Repository navigation
row 106: busbar-plane-a2a leaves for its own repo, pinned; qa_a2a moves into the plane's door cells (DRAFT, stacked on #787, #1006, #935) - #1042
Merged
Conversation
…ential binding) is a runtime carrier built from a reference the door section's walk already reported, never part of RootCfg (NotInResolvedConfig), so the inventory accounts for it
…in the trailers is an answer (RED) A far end that states its status at the end (the grpc transport: head with no status, trailers carrying grpc-status, BUSBAR-1.6.0.md l.394, l.747) answering NOT_FOUND must be relayed to the caller as the A2A error the status binds (TaskNotFound -32001), never failed over, and record no transient against the agent (coordinator ruling: the trailer status comes through the kernel). - kernel far_end: the trailers cross with their status; a non-success one is the answer's last piece, not a cut (no compensating transient, no refund); the plane's reading of it wins, with no second success beside the head's; a success stated there ends as it ends. - a2a relay/framed: the call's end is the status handed on beside the trailers; the grpc-status-details-bin details carry the ErrorInfo, never the code. - root agent_door: a gRPC agent answering NOT_FOUND six times is answered -32001 each time, dialled once per call, its breaker never open.
…plane, and a non-OK one is an answer, never a connection fault Coordinator ruling: the gRPC trailer status comes through the kernel (BUSBAR-1.6.0.md l.394 a gRPC binding reads grpc-status from the trailers; l.747 the trailers carry grpc-status, then a terminal piece). Before, the far end handed the plane the trailers' field block without its status_code, and the failed terminal piece after a non-OK end was read as a cut: a compensating transient on the member's breaker (even for NOT_FOUND) and the budget unit refunded, while the plane, seeing no status, read the details field for the code. - far_end: the trailers piece carries the status the transport read off it (its number and class). A non-success status after a head the walk recorded as a success is the answer's outcome: the trailers are the answer's last piece (the failed terminal is never read), and the transport's fault reading of the status is held for the plane's own (FarEnd::judged), as a relayed failure's head is; a plane reading that is a success again records no second success. NOT_FOUND's row reads as the caller's: nothing is recorded against the member. A success stated in the trailers ends as it ends (the line is still read to its completion). - route: the status crosses with PIECE_HAS_STATUS on the first piece and on a trailers piece; the head fields cross only with the first. - contract: PIECE_FIELDS documents the status it may carry (no layout change; the header's line is unchanged). - a2a framed::ended: the call's code is the status handed on beside the trailers, never the grpc-status-details-bin details (which still carry the error's ErrorInfo); the relay already maps the code to the A2A error and the breaker reading predev's classify_hop gives (a backend error is the destination answering; UNAUTHENTICATED/PERMISSION_DENIED hard). - the root cell's name speaks no instance noun in code.
…utral cause; the a2a door logs it as predev did and makes no hop predev's originated hops (origin/predev crates/busbar-a2a/src/a2a/originate.rs:80-86, called by mirror_push_config :235 and refresh_listed_tasks :352) logged A2A_OUTBOUND_CRED_UNLEASED when the outbound credential could not be leased and made no hop. On the lane the door's own requests ride the connection table, which failed such a request with the generic ConnError::Refused, so the door could not tell a vanished secret from any other refusal. - busbar_contract: ConnError::CredentialUnavailable, ConnOutcome::CredentialUnavailable (byte 9), the connector cause CAUSE_CREDENTIAL_UNAVAILABLE (6) carried in ServiceOut::value on the refused ack, and the SDK's ConnFailure::CredentialUnavailable read from it. C header regenerated; no layout changed. - plugin-loader: the table answers it when the binding's per_request.handle_now() is None. - busbar-auth-oauth: its exhaustive maps name the new cause. - busbar-plane-a2a: mirror::landed turns the exchange's answer into the status and body, or Unleased (logged A2A_OUTBOUND_CRED_UNLEASED naming the agent); an unleased mirror ends with no re-arm and an unleased ListTasks refresh moves nothing, as predev returned before any request. Tests: the outcome byte both ways, the SDK reading the cause, the table naming it on the refused ack (RED arm: a plain refusal names none), the door landing and logging it and the mirror ending (RED arm: an unanswered read re-arms).
FarEnd::judged is how the plane's reading of a far end's answer (OnPieceOut.fault) reaches the breaker (ARCHITECT 2026-10-05: plane first, then transport); the root's DoorFar forwarded member, send, next and write but not judged, so the trait's default dropped every plane reading and only the transport's table was ever recorded. It now forwards it to the unit's EgressFarEnd.
…ginated hop's signatures stay simple (clippy type_complexity)
FarEnd::judged is how the plane's reading of a far end's answer (OnPieceOut.fault) reaches the breaker (ARCHITECT 2026-10-05: plane first, then transport); the root's DoorFar forwarded member, send, next and write but not judged, so the trait's default dropped every plane reading and only the transport's table was ever recorded. It now forwards it to the unit's EgressFarEnd.
