Repository navigation
P3 FLIP-A2A: the a2a plane served through its door; busbar-a2a deleted (stacked on #778) - #787
Merged
Merged
Conversation
…eam_tests The hostless seam adapter (seam.rs buffered, read_capped_over, stream_head/pump) against a direct build_pinned_client hop over the same loopback fixture: byte-identical buffered GET, a 3xx status and Location surfaced as a direct hop surfaces them, all three ReadEnd states of the cap loop matching proxy::read_capped, and the stream concatenation equal to a direct streamed hop.
The section described a lease (header_for refusing Expired / WrongAgent) that no longer exists. It is busbar's own credential, re-resolved on every hop and presented by the auth kind's per-request call; the plane never holds it; card fetches carry none; lease_ttl_ms must be > 0 and has no further effect (predev presented a lease the instant it minted it); a credential that stops resolving refuses the hop (502) in predev's words, and busbar's own requests are not made.
instance-noun-neutrality scans literals and identifiers in every non-family crate, tests included: the root serve cells read the ErrorInfo domain and the task resource type from the agent door's wire fixture (agent_door_wire.txt) as the agent_door module already does, the door_steps cells use a neutral vendor URL, and the kernel seam cell is renamed buffered_adapter_matches_a_direct_pinned_get_byte_for_byte.
…ix a shadowed fixture in the callback-floor cell The capability arm (streaming and pushNotifications, each excluded and each fitting), the input- and output-mode arms with the compatible-both-ways case, and the exhaustive TaskShape destructure guarding content-blindness, from predev catalogue_tests.rs, now over skill::fit.
…c, and registration members riding every member-target need The a2a plane is one dialect whose JSON-RPC, REST and gRPC are its lines (spec, 2026-09-30: transport de-frames, plane transcodes protobuf<->ProtoJSON). predev's engine dialled gRPC agents (relay::GrpcFraming); the door refused a gRPC-only card as unspeakable. Now: - binding.rs: GRPC is speakable; a card listing it first is reached on it. - framed.rs: the outbound codec on the same generated messages: the hop's params written as the rpc's request message, each length-prefixed answer read back as its ProtoJSON result, and the status the trailers state (grpc-status-details-bin's google.rpc.Status and ErrorInfo). - door.rs: NEED_GRPC, outbound, member-target (settings.*.url), transport grpc, the same trust anchors (client identity) as NEED_AGENT. - relay.rs: the gRPC binding composes /lf.a2a.v1.A2AService/<rpc> with the request message; a unary answer is read whole, an error status is the backend's refusal (its A2A code where its reason or status binds one), no message and no status is the engine's Unframable; the two streaming rpcs re-frame each message as a JSON-RPC event through the one event reader. Trailers (PIECE_FIELDS) are read for the status and never appended to the answer. - plane_door.rs: an attempt on a gRPC-bound agent names NEED_GRPC; the door's own requests (push-config mirror, ListTasks refresh) dial NEED_GRPC and transcode the answer. - root door_steps.rs (approved root change): a registration member rides EVERY member-target need its plane states (the providers' rides pattern); its anchors and private reach are sealed, and its auth binding bound, on each ridden need. Ports the engine's grpc client legs (client_leg_tests grpc_client_issues_*, pushback grpc_client_issues_*_task_push_notification_config(s)) and the port-f rows at unit level.
…rce_cites_the_design_in_words_not_in_symbols test refuses the section sign)
… plane's purity and design-citation rules hold over the new cells The task_hop inline-callback cell answered DEST_ALLOWED for a plaintext and an internal-literal callback and relied on the plane's own scheme and literal checks; with the destination decision the host judge's (the design's one destination guard), the cell's host answers DEST_PLAINTEXT and DEST_INTERNAL, and the refusal words are unchanged. The push attempt seam takes &mut self so the test host keeps its log without a cell (the plane holds no interior state, tests/purity.rs); the internal-address refusal names the host as read, with no std::net parse; the design is cited in words; a clippy type_complexity alias. Root: a cell that a key no longer live never dials its agent (predev's authorise_egress KeyNotLive).
…own name (a local named desk shadowed the desk() helper)
… to end, and port the refresh, no-hop, terminal and token-lifetime cells - serve_tests agent_door: a loopback agent serving its card over HTTP/1.1 and its rpcs over HTTP/2 on one port; an agent whose card names only GRPC is approved and a relayed SendMessage reaches it on the door's gRPC need (its registration riding that need): the rpc's path, one length-prefixed message carrying the caller's content, the answer back under busbar's task identity. - The rig's Agent can answer per request; the engine's the_refreshed_state_reaches_the_callers_own_list, a_list_with_no_open_task_of_this_callers_makes_no_hop, a_terminal_task_is_not_armed_at_the_backend, a_token_is_not_spent_by_being_used_while_the_task_is_live and a_token_for_a_task_that_has_ended_authorises_nothing ported as root cells. - The plane's wire words these cells use are fixture data (agent_door_wire.txt), as the rig's others. - relay_grpc_tests: a request message whose fields are all default is zero bytes (nothing sent beside the head; the transport frames the empty message).
…ent DECLARES the agents section (served().section), not one that merely owns it; the cells never ran since 40ccb45 because the probe read the owned-section list and found no door. A missing door is now a failure through door(), never a silent skip (33 early returns removed)
…es the agents section linked_door() matched only a door that OWNS the fixture's section (a section kept beside its declaring one), but the agent door DECLARES it: its ServedFacts.owns is empty. So linked_door() was None in every build and every agent_door cell returned at its guard and passed without driving anything (witnessed on Latchkey: neither of two probe prints past the guard ran, and a cell with its kernel fix reverted still passed). It now matches the declaring section or an owned one.
…led on its trait object)
…s predev's did Without a store block the config also refuses "store is required", beside the agents-card refusal the cell pins (seen on Latchkey once the cell was actually driven).
