Files

T

kyleandClaude Opus 5.5 b426ca1958 Specify and plan M3b: the runner and the tools

A draft spec for the owner's review and 13 offline tasks with their given
tests: shared tool arguments and host rules in proto, the sealed fetch
target (M3a finding 14), the toolkit tools and SOCKS5 egress proxy, and
brokerd's [runner], podman argument lists, runtime and proxy lifecycle. Each
task's tests were run against a reference at that task's end state (560 to
638 tests, clippy clean); the reference is not in the repository. Adds the
runner-unavailable runbook entry and tip T23 (ETXTBSY in script tests).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-09-22 22:29:27 -07:00

2.2 KiB

Raw Blame History

M3b task 03: a grant path that cannot be mounted is invalid

Branch: m3b (run git switch m3b; git status --short must be empty, otherwise stop) Commit subject: Refuse grant paths that cannot be mounted

Goal

From M3b, a grant's paths are mounted into the tool container as --volume=<path>:<path>:ro. In that argument : and , are separators, so a path containing either would be read as something else. A grant with such a path is invalid, which (as for every invalid grant) makes the whole set invalid and denies every call until it is fixed.

Files

Copy: crates/brokerd/tests/grants_mount.rs
Modify: crates/brokerd/src/grants.rs, docs/implementer-log.md

The rule

In check_grant, the loop over inner.constraints.paths has two cases today: the path is /, or it is not a valid path. Add a third, checked only when the first two did not apply (a path that is already reported as invalid is not reported twice):

} else if path.contains([':', ',']) {
    // Mounted as `--volume=<path>:<path>:ro`, where both are separators.
    push(problems, file.clone(), None,
         format!("{:?} cannot be mounted: it contains ':' or ','", path));
}

So a grant file with paths = ["/home/kyle/a:b"] gives exactly one problem, for that file, whose text contains cannot be mounted. Other punctuation (space, ;, =, ., -, _) stays fine.

Steps

1. Copy. git switch m3b, then cp docs/plans/M3b/files/crates/brokerd/tests/grants_mount.rs crates/brokerd/tests/
2. See it fail. cargo test -p brokerd --test grants_mount. Expected: 1 of 2 fails (a_path_with_a_colon_or_a_comma_makes_the_set_invalid).
3. Add the rule. Run cargo fmt --all.
4. See it pass. cargo test -p brokerd --test grants_mount --test grants. Expected: 2 and 17 passed.
5. Run the gate. make gate. Expected last line: gate: ok.
6. Log and commit. git add crates/brokerd docs/implementer-log.md && git commit

Done when

Both suites pass; make gate prints gate: ok.

Stop and report if

A given test wants a path with : or , to be accepted, or wants two problems for one path.

2.2 KiB Raw Blame History