minimal 0.8.0-dev.390.g47eba5d3

0.8.0

386 commit(s) since v0.7.2.

Features

• mlog: opt-in OpenTelemetry export, switches and a local spool (2/7, spec 25) (#1994) (f4c13e4)
• min, minimald: one trace per request across the CLI and the daemon (3/7, spec 25) (#1995) (98dbe05)
• minvmd: export the VM host daemon's spans and carry telemetry into the guest (4/7, spec 25) (#1996) (8af4e1d)
• diag: min bug carries the telemetry spool and redacts telemetry settings (5/7, spec 25) (#1997) (1af0a88)
• otel: guest telemetry rides the VM channel (#2039) (f5bb38c)
• packaging: ship minzoned in a signed macOS app bundle with the app icon (#2188) (4a87666)
• stdlib: type the patch ledger by kind, and check revision against it (#1277) (aa13deb)
• scripts: report non-Rust dependency pins and bump the pkgs locked_commit (#1875) (482c744)
• bep: add the bep crate with the GitHub module and the sealed envelope (#2346) (c2f0b78)
• bep: hold the proxy keys in the host keychain and publish their identity (#2363) (f8431d0)
• bep: append one hash-chained audit record per proxy decision (#2361) (b8b4f22)
• min: refuse GitHub grants at activation that the box or the host cannot honour (#2365) (767c59f)
• bep: issue leaf certificates under a name-constrained root and a signing CA (#2438) (788b6ec)
• bep: decide redemption as a pure function over host key, attribution and bounds (#2359) (554eff3)
• min: sign in to GitHub under the published App, kept in the host keychain (#2364) (5919d28)
• bep: refuse off-set authorities, off-port and expired values (#2448) (03466f7)
• min: add min box spec with root fingerprint, upstream set, steering and full marker (#2443) (0c33a45)
• bep: parse request heads strictly and forward a canonical head and body (#2362) (35529c8)
• min: read one box's audit trail with min box audit (#2457) (334e184)
• bep: refuse undeclared egress and host mismatches, admit only when every check passes (#2450) (4fcfa9c)
• bep: verify store handles against the client's registered key and the current rule (#2467) (248b259)
• bep: accept only box connections and terminate TLS for the module hosts over HTTP/1.1 (#2475) (cff2d9e)
• bep: validate the upstream, pass unsealed requests through, and stream replies (#2481) (cc56e3b)
• bep: wire the redemption decision and each box's declared egress into bep serve (#2486) (47223e0)
• minimal: mint sealed GitHub sign-in references and register the box with the proxy (#2490) (e55b32c)
• minimald: deliver each GitHub grant's sealed value into its variable in the box (#2491) (3eb782b)
• minimald: point a proxy_env box's environment at the proxy (#2492) (e8feee2)
• bep: issue and publish the host root certificate and hand it to each grant box (#2493) (efb91c7)
• minimald: put the proxy's root certificate in a grant box's trust store (#2495) (197a96b)
• minvmd: start the Box Egress Proxy beside gvproxy so git and gh reach GitHub (#2497) (ccc4f95)
• bep: rotate the signing CA under an unchanged root (#2508) (99ade7d)
• minimal: log out deletes the sign-in and refuses every reference to it (#2512) (42cf41d)
• net: reject UDP to port 443 where a box's QUIC stance is blocked (#2513) (1c94b06)
• bep: attribute a host-address redemption to its cohort and mark the audit (#2511) (2aa47e7)
• minimal: read client-owned store rules and refuse rules in the deny set (#2514) (55d0845)
• bep: renew an expiring GitHub sign-in once at the proxy (#2518) (f388b54)
• minimal: mint store handles and keep client keys registered across proxy restarts (#2520) (17ce321)
• minimald: steer credentialed names to the proxy and fail closed while it is down (#2519) (33b984a)
• bep: rotate the signing CA through the control socket (#2545) (230709d)
• minimal: check store rules at box creation and ask once per item (T54) (#2552) (15e9079)
• minimal: sign store handles under one host-keychain client key (T59) (#2557) (4180736)
• minimald: block UDP 443 for a host_ip cohort with a blocked QUIC stance (T53) (#2553) (160d3ed)
• minimal: store, list and remove secrets with min secret (T26) (#2522) (da0bdfb)
• minimal: list each store reference with its authorities in min box spec (T61) (#2569) (81ccbce)