… so the transport names no plane (kind-isolation vocab back to predev's: zero findings)
…oot path installs (root::connector::install_io_reactor, now one function both call). The door's own requests (its card fetch, a mirrored push config) run on a dispatcher worker off any runtime, so with no process reactor their sockets were refused registration (io::NOT_ON_A_WORKER) and every connect failed as a host fault
…e, card signing, JWS verify) into p3-flip-a2a; its cells sit after helper e's at the agent-door module's end, and every early return on a missing door is struck (a missing door fails through door())
…R4: an unreachable card on the call path fails the hop closed; the verify_tests ports; the dated ruling in Appendix B) into p3-flip-a2a; the plane tests both branches appended sit one after the other, and the root cells' early returns are struck
…cation answered 202, a deleted push config's credential forgotten; registration judged by the host's dest.judge, no plane-local address check; ruling (C): the inert anomaly breaker and its cells deleted, egress_scopes documented as validated and unread) into p3-flip-a2a. The anomaly-breaker pass cell a2a-h-b ported retires with the breaker under ruling (C); the fixture keeps both branches' rows
…ired anomaly cell it headed
…urn on a missing door
…tes; PerHop's redacting Debug; the per-hop credential, waiver and seam conformance cells; docs/a2a.md's upstream_credential restated) into p3-flip-a2a. The refusal slot answers an unreadable rewrite first, then a refused credential, then the rest; docs keep a2a-h-a's egress_scopes row beside a2a-h-d's upstream_credential row
…ilent about an agent, through DoorSection::ledger_lanes; the R2 cell: a breaker-refused hop counts its request and bills no fee, bytes or spend) into p3-flip-a2a; the agent door probe stays the lane's (the declaring section only, never a skip)
…s own need, the codec's outbound direction, a registration riding every member-target need in the root, the client and mirror legs ported) into p3-flip-a2a. The cells' Agent fake keeps both branches' constructors over one start_core (head fields from a2a-h-i, an answer made of the request from a2a-h-f); the fixture, relay constants and appended cells keep both sides
…, served card, task hop, framing, the kernel lifecycle cell, the mutual-TLS and card-signing root cells) into p3-flip-a2a; appended tests keep both sides, the fixture both rows, the root cells no early return
…ential binding) is a runtime carrier built from a reference the door section's walk already reported, never part of RootCfg (NotInResolvedConfig), so the inventory accounts for it
…in the trailers is an answer (RED) A far end that states its status at the end (the grpc transport: head with no status, trailers carrying grpc-status, BUSBAR-1.6.0.md l.394, l.747) answering NOT_FOUND must be relayed to the caller as the A2A error the status binds (TaskNotFound -32001), never failed over, and record no transient against the agent (coordinator ruling: the trailer status comes through the kernel). - kernel far_end: the trailers cross with their status; a non-success one is the answer's last piece, not a cut (no compensating transient, no refund); the plane's reading of it wins, with no second success beside the head's; a success stated there ends as it ends. - a2a relay/framed: the call's end is the status handed on beside the trailers; the grpc-status-details-bin details carry the ErrorInfo, never the code. - root agent_door: a gRPC agent answering NOT_FOUND six times is answered -32001 each time, dialled once per call, its breaker never open.
…plane, and a non-OK one is an answer, never a connection fault Coordinator ruling: the gRPC trailer status comes through the kernel (BUSBAR-1.6.0.md l.394 a gRPC binding reads grpc-status from the trailers; l.747 the trailers carry grpc-status, then a terminal piece). Before, the far end handed the plane the trailers' field block without its status_code, and the failed terminal piece after a non-OK end was read as a cut: a compensating transient on the member's breaker (even for NOT_FOUND) and the budget unit refunded, while the plane, seeing no status, read the details field for the code. - far_end: the trailers piece carries the status the transport read off it (its number and class). A non-success status after a head the walk recorded as a success is the answer's outcome: the trailers are the answer's last piece (the failed terminal is never read), and the transport's fault reading of the status is held for the plane's own (FarEnd::judged), as a relayed failure's head is; a plane reading that is a success again records no second success. NOT_FOUND's row reads as the caller's: nothing is recorded against the member. A success stated in the trailers ends as it ends (the line is still read to its completion). - route: the status crosses with PIECE_HAS_STATUS on the first piece and on a trailers piece; the head fields cross only with the first. - contract: PIECE_FIELDS documents the status it may carry (no layout change; the header's line is unchanged). - a2a framed::ended: the call's code is the status handed on beside the trailers, never the grpc-status-details-bin details (which still carry the error's ErrorInfo); the relay already maps the code to the A2A error and the breaker reading predev's classify_hop gives (a backend error is the destination answering; UNAUTHENTICATED/PERMISSION_DENIED hard). - the root cell's name speaks no instance noun in code.
This was referenced Oct 14, 2026
Merged
…erged with predev (460be4d77d) Drains: busbar x instance:secret 25 -> 22, busbar x plane 772 -> 770, busbar-kernel x plane 1100 -> 1099, busbar-kernel x transport 266 -> 220, busbar-kernel-breaker x plane 2 -> 0, busbar-kernel-breaker x transport 134 -> 1 (the #561/#778 breaker work this branch stacks on, row 66, and FLIP-A2A). busbar-plugin-loader x instance:secret 21 -> 23 is a correction of the merge figure, not a rise: predev's -2 (#532, 40a4080) removed two `extern "C"` ABI strings (host_log_sink and its doc line) that this branch's scanner fix had already stopped counting, so the two drains overlap by those two; 23 is this branch's own pre-merge measure, and no hit was added.
…hat read as the c secret plugin are named for what they are Ruling on 60dd171: no raise. The 23 ModernCI measured is no hit #787 added (#787 adds no secret-instance literal to the loader; it removes one, the durable_tests rename): the merge figure 21 counted predev's -2 (#532, two extern "C" ABI strings) that the scanner fix behind #787's -85 had already stopped counting. The ceiling returns to 21 by draining two real hits: store_money_acceptance.rs the_floor_makes_arrival_order_matter's .expect("c") messages (the charge), now "the charge", and their refund pair "the refund".
This was referenced Oct 14, 2026
ModernCI merged predev (1d111f2) into lane-p3-flip-a2a: they conflicted only where a fixed rule settles it. Each file is settled by its rule: - crates/busbar/src/root/door_steps.rs: rust (items both sides added are all kept, the target's first; an item both changed is a real conflict) Keep-both: where both sides only added at one place, both are kept, predev's first. ModernCI writes nothing of its own. A red on this commit belongs to the pair and goes to lane-p3-flip-a2a with both sides' diffs. The change's own commits are untouched: this commit holds the resolution alone. It is judged in full, like any push, before anything lands.
