Repository navigation
feat(minimal): name the QUIC block helper in finalize-install (T88)
PASS (the design is silent)
Governs: networking design specs/networking/deployment-and-egress-gateway.md §5.3 line 150 (the quic443 stance: an active reject, node-side for steered h3) and box.toml lines 88-94 ([network] quic443). These lines govern what is blocked and where it is enforced. Arch checkout 109541a4 has no arch-map.md, so I started from the QUIC lines. I also read the min doctor checks at architecture.md line 547, the nearest design surface for host checks. The design does not name min finalize-install, the quic443-leaf helper, its sudoers drop-in, or any host-install readiness report. No findings.json and no sin
2F8E
ce.diff were staged. This is a first review of this PR.
Ruling: PASS by absence. The change touches only crates/minimal/src/cmd/finalize_install.rs, which is the layer the task names. It adds the quic443-helper item, which reuses the classifier step (classifier_item_over with table_present: false). It also adds a Plan::script dedup so that the shared step runs once, and it moves the names item to after userns-profile. The enforcement path is unchanged: HostMoves::add_blocked_leaf (crates/minimald/src/box_actor/host.rs) runs the helper through sudo -n, and a refused add fails the launch. A wrong readiness report therefore cannot open the QUIC block (rubric rules 7 and 10). The new path constants match scripts/install-host-classifier.sh lines 115-116 and minimald QUIC443_LEAF_HELPER, and the test checks them against CLASSIFIER_SCRIPT. The precedent is #2601 (the helper install), and this ruling does not depart from it.
For the next reviewer (outside the design, not conditions): (1) The printed text does not follow the task's diagnostics: line exactly. It prints ✗ QUIC block helper and then a today: line in place of one QUIC block helper: … line. The text also names the helper path when only the sudoers drop-in is missing. The PR body states both. This is a spec-text and user-facing-text matter for minimal-review (AGENTS.md User-facing text), not a design deviation. (2) When /etc/sudoers.d is not searchable (EACCES), the drop-in counts as present, so the item can show done when it cannot see the drop-in. The design has no line on readiness reports. The enforcement fails closed at launch, as noted above. (3) The new test's doc comment is inserted inside the doc comment of the test above it (classifier_item_table), so the two comments run together. (4) The docs that list the item ids are not updated, and no issue is filed for them.
Not checked: that the test passes. That needs a build, which is out of bounds. I checked the shape of the test only.
Ruled at e176275 against gominimal/arch@109541a48c31 by claude-opus-5-5; arch_rulings 441, job e2d8fbd9-6338-4f7d-a499-182638a014fb.