• minimald: ship a git credential helper in grant boxes (T50) (#2547) (853a4f6)
• bep: record a revocation when a live box is destroyed (T20) (#2548) (7529939)
• bep: revoke or replace a registered client key and bound the registry (T63) (#2571) (cdcf1a2)
• bep: carry a store handle sealed as a store member (T60) (#2568) (694dba5)
• minimal: lay out the split VM users, directories and socket modes (T65) (#2561) (be9202e)
• minimald: steer the credentialed names of dns and both boxes through the gate (T58) (#2567) (3061ef1)
• bep: deny Minimal's infrastructure domains in the box CA and store rules (T55) (#2582) (8409ca0)
• bep: inject a stored key in its registered form per request (T28) (#2574) (bec5136)
• bep: rotate audit segments, carry the chain and restore revocations at start (T33) (#2583) (9d3dc96)
• bep: name the kid when a store handle is refused as unknown_key (#2592) (a1e65c5)
• bep: wire the client-key bound into bep serve with --max-client-keys (T69) (#2593) (e8f53f6)
• minimal: give a box re-created under its name an id of its own that redeems (T22) (#2584) (a38e265)
• bep: carry the handle jti into the audit record (T68) (#2596) (e455d2d)
• minimal: write the store rule from min secret set with fixed-token presets (T39) (#2577) (78e2a51)
• bep: inject store values in bep serve (T67) (#2597) (5a93a07)
• minimald: reject UDP 443 from a blocked cohort's own leaves (T72) (#2601) (5741f2f)
• minvmd: refuse a minted box id that a retained revocation record holds (T74) (#2611) (2fc77ce)
• bep: keep a replaced client key verifying until its boxes end (T84) (#2615) (4152396)
• bep: give bep serve a chain-preserving way out of an unreadable audit line (T75) (#2608) (2ced764)
• minimal: name the QUIC block helper in min finalize-install (T88) (#2644) (b49feb5)
• minvmd: check a minted box id against retained revocations with no proxy (T89) (#2643) (8c5d45a)
• bep: give bep serve the client's store rules so a store member is admitted (T83) (#2614) (dbba22b)
• bep: free the client key of a box that ended without forget_box (T90) (#2642) (1b7dfad)
• bep: admit a widened store rule without restarting bep serve (T91) (#2663) (bdc7a84)
• minimal: keep store rules under min --config-dir in step with bep serve (T92) (#2666) (fad7c72)
• just: add a preflight check and default cross to the amd64 image (#2478) (6f5ed76)
• minimald: proxy runtime-published ports like a direct connection (T99) (#2714) (7097b96)
• minimal: make min login the GitHub sign-in and drop retired cert surfaces (T113) (#2719) (cc55fef)
• minimald: record VM refusals on the host and admit RPC only from the host (T107) (#2721) (abe99f7)
• minimald: refuse an activation whose declared port something else holds (T100) (#2725) (703bb7f)
• minimal: report an edited audit chain in min doctor (T34) (#2603) (d5e802b)
• minimal: keep box names answering across a reboot and a second VM (T119) (#2722) (1f4bfd6)
• minimald: route the documented host literal on a native daemon (T116) (#2715) (eebb8fb)
• minimald: answer a macOS box's ports at the address its name resolves to (T98) (#2713) (64d3358)
• minimald: refuse unmatched names for partial allow lists and gate proxy callers (T106) (#2716) (302edaf)
• minimald: run a box's package builds under that box's egress verdict (#2720) (a26f89b)
• minvmd: decide the node plane's own traffic by its baseline set (#2723) (486ea13)
• bep: re-certify the published root when a store registration changes (#2767) (642b738)
• minimal: read each box's parent so box audit --parent merges (#2800) (79c5030)
• release: ship a signed, notarized bep beside minvmd on macOS (#2792) (e0fb640)
• min: finish GitHub sign-in on a real page and offer repository choice (#2775) (463458e)
• bep: hold the proxy's keys in the Secure Enclave inside bep.app (#2823) (6571aa3)
• otel: a span on the ten error-returning entry points the instrumentation scan found (#2763) (628f0d9)
• minimald: interim answerer holds host.min.internal at loopback (#2985) (014fa3e)

Fixes

• minimal: say DNS, min.internal and box IPs plainly in finalize-install --show (#2166) (f90cf02)
• minvmd: reword the DNS-service refusals and minzoned release output in plain language (#2169) (0fb46a8)
