Repository navigation
promote predev into dev - #740
Merged
Merged
Conversation
promote into
|
This was referenced Oct 10, 2026
added 26 commits
October 14, 2026 20:30
Combined with #503 (FLIP-STREAMING): both legacy crates (busbar-a2a, busbar-voice) are struck everywhere; llm is the one legacy engine and the one installed PlaneDecl. Hand-settled: law0 busbar x plane 810+770-826 = 754; census plane_crates 1; root claim fixtures 26 claims, 22 overlaps (5 cross, 17 same); plane-hook-isomorphism allowlist 0 rows; drain-pair plant moved to busbar-llm.
qa/kind-isolation.toml settled by hand (T+O-B): busbar-kernel x plane 1099+1118-1122 = 1095; busbar-kernel x transport 220+260-266 = 214; #805's clauses appended with their from/to rewritten.
layout golden: refuse a re-seed that is not append-only unless named (TODO l.1829-1831)
qa/kind-isolation.toml busbar-kernel x plane: base 1122, b 1121 (#937 DEFAULT_PROTOCOL, config/providers.rs), c 1121 (KN-2 webhook SSRF guard, observability.rs): distinct drains, both deltas apply -> 1120; cites joined.
plane_secret_blindness.rs: #859's census-derived plane dirs replace PLANE_HOMES (#503/#787's edit to that list is moot). qa/plane-secret-blindness.toml: the busbar-voice rows and busbar-a2a creds.rs row struck (crates deleted, no expose_secret left in their successors); busbar-a2a pushdeliver.rs count 2 MOVED with the code to busbar-plane-a2a/src/push.rs (count 2, net flat).
qa/kind-isolation.toml settled by hand (T+O-B): busbar-kernel x transport 214+256-266 = 204; #866's clause appended as LOWERED 214 -> 204.
added 28 commits
October 15, 2026 07:53
busbar-plane-a2a repins ec289de3a5 -> a644de5256 (lane-chain-port, pinning busbar at the new lane-chain-32-1028 6bd0a7a so its cdylib builds standalone).
busbar-transport-webrtc repins 72a3b745ba -> 13de13ba41 (lane-chain-port, pinning busbar at the new lane-chain-32-1028 6bd0a7a so its cdylib builds standalone).
…th_modules entry (2026-10-15)
# Conflicts: # CHANGELOG.md # Cargo.toml # crates/busbar/Cargo.toml # crates/busbar/src/root/tests/linked_auth.rs
…roots - contract: the answer-layout size pins guard on a const `if usize::BITS == 64`, not a `cfg`, so the item is on every build's surface (feature_invariance; fixfwd-3 29d9314). - contract honesty table: `Hold::open` takes its grant as `token` since #1027. - kernel teller: under_hold refuses a replayed pass on an `if`/`else`, not a `return` (the loop has no early exits; #1027). - kernel walk test: the permit test reads every far-end piece as the plane does (`judged(FAULT_NONE)`), so the held clean end settles (fixfwd-3 012dd8a). - loader conn_services tests: bound through a dispatcher's adopter, which holds the seal a member's credential is revealed under (#1021). - plane-llm: its crate's own declares.json (`needs: [http]`, the Statement's), which the conformance suite #1015 brought in proves against. - plane-llm conformance fee cell (#902): the piece line ends in `tap_fault=`, so "no fee" reads `units=[]` inside the line. - serve rig: the dispatcher serves the composition's host services and is lent the kernel's seal, as root::dispatch::build boots it (#1028 entropy for a Bedrock request id, #1021 caller and member credentials); RigOpts carries `limits.request_body_max_bytes`. - workspace: the webrtc media pins (str0m, aes) leave [workspace.dependencies] with the crate (#964). - xtask plane-purity: a transport the base layer lays (an extracted, pinned crate) is still an instance of the tree (#964 removed the last on-disk transport).
