Repository navigation
Add attributes: sourceforge variant for source_provenance, description - #72
Merged
Merged
Conversation
Member
|
should we fix the cargo deny complaints? we also have a stack of dependabot changes to merge? The changes on attributes.ncl LGTM |
Contributor
Author
|
The dependabot changes usually don’t build unfortunately, I’ve been bumping deps manually. as for the deny stuff, that’s new, will fix in different pr |
msample
approved these changes
Mar 24, 2026
Member
There was a problem hiding this comment.
LGTM. Cargo deny to be fixed in a subsequent PR
1 of 2 tasks
norrietaylor
added a commit
that referenced
this pull request
Sep 18, 2026
…ngs, close the review findings Aligns the local Box Egress Proxy spec with gominimal/arch main at 3987a07 (Gatehouse v1.20.1, networking design v0.7.1, command tree after #72). - Sign-in and minting: both flows under the published GitHub App (BEP-001), the sign-in-required creation error (BEP-003), mode and breadth in the member and its context (BEP-005/006), un-enrolled validation (BEP-056, BEP-057 with the client-configuration acknowledgement), members without bounds refused (BEP-058), key and CA lifecycle (BEP-059 to BEP-061), the no-re-mint limit as a non-goal. - Command tree: `min box audit` grammar with `self` refused un-enrolled (BEP-042), `min box stop | rm` (BEP-043), F12 record shape with `kind` (BEP-039), mints and logouts recorded (BEP-067), `min secret --store` and the five-column list (BEP-050 to BEP-053), sections reordered. - Correctness: upstream TLS validation before substitution (BEP-055), hash chain narrowed to what a bare chain detects (BEP-049), BEP-029 on both request forms, BEP-040 record equivalence, store-handle contract (BEP-063, BEP-064), injection form and CR/LF refusal (BEP-065, BEP-066), fail-closed steering while the proxy is down (BEP-062), segment rotation (BEP-068), `proxy_env` boolean (BEP-012), proxy user named (BEP-047). - Design reasoning cites the architecture where it used to argue; crate, field ownership, proxy user, and the set-aside HMAC anchor recorded. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
norrietaylor
added a commit
that referenced
this pull request
Sep 18, 2026
…0 rulings Aligns the local Box Egress Proxy spec with gominimal/arch main at 3987a07 (Gatehouse v1.20.1, networking design v0.7.1, command tre 8000 e after #72). - Sign-in and minting: both flows under the published GitHub App (BEP-001), the sign-in-required creation error (BEP-003), mode and breadth in the member and its context (BEP-005/006), un-enrolled validation (BEP-056, BEP-057 with the client-configuration acknowledgement), members without bounds refused (BEP-058), key and CA lifecycle (BEP-059 to BEP-061), the no-re-mint limit as a non-goal. - Command tree: `min box audit` grammar with `self` refused un-enrolled (BEP-042), `min box stop | rm` (BEP-043), F12 record shape with `kind` (BEP-039), mints and logouts recorded (BEP-067), `min secret --store` and the five-column list (BEP-050 to BEP-053), sections reordered. - Correctness: upstream TLS validation before substitution (BEP-055), hash chain narrowed to what a bare chain detects (BEP-049), BEP-029 on both request forms, BEP-040 record equivalence, store-handle contract (BEP-063, BEP-064), injection form and CR/LF refusal (BEP-065, BEP-066), fail-closed steering while the proxy is down (BEP-062), segment rotation (BEP-068), `proxy_env` boolean (BEP-012), proxy user named (BEP-047). - Design reasoning cites the architecture where it used to argue; crate, field ownership, proxy user, and the set-aside HMAC anchor recorded. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
norrietaylor
added a commit
that referenced
this pull request
Sep 18, 2026
* docs(specs): add the local box egress proxy spec (BEP) docs/specs/24-spec-box-egress-proxy, prefix BEP, written from gominimal/inbox#625 with the spec-author workflow (interview, three checkpoints, EARS via spec-ears, tiers via spec-tiers). Binds the un-enrolled, no-Gatehouse Box Egress Proxy: host-side beside gvproxy, TLS terminated only for declared credentialed upstreams under a host-generated name-constrained CA, sealed GitHub members minted by a local device-flow sign-in, Keychain store references set with `min secret`, egress re-check, hash-chained local audit. 54 requirements; the redemption decision at T2 (Kani), expansion validation, name constraints and audit secrecy at T1. Lint clean apart from the expected P004 unresolved-test findings. Architecture of record: gominimal/arch at #67 (Gatehouse v1.19, networking design v0.7). Contradiction filed as gominimal/arch#69; command-tree notes on gominimal/arch#70. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(specs): revise BEP after review, applying the arch#69 and arch#70 rulings Aligns the local Box Egress Proxy spec with gominimal/arch main at 3987a07 (Gatehouse v1.20.1, networking design v0.7.1, command tree after #72). - Sign-in and minting: both flows under the published GitHub App (BEP-001), the sign-in-required creation error (BEP-003), mode and breadth in the member and its context (BEP-005/006), un-enrolled validation (BEP-056, BEP-057 with the client-configuration acknowledgement), members without bounds refused (BEP-058), key and CA lifecycle (BEP-059 to BEP-061), the no-re-mint limit as a non-goal. - Command tree: `min box audit` grammar with `self` refused un-enrolled (BEP-042), `min box stop | rm` (BEP-043), F12 record shape with `kind` (BEP-039), mints and logouts recorded (BEP-067), `min secret --store` and the five-column list (BEP-050 to BEP-053), sections reordered. - Correctness: upstream TLS validation before substitution (BEP-055), hash chain narrowed to what a bare chain detects (BEP-049), BEP-029 on both request forms, BEP-040 record equivalence, store-handle contract (BEP-063, BEP-064), injection form and CR/LF refusal (BEP-065, BEP-066), fail-closed steering while the proxy is down (BEP-062), segment rotation (BEP-068), `proxy_env` boolean (BEP-012), proxy user named (BEP-047). - Design reasoning cites the architecture where it used to argue; crate, field ownership, proxy user, and the set-aside HMAC anchor recorded. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(specs): close BEP's listener, upstream-validation and sign-in gaps BEP-026 refuses every connection that is not a box attachment at the listener, sealed value or not, per Gatehouse §6.10. BEP-055 validates the upstream chain on every flow the proxy terminated before forwarding anything on it, so the foreign-credential passthrough is validated no less than a direct connection. BEP-001 records the un-enrolled sign-in default: the bare verb and --device run the device flow, --browser selects the browser flow, with the divergence from the command tree's prose stated in Design reasoning. BEP-050 refuses an environment-variable flag as well as an argument. Bare issue references are links. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(specs): pin BEP's store-path checks, host set, and the key-custody invariant The GitHub v1 host set is defined by citation to Gatehouse §6.10 in First slice and under BEP-006. BEP-032 names the checks a store reference passes (BEP-019, BEP-020, BEP-022 to BEP-024, BEP-064) so one decision function covers both member kinds. BEP-040's secrecy property is a construction property with a length bound. The sixth invariant states the access-control claim the requirements make: unattended access to the keys and store items is the proxy identity's alone. Design reasoning records why two invariants stay at T0. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(specs): define BEP's audit-chain construction, control socket and authority pinning The audit chain is constructed over SHA-256 of the previous line's bytes with the proxy as the log's sole writer, so client mint and revocation records reach it over the control socket rather than a second writer. That control socket is the operator-owned UDS the client also uses to register its store-handle key, separate from the redemption listener. BEP-023 pins an absolute-form request target to the connection authority as well as Host. A box declaring steering off together with proxy_env is refused, since the environment would point at a proxy no injected CA validates. BEP-040's property excludes the chain field and drops the substring clause; BEP-049's property covers records with a successor. BEP-003's sub-bullet and BEP-027 are reworded as the findings asked. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(specs): key BEP-001 to the command tree's sign-in shape The owner ruled the un-enrolled sign-in default the tree's way: the bare verb is the browser flow wherever one exists, --device pins the device flow, and no other flag is added. BEP-001 runs the device flow on --device, or on the bare verb while no browser flow is shipped; the browser sub-bullet takes the bare verb once that flow ships. Design reasoning shrinks to that sentence. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(specs): bind BEP's signing CA to the host-wide union and refuse plaintext credentialed legs BEP-013 follows the Gatehouse un-enrolled bullet: one keychain-held signing CA per host, name-constrained to the union of every box's declared credentialed upstream set, with a box's own reach bounded by its egress declaration and its sealed values' host sets. A request to a credentialed host that would ride a non-TLS upstream leg is refused, since port discipline does not see an absolute-form http request inside the proxy_env connection and no chain exists to validate. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
gominimal-aw-bot Bot
added a commit
that referenced
this pull request
Sep 18, 2026