…e trailers as kept Lane owner's ruling (2026-10-07): match predev where predev settled the case, else keep the unit, as a protocol error carried in a 2xx answer keeps it. Predev settled no such unit: its plane breaker cells are never budgeted (origin/predev crates/busbar-kernel/src/store/planes.rs:65-66, budget -1 at :133), and its outbound gRPC hop (origin/predev crates/busbar-a2a/src/a2a/relay.rs:1195-1273) read no trailer status, so a trailers-only error end was Unframable (relay.rs:1835-1840) and recorded nothing (classify_hop, relay.rs:1573-1603). The keep rule applies: the cell drives a NOT_FOUND (caller) and an UNAVAILABLE (transient) trailer end, read by the plane and dropped unread, and holds one unit spent, none refunded.
Fixes the root agent-door cells of the metering/breaker/metrics/refusal group (crates/busbar/src/root/tests/serve_tests.rs, module agent_door). - Extended card counted as an admitted call. The served engine admitted, metered and audited GetExtendedAgentCard on the plane pool before answering it (predev receive.rs: governance, admission, meter_request, then the card); the door admitted every ROUTE_LOCAL unit with nothing charged, so the card counted no request. New contract flag ROUTE_COUNTED (ArriveOut.route_flags, ROUTE_LOCAL units only; checked, header regenerated): the root charges a keyed counted local unit through the one check-then-charge on the plane's pool, so the request is counted and a spent cap refuses it; the plane reports no fee unit for the card, so the admission's fee is given back (R2: counts the request, bills no fee). A notification stays uncounted, as predev's 202 moved nothing. - Upstream counters' lane label is the member's configured name (the entry), not the plane-qualified ledger lane, as WalkTelemetry documents; the relayed attempt and the unreachable agent's transient failure now land on lane="<agent>". - A hop that LEFT and heard nothing back (connection failed or closed before any answer, the walk then exhausted) is rendered as predev's RelayRefusal::Transport through refuse_hop: a task the hop opened ends failed, 502 "the backend agent did not complete this task" naming it; an addressed task is a failed read; a task-less hop gets a2a.hop.transport_failed. Before, it was rendered with the open breaker's words at 503. Shares the made-once refusal path with the credential refusal. - An open breaker's refusal carries Retry-After on every line (predev refuse_hop), and an unaddressed unit's refusal names the one serving agent it was routed to (1.5.5 select ran before the breaker); the HTTP+JSON line had neither. - Includes helper l's DoorFar::judged forward (cherry-picked), which is the fix for an_agent_answering_protocol_errors_never_trips_its_breaker. Cells: the fee-unit cells read UnitCounts.fee_count, where the book records a unit's fee (report_of: a fee unit is no usage class), instead of a usage class the line never carries; same expected values. The stream-down cell first serves one stream so the card is freshly verified, as predev's cell held it (its harness had no verify-on-call), so the hop and not the look is what fails; expectation unchanged (502), plus the task is named. The tripped cell also asserts the agent is named.
…ts listed key RecordChain now says what a put, a list, a get and a claim mean on a chained kind (BUSBAR-1.6.0.md Part 3 §5; THE DESIGN's route pump: the host frames and verifies a declared chain): a put appends to the chain its key names, the host seals it in the declared framing; a list answers every chain verified, a break announced by a span keyed by the bare scope; an empty put drops the chain; a get is refused. services::chain_key / chain_key_parts spell the listed key (scope, '/', 20 digits). No layout change: the header regenerates byte-identical.
check_record_chains existed but nothing ran it on a loaded tail; the host now frames each declared chain, so a framing it cannot name, a kind past the list or a kind named twice refuses the load (ARCHITECT ruling B1).
… chains; the old vtable's plane-only journal slots go ARCHITECT ruling B1 (BUSBAR-1.6.0.md THE DESIGN, route pump: 'A record kind the plane declares as chained keeps its declared framing (§5) ...; the host frames and verifies its chain'). InstanceFacts.record_chains was declared and read by nothing. Now (host_chains.rs): - record_write on a chained kind queues an APPEND (key = the chain's scope, value = the plane's own bytes); the write-behind flush seals it with the one chain mechanism (audit::Chain, frame_prelude in the declared framing, the plane's bytes raw: PlaneJournalRecord), stores it under chain_key(scope, seq), and advances the position only once the store took it. A scope not in the position cache is resumed from the store and VERIFIED; a break is reported (PLANE_JOURNAL_RESUME_CHAIN_BROKEN) and the chain continued from its tail, never refused. - records_list on a chained kind verifies every chain it reads and announces each break with a span keyed by the bare scope (its words the ChainBreak's), still answering the records; an undecodable record is skipped and reported (PLANE_JOURNAL_ROW_UNREADABLE). records_get is refused on a chained kind; an empty append drops the chain. - plane_host/journal.rs: journal_restore, journal_verify_scoped, journal_read_scoped and journal_forget, reached only through the old hot vtable, are deleted and their slots unwired; their tests drive the engine they wrapped (audit::journal restore/verify/read) directly. RED shown on Latchkey before the fix (the four host_chains_tests failed at their assertions); ported the frozen per-task chain golden, the undecodable-record and tampered-link tests here.
