row 130 E5+E7: the kernel's outbound HTTP engine leaves busbar-kernel; the no-socket pin is empty by MattJackson · Pull Request #1230 · GetBusbar/busbar

MattJackson · 2026-10-19T13:12:36Z

/status row 130, steps E5 and E7: the kernel's outbound HTTP engine (the engine pool) leaves busbar-kernel. The kernel's no-socket pin (crates/busbar-kernel/tests/no_socket.rs) ends with PINNED and PINNED_MANIFEST both empty, which is that file's own definition of row 130 done.

Rebuilt as four commits stacked on #1161's approved head 0166b67 (lane-delete-busbar-llm-6). This branch used to carry the whole outbound-auth stack (#1203, and #1207/#1263's content) under its own change; it no longer does, so it does not wait on that stack:

RED: a proxied mTLS dial goes through the connector (u30). Its kernel arm, no_egress_slot_and_no_credential_mint_is_reachable, was dropped on rebase: busbar-llm retired: the llm plane registers through its door alone (DEV-GREEN row 83) #1161's base deletes abi::hot and the whole host vtable (299e768), so no egress slot can exist to assert on.
Delete the kernel's outbound HTTP engine; every dial is the connector's.
E7: reqwest leaves busbar-kernel's [dependencies].
Cargo.lock: reqwest's h2 edge goes, because nothing in the workspace asks reqwest for http2 any more.

The stack's ledger edit, qa/construction.toml's ws reviewed-extras widening from 5959a4d, is no longer in this PR.

Stacked on #1161: #1161 deletes busbar-llm, the engine's last other consumer; this PR lands after it.

Each move and its grounds (BUSBAR-1.6.0.md on dev):

egress/engine/ deleted whole: client, pool, https, tls, CONNECT tunnel, observe, resolve, deadline.
- §5 l.581: "The kernel knows nothing about transport".
- §5 l.587: "TLS is core-only, inside the connector".
- §8 l.1141: the connector owns "TLS ... per-worker pools; ALPN; the proxy".
- The connector already holds the CONNECT proxy (E5a, row 130 E5a: every framed connector dial honours the proxy environment, as 1.5.5 did #804) and the mTLS identity (tls/client.rs).
The other engine-side pieces deleted:
- secure.rs (the TLS seam that handed the engine a dialled TcpStream).
- egress/fixtures.rs.
- PinnedClientPool and the reqwest reference stack in egress/mod.rs.
- topology's UpstreamClients.
- The egress/trust primitives only the engine read: identity, trust_anchor, spki. Grounds: §8 l.1141, the connector is "the only holder of TLS keys, certificates, trust roots and mTLS identity".
What egress/trust keeps: the one seam the kernel owns, the config commit raised to the connector's one destination guard. Grounds: §5 l.620, "Every scattered check (net_guard, the SSRF helpers, per-plugin checks) is deleted".
Connector side deleted with it:
- tls/engine.rs, the kernel-seam Layer.
- hostio::SystemNames and its bounded-lookup helpers, which were the kernel's resolver.
- The connector's proxy hand-off to the kernel.
UrlUserinfo moves to bound_credential.rs unchanged, with its parity test. It is a credential value, not transport.
E7, the kernel test kit: test_support::oversized_413_body hands its oversized POST to the router itself (tower::ServiceExt::oneshot) instead of serving on a loopback socket and POSTing through reqwest. The body cap is a layer of that router, so the 413 status and body are the same. The optional reqwest edge and test-support's dep:reqwest go. The kernel's own tests keep reqwest as a dev-dependency.