Collaborator
Author
|
ModernCI merged
The change's own commits are untouched; the new commit holds the resolution alone (ModernCI writes nothing of its own) and is judged in full like any push. A red on it belongs to the pair and comes back to this change with both sides' diffs. It was made as Matthew Jackson 1085847+MattJackson@users.noreply.github.com. |
…'s are renamed to what they are (787 reads its armed 96) Each pair was read on both sides. None is shared logic: each is a distinct concept that only shares a generic word, so the decisions side, whose name was the less precise, is disambiguated. - Relayed -> RelayedFields (driven.rs). Decisions: the caller's header fields the far end receives, one buffer per unit (what `relayed_fields` returns). MCP's `Relayed` (tool_door.rs) is the outcome of relaying an upstream ask: an answer, a pended host service, or refused child requests. Different concept; renamed, not shared. - Routed -> ModelRoute (plane_door.rs). Decisions: one configured model's route, its dialect index and its upstream_model. LLM's `Routed` (busbar-llm unit/route.rs) is the Route step's output: the sealed seat verdict, the response bytes, the meter facts and the unspent meter sink. Different concept; renamed, not shared. - Unreadable -> UnreadableUsage (driven.rs). Decisions: a usage member present in a success answer but not a whole count, naming its pointer (the money rule's loud failure). A2A's `Unreadable` (skill.rs) is why a held agent card cannot be read. Different concept; renamed, not shared. The private `Member::Unreadable` variant is not a top-level symbol and is unchanged. No ledger row is added and the armed count is not touched.
… base, so it compiles against #787's FramePiece (fault in the old _reserved byte) #787's FramePiece states the framer's fault reading in the byte that was `_reserved` (the breaker plane-fault work); the datagram rig landed on predev against the old layout and named `_reserved: 0`, which #787's tree does not have (E0560). FramePiece has no constructor or Default, so the literal names the four fields the rig sets and takes the rest from an all-zero piece (code, status class, FAULT_NONE, no retry), as the contract and loader tests' `z()` pieces do. An appended field (#1032's declared_len) no longer breaks it. Every other FramePiece and WirePiece literal in the tree was checked: the rest are built from `z()` or already name the current fields.
…: both sides' hunks kept - crates/busbar-contract/src/abi/plane/check.rs: the import list carries #787's MAX_METRIC_LANES, ROUTE_CARRIES_OWN_TOKEN, ROUTE_SCOPE_LOCAL and TAIL_REFUSED_PIECE with predev's TAP_FAULT_NONE. - crates/busbar-kernel/src/plane_driver/route.rs: the Answer copy carries #787's metric_pool, metric_lane and wait_member with predev's tap_fault (OnPieceOut holds all four: tap_fault in the old padding byte, the spans appended; the layout golden and header agree at 181/182 and 216..240). - crates/busbar-kernel/tests/common/mod.rs: TestUnits keeps #787's `resolved` and predev's `tap_faults`; its one DriverSteps impl answers both `resolved` and `usage_tap_fault`. Stale-copy check over every file either side changed since 1d111f2: a file only one side changed is that side's copy exactly, and no file both changed fell back to the base or to one side alone.
This was referenced Oct 14, 2026
…he measured 42 (Law 9); five a2a capability cells proven again H1 (structure-lint:plane-dup:unledgered). The armed 96 rested on "none of the new pairs is new code"; 52 of the 81 new findings (plus the 2 #703 met through predev's door_sessions.rs) were declarations this branch added (39cf69f, the plane-local a2a door). All 54 are drained: Shared once in the SDK (busbar_contract::abi::sdk), both doors use it (8): - Route -> publish::ServedRoute (a2a and mcp door tables alias it) - claim -> ServedRoute::claim_spec (a2a's dialect step is dialect_claim) - admin_route -> publish::admin_route - op_class_index -> publish::class_index (a2a calls it; mcp's op_class_index delegates) - public_url -> Lent::stated - hex -> digest::lower_hex (a2a push token); mcp uses busbar_contract::sha256_hex - State -> trust::State (identical state word, both trust.rs) - Sighting -> trust::Sighting<O> (a2a over CardObservation, mcp over Observation) Renamed, distinct concepts sharing a word (46): - modules: trust.rs -> card_trust.rs, arrival.rs -> agent_arrival.rs, door.rs -> door_statement.rs, plane_door.rs -> agent_door.rs (busbar/Cargo.toml plane-a2a-door row follows), identity.rs -> task_identity.rs - card_trust: Observation -> CardObservation, Standing -> TrustStanding, state_of -> verdict_state, verify -> verify_card, TrustView -> AgentTrustView, drift -> skill_drift, view -> agent_view - agent_arrival: Refusal -> AgentRefusal, Disposition -> AgentDisposition, decide -> decide_arrival, not_granted -> not_granted_sentence - door_statement: read_settings -> read_agents_section, snapshot_spec -> agents_snapshot_spec - agent_door: Unit -> AgentUnit, Head -> AnswerHead, Looked -> CardLook, section -> agents_section, stands -> caller_stands, piece -> hop_piece, verify_on_call -> verify_agent_on_call, session_of -> context_session - framed: Status -> CallStatus, answer -> answer_message, Reply -> FramedReply, reply -> framed_reply, events -> event_messages - local: Answer -> LocalAnswer, answer -> answer_local; push_serve: answer -> serve_answer - relay: Answer -> PieceAnswer, Reply -> RelayReply, Relay -> HopRelay, Settled -> TaskSettled - push: Settled -> DeliverySettled; push_door: tick -> tick_deliveries, advance -> advance_attempt - tasks: Held -> HeldTask, Step -> Stamp, seal -> seal_event, sweep -> retention_sweep - task_door: Held -> HeldAnswer, Head -> WindowHead; task_hop: Refused -> WriteRefused, settle -> settle_on_answer; events: frame -> json_event - the less precise other half: busbar-llm credential.rs Binding -> CredentialBinding (private), busbar-plane-mcp tool_sessions.rs Event -> SessionEvent (private), busbar-voice mount.rs refusal -> plain_refusal (private) Armed figure, measured by the lint's own rule (top-level fn/struct/enum/trait/union names and file names per plane