Repository navigation
docs(specs): name the BEP-063 known gap of a box with no forget
CONDITIONS
Baseline. This re-reviews 78a17003 against the CONDITIONS ruling on d1addbbb (this PR), on arch checkout 109541a4. The checkout has no arch-map.md, so I started from Gatehouse §6.10 lines 839 and 842, as the baselines did. No findings.json was staged. The ledger text of the baseline is truncated, so I rebuilt its open point from the compare. The compare is a comment in KeyFile::release and a new known-gap note in the BEP-063 replace sub-requirement.
Governs: §6.10 line 839 (handles minted over the local UDS work "for the life of the box") and line 842 (the client's local key is "registered with the helper over the UDS at first use"). The arch#144 owner ruling (keep a replaced key until its boxes end) is not in this checkout. I took its content from the spec link and from the PR.
Ruling: BEP-063 conforms. The placement follows the layers: the registry and bound are in crates/bep/src/control.rs, and the client mapping is in crates/minimal/src/mint.rs. The change in crates/bep/src/main.rs is only the box_id: None field in two test literals. The bound fails closed. A malformed box id is refused. The observability line names the kid. The diagnostics text matches the task. One condition stays open. The spec states a known gap with "(issue not yet filed)". That is a residual with no owner (rule 6). C1 files it, and also covers a failed write in release, which strands a box in the same way. The new release comment says "The next write records it". That is true only when another write occurs before a restart.
Not checked: test results (no build, by contract). The module docs in control.rs still say "The proxy binary has no setting for the bound", but bep serve --max-client-keys exists. That is a docs issue for minimal-review and not a design point. crates/minimal/src/tests.rs lists a_replaced_client_key_keeps_verifying_until_its_boxes_end three times. That is also a minimal-review point.
Conditions
- C1: Open an issue in gominimal/minimal for the stranded-box gap. A box that ends with no
forget_box(Ctrl-C beforeminvmdrecords the box, or a stoppedminvmd) stays in its key'sboxes=set across restarts. 16 such boxes make the bound refuse every new key. Include in the issue one more cause: a failedself.writeinKeyFile::release(crates/bep/src/control.rs) leaves the ended box in the file, so a restart restores the retired key as in use. Indocs/specs/24-spec-box-egress-proxy/24-spec-box-egress-proxy.mdline 494 (the BEP-063 replace sub-requirement comment), replace(issue not yet filed)with the issue link, and add the failed-write cause to the known-gap text. List the issue as a residual in the PR body.
Ruled at 78a1700 against gominimal/arch@109541a48c31 by claude-opus-5-5; arch_rulings 416, job 1231146a-8eea-4cdb-a232-473e160865d3.