Retired tests, and what now covers each

kernel egress/engine/tests/pool_tests.rs, pool_h2_tests.rs, egress/tests/pinned_pool_tests.rs, topology/worker_shard_tests.rs: the engine's pool and its per-worker shards. Pools are the connector's (§8). Now covered by the connector's own suites (connector_tests.rs, dialled_tests.rs, framed_stream_tests.rs) and, for pooled-line ownership, row 159: connector pool lines lent only under their own trust; registration anchors are their own (Q128 connector H1, H2, M9) #1122.
kernel egress/engine/tests/tls_tests.rs, egress/trust/tests/identity_tests.rs, trust_anchor_tests.rs, and connector tls/engine_tests.rs: now covered by connector tls/tests.rs, tls/client_tests.rs, trust_from_tests.rs (an_owned_trust_anchor_serves_its_ca_and_refuses_another, a_written_owned_trust_anchor_that_does_not_parse_refuses_the_need), and connector_tests::a_sealed_client_identity_is_presented_to_a_mutual_far_end / two_registrations_at_one_authority_each_present_their_own_identity.
kernel egress/engine/tests/tunnel_judge_tests.rs: now covered by connector proxy_tests.rs (a_framed_dial_rides_a_connect_tunnel_through_the_proxy, a_proxy_refusing_the_tunnel_refuses_the_exchange, the_proxys_answer_is_judged_on_its_status_line) and by this PR's RED connector_tests::a_proxied_dial_tunnels_first_then_presents_the_sealed_identity_over_tls.
kernel egress/engine/tests/dial_judge_tests.rs: now covered by connector dest_judge_tests.rs, guard_tests.rs (a_private_answer_is_refused_by_default, a_provider_dial_is_refused_a_private_address_unless_allowlisted, operator_infrastructure_is_allowed_private_and_refused_metadata_whatever_is_carved) and name_dial_tests.rs.
kernel egress/engine/tests/resolver_tests.rs and connector hostio_tests.rs (the SystemNames lookups: a_wedged_name_lookup_fails_within_its_bound_and_an_answer_in_time_is_kept, wedged_name_lookups_are_capped_and_an_ended_one_gives_its_place_back): the connector's own lookups are bounded and capped in compose, covered by guard_tests::a_lookup_past_the_cap_is_refused_at_once_and_starts_no_thread.
kernel egress/engine/tests/engine_tests.rs and observe_tests.rs: the engine's request and observer surface had no caller left once busbar-llm goes (busbar-llm retired: the llm plane registers through its door alone (DEV-GREEN row 83) #1161). The served path's dial and deadline are covered by connector_tests::a_request_bound_times_out_a_far_end_that_never_answers, a_request_bound_is_spent_once_the_answer_begins and framed_stream_tests.
kernel egress/trust/tests/egress_trust_tests.rs: rows of deleted primitives are struck. The kept seam's rows stay.

Proof (RED-able).

crates/busbar-kernel/tests/no_socket.rs: PINNED [] and PINNED_MANIFEST []. It is drain-only both ways, so re-adding a dial, resolver, HTTP stack or manifest edge reds it.
connector_tests::a_proxied_dial_tunnels_first_then_presents_the_sealed_identity_over_tls.

Ledgers (qa/), striking or lowering only:

qa/c1-literals.toml: findings of the deleted files.
qa/door-only.toml: comment only; the EGRESS_TRUST row stands.

1.5.5 bytes: none. Every dial was already the connector's on the served path, and the oracle cells for proxy (E5a) and plugins.fetch (E6) are unchanged.

MattJackson · 2026-10-19T16:21:16Z

ModernCI merged dev (258b728) into lane-delete-kernel-egress-engine as 28ae041: the branch conflicted with dev only where a fixed rule settles it (a mechanical file; both sides only adding at one place: both kept, dev's first; or edits to neighbouring, different lines: both applied), each file by its rule:

crates/busbar/src/root/tests/door_steps.rs: rust

The change's own commits are untouched; the new commit holds the resolution alone (ModernCI writes nothing of its own) and every check runs on it, like any push. A failure on it belongs to the pair and comes back to this change with both sides' diffs. It was made as Matthew Jackson 1085847+MattJackson@users.noreply.github.com.