… pipe-join, and the door restores and reports a break ARCHITECT ruling B1 (BUSBAR-1.6.0.md Part 3 §5). The task-event kind is declared chained, CHAIN_PIPE_SEPARATED with the scope digested: the framing the engine's chain was sealed under (prev|task|seq|ts|kind|context|principal|agent|state), the chain's scope being the task's key <caller>/<task>. The door no longer computes a chain: an event is an append carrying its own fields (tasks::suffix), the v2 length-prefixed digest and the held tail_hash are gone, the sweep drops an expired task's chain with one empty append. tasks::restore is the engine's boot rehydrate over the records (active, terminal, unreadable, and the breaks the host announces on an in-flight task's chain); the instance's first task piece runs it and the door emits A2A_TASK_ROWS_UNREADABLE and A2A_TASK_CHAIN_VERIFY_FAILED. Ported the engine's restore, tamper and frozen-chain tests; the two v2-digest tests cannot hold under the ruling (v2 is not a §5 framing).
…s change (predev ended it under the task's lock, receive.rs:3485-3500, handle_engine.rs:711-736); the refusal slot's ticketless end overwrites it
…rough the door's far end (RED) ARCHITECT 2026-10-05 (plane first, then transport) and row 68 (FAULT_HEALTHY): the route pump hands the plane's OnPieceOut fault reading to FarEnd::judged, and the kernel's EgressFarEnd records it against the destination. A door unit's far end is the root's DoorFar over that EgressFarEnd. The cell drives a routed door unit, performed at most once, whose one member answers a relayed 502; the plane reads it FAULT_HEALTHY, and the breaker must record a success, never the transport's transient. RED: DoorFar does not forward judged, so the trait's default drops the reading and the transport's transient is recorded when the unit drops.
FarEnd::judged (b521f40, b819efe, 2cf6521) is how the plane's reading of a far end's answer (OnPieceOut.fault) reaches the breaker (ARCHITECT 2026-10-05: plane first, then transport; row 68 FAULT_HEALTHY). The root's DoorFar forwarded member, send, next and write but not judged, so the trait's default dropped every plane reading and only the transport's table was recorded. It now forwards it to the unit's EgressFarEnd. No plane on this branch states a reading yet, so no served answer changes until one does.
… asks the host's verdict The plane no longer reads a callback's scheme itself: registration is judged by the host's dest.judge (a2a-h-a, R7), which answers DEST_PLAINTEXT for an http:// destination under the open-web class the callback need declares (busbar-core-connector process.rs, GuardJudge::named). The cell, ported before that move, kept a test double that answers DEST_ALLOWED for every destination, so its plaintext arm could not be refused. The double now answers that arm as the host does, as the sibling inline-callback floor cell already does; every spelling must still be found and judged for the refusal to come back.
…the config fixture cfg_with_provider_api_key names the registry's residual-default dialect, which in a test binary exists only once some test has installed the protocol set; run in its own order the cell panicked in the fixture before reaching the fee rule. It installs the linked declarations itself, as the root's other config-fixture cells (linked_auth.rs, tests.rs) do. Harness only: the fee rule and its assertions are unchanged.
…not per authority The connector sealed a member's anchors (its pin and busbar's client identity) by (owner, need, authority), so two registrations at one host:port overwrote each other: the last sealed won, and the other registration presented its client certificate, or none. On the agent door this failed both mutual-TLS cells (CertificateRequired: a registration with no identity sealed after one with an identity at the same peer; DecryptError: another registration's certificate presented at the first one's peer). Predev held one transport per registration, each presenting that registration's own identity (busbar-a2a verify.rs RegistrationProbe, LiveCardFetch::for_agent; transport_mutual_tls_tests each_registration_presents_its_own_certificate_and_not_another_ registrations). PollConns::anchor now names the registration (the member route's provider, as seal_reach already does, SEAM-4k). An open that names a registration sealed at its own authority is held to that registration's anchors alone, or to none where it holds none; an open naming no sealed registration is held to the destination's seal as before. A pooled line records whose anchors it was dialled under and is lent only to an open held to the same. RED cell: two_registrations_at_one_authority_each_present_their_own_identity.
A host service answer is stored per (ticket, seq) and a second call on the same handle reads the stored answer whatever it asks. A card fetch whose hop was refused (a redirect at the cloud-metadata address) kept that handle, and the legacy path's first hop was then judged on it: it read the metadata refusal back and worded it under its own host, so the fetch failed naming 127.0.0.1 instead of the hop that named 169.254.169.254. The refused judgement now advances the handle, as the relay's guard (guard_relay) already does, so each hop is judged from scratch as predev's fetch_card guarded every hop (busbar-a2a fetch.rs guard_hop). RED: the root cell a_card_fetch_redirected_at_cloud_metadata_is_refused_at_the_hop_that_names_it.