- plane-llm reply: a far-end CUT of a same-dialect whole answer states its report over the floor the relay stated while relaying (`stated`), as the end does: it bills only what the far end reported in the bytes in hand, never the floor (OWNER RULING Q31; v1.5.5 billed no floor). The floor stays what a caller that LEAVES mid-relay bills (item 367). The fixfwd-3 cut path (ARCHITECT ruling (a)) dropped the floor's replacement: the pools door billed 42/43 tokens for a whole answer cut before its usage. - plane-llm reply: a stream whose terminal error is its far end's FAILED GENERATION (a Gemini MALFORMED_FUNCTION_CALL, a Cohere ERROR: the far dialect's own stop token read as `Error`) bills the usage it reported, as 1.5.5 did (its readers raised no error for those stops; v1.5.5 proxy/response_body.rs:550-575) and as owner ruling Q31 charges. #892's no-tokens rule stays for every terminal error 1.5.5 raised too (a Responses `response.failed`, an unreadable count). - exchange_reply tests: the codec host's entropy is fixed, so the twin proofs see one minted id (#1028 handed the plane a CSPRNG host; #878's fixed source was dropped at that merge). Rows 336/337: the end STATES its zero over the floor it relayed (`stated: true`), which is what keeps the floor from billing; tokens 0 as before. - busbar-llm legacy rows 336/337 held to 1.5.5 with their served twins (coordinator ruling 2026-10-15, 51f401c; #852): a same-dialect body past the usage tap's cap bills no trailing usage and no floor (v1.5.5 proxy/response_body.rs:229-262). They pinned a post-1.5.5 tail copy and floor; renamed for what they pin. The test-only floor divisor re-export goes with them. - pools door over-cap cell (#908): the cap reaches the door as the deployment's `limits.request_body_max_bytes`, not the process-wide install the door never reads.
….5.5 wins unless an OWNER-LOCKED row or a signed entry says otherwise) 1) d7 vs #870: #870 wins (#81 and #77(8), both OWNER-LOCKED; #81 is a signed divergence). d7 now pins the exact decimal: every half-boundary rate 1.5.5 rounded is refused on both readings, and every whole-nano rate converts to exactly its decimal. rate_tests untouched. 2) #878 vs item 367: v1.5.5 wins. A same-dialect whole body states no floor while it relays and incurs none when its caller leaves mid-body: 0 tokens, as v1.5.5 response_body.rs:620-625 billed (#77(2): no floor added; Q33 (a) was told, never signed). Relay::relayed_floor goes; a far-end cut still bills only what the bytes in hand report (Q31). serve_tests' two drop cells and the legacy engine's drop cell follow to 0; exchange_reply rows 336/337 read Units::default() again (no floor to replace). 4) #892's buffered twin: v1.5.5 wins with (0, 0). A same-dialect body its dialect reads as a failure the FAR END reported (not an ir_parse) bills no tokens, as 1.5.5's usage tap read none (v1.5.5 handlers/chat.rs:60-98); Q37 is unsigned. 5) Anthropic in-stream error: `error.type` is v1.5.5's text again (the signal verbatim, null when none; v1.5.5 proto/anthropic/writer.rs:626-666). R-22 signs only the request_id, which stays; the cut cell checks it and compares every other byte to 1.5.5's recording. 6) conformance door_units cut cell: under ruling (a) and as v1.5.5 relayed it, a same-dialect answer streams as it arrives; the cut appends nothing and bills nothing. 8) Rerank billing off: an exit whose counts priced to nothing closes its hold with a COUNTED row (#77(2)/(3): one sealed line of counts, price never stored), not a zero Settlement. The book moves as before; replay closes the hold off the counts row and hands its reservation back.
ports-only-tests:busbar-llm (#1021, link 31). Secret<T> spelled the seal at each of 24 test sites as `.expose(&busbar_kernel::seal::lend())`, one `busbar_kernel::` line apiece: 1041 against the ceiling 1027 (measured 1017 before). `lend` now rides each file's existing `use busbar_kernel::{..}` line and the sites call `lend()`: 1017, no ceiling moved. token-sealed:kernel-seal (#1021, link 31). The contract's Secret<T> test minted a Grant through `KernelSeal::acquire_for_kernel()` outside crates/busbar-kernel/src. It presents the dev-only `plugin::TestKernelSeal` (#65) instead and mints nothing. seal-sites (#1027, link 01). Call-binding made the teller's two hold-cell takes mint their exit grant bound to the unit's call (`take(&Grant::<Exit>::mint_bound(seal, ctx.call))`), so the literal `take(&Grant::<Exit>::mint(` saw one of the three take sites the spec counts. The literal stops at `mint` in qa/construction.toml and in its mirror crates/busbar-contract/src/caps/fixtures/lint_rules.txt (the join test reads both); `sites = 3` is unchanged and still exact: two in teller.rs, the sweep in tick.rs.