• minvmd: reword refusal messages in plain language (#2171) (7dc57e6)
• cli,tui: reword cleanup and status warnings in plain language (#2175) (12a1152)
• minimald: reword network refusals and errors in plain language (#2173) (0ed86a6)
• minimald: reword attach refusals and port-request failures in plain language (#2172) (710abda)
• sessions: reword the credentialed-upstream policy row and ingress errors (#2180) (f3001e5)
• minimal: say the finalize-install egress item plainly (#2179) (1f6bc55)
• minimal: reword the min ls header rows and list warnings in plain language (#2182) (9db0c46)
• minimal: reword the box-name rows, the names line and session start messages in plain language (#2183) (080797e)
• minimal: skip the port-prompt subscription for a box with no host row (#2187) (4e168f6)
• switch: raise the outbound tcp connect bound so a burst of connections stops timing out (#2184) (265081b)
• minimald: elect one holder for a shared ingress port by creation order (#2185) (6f32545)
• minimal: accept a sticky root-owned directory and check before changing the host (#2195) (acda93b)
• minvmd: bind a waiting declared forward when the row holding its listener is withdrawn (#2186) (bfd0f99)
• minimal: give each local-range alias a /32 mask (#2196) (6c235fe)
• minimal: stop claiming a box name opens in any browser (#2211) (51f71f0)
• promote: find the draft release by listing and publish it under its tag (c5073b0)
• minimald: name the hand-over bind message in the actor's span (6e650e2)
• minimald: spawn the forward-ported tasks through the traced helpers (b567cf6)
• minvmd: say connection in the singular when the cap is one (5630f87)
• otel: the nineteen review follow-ups deferred from the telemetry stack (#2202) (#2207) (6c6c39a)
• cargo: remove the committed buf registry token (#2204) (813e4e5)
• minimald: hold an OS-picked port in the answerer relocation test (#2237) (e57b5ed)
• scripts: drop the nfpm pin that the 0.7.0 merge-back removed (#2243) (11b0b44)
• mctx: keep inline-table settings when adding deps (#2244) (9c985f0)
• minimal: hold the answerer channel socket owner-only (#2297) (746770d)
• minimal: remove the range aliases and resolver dir on macOS undo (#2246) (4e16307)
• minimal: compile the spin demo only in debug builds (#2301) (336c9b5)
• minimald: bound wedged transport writes with an inactivity deadline (#2303) (02f3af9)
• minimald: record dynamic-listen ports in the shared-port election (#2305) (3759c74)
• minimald: reuse the compose-time graph names in the finalize package check (#2304) (b45039a)
• minimal: spell network modes as host_ip, own_ip and none in min dash (#2310) (b18a418)
• minimald: log the box name plainly in shared-port hand-over lines (#2308) (1d13b17)
• minimald: name a pending hold in the expose refusal (#2317) (d825e46)
• minimal-client: skip entries vanishing during the workspace upload walk (#2316) (48a6259)
• minimal: flush the macOS system resolver cache in the finalize-install scripts (#2306) (9ea9433)
• common: write file cache downloads atomically via temp file and rename (#2242) (40420c9)
• minimal: ask only running VMs' daemons to release the hook port (#2245) (23e908f)
• mctx: keep task args from running as shell code (#2296) (cfcff04)
• net: keep restored own-ip boxes' rows and ingress across a VM restart (#2298) (10d34a5)
• net: refuse out-of-zone names at a guest deny-subtree DNS listener (#2300) (2c2f8cc)
• minimald: leave HEAD alone when a push targets another branch (#2319) (0a297d0)
• minimald: keep a timed-out hook's captured output (#2318) (3cfae65)
• minimal: report an already-destroyed session instead of failing (#2315) (c5b6dcd)
• minimald: handle --help at every level of the in-session min helper (#2312) (76cc0a7)
• minvmd: reap a stale gvproxy before drawing the node proxy port (#2313) (7675e02)
• send the lease ARP as the relay's first frame (#2333) (1bec117)
• minimal: name the held port in finalize-install's names item (#2309) (daa934d)
• installer,dash: stop the daemon across uninstall and reinstall (#2342) (2e67f8a)
• minimal: name the min stop race in plain language (#2314) (abbdb31)
• common: disallow tar Entry::unpack via clippy to prevent a hardlink cwd escape (#2336) (40b542d)