…its object spelling
The section grammar states placement as `bearer` or `{header: <name>}` (busbar-contract
section.rs, CREDENTIAL_PLACEMENT_KEY / PLACEMENT_HEADER_KEY; the root binds the api-key style off
that object). The plane derived the enum, and the section reaches it through split_section as a
YAML value, which reads a derived enum only from a tag (!header <name>) and refuses a map, so a
registration written `placement: {header: X-API-Key}` refused the door's open ("it did not open:
Refused"). The placement is now read by hand: `bearer`, the one-key object, or the tag; any other
word, or an object naming two placements, is refused. RED cell:
a_named_header_placement_reads_through_the_section; the root cell
upstream_credential::a_named_header_placement_carries_the_secret_verbatim.
… authorization field POST /a2a/push answered 401 to every report: the kernel's public serve path (answer_public) struck every never-kept field, authorization included, so the push token busbar registered with the agent never reached the plane, which checks it (BUSBAR-1.6.0.md l.4882: the callback route "is auth `none`; the plane checks its own callback correlation token (never logged/audited)"). Lane ruling 2026-10-07 (option A, scoped by a neutral bit): - abi::plane::ROUTE_CARRIES_OWN_TOKEN, an AdminRoute flag, legal only beside ROUTE_PUBLIC (an admin route's authorization is the operator's credential); check_admin_routes refuses it alone (Contradiction). The C header is regenerated. - answer_public lends such a route the request's authorization and nothing else: cookie, proxy-authorization and the rest stay struck, and a public route without the bit is served as SEAM-4o states. - The a2a door's push route states the bit. Its token is busbar's own value, minted and re-verified only through the host's signing service; the route stays unaudited, and a scan cell holds that no diagnostic line of the door names the token. Cells: plane_driver.rs a_public_route_carrying_its_own_token_is_lent_authorization_and_nothing_else (green arm beside SEAM-4o's unchanged red arm); plane_check_tests only_a_public_route_carries_its_ own_token (RED plant: the bit off a public route is refused at load; the unknown-bit probe of an_admin_route_flag_is_known moves past the new bit); the door's push-route cell states the bit; the root cells a_token_is_not_spent_by_being_used_while_the_task_is_live and a_token_for_a_task_that_has_ended_authorises_nothing.
…re the trust facts a plane states The ordered gate is identity, then grant, then the counterparty's standing (ruling (a), coordinator 2026-10-07; predev's inbound::authorize over validate_request). PlaneUnits::approve judged the stated trust facts first, so a caller outside its grant was told the counterparty's trust state (an a2a caller with no grant on a pending agent read "fronted agent `planner` is not serving (Pending)"). The deployment's Approve now runs first and its refusal stands; only a granted unit's facts reach the trust book. Generic: the driver names no plane. RED: the_kernels_approve_judges_the_grant_before_the_trust_facts (refused untrusted before the order).
…n::mount_node, which boot calls Boot composed the admin units (the sealed posture, configured pools, planes and records, the kernel's trust book behind the generic /api/v1/admin/trust verbs, the kernel breaker, the governance directory) inline in main.rs, so a root cell building its own admin router had no way to mount the same surface and its GET /api/v1/admin/trust answered 404. The composition moves verbatim into mount_node; main.rs calls it (ruling (d), coordinator 2026-10-07, the install_io_reactor pattern).
…04, a key that is not live is 401, and a config apply keeps an approved agent served - A refusal about an entry states no trust facts and no route flags (abi/plane "A refused arrival"): admit_addressed stated the agent's trust facts before the card's fit refused, and out.once() was set before the admission, so the dispatcher faulted the arrive and the caller read 400 decode_failed (ruling (b), coordinator 2026-10-07). The fit now refuses 403 SkillNotDeclared, after the trust gate. - An addressed agent the section does not front is refused at arrival about its entry, 404 "no fronted agent `<id>`" (predev's InboundRefusal::NoSuchAgent), never 503 no_destination. - The caller's identity is asked of the kernel at the attempt (entitlement.check over the agent scope): a key whose row is past its expires_at, which the kernel's auth chain admits by the pinned 1.5.5 rule (key_expires_at_tests, key_expires_at_cross_plane), is refused 401, -32004, "this key is not live" (predev's KeyNotLive), never dialled. - A refresh holds the cards of registrations the apply left unchanged under the new generation, so the operator's approval (the kernel trust book's) keeps the agent served. - The scope and not-live refusals say "this key" where predev named the key id: a plane never sees the raw principal (BUSBAR-1.6.0.md l.2639-2641; ruling (B), coordinator 2026-10-07, logged in Appendix B). - Root cells: the four scope cells assert predev's refusal (403, -32004, the sentence, id null) in place of the never-run "scope_denied" wording (ruling (a)); the not-live cell's expired catalogue read is predev's measured 200 with no skill (Latchkey job cli-cbd10b3b-45f6-4274-82bd-4a6a9e56c2c1; ruling: match predev). The harness mounts the admin surface through units_admin::mount_node. - Ported: inbound_tests::a_key_that_is_not_live_is_refused_401_however_it_is_not_live and the unknown-agent 404's words.
