row 155 F25 REHOME: misc non-money rows (plane door, egress ports, auth, metrics)

crates/busbar-plane-llm/tests/alloc_gate.rs

@@ -144,3 +144,138 @@ fn same_dialect_relay_does_not_reparse_the_request() {
          work on a document it is about to send back unchanged"
     );
 }
+
+// ── F25 REHOME: the whole forward the served door runs, bounded (coverage map v2) ─────────────────
+
+/// The generation the served door holds: one openai far end, under a pool that names it.
+fn served_generation() -> busbar_plane_llm::exchange::shaping::Shaping {
+    busbar_plane_llm::exchange::shaping::Shaping::from_settings(&serde_json::json!({
+        "providers": { "oai": { "protocol": "openai", "base_url": "https://openai.invalid" } },
+        "models": { "gpt-4o": { "provider": "oai" } },
+        "pools": { "p": { "members": ["gpt-4o"] } }
+    }))
+    .expect("a well-formed generation reads")
+}
+
+/// A canned far-end chat completion (the 1.5.5 gate's upstream answer).
+const FAR_OK: &[u8] = br#"{"id":"chatcmpl-gate","object":"chat.completion","created":0,"model":"gpt-4o","choices":[{"index":0,"message":{"role":"assistant","content":"ok"},"finish_reason":"stop"}],"usage":{"prompt_tokens":1,"completion_tokens":1,"total_tokens":2}}"#;
+
+/// ONE served forward, as the plane's door runs it for a unit: the arrival read off the caller's
+/// head and body, the far-end request the attempt writes for the member, and the far end's whole
+/// answer relayed back to the caller. Answers the caller's status.
+fn one_forward(shaping: &busbar_plane_llm::exchange::shaping::Shaping, body: &[u8]) -> u16 {
+    use busbar_plane_llm::exchange::attempt::{build, stream_intent};
+    use busbar_plane_llm::exchange::reply::{At, Reply, ReplyCtx};
+    use busbar_plane_llm::exchange::{arrive::arrive, handler_of};
+    let caller: &[(&[u8], &[u8])] = &[(b"content-type", b"application/json")];
+    let arrived = arrive("POST", "/v1/chat/completions", caller, body, shaping)
+        .expect("the caller's request arrives");
+    let far = build(&arrived, caller, shaping, "p", "gpt-4o").expect("the attempt is written");
+    assert!(!far.body.is_empty(), "the far end is sent a body");
+    let lane = shaping.lane("gpt-4o").expect("the member's lane");
+    let ctx = ReplyCtx {
+        arrived: &arrived,
+        lane,
+        intent: handler_of(&arrived)
+            .map(|h| stream_intent(h, arrived.parsed.as_ref()))
+            .unwrap_or_default(),
+        passthrough: false,
+    };
+    let head: &[(&[u8], &[u8])] = &[(b"content-type", b"application/json")];
+    let mut reply = Reply::new(&ctx, 200, head);
+    let at = At {
+        now_s: 1_752_000_000,
+        elapsed_ms: Some(1),
+    };
+    let piece = reply.feed(&ctx, FAR_OK, true, at);
+    assert!(piece.done, "a whole answer ends on its last piece");
+    piece.head.map_or(0, |h| h.status)
+}
+
+/// COMMITTED BOUND (1.5.5's `FORWARD_PASSTHROUGH_MAX_ALLOCS`): the most allocations ONE warmed
+/// openai>openai passthrough forward may make, measured as the minimum over several iterations.
+const FORWARD_PASSTHROUGH_MAX_ALLOCS: u64 = 107;
+
+/// LEGACY `crates/busbar-llm/src/engine/tests/alloc_gate_tests.rs::alloc_gate_openai_passthrough_forward`
+/// (coverage map v2 row 39). 1.5.5: one warmed, steady-state openai->openai chat forward through the
+/// served path (the arrival, the far-end exchange and the relay of the answer, 200 each) allocates
+/// at most 107 times, the minimum over the measured iterations.
+///
+/// RED: a new per-request allocation on the served forward (a builder per send, a codec boxed per
+/// call, a scaling allocation) pushes the warmed minimum over 107.