…h the connector (u30) Two REDs for TODO row 36 / status row 130 (BUSBAR-1.6.0.md THE DESIGN §5: "The kernel knows nothing about transport ... TLS is core-only, inside the connector"; §8: the connector is "the only holder of TLS keys, certificates, trust roots and mTLS identity ...; per-worker pools; ALPN; the proxy"; Appendix A B.6, l.3846: `egress_*` and `auth_resolve` deleted). - plane_host mod_tests `no_egress_slot_and_no_credential_mint_is_reachable`: RED at this head. The host vtable still wires egress_open/poll/write/close/fault and auth_resolve over the kernel's own outbound engine. - connector transport_pin `a_proxied_dial_tunnels_first_then_presents_the_sealed_identity_over_tls`: a secured dial under a CONNECT proxy asks the proxy for a tunnel to the far end's own authority first, runs the handshake over the tunnel, presents the sealed client identity to a mutual far end and observes the far end's key; the proxy relays only ciphertext. Its RED arm: with no identity sealed, the mutual far end refuses the same proxied dial. This is the behaviour the kernel engine's CONNECT tunnel and ClientIdentity carried, proven on the one path that remains once the engine is deleted. (cherry picked from commit 82d6bdf)

…'s (u30, TODO row 36, status row 130) The kernel no longer dials, frames, pools, tunnels or holds TLS (BUSBAR-1.6.0.md THE DESIGN §5: "The kernel knows nothing about transport ... TLS is core-only, inside the connector"; §8: the connector is "the only holder of TLS keys, certificates, trust roots and mTLS identity ...; per-worker pools; ALPN; the proxy"; Part 0 l.100: "Core never knows what `http`, `https` or `grpc` mean"). Deleted from busbar-kernel: - egress/engine/ whole: client.rs, pool.rs, https.rs, tls.rs, mod.rs (with its CONNECT tunnel), observe.rs, resolve.rs, deadline.rs and their suites. - plane_host/egress.rs (the HOT vtable egress slot that built `EngineSpec::pinned` and sent through `send_bounded`, :1032-1094) and its suite. Appendix A B.6 (l.3846) lists `egress_*` as deleted and no plane is handed a HostCtx, so it is deleted rather than ported. The slots answer `None` until abi::hot itself goes. `auth_resolve` and plane_host/creds.rs (its plaintext mint map, whose only redeemer was egress_open) go with it, along with the dispatch scope's egress-fault stash. - secure.rs (the TLS seam that handed the engine a dialled TcpStream), egress/fixtures.rs (the differential harness), the reqwest reference stack and PinnedClientPool in egress/mod.rs, topology's UpstreamClients, proxy's engine re-exports and build_egress_client, and the egress-trust primitives only the engine read (trust/identity.rs, trust_anchor.rs, spki.rs). egress/trust keeps the one seam the kernel owns: a config commit raised to the connector's destination guard. - UrlUserinfo (a credential value, not transport) moves to bound_credential.rs unchanged, with its parity test. The row 155 C residue stays for that row. The connector already holds the CONNECT proxy (proxy.rs, row 130 E5a) and busbar's mTLS identity (tls/client.rs). The previous commit's RED proves a proxied mTLS dial through it. Deleted with the engine: the connector's tls/engine.rs (the kernel-seam Layer) and its suite, hostio::SystemNames and its bounded-lookup helpers (the kernel's resolver), the connector's proxy() hand-off to the kernel, and the dev-dependencies only that suite used. The root installs the guard alone and hands the kernel no proxy. Deps gate (crates/busbar-kernel/tests/no_socket.rs, lowering only): PINNED is now empty, and `hyper-util` and `tokio:net` are struck from PINNED_MANIFEST. The kernel's [dependencies] ask for no hyper, hyper-util, rcgen or tokio `net`; the test kit asks for `tokio/net` through `test-support` and the dev-dependency. The connector's no_io_outside_hostio drops its tls/engine.rs exemption. Ledgers, lowering or striking only: qa/c1-literals.toml (13 rows of deleted files), qa/one-memory-abi.toml (plane_host/egress.rs), qa/construction.toml (the egress.rs known site), and qa/door-only.toml (comment only; the EGRESS_TRUST row stands). This depends on #1161, which deletes busbar-llm, the engine's other consumer. (cherry picked from commit 26d49c5)