• e2e: aim the escape-union cross arms at public halves (#2350) (28ab14c)
• deps: bump rustls-webpki and webpki-root-certs past the emSign advisories (#2466) (c0ac8c5)
• minvmd: keep a dormant creation's loopback address claimed (#2348) (3c9275a)
• installer: stop a daemon left on an older build after the swaps, asking before ending sessions (#2338) (e6cbd46)
• minimald: tell an exec why a session destroy ended it (#2351) (e815aad)
• rcache: skip an artifact write when the object exists at the same size; retry a 429 (#1755) (f38a87b)
• check: read only the parts of artifact files the checkers need (#2235) (4be6709)
• op: give the sandbox a private copy of non-extracted sources (#2234) (13aaa43)
• sandbox: remove a sandbox directory whose build failed (#2357) (02f68e2)
• minimald: run a session's teardown off the manager mainloop (#2224) (e30e124)
• common: a gcs transport error is an error, not a panic (#1718) (1223598)
• rcache: let one RemoteCacheWriter serve concurrent uploads (#2356) (3cd77c7)
• minimald,minimal: a cleanup destroy keeps a session that finished activating (#2233) (4cd07da)
• minimald: a listing reads a session's host from a slot the actor publishes (#2231) (06b3da5)
• minimald: take an exec's input off the SSH channel as it arrives, not as the command reads it (#2197) (608ab9c)
• minimal: close the daemon connection when the proxy's owner dies (#2226) (c5ea7aa)
• minimald: a kept session leaves the tearing-down set before the cleanup's answer (#2505) (c167e08)
• minimal: ask only a VM host daemon to re-hold a box name before an attach or an exec (#2225) (3f87f6d)
• scripts: refuse --root // and keep bep serve out of the gvproxy reap (#2529) (5a65f90)
• minimald: leave the host_ip QUIC cohort when a box's shell exits on its own (T64) (#2570) (0bf6bac)
• minimald: fork a task run's container on the sandbox fork thread, not a runtime worker (#2572) (cafa674)
• minvmd: stop or reap a bep serve left behind by a minvmd crash (#2504) (8952df6)
• minimald: close the race between the cohort lock and the shim's leaf join (T73) (#2595) (78e706f)
• installer: remove the QUIC block helper and its sudoers rule on uninstall (T93) (#2651) (03125f8)
• minvmd: bound the in-force baseline's host-alias reach to its fetch ports (#2444) (6471908)
• minimald: fail activation when a declared host port is already taken (#2352) (9437ba3)
• net: hand boxes the loopback interim when the host cannot bind the box range (#2332) (379c2f0)
• minimald: end the box_actor flakes from the mint seam race and reset hangups (#2649) (4066c3b)
• net: scope the host alias by the host-exposure port list (#2331) (0ce1fd8)
• mfile: lock minimal.toml edits and name missing link fields (#2302) (de8164b)
• minimald: name the range and refuse --public in min net expose (T109) (#2718) (1bbd45c)
• minimald: destroy run-owned boxes on restart instead of resuming them (#2345) (b3454c3)
• minimald: drain a quantum per window at an input bound, or the budget goes to another exec (#2625) (5eaef06)
• rcache: retry a transient 5xx on the index fetch, and only a 5xx (#2623) (3bf8275)
• minimald: close the host classifier's mark, IPv6 and probe gaps (T105) (#2712) (354548e)
• minimal: resolve a box's VM from its name for exec, task run and net forward, as attach does (#2626) (f2e6ed6)
• minimald: move a box's forward to its range address when the range lands present (#2749) (aa6964d)
• minimald: retry the finalize port probe so a parallel probe is not a holder (#2754) (8cac647)
• minimald: answer min net expose of a port the box's listener published (#2757) (bea4ea7)
• minimal: match box audit on the subject spelling the proxy writes (#2793) (907e13b)
• deps: bump pulldown-cmark to 0.13.6 for RUSTSEC-2026-0433 (#2846) (1aa79ab)
• minimald: hand a reaped name over in one manager step (#2842) (f5ab0a0)
• minimald: hand a destroyed box's name to the next holder (#2849) (03cc62c)
• minvmd: never mirror the node's own listeners (#2967) (d61577f)
• test(minimald): retry the quic443 helper and poll for the flip's verdict (#2819) (3ff4d84)
• minvmd: tolerate the macOS error kind in the control-cap race test (#2875) (7e65a84)