home, production files only) and listed pair by pair: 96 - 54 = 42. - 15 carried from predev 2bce54d (which measures 26; 11 left with the deleted engine or the decisions renames: meter.rs, plane.rs, route.rs, verify.rs, admit, approve, deliver, task_verb, Verified, Relayed, Routed): config.rs, absolute, Admitted, arrive, attempt, build_runtime, drive, fingerprint, Hop, meter, op_class, owe, refused, relayed, serve - 27 scope-moved (declared in busbar-plane-a2a files that existed on predev): claims.rs, diagnostics.rs, facts.rs, jsonrpc.rs, meta.rs, ops.rs, record.rs, records.rs, Envelope, IdShape, MethodRow, Tap, Task, correlation_for, correlation_value, decode, encode, error, id_shape, id_value, is_canonical_number, is_number, open, operations_for, read, row_for, success UNLEDGERED_ARMED 96 -> 42 (the coordinator's ceiling was 51: predev's 22 + 27 + 2; predev's true carry is 15 and the #703 two are drained). The source comment states this accounting; the standing-red strike stays, the measure equals the armed figure. H2 (qa/capability-equality.json): missing 5 -> 0. - failover-reroute x a2a-client: tests/root/mod.rs::a_tripped_pool_primary_reroutes_a_fresh_submission_to_the_twin_and_stays_untouched (root proven too) - metrics x a2a-client: tests/root/mod.rs::a_relayed_task_counts_an_upstream_attempt_naming_the_agent_it_was_issued_to (root proven too) - metrics x a2a-server: crates/busbar/tests/plane_integration.rs::mounted_plane_traffic_appears_on_a_real_metrics_scrape (its agents: owner is the a2a door row) - net-guard x a2a-server: src/tests/push_door_tests.rs::a_callback_that_became_internal_after_registration_is_refused_at_delivery - egress-auth x a2a-server: src/tests/push_door_tests.rs::the_callers_own_webhook_credential_is_presented_on_the_delivery, ported from the engine's pushdeliver_tests.rs (the caller's own credential is the one authorization field of the delivery the judge admits, and that delivery is sent) H3: no change. predev's snapshot "header" sat in CredentialPlacement's "variants" array, which the instance scanner's placement collision already did not count, so busbar-kernel x instance:auth measured 8 without it; the row reserves the moved spelling and stays 8.
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…c] (no backend is promised a C compiler; #787 preflight 'linker cc not found')
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…] (no backend is promised a C compiler; #787 preflight 'linker cc not found')
…ually sent The ported cell asserted on `d.request(&due)`, a request the test recomputed, while the test host's `send` dropped the exchange it was handed; framing the attempt without the credential (push_door.rs `Exchange::request(deliveries.request(..))`) would still have passed. - busbar-contract `Exchange::framed_fields`: the fields the exchange frames, read back off the head it sends (empty for a raw send), pinned by exchange_tests::the_framed_fields_are_the_head_the_exchange_sends. - push_door_tests TestHost records each send's URL and the exchange's framed fields; the other cells read only `sent`, as before. - the_callers_own_webhook_credential_is_presented_on_the_delivery now ticks the delivery and asserts on the one exchange sent, to the callback: exactly one `authorization` field, equal to `Bearer receiver-issued-token`. The credential is never printed. RED arm (read from the code): framing with `push::request(&flight.delivery, None)` puts only `content-type` in the head, so framed_fields has no `authorization` and the count assert fails; an `Exchange::request` that drops the field leaves the head's field block without it, same failure.
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
Conflicts: - Cargo.toml, Cargo.lock: busbar-transport-http pinned at a6e29e36da, the http dev commit that carries both sides: this branch's fault-table pin 2d1dbfdabf (the dev pin that drains tokio and hyper-util) and predev's a715d1ab57 (an IPv4 spelling is sent as the address it names). It is the pin #787 already carries over the same two. grpc 1303273a73, ws 2ec0786eba and tcp b3047ce874 each contain predev's pin (a5140eee3e, f8ba71d259, eb334dd6e9), so they stay. The transport ABI over predev's new code: - busbar-transport-webrtc (new on predev): its tail states no fault table (fault_rows null, as the byte-stream carrier's), its pieces name the fault byte where the padding was, and a closed data channel is the stream's END by flag (PIECE_END | PIECE_END_OF_FRAME), never an empty message; door_tests prove both. The connector datagram test builds its piece over a zeroed base. Same port #787 carries. - Layout golden and C header: the textual merge equals the generator's output over the merged types (predev's OnPieceOut.tap_fault and this branch's FaultRow / TransportTail.fault_rows / FramePiece.fault are disjoint; 287 of 291 structures pinned). qa/kind-isolation.toml law0: busbar-kernel-breaker x plane 2 -> 0 and x transport 134 -> 1, the measure ModernCI took of this same breaker code in #787 (60dd171, 460be4d77d).
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…eaker-plane-fault No conflicts. The base's merge of predev brings the http pin at a6e29e36da (this branch's fault table and predev's IPv4 spelling) and the webrtc transport's port onto the fault ABI. This branch's grpc pin b6b269d99d contains predev's a5140eee3e, so it stays; the four transport pins now equal #787's. Layout golden and C header equal the generator's output over the merged types (this branch's FAULT_HEALTHY over the base's FaultRow / FramePiece.fault, predev's OnPieceOut.tap_fault). The breaker law0 rows (x plane 0, x transport 1) are ModernCI's measure of this branch's breaker code inside #787.
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…IP-STREAMING (#503) each struck the last legacy crate's row Merged together, the two flips left [package.metadata.busbar.served-witness] with no row and build.rs's metadata_map refused it, failing every busbar build. The empty table leaves the manifest and build.rs emits an empty SERVED_WITNESSES when there is none, the shape it already takes for the linked-swaps table once the last switch went (FLIP-STREAMING).