+#[test]
+fn alloc_gate_openai_passthrough_forward() {
+    let shaping = served_generation();
+    let body = br#"{"model":"p","messages":[{"role":"user","content":"hi"}],"max_tokens":16}"#;
+    // WARM UP: first-touch statics are per process, not per request.
+    assert_eq!(one_forward(&shaping, body), 200, "passthrough must be 200");
+    let mut min_allocs = u64::MAX;
+    for _ in 0..4 {
+        let mut status = 0;
+        let count = allocations_of(|| status = one_forward(&shaping, body));
+        assert_eq!(status, 200, "passthrough must be 200");
+        min_allocs = min_allocs.min(count);
+    }
+    println!("served forward openai>openai steady-state min allocations = {min_allocs}");
+    assert!(
+        min_allocs <= FORWARD_PASSTHROUGH_MAX_ALLOCS,
+        "OPENAI>OPENAI FORWARD-PATH ALLOCATION COUNT REGRESSED: measured {min_allocs} > committed \
+         bound {FORWARD_PASSTHROUGH_MAX_ALLOCS}. A new per-request allocation on the forward path \
+         (or a scaling one) pushed it over."
+    );
+}
+
+/// How many `messages` entries the large body carries (1.5.5's `ECHO_SCALING_MESSAGES`).
+const ECHO_SCALING_MESSAGES: usize = 4_000;
+
+/// COMMITTED BOUND (1.5.5's `ECHO_BODY_SCALING_MAX_ALLOCS`): how many more allocations a request of
+/// [`ECHO_SCALING_MESSAGES`] messages may cost than the same request with one, on the buffered
+/// delivery arm (the caller asked to stream, the far end answered one body).
+const ECHO_BODY_SCALING_MAX_ALLOCS: u64 = 92_000;
+
+/// An openai chat request with `n` messages, asking to STREAM.
+fn openai_stream_body(n: usize) -> Vec<u8> {
+    let messages: Vec<serde_json::Value> = (0..n)
+        .map(|i| serde_json::json!({ "role": "user", "content": format!("message {i}") }))
+        .collect();
+    serde_json::to_vec(&serde_json::json!({
+        "model": "p",
+        "messages": messages,
+        "max_tokens": 16,
+        "stream": true,
+    }))
+    .expect("serializes")
+}
+
+/// LEGACY `crates/busbar-llm/src/engine/tests/alloc_gate_tests.rs::alloc_gate_request_echo_body_materialized_once`
+/// (coverage map v2 row 40). 1.5.5: on the buffered delivery arm (an openai caller asking to
+/// stream, answered one JSON body, 200 each), a body of 4000 messages costs at most 92000
+/// allocations more than the same body with one: the client-chosen node count multiplies no added
+/// per-node wave (the deep clone of the parsed request it once paid).
+///
+/// RED: the served forward gains a whole-body materialization (a second parse, a deep clone of the
+/// request) whose cost scales with the caller's message count past the 92000 delta.
+#[test]
+fn alloc_gate_request_echo_body_materialized_once() {
+    let shaping = served_generation();
+    let small_body = openai_stream_body(1);
+    let large_body = openai_stream_body(ECHO_SCALING_MESSAGES);
+    // WARM both shapes outside the measured window.
+    assert_eq!(one_forward(&shaping, &small_body), 200);
+    assert_eq!(one_forward(&shaping, &large_body), 200);
+    let mut status = (0, 0);
+    let small = allocations_of(|| status.0 = one_forward(&shaping, &small_body));
+    let large = allocations_of(|| status.1 = one_forward(&shaping, &large_body));
+    assert_eq!(status, (200, 200), "the arm under test must be 200");
+    let delta = large.saturating_sub(small);
+    println!(
+        "buffered delivery arm: small={small} large={large} delta={delta} over \
+         {ECHO_SCALING_MESSAGES} messages"
+    );
+    assert!(
+        delta <= ECHO_BODY_SCALING_MAX_ALLOCS,
+        "THE BUFFERED DELIVERY ARM GAINED A PER-NODE ALLOCATION WAVE: a body with \
+         {ECHO_SCALING_MESSAGES} messages cost {delta} allocations more than a one-message body, \
+         over the committed bound {ECHO_BODY_SCALING_MAX_ALLOCS}."