…30's no-socket proof is met (E7) The test kit's one reqwest site, `test_support::oversized_413_body`, bound a loopback listener, served the router on it and POSTed through reqwest only to reach the router's own body cap. It now hands the same request (host, content-type, content-length, the 4 KiB JSON body) to the router through `tower::ServiceExt::oneshot`: the cap is a layer of that router, so the 413 status and its JSON body are the same, with no socket and no HTTP client. With that, the optional `reqwest` edge and `test-support`'s `dep:reqwest` are deleted, and `tests/no_socket.rs` strikes "reqwest" from PINNED_MANIFEST: PINNED and PINNED_MANIFEST are both empty, which is the file's own definition of row 130 done (THE DESIGN §5, BUSBAR-1.6.0.md l.572-579: "No plugin opens a socket ... The kernel knows nothing about transport"). The kernel's tests keep reqwest as a dev-dependency (test scaffolding, outside the scan).

…qwest edge (E7); nothing else in the workspace asks reqwest for http2

…r call left with the egress engine names no http:// literal

…ress engine: law0 rows lowered to the measure (core-connector x transport 57, kernel x auth 47, kernel x plane 739, kernel x transport 107) and MIN_FILES 1220 -> 1197 naming the 27 files that left

ModernCI merged dev (bc610c6) into lane-delete-kernel-egress-engine: they conflicted only in files a repo-declared merge driver merges or a command derives. Each ran on compute, in the merged checkout; this commit holds what they wrote. - qa/kind-isolation.toml: merged by driver `ledger-count` (`cargo xtask ledger-merge %O %A %B`) The change's own commits are untouched. Every check runs on it, like any push, before anything merges; a failure on it belongs to the pair. Merged-By-Driver: qa/kind-isolation.toml=ledger-count

MattJackson · 2026-10-21T00:48:59Z

ModernCI merged dev (bc610c6) into lane-delete-kernel-egress-engine as a86090e: the branch conflicted with dev only where a fixed rule settles it (a mechanical file; both sides only adding at one place: both kept, dev's first; or edits to neighbouring, different lines: both applied), each file by its rule:

qa/kind-isolation.toml: merge_policy driver ledger-count

The change's own commits are untouched; the new commit holds the resolution alone (ModernCI writes nothing of its own) and every check runs on it, like any push. A failure on it belongs to the pair and comes back to this change with both sides' diffs. It was made as Matthew Jackson 1085847+MattJackson@users.noreply.github.com.

ModernCI merged dev (e39ad75) into lane-delete-kernel-egress-engine: they conflicted only in files a repo-declared merge driver merges or a command derives. Each ran on compute, in the merged checkout; this commit holds what they wrote. - qa/kind-isolation.toml: merged by driver `ledger-count` (`cargo xtask ledger-merge %O %A %B`) The change's own commits are untouched. Every check runs on it, like any push, before anything merges; a failure on it belongs to the pair. Merged-By-Driver: qa/kind-isolation.toml=ledger-count

MattJackson · 2026-10-21T03:22:38Z

ModernCI merged dev (e39ad75) into lane-delete-kernel-egress-engine as 1331537: the branch conflicted with dev only where a fixed rule settles it (a mechanical file; both sides only adding at one place: both kept, dev's first; or edits to neighbouring, different lines: both applied), each file by its rule:

qa/kind-isolation.toml: merge_policy driver ledger-count

The change's own commits are untouched; the new commit holds the resolution alone (ModernCI writes nothing of its own) and every check runs on it, like any push. A failure on it belongs to the pair and comes back to this change with both sides' diffs. It was made as Matthew Jackson 1085847+MattJackson@users.noreply.github.com.

… the branch merged with dev e39ad75 (the kernel egress engine files left, none arrived)

…h dev 9791fbb (dev's transport/driver.rs left)

# Conflicts: # crates/busbar-core-connector/src/tests/connector_tests.rs # crates/busbar-kernel/Cargo.toml # crates/busbar-kernel/src/egress/trust/mod.rs # crates/busbar-kernel/src/egress/trust/spki.rs # crates/busbar-kernel/src/plane_host/mod.rs # qa/kind-isolation.toml # xtask/src/gates/plane_transport_neutrality.rs

kind-isolation law0 core-connector x transport 51, kernel x auth 47, kernel x plane 629 and kernel x transport 104 are the figures the gate printed on c61266f; MIN_FILES 1206 -> 1207 (zero-file-refusal's measure) and the plane-purity NEUTRAL_FLOOR 1108 -> 1089 (the measured neutral_files).