• minimald: the attach redraw rides the binding, which drains its channel and never parks on the host's stdin queue (#2835) (f54c3da)
• e2e: let the live Box Egress Proxy cases reach their checks (#2998) (018e281)
• minimald: keep the proxy's listener state fresh between lookups (#3003) (39a92eb)
• classifier: decode masked ct-mark writes in the install's conflict scan (#3004) (fce331f)
• admit a bundled bep.app proxy in keychain read-backs (#3023) (3c2b2a7)

Other changes

• declare 0.8.0 as the next release (#2168) (28a38b3)
• switch: gate bep_host socket tests under miri (#2165) (1e32c2b)
• deny: ignore RUSTSEC-2024-0449 (unsafe-libyaml via nickel-lang-core's serde_yaml) (#2194) (71f35e0)
• rename the sandbox2 crate to sandbox and add the box naming rule (#2106) (21b369b)
• otel: spec 25 — review round: stories, opt-out, host-env scope, vsock guest path, trust model (#1988) (a214f31)
• harden three flaky probes ahead of the telemetry series (#1993) (aacba86)
• otel: requirement tests for mlog, min, minimald and minvmd; Kani lanes (#1989) (b6386b9)
• macos: take the unit job's crate list from the justfile scope (#2200) (1e2d93a)
• deps: rustls 0.23.46 (RUSTSEC-2026-0346, -0347, -0348, -0349) (#2206) (598e6d8)
• minimal: fold minimal-tui into the dash module (#2104) (a3f2fa9)
• minimal: reword activate network and egress flag help (#2170) (93e440a)
• release: drop distro packages from the 0.7.0 release (#2214) (ce79c45)
• cli-min: qualify the own_ip deny-all default by the box's egress declaration (2ce67fd)
• e2e: expect the bundle's program in the range proof when the step installs the bundle (00eb544)
• rename the sessions crate to boxes (#2201) (6fb3c55)
• reference: document min net expose in sandbox-operations (#2216) (5955f3f)
• minimald: rename the session modules for what they hold (#2228) (c22640e)
• rename the session types for the box they model (#2229) (bfe0c5a)
• release: merge a diverged release tag back into main (804680c)
• release: fetch the tag and list unmatched fixes before a merge-back (e448eb2)
• release: force the tag fetch so a stale local tag is replaced (4cf5524)
• vale: accept the spec-hash and supply-chain terms (#2018) (647e902)
• telemetry: say DO_NOT_TRACK needs a non-empty value, and link spec 25 by URL (#2209) (cb46bda)
• reference: correct the --dynamic-ingress row for VM-backed hosts (#2217) (21744cc)
• e2e: hold daemon 2's busy default port across its start (#2311) (e2443c1)
• specs: let min secret set write the store rule, with fixed-token presets (#2247) (bb01558)
• spec-lint: read the linter from foundry's spec plugin (#2240) (#2241) (51c1348)
• specs: add an Anthropic API-key preset and set NODE_USE_ENV_PROXY under proxy_env (#2328) (c485dae)
• spikes: measure whether clients send a sealed handle unmodified (#2327) (dedbf2c)
• minvmd: move canonical_box_name into box_registry (#2344) (d67d78e)
• deps: bump the github-actions group across 1 directory with 5 updates (#2353) (559a1d8)
• orchestrator: move DeliverableRef into a leaf ids module (#2340) (75a4646)
• minvmd: move the drop limiter core into its own module (#2349) (8d4e7c5)
• minimal-client: move AskWatch into ask_dialog to break an import cycle (#2341) (21adc79)
• op: move materialize events into their own module (#2343) (0c146d9)
• agents: add the rules for user-facing text (#2190) (15500cd)
• minimald: split box manager tests and handle into files (#2454) (abeb005)
• minimald: split box_runtime into files by concern (#2455) (87d74a7)
• use the settled "build spec" spelling in prose (#2330) (54d8349)
• T38 — Split the box actor into files by concern (#2453) (dcefe36)
• T34 — Move the session commands into one file per verb (#2452) (f0ffef9)
• specs: put the listener cause on the ls hostname-proxy row and order the two closing lines (#2147) (904c3f6)
• sandbox: prove a box can mount a nested procfs (#2347) (1df7f7f)
• guide: open the getting-started intro with the definition sentence (#2337) (e784f29)
• T51 — Move the exec and RPC-crate tests into their own files (#2451) (7ebdbe8)
• T37 — Move the daemon's RPC and server tests out, and build daemon-side create requests through one constructor (#2472) (1c770db)
• T50 — Prove a plain exec ends when its client drops (#2470) (ab53ed4)