…dev refused it The cell expected tasks/get of the task the refused send closed to answer 200 from busbar's row. Predev relayed GetTask like every non-local verb, and a credential that cannot be minted answered every relayed verb fail_task's 502, -32006 "the backend agent did not complete this task", naming the task (busbar-a2a receive.rs:2186-2207; only ListTasks and the push-config verbs are local, local.rs). The cell was written on the lane and never ran; per the coordinator's standing rule it is corrected to match predev: the tasks/get arm expects those bytes, and the row's failed state is read from the caller's own list (a local verb) instead. Ruling relayed by the lane owner, 2026-10-07.
…e agent goes down, as predev's cell drove the hop (predev verbs.rs approve stamps no look; receive.rs:1947 verify_agent_on_call runs before the hop), and the hop-refusal arm count includes the transport arm
…unit's ticket; the a2a door ends the refused hop's task race-safe there predev ended a task whose lease could not be minted under the task's own lock (origin/predev crates/busbar-a2a/src/a2a/receive.rs:3485-3500 end_task -> TASKS.transition -> crates/busbar-kernel/src/plane/handle_engine.rs:711-736). The door's ticketless refusal slot could only end it over the records the hop's opening left, claiming the next event sequence without the host, so a write by another unit in between was overwritten. - contract: TAIL_REFUSED_PIECE (a neutral plane-statement bit), PIECE_REFUSED, and OnPieceIn::reason laid in the struct's former tail padding (size and offsets unchanged; the layout golden names the field). check_tail admits the bit. C header regenerated. - kernel: when the walk refuses a unit credential_unavailable and the driver was built with_refused_piece, the pump hands on_piece a FROM_KERNEL piece flagged PIECE_REFUSED and last, carrying the reason, on the unit's own ticket; its record writes are written and nothing it emits goes anywhere (Toward::Nowhere); then the unit is refused and rendered by refusal as before. A plane without the bit behaves exactly as today. - root: a plane whose tail states the bit is driven with_refused_piece. - a2a door: states the bit. On the refused piece it logs A2A_OUTBOUND_CRED_UNLEASED, makes the caller's answer in predev's bytes (the relay's 502 -32006 naming the task; the card fetch's, with no task row), and ends the task failed through settle on the host's records (claim, re-read, next sequence); refusal renders the answer it made. task_hop::fail_unhosted, its Unhosted records, the hop's OpenedTask and the opening's read record are removed. Tests: the race cell (red on the refusal-slot path at the previous commit) now drives the door's ticketed end and keeps the other writer's event; a kernel cell hands the refused piece only to a plane that states the bit, writes its record and lets none of its output reach the caller; the tail-bit checks name the new last bit.
…ity), the door's comments cite the chain section in words, and the dispatch event's request_id check goes (the join key is not on the host's chain, ruling B1)
…s new bit; the never-logged scan lives with the purity cells The linked door's Statement now states the push route as ROUTE_PUBLIC | ROUTE_CARRIES_OWN_TOKEN (3), and the admin crate's double (door_double_statement.json) is pinned to it by the root cell the_admin_crates_door_double_states_the_linked_doors_statement. The scan that holds no diagnostic line names the push token reads the plane's sources from disk, which the plane's purity cell forbids inside src/, so it moves to tests/purity.rs beside the other source scans.
… fix 7b30159) into lane-plane-delete-pinned
…ut (dirs_for_globs filters with Ctx::is_dir, disk then base layer); RED: a plane present only in the base layer is counted
… fix ccc0eff) into lane-plane-delete-pinned
…dirs_for_globs counts a pinned plane from the base layer) into lane-p5-extract-plane-decisions
…er the scan roots (a pinned plane's crate), so rules that read lines read a pinned plane; RED: forbid-unsafe finds the attribute in a base-laid plane's lib and reports its absence MISSING
… scan carries pinned-plane sources; forbid-unsafe MISSING fix) into lane-p5-extract-plane-decisions
…nsport-webrtc: the webrtc extraction stacks on the stdio extraction and the pinned-plane stack
…d-features and plugin-closure-deps read the pinned plugin crates ARCHITECT P5 rulings 2026-10-14. The gates keep READING extracted code (BUSBAR-1.6.0.md l.2220, #39: plugin source never re-enters busbar, so it is read from the pinned checkout). 1. The base layer is widened from planes to every kind the census floors above zero: plane and transport (kind_isolation/pinned.rs BASE_KINDS). The pinned tcp, http, grpc, ws and stdio crates are laid at crates/<package> as the planes are, so the `transport` census counts them and the construction rules read their lines. Pinned packages resolve from `cargo metadata --all-features` (Ctx::cargo_metadata_all_features, honouring the same planted key). A plugin linked only behind a default-off feature (transport-webrtc, once pinned) is no package of the default answer, and the base would refuse it as unresolved. RED: xtask/tests/pinned_planes_base.rs the_base_lays_a_pinned_transport_the_census_counts_and_the_rules_read. The pinned stdio carrier is laid, the transport glob counts it only with the base, and `forbid-unsafe:busbar-transport-stdio` passes over it and is not emitted without the base. 2. linked-dropped-features and plugin-closure-deps read the workspace members AND every pinned plugin crate (one_abi::members_with_pinned): a `git+` plugin package of cargo metadata, at crates/<package>, its manifest read through the context (a plant or the base wins), else from the checkout. Their "gone blind" floors (3 linked, 5 plugins) count both. RED: each gate's selftest now plants into the PINNED stdio carrier (its manifest at crates/busbar-transport-stdio). A gate reading workspace members only never sees the plant. 3. What reading them again measures, restored at the pinned manifests: - qa/linked-dropped-features.toml: the four tokio rows of busbar-transport-http (io-std, process, rt-multi-thread, signal), exactly the rows 871a978 struck when http left and the gate stopped seeing it. - qa/construction.toml manifest-allowlist reviewed_extra: http, grpc and ws, each its own direct third-party deps at the pinned rev (the PLUGIN LIBRARIES ruling's rows; tcp and stdio name busbar-contract alone).