* docs(specs): add the local box egress proxy spec (BEP) docs/specs/24-spec-box-egress-proxy, prefix BEP, written from gominimal/inbox#625 with the spec-author workflow (interview, three checkpoints, EARS via spec-ears, tiers via spec-tiers). Binds the un-enrolled, no-Gatehouse Box Egress Proxy: host-side beside gvproxy, TLS terminated only for declared credentialed upstreams under a host-generated name-constrained CA, sealed GitHub members minted by a local device-flow sign-in, Keychain store references set with `min secret`, egress re-check, hash-chained local audit. 54 requirements; the redemption decision at T2 (Kani), expansion validation, name constraints and audit secrecy at T1. Lint clean apart from the expected P004 unresolved-test findings. Architecture of record: gominimal/arch at #67 (Gatehouse v1.19, networking design v0.7). Contradiction filed as gominimal/arch#69; command-tree notes on gominimal/arch#70. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(specs): revise BEP after review, applying the arch#69 and arch#70 rulings Aligns the local Box Egress Proxy spec with gominimal/arch main at 3987a07 (Gatehouse v1.20.1, networking design v0.7.1, command tree after #72). - Sign-in and minting: both flows under the published GitHub App (BEP-001), the sign-in-required creation error (BEP-003), mode and breadth in the member and its context (BEP-005/006), un-enrolled validation (BEP-056, BEP-057 with the client-configuration acknowledgement), members without bounds refused (BEP-058), key and CA lifecycle (BEP-059 to BEP-061), the no-re-mint limit as a non-goal. - Command tree: `min box audit` grammar with `self` refused un-enrolled (BEP-042), `min box stop | rm` (BEP-043), F12 record shape with `kind` (BEP-039), mints and logouts recorded (BEP-067), `min secret --store` and the five-column list (BEP-050 to BEP-053), sections reordered. - Correctness: upstream TLS validation before substitution (BEP-055), hash chain narrowed to what a bare chain detects (BEP-049), BEP-029 on both request forms, BEP-040 record equivalence, store-handle contract (BEP-063, BEP-064), injection form and CR/LF refusal (BEP-065, BEP-066), fail-closed steering while the proxy is down (BEP-062), segment rotation (BEP-068), `proxy_env` boolean (BEP-012), proxy user named (BEP-047). - Design reasoning cites the architecture where it used to argue; crate, field ownership, proxy user, and the set-aside HMAC anchor recorded. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(specs): close BEP's listener, upstream-validation and sign-in gaps BEP-026 refuses every connection that is not a box attachment at the listener, sealed value or not, per Gatehouse §6.10. BEP-055 validates the upstream chain on every flow the proxy terminated before forwarding anything on it, so the foreign-credential passthrough is validated no less than a direct connection. BEP-001 records the un-enrolled sign-in default: the bare verb and --device run the device flow, --browser selects the browser flow, with the divergence from the command tree's prose stated in Design reasoning. BEP-050 refuses an environment-variable flag as well as an argument. Bare issue references are links. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(specs): pin BEP's store-path checks, host set, and the key-custody invariant The GitHub v1 host set is defined by citation to Gatehouse §6.10 in First slice and under BEP-006. BEP-032 names the checks a store reference passes (BEP-019, BEP-020, BEP-022 to BEP-024, BEP-064) so one decision function covers both member kinds. BEP-040's secrecy property is a construction property with a length bound. The sixth invariant states the access-control claim the requirements make: unattended access to the keys and store items is the proxy identity's alone. Design reasoning records why two invariants stay at T0. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(specs): define BEP's audit-chain construction, control socket and authority pinning The audit chain is constructed over SHA-256 of the previous line's bytes with the proxy as the log's sole writer, so client mint and revocation records reach it over the control socket rather than a second writer. That control socket is the operator-owned UDS the client also uses to register its store-handle key, separate from the redemption listener. BEP-023 pins an absolute-form request target to the connection authority as well as Host. A box declaring steering off together with proxy_env is refused, since the environment would point at a proxy no injected CA validates. BEP-040's property excludes the chain field and drops the substring clause; BEP-049's property covers records with a successor. BEP-003's sub-bullet and BEP-027 are reworded as the findings asked. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(specs): key BEP-001 to the command tree's sign-in shape The owner ruled the un-enrolled sign-in default the tree's way: the bare verb is the browser flow wherever one exists, --device pins the device flow, and no other flag is added. BEP-001 runs the device flow on --device, or on the bare verb while no browser flow is shipped; the browser sub-bullet takes the bare verb once that flow ships. Design reasoning shrinks to that sentence. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(specs): bind BEP's signing CA to the host-wide union and refuse plaintext credentialed legs BEP-013 follows the Gatehouse un-enrolled bullet: one keychain-held signing CA per host, name-constrained to the union of every box's declared credentialed upstream set, with a box's own reach bounded by its egress declaration and its sealed values' host sets. A request to a credentialed host that would ride a non-TLS upstream leg is refused, since port discipline does not see an absolute-form http request inside the proxy_env connection and no chain exists to validate. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.