• T35 — Break session activation into named steps (#2464) (cb34c44)
• T36 — Name the CLI's operations after the box (#2479) (3c4b691)
• T55 — Build the CLI's and the VM tests' create requests through the same constructor (#2480) (5eea194)
• release: merge tag v0.7.1 back into main (#2474) (5378e56)
• deps: wnaf 0.14.1, since 0.14.0 was yanked (#2487) (906b51e)
• minimald: each VM's stand-in box binds a port of its own in the proxy tests (#2223) (9b4c150)
• spec-lint: match the workflow and template to foundry's copies (#2329) (fb92f87)
• deps: russh 0.64.1 and the cargo group bump of #2230, on main (#2326) (deaacc5)
• deps: ctutils 0.4.5, for RUSTSEC-2026-0385 (#2503) (c9114e1)
• promote: the promotion approvers are the minimalists team (#1756) (9fc0292)
• e2e: walk the Box Egress Proxy first slice end to end (d6a4193)
• deps: crypto-bigint 0.7.7, for RUSTSEC-2026-0387 (#2517) (20e25e4)
• macos: reap the runner's leftover VM processes before and after the e2e (#2458) (fa31776)
• boxes: make the box id the one key for every record (#2485) (b197a79)
• design: split-user VMM provider directory and socket ownership (T57) (#2546) (dd75365)
• minimald: prove DNS steering fails closed end to end (T32) (#2550) (e40e028)
• minvmd: keep clone and push working across a signing rotation (T52) (#2551) (00864d8)
• specs: add the package verification spec (PKV, inbox#721) (#1586) (9aa3692)
• toolchain: bump the pinned Rust from 1.97.0 to 1.99.0 (#2494) (8e0a825)
• bep: give the proxy-binary resolver one owner for min secret and minvmd (T62) (#2581) (85fce87)
• specs: amend BEP-063 for client-key revocation, replacement and the bound (T71) (#2594) (13a8ccd)
• deps: zstd 0.14.3, zstd-safe 8.2.0, zstd-sys 2.1.2, for RUSTSEC-2026-0391, -0398 and -0403 (#2627) (468a859)
• T1 — Give every record its type, parent and project root at creation (#2521) (343847d)
• bump the pkgs locked_commit for the October security fixes (#2637) (edd5d66)
• bep: name the handle jti in BEP-039's audit field list (#2641) (587207f)
• T5 — Send the box's spec on the create request and store it with the record (#2633) (bcc204c)
• T52 — Hold every record in one of five states, migrated once, and reaped only when unfinished (#2632) (994cabc)
• e2e: revoke a box and sign out, end to end in one case (T23) (#2610) (f16806a)
• toolchain: bump the pinned Rust from 1.99.0 to 1.99.1 (#2645) (30dd225)
• minimald: prove on a real kernel that a blocked cohort refuses pre-flip UDP 443 (T87) (#2648) (a558eb1)
• minvmd: retry a released port another test took first (#2660) (d3d21a4)
• e2e: close the round-one arch conditions end to end (T56) (#2604) (b3dd589)
• minimal: dash shares the CLI upload, loadouts, and zone-hold helpers (#2114) (e4edb30)
• T2 — Write each box's lifecycle events where only the daemon can reach (#2654) (2240ddd)
• specs: read BOX's local0 and local-minvmd0 as hosts, per arch#45's ruling (#2662) (e924710)
• bump the pkgs locked_commit for the brotli and curl fixes (#2670) (480c335)
• bep: state the audit quarantine in BEP-041 and BEP-068 (T86) (#2647) (e8a7bd8)
• specs: refuse names a box's allow list does not match before forwarding upstream (#2009) (34bf60e)
• e2e: close the Box Egress Proxy round-three conditions in one walk (T94) (#2673) (2a3cf86)
• agents: keep exact user-facing text out of specs (#2677) (2aaf514)
• deps: pulldown-cmark 0.13.5, for RUSTSEC-2026-0414 (#2726) (721ad02)
• e2e: walk the round-two BEP conditions end to end (T76) (#2665) (62f1886)
• T56 — Store each box's stopped and exited ending on its record (#2676) (f401b8b)
• macos: drop the await-kvm gate now that the fleet has more than one Mac (#2731) (f43c25e)
• call a local daemon a box host, not a provider (#2728) (65d757d)
• boxes: drop the unused hex dependency (#2573) (6a1602f)
• minimald: queue the trickle test's one-byte chunks up front (#2737) (9d3ffa5)
• T3 — Stop a box and keep its record (#2733) (5d339df)
• e2e: open a macOS box by name and through the proxy (T101) (#2741) (de32bd3)
• T4 — List and read box records with their states (#2743) (1abfd90)
• T6 — Resume a stopped box from its stored spec (#2744) (a811980)
• T49 — Prove a stopped box's files stay readable (#2750) (80abc9f)