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…e pinned decisions plane on a busbar rev that holds its contract - busbar-plane-decisions re-pinned 0ac65e1 -> 8b214c02cc: the plugin repo now pins busbar fca71d1 (this branch), whose contract carries the PlaneTail::metric_lanes, RefusalReason::CredentialUnavailable and HostCtx::NONE its ported edits use; its own workspace failed to build at 5c99bef (test check's dropped-in step). One busbar-contract in Cargo.lock (the [patch] path). - kind-isolation:law0: five rows settled to the union's measure, each at or under the merge-base's own row: busbar x instance:secret 13 -> 16, busbar x plane 583 -> 620, busbar-contract x instance:secret 43 -> 45, busbar-kernel x plane 1071 -> 1068, busbar-kernel x transport 203 -> 220. - kind-isolation:law0-base busbar x vendor (143 -> 144): #988's cap.perf.streams-2000 named its upstream's dialect in a root test literal; the provider row is test data (fixtures/streaming_mock_provider.yaml), as fixtures/mock_provider.yaml already is. - kind-isolation:test-deps: the busbar-kernel -> busbar-contract test edge #941 (#65) added (the dev-only test-seal) gets its [[dep]] row, count 1. - kind-isolation:test-deps plane -> plugin-tooling: #981 named the loader from a second busbar-plane-llm test file; its two loader cells move into tests/conformance.rs, the one file the conformance-witness grant covers. - structure-lint:plane-dup: armed at the measured 46 (Law 9; #787's 42 less six drains, plus ten names #503 and #787 each saw only once both homes moved), the stale Outbound and Route rows struck. - plane-secret-blindness: the a2a push.rs exposes-secret-bytes row is struck (drained). - script-allowlist: #972's scripts/store-migration-fixture.sh gets its entry.
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
- busbar-plane-llm tests: WholeCtx and ReplyCtx initializers state translate_cap (the default cap, as the in-crate tests already do), the reply rig's Piece copy carries tap_fault, and the dialect's auth-failure status is already a u16 (no as_u16) (#1030/#1031 against the rehomed exchange tests). - busbar build.rs: a test-linked door row's module is the one its plane-door row names in linked-entry (busbar_plane_a2a::agent_door, busbar_plane_mcp::plane_door), not an assumed <crate>::plane_door (E0433 in out/test_linked.rs after FLIP-A2A). - root serve_door_far: the far end's conn::Piece states declared_len (#1032). - root serve_tests session_door: DoorReach takes its secret seam as a shared Arc (#787's per-hop credential re-resolution).
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
… leg; the superseded structure-lint figure struck ModernCI's Law 9 review of 44b9451..179abf2 (HIGH): #503 deleted busbar-voice's tests and nothing re-homed them, so eleven streaming cells of qa/capability-equality.json went proven -> missing and five root legs proven -> none. Each is proven again by a cell on the streaming door's served root leg (root/tests/serve_tests.rs, module session_door), the door composed as production seals it, as the decisions and mcp doors' cells are: - breaker-trip: a_failing_provider_opens_the_breaker_cell_of_the_doors_route - breaker-fastfail: a_tripped_provider_is_refused_at_the_session_door_before_the_dial_at_once - hooks-gate (client, server): a_gate_hook_refuses_the_mint_before_the_provider_is_dialled (a deployment-wide gate on the hook stage, the door's routed order) - audit-chain (client, server): every_session_door_mint_served_or_refused_seals_one_record_on_one_chain - metrics (client, server): a_served_mint_counts_its_upstream_attempt_under_the_doors_route - egress-auth, governance-budget (client, server): the mint and spent-key cells already on the leg, which assert the provider's own credential and the presenting key's charge and refusal - teller-steps streaming approve: a_key_short_of_the_doors_grant_is_refused_before_any_dial Each keeps its RED arm. The session door harness takes a scripted provider, group limits, the key's pools and deployment hooks (with the hook stage composed over the generation). LOW: STRUCTURE_LINT_STANDING_FIGURES' plane-dup:unledgered figure (22) is struck, superseded by UNLEDGERED_ARMED when #787 armed the row.
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
… leg; the superseded structure-lint figure struck ModernCI's Law 9 review of 44b9451..179abf2 (HIGH): #503 deleted busbar-voice's tests and nothing re-homed them, so eleven streaming cells of qa/capability-equality.json went proven -> missing and five root legs proven -> none. Each is proven again by a cell on the streaming door's served root leg (root/tests/serve_tests.rs, module session_door), the door composed as production seals it, as the decisions and mcp doors' cells are: - breaker-trip: a_failing_provider_opens_the_breaker_cell_of_the_doors_route - breaker-fastfail: a_tripped_provider_is_refused_at_the_session_door_before_the_dial_at_once - hooks-gate (client, server): a_gate_hook_refuses_the_mint_before_the_provider_is_dialled (a deployment-wide gate on the hook stage, the door's routed order) - audit-chain (client, server): every_session_door_mint_served_or_refused_seals_one_record_on_one_chain - metrics (client, server): a_served_mint_counts_its_upstream_attempt_under_the_doors_route - egress-auth, governance-budget (client, server): the mint and spent-key cells already on the leg, which assert the provider's own credential and the presenting key's charge and refusal - teller-steps streaming approve: a_key_short_of_the_doors_grant_is_refused_before_any_dial Each keeps its RED arm. The session door harness takes a scripted provider, group limits, the key's pools and deployment hooks (with the hook stage composed over the generation). LOW: STRUCTURE_LINT_STANDING_FIGURES' plane-dup:unledgered figure (22) is struck, superseded by UNLEDGERED_ARMED when #787 armed the row.