…ings) #878 (link 15) rehomed four PB-27-cited metering tests into crates/busbar-plane-llm/tests/exchange_reply.rs (mod rehomed_metering) under their legacy names, so each `test:` ref of PB-27 named two fns and the binding read "partly proven"; design-bindings:regen-clean followed, since a fresh derivation records PB-27 unproven where the committed ledger says PASS. The rehomed copies are named `rehomed_*`; their REHOMES docs keep the legacy `path.rs::name`. Appendix B, xtask's design-bindings tables and both ledger artifacts (qa/design-bindings.json, qa/DESIGN-BINDINGS.md) are untouched: with the refs unambiguous the derivation is the committed ledger again, so no generated file needed a hand edit.
workspace-deps:no-orphans (#964, link 34). The webrtc framer left for its own repo and took its last inheritors of the `str0m` and `aes` workspace pins with it. Both pins are deleted from the root Cargo.toml (no member names them; Cargo.lock is unchanged and `cargo metadata --locked` resolves). plane-purity:* (#964, link 34). The vocabulary read `crates/busbar-transport-*` off the disk and the overlay only, so once the last in-tree transport was extracted it derived transports=0 and every rule refused (scan-denominator, path-include, symbol, type, key, dialect, backwards, frozen-wire-claim, segment-debt). `vocab::crate_dirs_on_tree` now also reads the base layer, which lays every pinned transport at `crates/<package>` (ARCHITECT P5 ruling), so the words are derived from the tree again, never typed. No neutral root names a pinned transport's crate identifier, compound name or directory, so the wider vocabulary adds no finding. teller-steps:root-legs (#1042, link 33). The a2a plane's root cells moved to its repo with the plane; the root still compiles them from the pin (build.rs: DEP_BUSBAR_DOOR_CELLS_<CRATE>_CELLS) and cites them at the census mount `crates/busbar-plane-a2a/tests/root/mod.rs`, where the base layer lays them (every cited fn is there at a644de5256). `libtest_path::door_cells` skipped a door row whose dependency names no `path`, so the root-a2a leg read as outside the root and the plane as answered by no leg. A pinned door's cells are now read at its census mount (a sibling of the root's directory); a path dependency's are read at its path as before. A unit case covers the pinned arm.
money-invariants:no-plugin-keyed-money and :no-stored-price (#849, link 04) refused with "the Policy writers yield 1 Policy record type(s), below the floor of 2". The invariant did not break: the tree writes the two Policy records the floor names (root/kernel.rs CardApplied, root/units_admin AmendmentRecord), and neither stores a price. #849's `journal_roots` read a BLANK line inside an impl as the impl's end, so `impl CardApplied { fn draft .. <blank> fn body(&self) .. }` lost its writer and only AmendmentRecord was derived. A blank line now closes nothing; only a column-0 line opens or closes an item. The gate is not weakened: it reads one more writer, and CardApplied's integers (effective_from, appended_at, policy_epoch; CardForm flat, cells, units, planes) are exactly the rows POLICY_FIELDS already declares. Replayed over the tree the journal writers still yield the same eight record types; only the Policy derivation changes (1 -> 2). No billing code is touched.
kind-isolation:law0 and :law0-base over the merge-base 8bb0343. No ceiling is raised; one is lowered. busbar x auth 30 -> 24 and busbar x instance:auth 13 -> 10 (#948, link 35). The webhook-signature link wrote the auth module's name into the root eight times (its new test's file name, two doc lines, a temp-dir prefix and its feature cfg; linked_auth's feature cfg and expected literal) and three `"admin-tokens"` literals into doc comments; #1042's deletion of tests/qa_a2a.rs drained two. Now: the test is tests/inbound_webhook_signature_linked.rs, both cases ride every linked auth row (`linked_every_auth`, build.rs) instead of spelling one row's feature, and the prose names the module by role. What stays is what the cases assert: the module the chain names and the name the info answer lists. 24 and 10, each the merge-base's own measure. busbar x transport 99 -> 97 (#908, link 20). Two new pools-door money cases built their far end as `MockResponse::Sse` (`sse` is the http transport's declared key). One file-level `event_stream()` helper now spells the mock's stream answer for those two sites and one existing walk case: 97. busbar-kernel x plane 1051 -> 1050 (#895, link 17). Its new plane_driver/tests/money_tests.rs said "every LLM unit"; it says "every plane unit". 1050 is the merge-base's measure; the 1050/1049 against the row is standing on predev and stays. busbar x plane 505 under 525 (#1042, link 33): law0-slack. The a2a extraction deleted the root's a2a suite and its wire fixture and did not give the drain back. The [[law0]] row falls 525 -> 505 (Law 9: ceilings only fall), cited in the row.