Nothing emits it: no anomaly breaker suspends a trust registration. The agent plane's breaker, the one that was to raise it, was never armed and is deleted (cb6fa7f), and no emit site names the code on predev or here. The catalogue is append-only, so the number is kept and marked retired (as BUSBAR-8013 and the breaker codes are), its words saying what replaced it; docs/diagnostics.md and docs/diagnostics.json follow the render.
Nothing emits it (no site names the const, the slug or the number outside the catalogue, on predev or here), and its words fed an anomaly breaker toward suspension that does not exist (BUSBAR-4021, retired). Retired as the catalogue's rule says, its number kept; docs/diagnostics.md and docs/diagnostics.json follow the render.
…links` name; no-cells RED; N/A held to the ledger Coordinator ruling (Law 0 root lane, (b)): the door-cells mechanism (ARCHITECT ruling on #464) is the one root-leg mechanism. Stacked on #787. - A plane door crate states where its root cells are under `links = "busbar-door-cells-<crate>"`; its build.rs prints `cargo::metadata=cells=<CARGO_MANIFEST_DIR>/tests/root/mod.rs`. The root's build.rs reads `DEP_BUSBAR_DOOR_CELLS_<CRATE>_CELLS` for every enabled linked plane-door row, the same for a path dependency and a pinned one: no checkout is resolved by hand. The `[package.metadata.busbar.door-cells]` table goes: the list is the linked table's. - `$OUT_DIR/door_cells.rs` adds `DOOR_CELLS` (each module's COLUMNS and NOT_APPLICABLE) and `DOOR_CELLS_MISSING` (each enabled plane door whose crate states no cells). - root/tests/door_cells.rs: a linked plane door stating no cells fails, naming its crate (RED); a door's not-applicable (capability, column, reason) set must EQUAL the root-leg cells qa/capability-equality.json marks not applicable on its columns (RED each way). - busbar-plane-a2a states its cells (links + build.rs) and its COLUMNS / NOT_APPLICABLE. - tests/capability_equality.rs finds the door planes' cells files from the linked plane-door rows.
…through the build's one resolver tests/capability_equality.rs no longer reads a door's `path` dependency row: build.rs emits `$OUT_DIR/door_cells_files.rs` (DOOR_CELLS_FILES: each enabled plane door's cells as the ledger cites them, `crates/<crate>/tests/root/mod.rs`, beside the file its crate states under its `links` name), from the same DEP_BUSBAR_DOOR_CELLS_<CRATE>_CELLS the root compiles the cells from, so a pinned door's cells verify exactly as a path dependency's. DOOR_CELLS carries the resolved file too. RED: a root leg citing a pinned door's cells (a file outside the repo) is refused while no door states them, and verifies once the resolver maps the citation to that file.
…erged with predev (460be4d77d) Drains: busbar x instance:secret 25 -> 22, busbar x plane 772 -> 770, busbar-kernel x plane 1100 -> 1099, busbar-kernel x transport 266 -> 220, busbar-kernel-breaker x plane 2 -> 0, busbar-kernel-breaker x transport 134 -> 1 (the #561/#778 breaker work this branch stacks on, row 66, and FLIP-A2A). busbar-plugin-loader x instance:secret 21 -> 23 is a correction of the merge figure, not a rise: predev's -2 (#532, 40a4080) removed two `extern "C"` ABI strings (host_log_sink and its doc line) that this branch's scanner fix had already stopped counting, so the two drains overlap by those two; 23 is this branch's own pre-merge measure, and no hit was added.
…hat read as the c secret plugin are named for what they are Ruling on 60dd171: no raise. The 23 ModernCI measured is no hit #787 added (#787 adds no secret-instance literal to the loader; it removes one, the durable_tests rename): the merge figure 21 counted predev's -2 (#532, two extern "C" ABI strings) that the scanner fix behind #787's -85 had already stopped counting. The ceiling returns to 21 by draining two real hits: store_money_acceptance.rs the_floor_makes_arrival_order_matter's .expect("c") messages (the charge), now "the charge", and their refund pair "the refund".
ModernCI merged predev (1d111f2) into lane-p3-flip-a2a: they conflicted only where a fixed rule settles it. Each file is settled by its rule: - crates/busbar/src/root/door_steps.rs: rust (items both sides added are all kept, the target's first; an item both changed is a real conflict) Keep-both: where both sides only added at one place, both are kept, predev's first. ModernCI writes nothing of its own. A red on this commit belongs to the pair and goes to lane-p3-flip-a2a with both sides' diffs. The change's own commits are untouched: this commit holds the resolution alone. It is judged in full, like any push, before anything lands.
