's test-kvm log excerpt does not show which step failed. The C1 false failure is a likely cause, but I did not confirm it. The KVM lane must re-run to show the result. C2 and C3 ask for things that a person or the runner must do: a VM-lane run recorded in the PR body, and a new issue for the node-plane baseline gap and the host-address cohort gap. I have no credential to file issues or edit the PR body. |
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 3 unresolved threads — minimal-arch[bot] scripts/session-e2e.sh:23261, minimal-arch[bot] scripts/session-e2e.sh:23073, minimal-arch[bot] scripts/session-e2e.sh:23055. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
There was a problem hiding this comment.
arch-review: CONDITIONS · 1 condition · the full ruling
The case follows §7.1 lines 248 to 251, and the new 61 s wait fixes the revocation leg. That leg needs the wait because minvmd logs one host-alias refusal per source each 60 s. The case did not run on any host yet. It printed NOT RUN, and a NOT RUN leg is not a pass. Run the case on the KVM or macOS lane, and put that output in the PR's Tests table (C1). Then the change conforms.
Ruled at a148509 against gominimal/arch@7a86ec7bb3c0 by claude-opus-5-5.
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — every review thread is resolved; @norrietaylor closed the last one. The review of a14850917451 withheld this approval on the threads open then. Posted as a comment: the App cannot approve its own pull request; the check and the label carry it.
There was a problem hiding this comment.
Read at a148509. The KVM lane ran host_exposures_follow_the_table and it passed, with the host-alias lines for both refusal legs. The two gaps have an owner in the issue named under Residuals. Arch's condition is met by that run, as the owner accepted.
T152 — host.min.internal reaches only the design's openings, end to end
slice: S21
kind: integration
covers: none
size: M
est: 80 code, 140 tests
executor: agent
difficulty: routine
model: standard
diagnostics: a person reads the case's output and the daemon logs on the host, which carry each refused flow with its rule
observability: the case prints each request, its target and its status
layers:
- e2e:
- scripts/session-e2e.sh: adds the case host_exposures_follow_the_table, which writes a
[host-exposures]entry to the clientconfig.toml, checks that a box naminghost.min.internalreaches it and one that does not is refused, removes the entry and checks the next flow is refusedtest: ./scripts/session-e2e.sh host_exposures_follow_the_table
produces: none
consumes: none
proof: On a VM host, a flow from any box to
host.min.internalreaches only the design's openings, and the node alone also reaches the node-plane baseline set there.depends on:
- blocked by #2689
- blocked by #2936
- blocked by #2937
- blocked by #2990
- blocked by #2938
Proof
On a VM lane, ./scripts/session-e2e.sh host_exposures_follow_the_table prints each request to host.min.internal:18157 with its curl exit and HTTP status. A box that names host.min.internal is refused before a [host-exposures] entry opens the port. It fetches the marker while the entry is in config.toml, and it is refused again after the entry is removed. A box that does not name the host is refused while the entry holds. minvmd's log on the host shows each host-gate refusal under the host-alias rule. The node-plane baseline half of the proof is not shown by this case (see notes).
Notes from the agent: Not verified end to end: this box has no KVM, so the case stopped at its gate and recorded NOT RUN. It needs a run on the KVM or macOS lane with MINVMD_GVPROXY_BIN set. The case is in the forced-VM list at th 8000 e top of the script, so a run with no environment selects the VM provider, in the same way as the other VM-only cases. It runs in the whole-lane order after min_internal_names_through_proxy. It uses port 18157, and it adds its entry under the lane's existing [host-exposures] header (a second header is not valid TOML). Teardown puts back the saved config.toml. Proof gap: the proof sentence also says that the node alone reaches the node-plane baseline set at host.min.internal (NET-158). The layer note does not ask for that check, and the case does not drive it. The built-in baseline names no endpoint at the alias ('the built-in categories name no endpoint at the host alias' in crates/minvmd/src/net/baseline.rs), and no box can send with the node identity. The minvmd unit test host_alias_admits_baseline_for_node_plane_only carries that half. The refusal of the box that does not name the host comes from its relay in the guest. The case prints the guest console's host-alias lines for that refusal but does not assert them. It asserts the minvmd host log only for the two host-gate refusals. The case covers own-address boxes only, not the host-address cohort.
Tests
./scripts/session-e2e.sh host_exposures_follow_the_tablehost_exposures_follow_the_table OK (host.min.internal:18157 refused with no entry, reached with the entry from the box that names the host, refused from the box that does not, and refused again once the entry is removed). Theminvmd log:lines showrule_matched="host-alias"at port 18157 for the legs before the entry and after its removal.Verify
min task run agent-verifypassed ([tasks.verify]).Residuals
Closes #2946