3) An unreadable usage count is REFUSED ON ITS OWN. The llm plane's usage reader
(usage_count::read_usage, every chat dialect's table) judges each field alone: a readable field
bills as stated; an unreadable one ("1500" as a string) is refused loudly (a warn naming the
protocol, field and spelling), bills nothing, and is never read as zero; no floor stands in for
it (#77(2)), and no stated-total gap prices it back in (refused_any gates the openai, responses
and bedrock total cross-checks; gemini's already skips). The answer and its readable counts are
no longer refused with it, so the stream does not end in an error and #892's failed-stream rule
does not zero it. `{"prompt_tokens":"1500","completion_tokens":9}` bills (0, 9), v1.5.5's figure
(v1.5.5 proto/openai_chat/reader.rs:678). Bedrock guardrail units follow the same rule.
#878's (0, bytes/4) and #892's (0, 0) both move to (0, 9): exchange_reply's two refused-usage
cells and the legacy engine's twins; the six dialects' refusal suites, wire_shim and the
bedrock guardrail cell now pin per-field refusal. Op handlers (embeddings, rerank,
transcription, image) and the streaming plane's reader are unchanged.
7) Finish class (new in 1.6.0; v1.5.5 wrote no per-request audit record): door_steps::facts
classes a whole answer Complete; a unit the far end cut after its head, or one the node ended
after a byte reached the caller (a caller drop, a cut-stream cut), Partial (#77(7)/#62: a cut is
not a refusal); a refused or failed unit, or one ended before its first byte, Error. The driver
tells the steps how the answer went before the audit seat (DriverSteps::answered: streamed, and
the new Facts::cut, reset per attempt).
# Conflicts: # Cargo.toml # xtask/src/gates/plane_purity/vocab.rs
…ettlement_kind (it clashed with journal_settlement_as); teller-step-order licenses the #74 replay arm of under_hold to omit route and meter
…73dd - Finish class (ARCHITECT ruling 7): a far-end cut is Partial only when the caller had the first byte of a SUCCESS answer; a cut the caller was answered with an error for (a buffered answer's 502) is Error. The driver keeps the status its head stated (Facts::status) and hands the steps "a byte of a success answer streamed" (pools_door seals_an_error_end_as_one_error_record). - The plane took the answer as final before its last piece (a whole answer past its translation cap, the caller's 500): FarEnd::taken keeps the attempt's budget unit spent when it settles mid-read, as 1.5.5 kept it for a body past its cap (its test_truncated_body_does_not_refund_ budget); a caller that leaves mid-read still refunds. DoorFar hands it on (pools_door keeps_the_budget_unit_of_an_over_cap_answer). - A unit that did not complete and whose reading counts nothing (no class, no billable request: a gate hook refused it before its dial) leaves no counts line on the node's book; the exit's posting closes its hold (session_door a_gate_hook_refuses_the_mint_before_the_provider_is_dialled). - pools_door_money token_lines reads the record's token lines by the contract's reserved units (input, output, cache read, cache write), the names a record line carries; the dead-stream cell's expected lines name them (quantities unchanged: 11 in, 7 out). - exchange_reply cut cell, Responses caller: 1.5.5's frame restarted sequence_number at 0, wrote a fresh writer's fallback model and none of the Response object's required members; signed entries S-2 (contiguous sequence_number) and S-6 (required members) and the stream's one carried identity (S-15) move those, so they are checked present and well formed and compared with them removed; every other member is 1.5.5's.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The ladder's PROMOTE rule: predev is green and 9501 commit(s) ahead of dev.