…'s are renamed to what they are (787 reads its armed 96) Each pair was read on both sides. None is shared logic: each is a distinct concept that only shares a generic word, so the decisions side, whose name was the less precise, is disambiguated. - Relayed -> RelayedFields (driven.rs). Decisions: the caller's header fields the far end receives, one buffer per unit (what `relayed_fields` returns). MCP's `Relayed` (tool_door.rs) is the outcome of relaying an upstream ask: an answer, a pended host service, or refused child requests. Different concept; renamed, not shared. - Routed -> ModelRoute (plane_door.rs). Decisions: one configured model's route, its dialect index and its upstream_model. LLM's `Routed` (busbar-llm unit/route.rs) is the Route step's output: the sealed seat verdict, the response bytes, the meter facts and the unspent meter sink. Different concept; renamed, not shared. - Unreadable -> UnreadableUsage (driven.rs). Decisions: a usage member present in a success answer but not a whole count, naming its pointer (the money rule's loud failure). A2A's `Unreadable` (skill.rs) is why a held agent card cannot be read. Different concept; renamed, not shared. The private `Member::Unreadable` variant is not a top-level symbol and is unchanged. No ledger row is added and the armed count is not touched.
…annot lose, the transports' layout comment is no debt label, and the moved-out tools type leaves the secret inventory - kind_isolation: plane_kind_src_roots unions the root manifest's pinned plane rows (pinned::pinned_plane_dirs), so a context without the base lists their roots and plane-purity:roots refuses them by name; plane_kind_crates refuses a pinned plane the census cannot read, so reachability:plane-crates is red without the base. - pinned_planes_base: the stdio carrier's construction row is forbid-unsafe-deny (transports carry deny), the row the gate emits. - Cargo.toml/Cargo.lock: grpc/http/stdio/tcp pinned to the one-line commit on top of each current pin that names the kind's layout SHAPE (no-deferral reads SKELETON as a Class B label once the base lays the pinned transports); the same commit is open against each repo's dev. - secret_refs: TokenExchangeCfg left the tree with its plane; its references are read at the door's declared paths through the DoorSection row, so the stale inventory entry is removed. - docs/architecture.md: names the in-tree plane directories and the two pinned plane repos.
… base, so it compiles against #787's FramePiece (fault in the old _reserved byte) #787's FramePiece states the framer's fault reading in the byte that was `_reserved` (the breaker plane-fault work); the datagram rig landed on predev against the old layout and named `_reserved: 0`, which #787's tree does not have (E0560). FramePiece has no constructor or Default, so the literal names the four fields the rig sets and takes the rest from an all-zero piece (code, status class, FAULT_NONE, no retry), as the contract and loader tests' `z()` pieces do. An appended field (#1032's declared_len) no longer breaks it. Every other FramePiece and WirePiece literal in the tree was checked: the rest are built from `z()` or already name the current fields.
…s tools type leaves the secret inventory, and the architecture page names only paths on disk - kind_isolation: plane_kind_src_roots unions the root manifest's pinned plane rows (pinned::pinned_plane_dirs), so a context without the base lists the pinned plane's root and plane-purity:roots refuses it by name; plane_kind_crates refuses a pinned plane the census cannot read, so reachability:plane-crates is red without the base (pinned_planes_base's two RED arms). - secret_refs: TokenExchangeCfg left the tree with the plane; its references are read at the door's declared paths through the DoorSection row, so the stale inventory entry is removed. - docs/architecture.md: the in-tree plane directories, and the MCP plane's own repository.
… and is pinned; the page names only the in-tree plane directories
…: both sides' hunks kept - crates/busbar-contract/src/abi/plane/check.rs: the import list carries #787's MAX_METRIC_LANES, ROUTE_CARRIES_OWN_TOKEN, ROUTE_SCOPE_LOCAL and TAIL_REFUSED_PIECE with predev's TAP_FAULT_NONE. - crates/busbar-kernel/src/plane_driver/route.rs: the Answer copy carries #787's metric_pool, metric_lane and wait_member with predev's tap_fault (OnPieceOut holds all four: tap_fault in the old padding byte, the spans appended; the layout golden and header agree at 181/182 and 216..240). - crates/busbar-kernel/tests/common/mod.rs: TestUnits keeps #787's `resolved` and predev's `tap_faults`; its one DriverSteps impl answers both `resolved` and `usage_tap_fault`. Stale-copy check over every file either side changed since 1d111f2: a file only one side changed is that side's copy exactly, and no file both changed fell back to the base or to one side alone.
