test(e2e): a stopped host_ip box loses its reach at the VM gate · gominimal/minimal@1239cb0

PASS

Baseline. This re-reviews 1239cb09 against the PASS_WITH_CONDITIONS on d8606958 (this PR), on arch 7a86ec7b. I checked these facts. since.diff equals git diff d8606958 1239cb09. pr.diff equals git diff 090a624f 1239cb09, and 090a624f (#2969) is the base and the merge base. The compare has two branch commits, 70faed2c and 1239cb09, and no merge. The reconcile in crates/minvmd/src/box_registry.rs (reconcile_host_ip_boxes, guest_runs, the dormant set) is the same as on d8606958. Only one doc line changed there. So the ruling on d8606958 stands for that code.

Governs: specs/networking/deployment-and-egress-gateway.md §4.3 rule 2 (line 84: the cohort is evaluated against each live host_ip box's rules), §5.5 (line 183: a stopped box has no live egress), §4.3 rule 1 (line 83: default-deny for a source with no entry), §4.3 rule 3 (line 85: fail-static, never fail open) and the §4.3 trust analysis (line 88: a node-asserted input selects only within the resident union).

What the compare closes. The PR body for d8606958 listed three gaps, and this compare closes ea 33EE ch of them:

crates/minvmd/src/control.rs: the reconcile thread now takes its interval and its session-list read (spawn_host_ip_reconcile_with). host_ip_reconcile_thread_runs_on_nudge_and_timer drives the real loop. It checks a nudge pass, a timer pass, a rejoin, and a failed read that changes nothing (line 85). The test does not relax the gate (rule 3). It asserts the resident set after the failed pass, before the next answer.
crates/minimal/src/cmd/boxes/vm_host.rs HostIpResidency::keep: the doc no longer says that a stopped box's rules stay until destroy, and it no longer cites #2747.
The restart case (after a VM host daemon restart, nothing is set aside, so a resumed host_ip box gets no egress until a client admits it again) is now linked to #3015 on admit_host_ip_box. That outcome fails closed (line 83), so it is a residual and not a deviation.
scripts/session-e2e.sh adds host_ip_rules_follow_the_running_box, the T0 root-in-VM system test the spec names for NET-085. Each arm requires an exact gate verdict (admitted, then dropped within 35 s, then admitted). A missing decision line is none, and none fails the arm, so the leg stays hard (rule 4). It is in the whole-lane run and the dispatch list. Its not_run is only for a Linux host with no writable /dev/kvm. The anchors it reads exist at this head: decided a box-marked frame and MARKED_DECISION_TARGET in crates/minvmd/src/net/egress_gate.rs, node-plane baseline set at the gate, and the reconcile's dropped the host_ip box's egress rules line. A host_ip box with no egress section is AllowAll (boxes::effective_egress), and the case respawns the daemon pair first. So the running arm's admit can come only from that box's rules, and the stopped arm's drop is the cohort that line 84 leaves empty.

Ruling. NET-085 conforms. The union narrows to live boxes only from the host client's own rules (line 88), a failed read holds the last state (line 85), and the restart gap fails closed with an issue. No condition stays open.

Not checked. I did not see the CI result for host_ip_rules_follow_the_running_box at this head. gh is not in this sandbox, and the instructions forbid a local run. The leg is in the KVM and macOS e2e lanes, and their aggregators are required checks. The flow-termination half of line 183 goes through the same ping and mirror path as retire_host_ip_box, which the ruling on d8606958 accepted. I did not trace it further.

_{Ruled at 1239cb0 against gominimal/arch@7a86ec7bb3c0 by claude-opus-5-5; arch_rulings 923, job f0f9f35a-ba13-4285-b138-13e20ace9d80.}

Navigation Menu

Repository navigation

PASS

Re-running checks...