Repository navigation
test(e2e): own-address box reaches the host exposure it covers
PASS
Baseline. This re-reviews e5e414fc against the PASS on 7eedd686 (this PR), on the same arch commit 7a86ec7b. since.diff equals git diff 7eedd686 e5e414fc. The compare is one commit, and it touches only scripts/session-e2e.sh. The PASS on 7eedd686 stands for crates/minimald/src/net/switch.rs and crates/boxes/src/core/egress.rs, which the compare does not touch.
Governs: specs/networking/deployment-and-egress-gateway.md §7.1. Line 248 makes box→host reach over the alias default-deny except configured host exposures. Line 249 says reach needs both halves: the exposure and the box's egress rules. Line 251 makes CIDR coverage of the alias the fall-through for the box half, at the exposed ports and no other.
Ruling on the compare. The old own-address leg asserted a silent drop at the host alias for a box with --allow-subnets 0.0.0.0/0. Under line 251 that box covers the alias, so the old assertion contradicted the design and the new relay behaviour. The new leg asserts reach at the exposed port (PROXY_HOST_PORT = E2E_HOST_EXPOSURE_PORT, the one [host-exposures] entry) and refusal at PROXY_UNEXPOSED_PORT 18089. That is both halves of line 249 and the "no other" port bound of line 251. The leg is hard (rule 4): a failed fetch at the exposed port fails, a success at the unexposed port fails, and any curl exit other than 7 or 28 fails. It copies the host-address leg at lines 22390–22414, which a prior ruling accepted. No leg is marked known_gap or not_run.
Not on the e2e lane. The negative half of the task proof (a box that does not name the host stays refused, under rule_matched="host-alias") is pinned only by the unit test own_ip_box_exposure_passes_the_guest_relay, which is the proof the task names. The baseline accepted that. No e2e leg on a VM host asserts it now.
Not a condition. The comment at scripts/session-e2e.sh lines 22477–22486 still says an own-address box is refused even at the exposure, with a TODO(host-exposure) to gominimal/inbox#867. The leg below it now asserts that reach. That comment is stale. It is not a design deviation, so it is not a condition here. The removed comment also named gominimal/inbox#868 (the deprecation notice on a drop). The leg does not assert the NET-004 notice. NET-004 is outside this task's covers:.
Not checked: the leg on a real VM lane. That needs just e2e, which is out of bounds here.
Ruled at e5e414f against gominimal/arch@7a86ec7bb3c0 by claude-opus-5-5; arch_rulings 898, job 80b440a2-e457-4552-bb35-a9b56db88c86.