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
… the framer repin past #1032; token-sealed's new red From ModernCI's nextest log at predev f4eb715 (8c1c308c) and its gates log (f50fb550): Two lanes meeting: - busbar config_validate_cross_plane: a present card is held to every registration the section bills, keyed <first scope kind>:<name> (DoorSection ledger lanes, d1be722); the cell's row was keyed `lane:`. Its row is now the registration's lane (BUSBAR-1.6.0.md l.2226, #42; #77(5)). - busbar Book is boot-only: the credential refresher's own `book()` (door_steps) read as a call of root::boot::book; renamed kept_book. The one boot call stays main.rs's. - busbar gauntlet_kernel: served_rider_chains_what_it_audits / _charges_the_presenting_key were cited only by the a2a and streaming root cells, which FLIP-A2A/FLIP-STREAMING re-pointed to their door legs; cited by nobody, they are dropped as U14 (686b91e) dropped mcp's two. - busbar plane_host_universal_purity: with a2a and streaming served through their doors (a plugin reaches busbar only over the ABI, BUSBAR-1.6.0.md l.2179, Part 2 #2) one in-root plane is left, so clock_now_secs has one caller: allowlisted with its reason, and the detector's multi-plane class is proved over the same counter on two planted plane sources. - busbar-contract feature_invariance: #65 made acquire_for_kernel dev-only; it is spelled #[cfg(feature = "test-seal")] and named in TEST_SEAL_ITEMS (no contract cfg(test) code calls it). - busbar-contract / busbar-plane-a2a: the design cited in words, not section signs. - xtask ledger_merge: [[shape-word]] (#787's reservation table) has its identity (word, file, holder), as duplicate-shape-word keys it. - xtask reachability selftest: #935's plane-crates row reads the root manifest's pins; the green fixture tree gains its root Cargo.toml (no pins: all five plane crates are laid). - busbar-core-connector fetch: the pre-body cap reads the head piece's declared_len (#1032); the field block never carries content-length, so the old lookup could not fire. - busbar root model_egress: pools_of registers the neutral test plane before parsing models/pools, as bf08115 did for the timeout cells (nextest: one process per test). A test wrong on its own head: - busbar-core-connector listen: the framer entry's listener rides the address carrier, so the view lays one beside it (TestDoor::identity("carrier")), as the connector's other cells do. - busbar-plane-llm conformance: an openai caller's head carries no anthropic-version, whose header claim outranks the chat-completions path claim (1.5.5's detection order). - busbar-plane-llm exchange_reply: never the far body; the far sentence is checked except where it is the caller dialect's own refusal sentence, which the envelope equality pins. - busbar-plane-streaming broker: the pre-X-2204 assertion that an expiry-less ek_ answer reads as 0 is struck; X-2204 refuses it (a_minted_answer_with_no_stated_expiry_is_refused). Gates: token-sealed's red was seal_release_path.rs minting a Pass outside crates/busbar-kernel/src; the release-path witness holds the seal and mints nothing. Not fixed here: universal_needs x8 are the pinned http framer built against a pre-#1032 contract (40-byte FramePiece against the host's 48); they go green with lane-transport-repin-1032.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
P3 FLIP-A2A: the a2a plane is served through its plugin door (
busbar-plane-a2a), the same way the mcp and decisions planes are. Compiled-in and dropped-in use one table. The legacybusbar-a2acrate is deleted, and its tests are ported into the door.Stacked: #502 → #561 → #778 (row 68) → this PR. The branch carries #778's head e846df4 (predev 740a8f5 merged through #502 and #561), so the diff against predev includes #561 and #778. This PR's own work is its two merge commits (the lane port onto #778, then #778's new head) and the commits after them.
What it carries
p3-flip-a2a-lane(all its coordinator rulings of 2026-10-07), ported onto predev. Not redone.plane-a2a = ["plane-a2a-door", …],plane-a2a-door = ["dep:busbar-plane-a2a"], aplane-doorrow with itslinked-declaresandlinked-sectionagents, and no linked row of the plane's key.busbar-a2ais deleted along with every row that names it (workspace, test-linked lists, served-witness rows, qa ledgers, and row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's two A2A[[dep]]rows). Thea2a-lf/a2a-pbworkspace pins go with it.crates/busbar-plane-a2a/tests/root/mod.rs. They compile into the root's serve module through a[package.metadata.busbar.door-cells]row (build.rsemits one#[path]module per row). The module-tree readers follow that include (xtasklibtest_path,scripts/capability-equality-summary.py, the capability-equality and teller-steps gates), andqa/capability-equality.jsonandqa/teller-steps.jsoncite the new file.ChainBook(host-sealed appends, a verifiedrecords.listread). predev'sChainedKindis removed; its admit check for an unkeepable chain is kept.RefusalCode::CredentialUnavailableis classedUnreachablein predev's single classification.busbar-auth-oauthis pinned atlane-p3-flip-a2a-pin(97627f86): predev's 7022a089 plus theCredentialUnavailablearms.test-linked = ["busbar-llm"]); its two cross-plane tests that need a mounting plane move whole to the composition root, as DEL-MCP did (a2b32ed). The admin crate's door double is gone.200withcontent-type: application/grpc. The call's status is its final status, which the framer renders. A refusal is the door's status block. A refusal that comes beforearriveread the line picks the gRPC line from its target (the contract'sRefusalIn::targetrule). The a2a root harness gives its served planes the connector's framers, as boot does.Architect rulings on #787, applied
