Repository navigation
row 130: proxy_route moves from busbar-contract into busbar-core-connector (stacked on #1230) - #1232
Closed
MattJackson wants to merge 5 commits into
Closed
MattJackson wants to merge 5 commits into
MattJackson wants to merge 5 commits into
Conversation
Collaborator
Author
|
ModernCI merged
The change's own commits are untouched; the new commit holds the resolution alone (ModernCI writes nothing of its own) and every check runs on it, like any push. A failure on it belongs to the pair and comes back to this change with both sides' diffs. It was made as Matthew Jackson 1085847+MattJackson@users.noreply.github.com. |
MattJackson
force-pushed
the
lane-proxy-route-into-connector
branch
from
October 20, 2026 04:23
5c91ded to
2f29af6
Compare
MattJackson
changed the title
MattJackson
force-pushed
the
lane-proxy-route-into-connector
branch
from
October 20, 2026 04:24
2f29af6 to
17bc516
Compare
MattJackson
marked this pull request as draft
October 20, 2026 16:02
…h the connector (u30) Two REDs for TODO row 36 / status row 130 (BUSBAR-1.6.0.md THE DESIGN §5: "The kernel knows nothing about transport ... TLS is core-only, inside the connector"; §8: the connector is "the only holder of TLS keys, certificates, trust roots and mTLS identity ...; per-worker pools; ALPN; the proxy"; Appendix A B.6, l.3846: `egress_*` and `auth_resolve` deleted). - plane_host mod_tests `no_egress_slot_and_no_credential_mint_is_reachable`: RED at this head. The host vtable still wires egress_open/poll/write/close/fault and auth_resolve over the kernel's own outbound engine. - connector transport_pin `a_proxied_dial_tunnels_first_then_presents_the_sealed_identity_over_tls`: a secured dial under a CONNECT proxy asks the proxy for a tunnel to the far end's own authority first, runs the handshake over the tunnel, presents the sealed client identity to a mutual far end and observes the far end's key; the proxy relays only ciphertext. Its RED arm: with no identity sealed, the mutual far end refuses the same proxied dial. This is the behaviour the kernel engine's CONNECT tunnel and ClientIdentity carried, proven on the one path that remains once the engine is deleted. (cherry picked from commit 82d6bdf)
…'s (u30, TODO row 36, status row 130) The kernel no longer dials, frames, pools, tunnels or holds TLS (BUSBAR-1.6.0.md THE DESIGN §5: "The kernel knows nothing about transport ... TLS is core-only, inside the connector"; §8: the connector is "the only holder of TLS keys, certificates, trust roots and mTLS identity ...; per-worker pools; ALPN; the proxy"; Part 0 l.100: "Core never knows what `http`, `https` or `grpc` mean"). Deleted from busbar-kernel: - egress/engine/ whole: client.rs, pool.rs, https.rs, tls.rs, mod.rs (with its CONNECT tunnel), observe.rs, resolve.rs, deadline.rs and their suites. - plane_host/egress.rs (the HOT vtable egress slot that built `EngineSpec::pinned` and sent through `send_bounded`, :1032-1094) and its suite. Appendix A B.6 (l.3846) lists `egress_*` as deleted and no plane is handed a HostCtx, so it is deleted rather than ported. The slots answer `None` until abi::hot itself goes. `auth_resolve` and plane_host/creds.rs (its plaintext mint map, whose only redeemer was egress_open) go with it, along with the dispatch scope's egress-fault stash. - secure.rs (the TLS seam that handed the engine a dialled TcpStream), egress/fixtures.rs (the differential harness), the reqwest reference stack and PinnedClientPool in egress/mod.rs, topology's UpstreamClients, proxy's engine re-exports and build_egress_client, and the egress-trust primitives only the engine read (trust/identity.rs, trust_anchor.rs, spki.rs). egress/trust keeps the one seam the kernel owns: a config commit raised to the connector's destination guard. - UrlUserinfo (a credential value, not transport) moves to bound_credential.rs unchanged, with its parity test. The row 155 C residue stays for that row. The connector already holds the CONNECT proxy (proxy.rs, row 130 E5a) and busbar's mTLS identity (tls/client.rs). The previous commit's RED proves a proxied mTLS dial through it. Deleted with the engine: the connector's tls/engine.rs (the kernel-seam Layer) and its suite, hostio::SystemNames and its bounded-lookup helpers (the kernel's resolver), the connector's proxy() hand-off to the kernel, and the dev-dependencies only that suite used. The root installs the guard alone and hands the kernel no proxy. Deps gate (crates/busbar-kernel/tests/no_socket.rs, lowering only): PINNED is now empty, and `hyper-util` and `tokio:net` are struck from PINNED_MANIFEST. The kernel's [dependencies] ask for no hyper, hyper-util, rcgen or tokio `net`; the test kit asks for `tokio/net` through `test-support` and the dev-dependency. The connector's no_io_outside_hostio drops its tls/engine.rs exemption. Ledgers, lowering or striking only: qa/c1-literals.toml (13 rows of deleted files), qa/one-memory-abi.toml (plane_host/egress.rs), qa/construction.toml (the egress.rs known site), and qa/door-only.toml (comment only; the EGRESS_TRUST row stands). This depends on #1161, which deletes busbar-llm, the engine's other consumer. (cherry picked from commit 26d49c5)
…30's no-socket proof is met (E7) The test kit's one reqwest site, `test_support::oversized_413_body`, bound a loopback listener, served the router on it and POSTed through reqwest only to reach the router's own body cap. It now hands the same request (host, content-type, content-length, the 4 KiB JSON body) to the router through `tower::ServiceExt::oneshot`: the cap is a layer of that router, so the 413 status and its JSON body are the same, with no socket and no HTTP client. With that, the optional `reqwest` edge and `test-support`'s `dep:reqwest` are deleted, and `tests/no_socket.rs` strikes "reqwest" from PINNED_MANIFEST: PINNED and PINNED_MANIFEST are both empty, which is the file's own definition of row 130 done (THE DESIGN §5, BUSBAR-1.6.0.md l.572-579: "No plugin opens a socket ... The kernel knows nothing about transport"). The kernel's tests keep reqwest as a dev-dependency (test scaffolding, outside the scan).
…qwest edge (E7); nothing else in the workspace asks reqwest for http2
…0 follow-up) busbar_contract::proxy_route (ProxyChoice, ProxyHop) was in the contract only because the composition root handed the connector's proxy choice to the kernel's outbound engine. That engine is deleted (u30; the previous PR), so only the connector names the choice now: it reads the environment into it (proxy.rs) and every framed dial asks it (BUSBAR-1.6.0.md THE DESIGN §8: the connector is the holder of "the proxy"; the contract holds cross-kind shapes only). The module moves verbatim, with its doc updated, as busbar_core_connector::proxy_route. busbar_core_connector::proxy re-exports both types at their existing paths, so every connector call site is unchanged. No plugin repo imports busbar_contract::proxy_route: a GitHub code search of the GetBusbar org and a grep of every pinned plugin checkout found none.
MattJackson
force-pushed
the
lane-proxy-route-into-connector
branch
from
October 20, 2026 20:45
17bc516 to
51ea314
Compare
MattJackson
changed the base branch from
dev
to
lane-delete-kernel-egress-engine
October 20, 2026 20:46
MattJackson
changed the base branch from
lane-delete-kernel-egress-engine
to
del-c2
October 25, 2026 16:23
Collaborator
Author
|
Retargeted onto del-c2 (#1656). #1230 was closed as superseded by #1656 (TODO D, C2), which carries the same kernel egress-engine deletion onto current dev. This PR's diff against del-c2 still includes #1230's own history; it needs a merge of del-c2 (or of dev once #1656 lands) to show only the proxy_route move. |
An error occurred while trying to automatically change base from
del-c2
to
dev
October 26, 2026 01:01
Collaborator
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/status row 130, a follow-up to E5 (#1230). Stacked on #1230, which is itself stacked on #1161.
busbar_contract::proxy_route(ProxyChoice,ProxyHop) was in the contract only because the composition root handed the connector's proxy choice to the kernel's outbound engine. #1230 deletes that engine, so only the connector names the choice now:proxy.rsreads the environment into it and every framed dial asks it.busbar_core_connector::proxy_route.busbar_core_connector::proxyre-exports both types at their existing paths, so every connector call site is unchanged.busbar_contract::proxy_route. No plugin repo imports it: a GitHub code search of the GetBusbar org and a grep of every pinned plugin checkout found none.Grounds: BUSBAR-1.6.0.md THE DESIGN §8 l.1141, the connector owns "the proxy". Part 2 #3 (l.2180): the connector is a cleanliness crate, and the contract holds cross-kind shapes only.
Rebuilt as one commit on #1230's rebuilt head; the outbound-auth stack history is no longer in it.
Retired tests: none. qa/: untouched. 1.5.5 bytes: none.