…s, not a weakening The gate's own count on c61266f merged with dev 0f3c9ca is neutral_files=1089. The floor falls by exactly the files this PR deletes from the neutral roots: 27 .rs files, none added (dev's count at 0f3c9ca was therefore 1089 + 27 = 1116, above the 1108 floor): - busbar-kernel/src/egress/engine/*.rs and engine/tests/* (16): the kernel egress engine, which #1230 deletes; - busbar-kernel/src/egress/{fixtures.rs,tests/pinned_pool_tests.rs} and egress/trust/* (7); - busbar-kernel/src/secure.rs and topology/worker_shard_tests.rs (2); - busbar-core-connector/src/tls/{engine,engine_tests}.rs (2), the connector's TLS engine. No file left the walk except by deletion, so no scan root or filter was narrowed.

…(clippy doc_lazy_continuation)

…ess-engine # Conflicts: # crates/busbar-kernel/src/egress/engine/mod.rs # crates/busbar-kernel/src/egress/mod.rs # qa/c1-literals.toml # qa/door-only.toml # qa/kind-isolation.toml # xtask/src/gates/plane_purity/mod.rs # xtask/src/gates/plane_transport_neutrality.rs

…ess-engine # Conflicts: # crates/busbar-core-connector/Cargo.toml # crates/busbar-core-connector/src/test_support.rs # crates/busbar-core-connector/src/tests/guard_tests.rs # crates/busbar-core-connector/tests/no_io_outside_hostio.rs # crates/busbar-kernel/src/egress/engine/mod.rs # crates/busbar-kernel/src/egress/engine/resolve.rs # crates/busbar-kernel/src/egress/engine/tests/dial_judge_tests.rs # crates/busbar-kernel/src/egress/engine/tests/observe_tests.rs # crates/busbar-kernel/src/egress/engine/tests/pool_tests.rs # crates/busbar-kernel/src/egress/engine/tests/tls_tests.rs # crates/busbar-kernel/src/egress/fixtures.rs # crates/busbar-kernel/src/egress/trust/mod.rs # crates/busbar-kernel/src/egress/trust/tests/egress_trust_tests.rs # crates/busbar-kernel/src/egress/trust/tests/identity_tests.rs # crates/busbar-kernel/src/secure.rs # crates/busbar/src/root/connector.rs

MattJackson · 2026-10-25T01:26:56Z

Resolved: lane-delete-kernel-egress-engine at 76483600ee55 merges cleanly onto dev. It no longer conflicts.

…mes neither the loader (dev) nor reqwest/rcgen (this lane); test-support asks tokio/net; no_silent_skip's sibling-shape anchor left with topology/worker_shard_tests.rs

MattJackson · 2026-10-25T05:13:20Z

Superseded by #1656 (TODO D, C2). #1656 carries this PR's whole engine deletion onto current dev and changes the same files, except one. It also fixes the reds here:

transport_pin's proxied mTLS fixture now serves the plain carrier its sec door rides.
no_silent_skip's MUST_COVER keeps its sibling-shape anchor: topology/worker_shard_tests.rs now pins the surviving worker_stripe behaviour, so the guard is not dropped.

MattJackson force-pushed the lane-delete-kernel-egress-engine branch from 28ae041 to 7b173e2 Compare October 20, 2026 04:23

MattJackson changed the title ~~lane-delete-kernel-egress-engine → dev~~ row 130 E5+E7: the kernel's outbound HTTP engine leaves busbar-kernel; the no-socket pin is empty Oct 20, 2026

MattJackson mentioned this pull request Oct 20, 2026

row 130: proxy_route moves from busbar-contract into busbar-core-connector (stacked on #1230) #1232