headerin neutral crates. The 1.5.5 credential placement key stays byte-identical, as ONE constant in busbar-contract (section::PLACEMENT_HEADER_KEY, Part 2 mcp: a resource is addressable by the URI the protocol defines (A1.3) #83; DoD item 6).[[shape-word]]table. Each row is a NAMED reservation of one spelling: its word, its file, and the line its holder names (aconst <holder>:in a.rsfile, or the object keyed"<holder>"in a.jsonfile). It is never word-wide.manual-de CredentialPlacement. Each cites BUSBAR-1.6.0.md:2284 (mcp: a resource is addressable by the URI the protocol defines (A1.3) #83) and :2020 (DoD 6).shape-word-unused.busbar-contract × instance:authandbusbar-kernel × instance:authare back at the merge-base's 3 and 8.busbar-plane-a2a/src/a2a/creds.rs), not the kernel's. The kernel spells the word only in the generated snapshot. The plane keeps its literal match arms, because the config-schema gate reads a deserializer's wire keys off them.structure-lint:plane-dup:unledgeredis ARMED at 42 (plane_dups::UNLEDGERED_ARMED, Law 9; ModernCI Law-9 review H1, head dca6f92).busbar_contract::abi::sdk(used by both the a2a and mcp doors:ServedRoute/claim,admin_route,class_index,Lent::stated,digest::lower_hex,trust::State,trust::Sighting); 46 renamed precisely where the concepts only share a word (43 a2a-side incl. 5 modules; 3 private renames: llmBinding->CredentialBinding, mcpEvent->SessionEvent, voicerefusal->plain_refusal). Every pair is listed in commit dca6f92.agents:section, and v1.5.5's source has no a2a crate. So no 1.5.5 golden or oracle cell holds these bytes, and the decider is predev's subject (row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's head) on M3.GetTaskthat its agent refuses with ONE header block::status 200,content-type: application/grpc,grpc-status: 5,grpc-message: the%20backend%20agent%20refused%20this%20task,grpc-status-details-bin: …,content-length: 0.a_grpc_call_refused_before_any_message_closes_trailers_only_as_predevpins those bytes (red before). The OK cell pinscontent-type: application/grpc.A2aTrustView's description is predev's text again. The door's fragment is data (src/admin_openapi.json), andopenapi.json/.gzare byte-identical to row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's.plane_isomorphismallowlist 21 → 4 rowsbusbar-a2a, the retired engine (97 files, 39 of them non-test); the a2a plane crate's in-processPlaneimpl (src/plane.rs, its tests, alloc gate and scaffold); and the anomaly breaker predev never wired.The 81 plane-dup findings measured before the drain (historical: 54 drained at dca6f92, 27 scope moves remain)
The count went from 22 to 94. 9 of predev's findings left with the engine (the duplicates that were the engine's
meter.rs,route.rs,verify.rs, …), and 81 are new, all in the a2a door crate:crates/busbar-plane-a2a/src/jsonrpc.rs+crates/busbar-plane-mcp/src/jsonrpc.rs: symbolEnvelope, symbolIdShape, symbolid_shape, symbolid_value, symbolis_number, symbolread, symbolsuccesscrates/busbar-plane-a2a/src/trust.rs+crates/busbar-plane-mcp/src/trust.rs: moduletrust.rs, symbolObservation, symbolSighting, symbolState, symbolTrustView, symboldriftcrates/busbar-plane-a2a/src/plane_door.rs+crates/busbar-plane-mcp/src/tool_door.rs: symbolLooked, symbolkeep, symbolpublic_url, symbolsection, symbolverify_on_callcrates/busbar-plane-a2a/src/door.rs+crates/busbar-plane-mcp/src/door.rs: moduledoor.rs, symbolRoute, symboladmin_route, symbolop_class_indexcrates/busbar-plane-a2a/src/facts.rs+crates/busbar-plane-mcp/src/tool_facts.rs: symbolcorrelation_for, symbolcorrelation_value, symbolis_canonical_numbercrates/busbar-plane-a2a/src/ops.rs+crates/busbar-plane-decisions/src/ops.rs: moduleops.rs, symbolMethodRow, symbolrow_forcrates/busbar-plane-a2a/src/door.rs+crates/busbar-plane-decisions/src/plane_door.rs: symbolread_settings, symbolsnapshot_speccrates/busbar-plane-a2a/src/plane_door.rs+crates/busbar-plane-decisions/src/plane_door.rs: moduleplane_door.rs, symbolUnitcrates/busbar-plane-a2a/src/plane_door.rs+crates/busbar-plane-mcp/src/door_listen.rs: symbolpiece, symbolstandscrates/busbar-llm/src/arrival.rs+crates/busbar-plane-a2a/src/arrival.rs: modulearrival.rscrates/busbar-llm/src/engine/credential.rs+crates/busbar-plane-a2a/src/binding.rs: symbolBindingcrates/busbar-llm/src/engine/lazy_body.rs+crates/busbar-plane-a2a/src/plane_door.rs+crates/busbar-plane-a2a/src/task_door.rs: symbolHeadcrates/busbar-llm/src/unit/route.rs+crates/busbar-plane-a2a/src/tasks.rs: symbolsealcrates/busbar-llm/src/unit/verify.rs+crates/busbar-plane-a2a/src/trust.rs: symbolverifycrates/busbar-llm/src/unit/walk.rs+crates/busbar-plane-a2a/src/frame.rs: symbolTapcrates/busbar-plane-a2a/src/a2a/task.rs+crates/busbar-plane-mcp/src/tool_tasks.rs: symbolTaskcrates/busbar-plane-a2a/src/arrival.rs+crates/busbar-plane-mcp/src/ask.rs+crates/busbar-plane-mcp/src/tool_arrival.rs: symboldecidecrates/busbar-plane-a2a/src/arrival.rs+crates/busbar-plane-mcp/src/call.rs: symbolnot_grantedcrates/busbar-plane-a2a/src/arrival.rs+crates/busbar-plane-mcp/src/client/negotiate.rs+crates/busbar-plane-mcp/src/tool_arrival.rs: symbolRefusalcrates/busbar-plane-a2a/src/arrival.rs+crates/busbar-plane-mcp/src/tool_arrival.rs: symbolDispositioncrates/busbar-plane-a2a/src/claims.rs+crates/busbar-plane-decisions/src/claims.rs: moduleclaims.rscrates/busbar-plane-a2a/src/diagnostics.rs+crates/busbar-plane-mcp/src/diagnostics.rs: modulediagnostics.rscrates/busbar-plane-a2a/src/door.rs+crates/busbar-plane-a2a/src/surface.rs+crates/busbar-plane-a2a/src/task_hop.rs+crates/busbar-plane-a2a/src/tasks.rs+crates/busbar-plane-mcp/src/door_listen.rs+crates/busbar-plane-mcp/src/tool_claims.rs: symbolopencrates/busbar-plane-a2a/src/door.rs+crates/busbar-plane-mcp/src/door.rs+crates/busbar-plane-mcp/src/tool_claims.rs: symbolclaimcrates/busbar-plane-a2a/src/door.rs+crates/busbar-plane-mcp/src/door.rs+crates/busbar-plane-mcp/src/tool_door.rs: symbolop_classcrates/busbar-plane-a2a/src/events.rs+crates/busbar-plane-mcp/src/adapt.rs+crates/busbar-plane-mcp/src/door_listen.rs: symbolframecrates/busbar-plane-a2a/src/events.rs+crates/busbar-plane-mcp/src/tool_sessions.rs: symbolEventcrates/busbar-plane-a2a/src/facts.rs+crates/busbar-plane-decisions/src/facts.rs: modulefacts.rscrates/busbar-plane-a2a/src/framed.rs+crates/busbar-plane-a2a/src/local.rs+crates/busbar-plane-a2a/src/push_serve.rs+crates/busbar-plane-mcp/src/answer.rs+crates/busbar-plane-mcp/src/client/peer.rs+crates/busbar-plane-mcp/src/door_tasks.rs: symbolanswercrates/busbar-plane-a2a/src/framed.rs+crates/busbar-plane-a2a/src/local.rs+crates/busbar-plane-a2a/src/skill.rs+crates/busbar-plane-a2a/src/task_hop.rs+crates/busbar-voice/src/mount.rs: symbolrefusalcrates/busbar-plane-a2a/src/framed.rs+crates/busbar-plane-a2a/src/relay.rs+crates/busbar-plane-mcp/src/line.rs: symbolReplycrates/busbar-plane-a2a/src/framed.rs+crates/busbar-plane-mcp/src/door_tasks.rs+crates/busbar-plane-mcp/src/line.rs: symbolreplycrates/busbar-plane-a2a/src/framed.rs+crates/busbar-plane-mcp/src/framing.rs: symboleventscrates/busbar-plane-a2a/src/framed.rs+crates/busbar-plane-mcp/src/tool_tasks.rs: symbolStatuscrates/busbar-plane-a2a/src/identity.rs+crates/busbar-plane-mcp/src/identity.rs: moduleidentity.rscrates/busbar-plane-a2a/src/jsonrpc.rs+crates/busbar-plane-mcp/src/call.rs+crates/busbar-plane-mcp/src/jsonrpc.rs: symbolerrorcrates/busbar-plane-a2a/src/jsonrpc.rs+crates/busbar-plane-mcp/src/client/jsonrpc.rs: modulejsonrpc.rscrates/busbar-plane-a2a/src/local.rs+crates/busbar-plane-a2a/src/relay.rs+crates/busbar-plane-mcp/src/answer.rs: symbolAnswercrates/busbar-plane-a2a/src/meta.rs+crates/busbar-plane-decisions/src/meta.rs: modulemeta.rscrates/busbar-plane-a2a/src/push.rs+crates/busbar-plane-a2a/src/relay.rs+crates/busbar-plane-mcp/src/call.rs: symbolSettledcrates/busbar-plane-a2a/src/push.rs+crates/busbar-plane-a2a/src/rest.rs+crates/busbar-plane-mcp/src/trust.rs: symbolhexcrates/busbar-plane-a2a/src/push_door.rs+crates/busbar-plane-mcp/src/door_line.rs+crates/busbar-plane-mcp/src/door_listen.rs: symboltickcrates/busbar-plane-a2a/src/push_door.rs+crates/busbar-plane-mcp/src/door_tasks.rs: symboladvancecrates/busbar-plane-a2a/src/record.rs+crates/busbar-plane-a2a/src/tasks.rs+crates/busbar-plane-mcp/src/record.rs: symbolencodecrates/busbar-plane-a2a/src/record.rs+crates/busbar-plane-a2a/src/tasks.rs+crates/busbar-voice/src/bin/voice-conform.rs: symboldecodecrates/busbar-plane-a2a/src/record.rs+crates/busbar-plane-mcp/src/record.rs: modulerecord.rscrates/busbar-plane-a2a/src/records.rs+crates/busbar-plane-decisions/src/records.rs: modulerecords.rscrates/busbar-plane-a2a/src/records.rs+crates/busbar-plane-mcp/src/tool_records.rs: symboloperations_forcrates/busbar-plane-a2a/src/relay.rs+crates/busbar-plane-mcp/src/tool_door.rs: symbolRelaycrates/busbar-plane-a2a/src/task_door.rs+crates/busbar-plane-a2a/src/tasks.rs+crates/busbar-plane-mcp/src/tool_door.rs: symbolHeldcrates/busbar-plane-a2a/src/task_hop.rs+crates/busbar-plane-decisions/src/plane_door.rs: symbolsettlecrates/busbar-plane-a2a/src/task_hop.rs+crates/busbar-plane-mcp/src/checks.rs: symbolRefusedcrates/busbar-plane-a2a/src/tasks.rs+crates/busbar-plane-mcp/src/subscribe.rs+crates/busbar-plane-mcp/src/tool_door.rs+crates/busbar-plane-mcp/src/tool_program.rs: symbolStepcrates/busbar-plane-a2a/src/tasks.rs+crates/busbar-plane-mcp/src/tool_tasks.rs: symbolsweepcrates/busbar-plane-a2a/src/trust.rs+crates/busbar-plane-decisions/src/codec/mod.rs: symbolviewcrates/busbar-plane-a2a/src/trust.rs+crates/busbar-plane-mcp/src/subscribe.rs: symbolStandingTwo more rulings on #787, applied
extern "C"is not a secret instance (scanner precision fix).externtakes, and anabi = "…"argument. plugins.yaml'sbusbar-secret-chad taught the secret axis the wordc, so everyextern "C"in a neutral crate counted as that plugin.extern "C" fn,extern "C-unwind" fnandabi = "C"count 0."c"literal naming the plugin counts.extern "C"counts.instance:secretbusbar 35 → 25, busbar-contract 133 → 64, busbar-kernel 115 → 112, busbar-plugin-loader 111 → 25.crates/busbar-plane-a2a/tests/alloc_gate.rs, DoD item 6).String;piece.bytes.to_vec());target_ofparsing the agent url (a parse buffer, and a lower-cased copy per path segment, beside the target).Answer::ToFarEndLent): the door writes it from the piece the host lent, keeping only what a short host buffer could not take;a_target_read_without_a_parse_is_the_parsed_targetholds the two equal over 20 urls.Still open
kind-isolation:law0-baseis 3 hits over 1 cell:busbar-contract × transport226 → 229. row 68: the breaker reads a plane fault at the far end (stacked on #561) #778 carries the same cell; nothing in this branch grows it.docs/diagnostics.{json,md}and the C header are regenerated by their writers.Proof (M3 prover VM, this branch's head)
cargo xtask conformance record --suite a2a: pass. Every control leg is green, the subject battery passes, and the subject TCK has no unwaived red. On the run before the last two rulings it measured grpc 64/72, jsonrpc 89/102, http_json 85/96 and agent_card 8/10, which equals predev's subject at row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's head.cargo clippy --workspace --all-targets --locked -D warnings: clean.cargo test --workspace --locked --no-fail-fast: 12,951 passed, 10 failed. All 10 are environment-only and fail the same way on row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's head in that VM:plugin-loader --lib×3,core-connector --test universal_needs×6);ledger_identity, whose oracle clones a private repository.busbar-plane-a2a --test alloc_gate): 2 allocations, at the pin, and its RED arm sees the planted one.cargo xtask gate --all(XTASK_CEILING_BASE=740a8f5db9,XTASK_SHIP_TARGET=predev) is red in exactly row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's gates: kind-isolation, kind-isolation-ship and ship-ready.kind-isolation:law0is 179 hits off the ceilings, against row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's 211.kind-isolation:law0-baseis 3 hits over 1 cell, against row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's 4 over 2.structure-lintis green (row 68: the breaker reads a plane fault at the far end (stacked on #561) #778 has it red).busbar-plane-a2asuite (542 lib cells, the both-ways door conformance and the allocation pin) and the 120 a2a door cells in the root.