…nto lane-p5-extract-plane-a2a
…se layer, carrying #838 and #888) into lane-p5-extract-plane-a2a The a2a extraction stacks on #787, #1006 and #935 (coordinator ruling, row 106). Resolution: - The crates #935 extracts (busbar-plane-decisions, busbar-plane-mcp, busbar-transport-stdio) are deleted here as #935 deletes them; #787's edits to them belong in their plane repos (P5). - Cargo.toml / crates/busbar/Cargo.toml: #935's pinned mcp and decisions rows, #787's deletion of busbar-a2a and of the a2a-lf / a2a-pb rows, and the a2a plane door's path rows (they become a pin in the extraction commit). The http/grpc/tcp transport pins keep #787's (predev's at bad5943); #935 re-resolves its own pins against predev when it lands. - crates/busbar-kernel/src/config_validate/secret_refs.rs: #935's note that the tools door's credential type left with its plane, beside #787's door-declared rows for the agents door. - crates/busbar/tests/capability_equality.rs: #1006's `source_of` (a door plane's cells from the file its crate states) now falls back to #935's `pinned_planes::resolve`, so a cited file is read from the door's own statement, the tree, or a pinned plane's checkout, in that order. - Cargo.lock re-resolved with `cargo metadata` over the merged manifests. Stale-copy check over every file either side changed since the merge base: clean.
…a, pinned; the root's a2a suite moves into the plane's door cells The a2a plane is extracted as P5 extracted mcp (#838) and decisions (#888), on #935's base layer and #1006's door cells (DRAFT, stacked on #787, #1006 and #935; coordinator ruling, row 106). - crates/busbar-plane-a2a: deleted. The root pins it: Cargo.toml's workspace row `busbar-plane-a2a = { git = ".../busbar-plane-a2a", rev = 6466ca164a }` (GetBusbar/busbar-plane-a2a #15, which pins busbar #787's head and merges only after #787 lands), and crates/busbar/Cargo.toml's two path rows take it from the workspace. Cargo.lock re-resolved with `cargo metadata`; the contract stays one crate through the root's `[patch]`. - The door cells stay door cells (coordinator ruling: door-cells is the one root-leg mechanism): the plane states tests/root/mod.rs under its `links` name and the root compiles it from the pinned checkout exactly as from the path, so qa/capability-equality.json and qa/teller-steps.json cite the same file and the same test names. - crates/busbar/tests/qa_a2a.rs and tests/fixtures/agent_plane_wire.txt: deleted (the composition root names no plane). Their control and rug-pull cases are the plane's trust-book door cell; the look-alike case is the plane's new door cell `an_approved_agents_card_resigned_by_another_key_stops_it_being_served`. - The plane's gRPC build crates (prost-build, pbjson, pbjson-build, protoc-bin-vendored) leave the root's [workspace.dependencies] (nothing in busbar names them) for .github/fleet/deps.toml [plugin-deps], repos = busbar-plane-a2a, so the fleet render carries them (P5 notified for the re-render). prost stays: the root crate names it. - deny.toml allow-git gains the repo; plugins.yaml's a2a entry drops pending_crate and states busbar_checkout (its tests read the method inventory and the supplement rig at the pin); docs/architecture.md names only the two in-tree plane directories. - crates/busbar-kernel config_validate: the agents door's credential types (OutboundCredential, ClientIdentityCfg) left the tree with their plane, so they leave SECRET_BEARING_TYPES (the coverage scan holds the table to the tree both ways), as the tools door's type did in #935. - xtask: method-inventory reads the plane's vendored a2a.proto through the context (the tree, else the pinned checkout laid at the same path); infra's plane-root case 4 resolves the a2a home over the context's base layer.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Row 106: the a2a plane leaves busbar for GetBusbar/busbar-plane-a2a and is pinned there. Root's
qa_a2a.rsmoves into the plane's door cells.DRAFT. Stacked on #787, #1006 and #935 (rule 19). It stays a draft until all three have landed. Then it is retargeted, predev is merged in, it is repinned to the plane repo's predev-pinned head, and the coordinator undrafts it.
What it does:
crates/busbar-plane-a2ais deleted. The root pins GetBusbar/busbar-plane-a2a at6466ca164a(that repo's ci: bump docker/build-push-action from 6 to 7 #15, which pins busbar P3 FLIP-A2A: the a2a plane served through its door; busbar-a2a deleted (stacked on #778) #787's head and merges only after P3 FLIP-A2A: the a2a plane served through its door; busbar-a2a deleted (stacked on #778) #787 lands).links. The root compiles them from the pinned checkout, so the citations inqa/capability-equality.jsonandqa/teller-steps.jsonare unchanged.crates/busbar/tests/qa_a2a.rsand its fixture are deleted..github/fleet/deps.toml[plugin-deps].deny.toml,plugins.yaml(busbar_checkout, nopending_crate),docs/architecture.md, and the secret-bearing table (a2a's two types left with their plane).Open items, reported to the coordinator:
qa_a2a.rscounted (17 hits on busbar's rows) drop. Their ceilings are lowered to measured once ModernCI judges this.libtest_path::door_cellsstill reads the[package.metadata.busbar.door-cells]table that door cells: plane doors state their root cells under links; no-cells RED; N/A held to the ledger (stacked on #787) #1006 removed. That belongs to door cells: plane doors state their root cells under links; no-cells RED; N/A held to the ledger (stacked on #787) #1006.