Draft

MattJackson marked this pull request as draft October 20, 2026 16:02

MattJackson added 4 commits October 20, 2026 13:43

Cargo.lock: reqwest's h2 edge goes with the kernel's http2-feature re…

c06d869

…qwest edge (E7); nothing else in the workspace asks reqwest for http2

MattJackson force-pushed the lane-delete-kernel-egress-engine branch from 2f357dc to c06d869 Compare October 20, 2026 20:45

MattJackson changed the base branch from dev to lane-delete-busbar-llm-6 October 20, 2026 20:46

Base automatically changed from lane-delete-busbar-llm-6 to dev October 20, 2026 21:47

MattJackson marked this pull request as ready for review October 20, 2026 21:47

MattJackson added 4 commits October 20, 2026 16:56

Merge remote-tracking branch 'origin/dev' into HEAD

d628c70

c1-literals: strike the kernel fixtures' http row; the in-process doo…

ace52cd

…r call left with the egress engine names no http:// literal

kind-isolation and plane-transport-neutrality fall with the kernel eg…

345d90b

…ress engine: law0 rows lowered to the measure (core-connector x transport 57, kernel x auth 47, kernel x plane 739, kernel x transport 107) and MIN_FILES 1220 -> 1197 naming the 27 files that left

MattJackson mentioned this pull request Oct 21, 2026

Law 0 kernel (P04, part 1): the test-support seam and kit describe their doubles by kind #1367

Merged

MattJackson added 6 commits October 20, 2026 20:59

plane-transport-neutrality: floor 1197 -> 1196, the count measured on…

a6f7e43

… the branch merged with dev e39ad75 (the kernel egress engine files left, none arrived)

Merge origin/dev into lane-delete-kernel-egress-engine

dba3fee

plane-transport-neutrality: floor 1196 -> 1195 on the tree merged wit…

7abafb6

…h dev 9791fbb (dev's transport/driver.rs left)

MattJackson mentioned this pull request Oct 22, 2026

xtask: gate --settle settles the gates' measured numbers on the merged tree #1553

Merged

MattJackson added 2 commits October 23, 2026 17:50

Merge origin/dev into lane-delete-kernel-egress-engine

6b21736

plane-purity: the floor note's closing sentence is its own paragraph …

13948c9

…(clippy doc_lazy_continuation)

MattJackson added 3 commits October 23, 2026 21:02

Merge origin/dev into lane-delete-kernel-egress-engine

71b6b33

MattJackson mentioned this pull request Oct 25, 2026

C13 + C10: TODO/transitional markers out of the code; delete dead qa/field-inventory.json #1650

Merged

Merge origin/dev into lane-delete-kernel-egress-engine: the kernel na…

7648360

…mes neither the loader (dev) nor reqwest/rcgen (this lane); test-support asks tokio/net; no_silent_skip's sibling-shape anchor left with topology/worker_shard_tests.rs

This was referenced Oct 25, 2026

C2: delete the kernel egress engine; the connector is the one outbound path (supersedes #1230) #1656

Open

C12: delete tests that prove internal seams, status rows or censuses #1657

Merged

MattJackson closed this Oct 25, 2026

Navigation Menu

Repository navigation

row 130 E5+E7: the kernel's outbound HTTP engine leaves busbar-kernel; the no-socket pin is empty - #1230

row 130 E5+E7: the kernel's outbound HTTP engine leaves busbar-kernel; the no-socket pin is empty#1230
MattJackson wants to merge 21 commits into
devfrom
lane-delete-kernel-egress-engine

MattJackson commented Oct 19, 2026 •

edited

Loading

Uh oh!

MattJackson commented Oct 19, 2026

Uh oh!

MattJackson commented Oct 21, 2026

Uh oh!

MattJackson commented Oct 21, 2026

Uh oh!

MattJackson commented Oct 25, 2026 •

edited

Loading

Uh oh!

MattJackson commented Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

MattJackson commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MattJackson commented Oct 19, 2026

Uh oh!

MattJackson commented Oct 21, 2026

Uh oh!

MattJackson commented Oct 21, 2026

Uh oh!

MattJackson commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MattJackson commented Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

MattJackson commented Oct 19, 2026 •

edited

Loading

MattJackson commented Oct 25, 2026 •

edited

Loading