• T7 — Retained sessions, end to end, with list and show (#2753) (d558bdb)
• release: pass the GitHub App client secret to the build jobs (#2320) (892033c)
• minimald: give each own-address test box its own host port (#2752) (0be7561)
• T12 — Keep a name unique only among running boxes (#2756) (30c43a1)
• T13 — Mint every box's id in the VM host and take it only from there (#2759) (21506b7)
• T57 — Stop the client relaying a box id into a VM box's create (#2764) (b0e9263)
• T46 — Name a new box from its entry, refuse a held name, number a fresh one (#2760) (ff44045)
• e2e: prove Keychain secrets by reference end to end (#2612) (f3a4506)
• e2e: give the BEP grant seeds a GitHub scope and proxy_env steering (#2765) (9ebf1e7)
• spec: move BEP-047 (split-user VM) to spec 24's non-goals (#2768) (53cd4be)
• bep: say bep serve sets the client-key bound (#2788) (5a652fe)
• bep: prove the reader reads the segments bep serve writes (#2789) (ca6d27d)
• T111 — Accept a key the keychain made exportable in a debug build of bep, and scope the custody rule to release builds (#2790) (026fec1)
• T97 — Accept source = "store" with store and id in a box spec's grant (#2774) (0dd6619)
• T109 — Name the cause and the next step in the grant and proxy refusals (#2794) (268a394)
• T110 — min ls shows each box's address and egress posture, and states the naming surface as activate does (#2777) (08045bf)
• T105 — Strip Alt-Svc on the live response relay and point the HTTP checks at the live path (#2791) (e19410b)
• T98 — Seal a store handle per accepted store rule at box creation (#2803) (35074ab)
• T35 — Audit segments rotate and the chain is checked, end to end (#2773) (1eb6ec1)
• T110 — Make bep --replace-key keep the old key until the new key exists (#2801) (c8bb81b)
• minimal: describe min ls ADDRESS, EGRESS and activate host line (#2808) (b694822)
• T120 — A retracted port closes the connections it accepted (#2778) (00d30d9)
• T58 — Stop min inventing box names and carry the held-name refusal to the user (#2766) (0911ad5)
• T124 — A box's package build fetches its declared web sources under the box's egress verdict (#2795) (c7f6ddd)
• T113 — Admit dns and both steering where the host's switch resolves box names (#2797) (6898af6)
• release: pin the darwin bep row and its uninstall (#2810) (75582af)
• T106 — Audit a refused ambiguous request head on the live path and show it in min box audit (#2809) (36d7c62)
• T114 — Steer a dns box's store-rule authorities to the proxy (#2822) (ea5b21a)
• T112 — Audit, HTTP and message conditions, end to end (#2826) (ca13a6a)
• T115 — DNS steering through the box-zone resolver, end to end (#2829) (a9c06ea)
• T117 — The VM host mirrors a host-address box's binds onto the node's address (#2776) (558a240)
• T121 — Names survive a reboot and a second VM, end to end (#2818) (4895b0d)
• T108 — Escapes and builds stay inside the box's rules, end to end (#2820) (ac5a631)
• T111 — Host-side commands find a box on any VM, a stopped VM included, and attach errors stay on screen (#2811) (2e3962f)
• T14 — Names follow the id, end to end (#2821) (6bddc07)
• T8 — Remove and prune stopped boxes on purpose (#2833) (6fff48c)
• T112 — The hostname proxy takes its preferred port back when it frees, and min ls lists every port it serves (#2832) (0e2a028)
• minimald: split exec dispatch into files by concern (#2838) (2d06816)
• T126 — A host-address box's port that collides on the host is shown at session start and in min ls (#2830) (a97c477)
• T42 — Start every box's entrypoint from its spec through one launcher (#2841) (ec2f3ec)
• T30 — Run a command in a box with a terminal or detached, under an exec id (#2843) (3a458b7)
• T114 — min ls and the box commands tell the truth, end to end (#2839) (5b82df0)
• spec: specify dns steering and the host_ip lane for spec 24 (#2851) (10ff157)
• T10 — Log a box's output from its start, out of the box's reach (#2852) (2894ffc)
• T9 — End a box when its entrypoint returns, never for idleness or client loss (#2850) (f6fcbab)
• T61 — A stop racing a box's natural end gives one honest ending (#2863) (687d2f3)
• deps: bump pageant from 0.2.3 to 0.2.5 (#2824) (4137359)