+    );
+}

crates/busbar-plane-llm/tests/exchange_probe.rs

@@ -62,3 +62,93 @@ fn a_lane_under_a_path_base_is_not_probed_and_a_fixed_path_is_kept() {
         "/fixed/chat"
     );
 }
+
+/// The value of the head field `name` on `r`.
+fn field_value<'a>(r: &'a busbar_plane_llm::exchange::attempt::FarRequest, name: &str) -> &'a [u8] {
+    r.fields
+        .iter()
+        .find(|(n, _)| n.eq_ignore_ascii_case(name))
+        .map(|(_, v)| v.as_slice())
+        .unwrap_or_else(|| panic!("the request carries `{name}`"))
+}
+
+/// LEGACY `crates/busbar-llm/src/engine/tests/health_tests.rs::test_probe_sends_native_user_agent_and_accept_headers`
+/// (coverage map v2 row 220). 1.5.5: an active probe of an anthropic lane sends the SAME native-SDK
+/// fingerprint organic traffic sends: `user-agent: Anthropic/Python 0.39.0` and the non-streaming
+/// `accept: application/json`, so a far end cannot tell busbar's probes from its clients.
+///
+/// RED: the probe's `user-agent` or `accept` value differs from the one an organic (UA-less,
+/// non-streaming) anthropic request carries, or either moves off the pinned literal.
+#[test]
+fn test_probe_sends_native_user_agent_and_accept_headers() {
+    use busbar_plane_llm::exchange::arrive::arrive;
+    use busbar_plane_llm::exchange::attempt::build;
+    let s = Shaping::from_settings(&json!({
+        "providers": { "ant": { "protocol": "anthropic", "base_url": "https://b" } },
+        "models": { "claude": { "provider": "ant" } },
+        "pools": { "p": { "members": ["claude"] } }
+    }))
+    .expect("reads");
+    let lane = s.lane("claude").expect("lane");
+    let probe = request(lane).expect("probed");
+
+    // Organic traffic on the same lane: a native caller that sent no user-agent, not streaming.
+    let head: Vec<(&[u8], &[u8])> =
+        vec![(b"content-type".as_slice(), b"application/json".as_slice())];
+    let body = br#"{"model":"claude","max_tokens":5,"messages":[{"role":"user","content":"hi"}]}"#;
+    let arrived = arrive("POST", "/v1/messages", &head, body, &()).expect("arrives");
+    let organic = build(&arrived, &head, &s, "p", "claude").expect("built");
+
+    assert_eq!(
+        field_value(&probe, "user-agent"),
+        field_value(&organic, "user-agent"),
+        "probe must send the native User-Agent organic traffic sends"
+    );
+    assert_eq!(
+        field_value(&probe, "user-agent"),
+        b"Anthropic/Python 0.39.0"
+    );
+    assert_eq!(
+        field_value(&probe, "accept"),
+        field_value(&organic, "accept"),
+        "probe must send the native Accept organic traffic sends"
+    );
+    assert_eq!(field_value(&probe, "accept"), b"application/json");
+}
+
+/// LEGACY `crates/busbar-llm/src/engine/tests/health_tests.rs::test_probe_signs_and_sends_same_encoded_path_for_reserved_chars`
+/// (coverage map v2 row 230). 1.5.5: a probe of a bedrock model id carrying a reserved `:` sends
+/// the `%3A`-encoded path, never the raw `:0/converse`, and the signature's canonical path is
+/// computed from that SAME wire path, so the signed and sent paths cannot diverge
+/// (`SignatureDoesNotMatch` would park every such lane dead).
+///
+/// RED: the raw colon reaches the wire, the probe sends a path other than the one the signature
+/// is computed from, or the canonical path stops being the wire path's own encoding.
