Repository navigation
test(e2e): resolve a sibling's box name from inside a native box
CONDITIONS
Governs (arch 15b603e6. The checkout has no arch-map.md, so I found the sections by search.) Egress-gateway design §7.1, line 249: the un-enrolled zone *.min.internal is answered in-guest by the node's DNS layer, each box at <name>.min.internal. §5.3, line 153: box-name lookups are not subject to egress rules, and un-enrolled hosts serve the zone the same way in-guest. §7.4, line 282: on a co-resident SharedLinux (native Linux) host, the §7.1 profile applies as written. The repo spec carries this in NET-072 and NET-073.
Ruling. The code in the diff does not depart from the design. The relay test is a correct proof of §5.3 at relay level: a TCP-only box's UDP 53 query and the zone reply pass unchanged, with the gate built as the native attach builds it. It does not relax a gate. The debug! line on a successful register_dns_name is a log, not audit, so the §7.1 rule that *.min.internal never appears in audit does not apply. The placement is in the owners that the task's layers name. But the PR does not fix #3354 and does not prove the behaviour. The author did not reproduce the defect. The only leg that tests the native lookup end to end, beat 5, prints not_run on a host without sudo and gvproxy, and it has not passed anywhere. An e2e leg that has not run is open (rubric rule 4). The PR body says Fixes #3354, so a merge closes the defect while it is unproven. C1 changes this to Refs #3354, and the residual keeps #3354 as the owner of the open work. With C1 the change can merge.
Precedent. No ruling in the ledger is on #3397 or #3354, and none decides a defect PR that adds proofs without a fix. The ledger cuts each entry at 400 characters, so I could not read their conditions in full.
Not checked. Whether beat 5 passes on a native lane: that needs sudo, gvproxy and a run of scripts/session-e2e.sh, which this review does not do. The author's session-e2e.sh run exited 1. Its tail names the e2e-banner box, so the failure is possibly in an earlier case, but I could not confirm which case failed. The verify run timed out on env::tests::minenv_run_forwards_stdin_to_the_task, which this diff does not touch. The relay test harness attaches the relay on the default /16 subnet and gives the gate the /24, so the relay's own subnet arithmetic for a native /24 is not under test.
Conditions
- C1: In the PR body of #3397, replace
Fixes #3354withRefs #3354. This change does not fix the defect, and its e2e leg (beat 5 ofproof_native_names_answer_on_timeinscripts/session-e2e.sh) has not run. A merge withFixescloses #3354 while the §7.1 sibling-name answer on a native host is unproven. #3354 closes only when beat 5 passes on a native Linux lane with sudo and gvproxy, or when a code fix lands with that pass.
Ruled at bbb2309 against gominimal/arch@15b603e6afb8 by claude-opus-5-5; arch_rulings 1251, job f6583c2b-eaa9-4f30-a0d3-53bf4c3ffe2c.