• T123 — A host-address box's name answers its node's address on a VM host (#2831) (fab6ba0)
• kvm: raise the test-kvm job timeout to 45 minutes (#2870) (ed17603)
• deps: bump russh from 0.64.1 to 0.65.0 (#2825) (853df31)
• T116 — Carry dns-steered TLS to the proxy on port 443 (#2860) (20f242e)
• specs: add the min box CLI spec (BCLI) for inbox#731 (#1991) (df86453)
• minimald: put the QUIC block helper where root can exec it (#2859) (b01bdee)
• specs: amend NET for the close-out fixes (#2679) (b7d5ce1)
• specs: mark spec 03's retired proxy requirements superseded (#2957) (fe474da)
• T144 — The min reference names the 100.64.0.0/10 overlap with host VPNs (#2954) (0beced3)
• T143 — The retired proxy's certificate files are removed once on upgrade (#2955) (bbe492e)
• T5 — Versioned JSON objects and errors, secrets as references (#2960) (d549b97)
• T129 — A refused connection to an unpublished port is logged as a policy violation (#2972) (80deec9)
• T127 — A box's name answers when activate returns and is gone when destroy returns (#2974) (0930153)
• T31 — Keep terminal and detached execs past a client loss, stop one exec, and honour exec_enabled (#2874) (8a65e47)
• T1 — List and show every box with its provider and host (#2963) (194b68e)
• T2 — Stop and remove a box (#2961) (5ac253d)
• T118 — Host-address boxes open by name on a VM host, end to end (#2873) (462d8fe)
• T136 — A failed retire is retried, and a resumed host-address box is admitted again (#2964) (412fa44)
• T3 — Boxes listed, shown, stopped and removed, end to end (#2991) (bb7cf6d)
• T32 — Exec into a box, end to end (#2986) (1d49da5)
• T62 — Relay a task's exit code and inputs through the in-box min helper (#2971) (ca2d699)
• T149 — A native host-address box's network view says host exposures do not apply (#2958) (ee52c1a)
• T138 — The hostname proxy refuses a host-address port that listens on 127.0.0.1 only (#2966) (4e7bb41)
• T131 — A native host-address box's probe and launch refusal read the box's own state (#2965) (e985397)
• T137 — The hostname-allowlist toolchain proof runs on the VM lanes instead of skipping (#2979) (7354e4c)
• T102 — Flows to host.min.internal are refused outside the design's openings (#2871) (964a71b)
• T147 — A project file cannot open host ports to its boxes (#2956) (20dd86b)
• T139 — The hostname proxy's failure cause prints once at activate and on the HOSTNAME PROXY row (#2968) (befda07)
• T4 — Resolve a box address across the local hosts (#2987) (a4a7c52)
• T132 — A refused name always reaches the log, and one box cannot hold the proxy's owner lookups (#2997) (f02cbc0)
• T134 — Expose decisions for a box with no switch, and answered asks, reach the host's audit log (#2969) (090a624)
• T145 — Native Linux names answer on time, end to end (#2992) (5a29f78)
• T154 — A VM host's own-address box reaches a host exposure through the guest relay (#3002) (79aeaa8)
• T27 — Name and list the local providers and hosts (#2984) (2a59f34)
• T117 — Give a host-address grant box an id and open the proxy lane to its cohort (#2861) (228e681)
• T133 — The hostname proxy refuses a host-address caller it cannot attribute (#3013) (4e869ee)
• minimal: box addresses and -o json output, end to end (#3006) (46d9e53)
• T148 — A native own-address box reaches a host exposure under the current table (#2970) (e00e7ab)
• T22 — Rename and prune boxes (#3008) (6c1eeaf)
• T24 — Copy files out of a box and read its events (#3016) (768cc4b)
• T152 — host.min.internal reaches only the design's openings, end to end (#3028) (c509b4c)
• T120 — Treat the proxy lane as in effect for a host-address box on a VM host (#3025) (83b3ba8)
• T15 — Run a command in a running box (#3009) (14a3a7f)
• T140 — The VM starts with its hostname proxy down and the proxy serves once its port frees (#3005) (cc8bdaf)
• T130 — A name off a box's allow list fails at once instead of looking temporary (#3017) (65d87ee)
• T150 — A box reaches another box it names, and not that box's parallel instances (#3029) (00fbb93)
• T28 — Stop a host with its boxes, daemon and VM (#3022) (6cced61)
• T29 — Local hosts and providers, end to end (#3040) (a1aaac8)
• T12 — Attach to a box's terminal, with or without an address (#3018) (47eba5d)