Repository navigation
Merge remote-tracking branch 'origin/main' into agent/2620-keep-store…
PASS_WITH_CONDITIONS
Governs: Gatehouse §6.10 (specs/authn-authz/gatehouse-spec.md) line 842. A store handle's upstream authorities and injection form "come from the registration", which is a [secret-store-rules] rule for host stores. Redemption refuses unless "upstream ⊆ and inject equal to the current registration for (store, id)". Un-enrolled, the client signs the handle under its local key. The design says nothing about min --config-dir. Arch checkout 109541a4 has no arch-map.md, so I started from line 842, as the BEP precedents (#2665, #2642) did. No findings.json and no since.diff were staged. This is a first review of this head.
Ruling: BEP-032 conforms. bep_reads_store_rule is a client-side gate before the signature. It passes when the override resolves to the config.toml that bep serve reads. It also passes when bep serve holds an equal rule after the same merge, deny set and organization-error handling that store_rules_in in crates/bep/src/main.rs applies. Every other case refuses, including an unreadable file. That is the fail-closed side (rule 7), and it is stricter than the redemption subset check. Placement is right: the client mints, so the gate is in crates/minimal (rule 8). Redemption stays in bep unchanged (rule 10). The proof calls the gate with real files and covers absent, different-form, equal and same-dir cases (rule 3). C1 exists because the PR body leaves the duplicated proxy_rule conversion as later work with no issue (rule 6). The residual on #2525 records that the future caller must pass the override.
Not checked: I did not build or run the test. Path equality is a plain PathBuf compare with no canonicalisation, so a symlinked override that names the default dir falls through to the rule compare. That is safe. The refusal text is the task's diagnostics line, and I left its wording to minimal-review. I could not read issues #2525 and #2620 because the sandbox has no gh. The ledger entries for the precedents are truncated, so I reused only their reading of line 842.
Conditions
- C1: File an issue to move the
StoreRuleConfigtoStoreRuleconversion (store_ruleincrates/bep/src/main.rs) into thebeplibrary, sominandbep serveuse one conversion. Then put its URL in the doc comment ofproxy_ruleincrates/minimal/src/mint.rsand in the PR body. The PR body names this as later work, but no issue owns it. If the two conversions drift, the mint check can mint a handle under a rule that line 842'sinjectequality then refuses at redemption, or refuse a handle thatbep servecan redeem.
Ruled at 0f4bb3a against gominimal/arch@109541a48c31 by claude-opus-5-5; arch_rulings 475, job 6360d9d9-a67b-4af4-9fc8-3183c0c80f1a.