+#[test]
+fn test_probe_signs_and_sends_same_encoded_path_for_reserved_chars() {
+    use busbar_plane_llm::exchange::attempt::{uri_encode_path, wire_and_canonical_path};
+    let s = shaping();
+    let lane = s.lane("bed").expect("lane");
+    let probe = request(lane).expect("probed");
+    let (wire_path, canonical) = wire_and_canonical_path(&probe_path(lane));
+    assert!(
+        probe.target.contains("%3A"),
+        "Bedrock modelId ':' must be percent-encoded on the wire path: {}",
+        probe.target
+    );
+    assert!(
+        !probe.target.contains(":0/converse"),
+        "the raw ':' must NOT survive on the wire path (would diverge from the signed URI): {}",
+        probe.target
+    );
+    assert_eq!(
+        probe.target, wire_path,
+        "the probe sends exactly the wire path the signature is computed from"
+    );
+    assert_eq!(
+        canonical,
+        uri_encode_path(&wire_path),
+        "the signed canonical path is the transmitted wire path's own encoding (signed == sent)"
+    );
+    assert_eq!(probe.target, "/model/anthropic.claude-3%3A0/converse");
+}

crates/busbar-plane-llm/tests/exchange_shaping.rs

@@ -112,3 +112,54 @@ fn the_glob_takes_prefix_suffix_and_middle_wildcards() {
     assert!(!glob_match("a*c*e", "abde"));
     assert!(glob_match("exact", "exact") && !glob_match("exact", "exactly"));
 }
+
+/// LEGACY `crates/busbar-llm/src/engine/tests/attempt_timeout_precedence_tests.rs::effective_reasoning_member_override_wins`
+/// (coverage map v2 row 43). 1.5.5: the pool member's `reasoning` override wins over the model's
+/// flag in both directions (true over false AND false over true); a member with no override
+/// inherits the model's flag, true or false; a pool or member with no candidate row uses the
+/// model's flag.
+///
+/// RED: a member's `reasoning: false` stops beating a model's `reasoning: true` (the arm the
+/// neighbouring test never drives), or a route with no member row stops reading the model's flag.
+#[test]
+fn effective_reasoning_member_override_wins() {
+    let mut v = settings();
+    // `claude` states `reasoning: true` at the model level; `quiet` turns it off in its pool only.
+    v["pools"]["quiet"] = json!({ "members": [ { "model": "claude", "reasoning": false } ] });
+    let s = Shaping::from_settings(&v).expect("reads");
+    assert_eq!(
+        s.reasoning("main", "gpt"),
+        Some(true),
+        "member true beats model false"
+    );
+    assert_eq!(
+        s.reasoning("quiet", "claude"),
+        Some(false),
+        "member false beats model true"
+    );
+    assert_eq!(
+        s.reasoning("main", "claude"),
+        Some(true),
+        "no member override inherits model true"
+    );
+    assert_eq!(
+        s.reasoning("alt", "gpt"),
+        Some(false),
+        "no member override inherits model false"
+    );
+    assert_eq!(
+        s.reasoning("alt", "claude"),
+        Some(true),
+        "a pool with no row for the member uses the model flag"
+    );
+    assert_eq!(
+        s.reasoning("no-such-pool", "gpt"),
+        Some(false),
+        "no candidate row uses the model flag"
+    );
+    assert_eq!(
+        s.reasoning("no-such-pool", "claude"),
+        Some(true),
+        "no candidate row uses the model flag"
+    );
+}

crates/busbar-plane-llm/tests/exchange_user_agent.rs

@@ -105,3 +105,107 @@ fn a_translated_far_end_sees_the_far_dialect_s_fingerprint_never_the_caller_s()
         }
     }
 }
+
+/// One member per far dialect, so every dialect's fingerprint is read off a request the plane builds.
+fn every_dialect() -> Shaping {
+    Shaping::from_settings(&json!({
+        "providers": {
+            "oai": { "protocol": "openai", "base_url": "https://api.example" },
+            "ant": { "protocol": "anthropic", "base_url": "https://anthropic.example" },
+            "goo": { "protocol": "gemini", "base_url": "https://gemini.example" },
+            "bed": { "protocol": "bedrock", "base_url": "https://bedrock.example" },
+            "res": { "protocol": "responses", "base_url": "https://responses.example" },
+            "coh": { "protocol": "cohere", "base_url": "https://cohere.example" }
+        },
+        "models": {
+            "gpt": { "provider": "oai" },
+            "claude": { "provider": "ant" },
+            "gem": { "provider": "goo", "upstream_model": "gemini-pro" },
+            "bedrock-claude": { "provider": "bed", "upstream_model": "anthropic.claude-3" },
+            "resp": { "provider": "res" },
+            "command": { "provider": "coh" }
+        },
+        "pools": { "p": { "members": ["gpt", "claude", "gem", "bedrock-claude", "resp", "command"] } }
+    }))
+    .expect("reads")
+}
+
+/// LEGACY `crates/busbar-llm/src/engine/tests/ingress_indistinguishability_tests.rs::test_egress_ua_versions_are_pinned_and_present`
+/// (coverage map v2 row 325). 1.5.5: every egress request carries the pinned native-SDK
+/// `user-agent` of its far dialect, as a golden literal: anthropic `Anthropic/Python 0.39.0`,
+/// openai and responses `OpenAI/Python 1.54.0`, gemini `google-genai-sdk/0.8.0 gl-python/3.11`,
+/// bedrock `Boto3/1.35.0 md/Botocore#1.35.0`, cohere `cohere-python/5.11.0`, and a far end no
+/// declaration names `okhttp/4.12.0`. None is ever empty or versionless, and the two Stainless
+/// Python SDKs share the `<Title>/Python <ver>` grammar.
+///
+/// RED: any far dialect's request goes out with another (or no) `user-agent`, the foreign default
+/// moves, or a pinned version string is edited without touching this table.
+#[test]
+fn every_dialects_egress_user_agent_version_is_pinned_and_present() {
+    let s = every_dialect();
+    let pinned = [
+        ("claude", "Anthropic/Python 0.39.0"),
+        ("gpt", "OpenAI/Python 1.54.0"),
+        ("resp", "OpenAI/Python 1.54.0"),
+        ("gem", "google-genai-sdk/0.8.0 gl-python/3.11"),
+        ("bedrock-claude", "Boto3/1.35.0 md/Botocore#1.35.0"),
+        ("command", "cohere-python/5.11.0"),
+    ];
+    // An anthropic caller that sent no user-agent: every far end below sees its own fingerprint,
+    // the same-dialect one included (1.5.5 sent the native fingerprint to a UA-less caller's far end).
+    let head: Vec<(&[u8], &[u8])> =
+        vec![(b"content-type".as_slice(), b"application/json".as_slice())];
+    let arrived = arrive("POST", "/v1/messages", &head, MESSAGES.as_bytes(), &()).expect("arrives");
+    for (member, want) in pinned {
+        let r = build(&arrived, &head, &s, "p", member).expect("built");
+        assert_eq!(
+            user_agent(&r),
+            [want.as_bytes()],
+            "{member} egress UA drifted from the pinned native-SDK string"
+        );
+    }
+    // The foreign far end (a dialect no declaration names) still gets a present, plausible UA.
+    assert_eq!(
+        busbar_contract::protocol::EGRESS_UA_DEFAULT,
+        "okhttp/4.12.0",
+        "the foreign/default egress UA drifted from the pinned literal"
+    );
+    // Every declaration states its pinned literal, so no far dialect can fall to the default.
+    for d in busbar_plane_llm::codec::DECLS {
+        let want = match d.name {
+            "anthropic" => "Anthropic/Python 0.39.0",
+            "openai" | "responses" => "OpenAI/Python 1.54.0",
+            "gemini" => "google-genai-sdk/0.8.0 gl-python/3.11",
+            "bedrock" => "Boto3/1.35.0 md/Botocore#1.35.0",
+            "cohere" => "cohere-python/5.11.0",
+            other => panic!("a dialect this table does not pin: {other}"),
+        };
+        assert_eq!(d.egress_user_agent, want, "{}", d.name);
+    }
+    let every: Vec<&str> = pinned
+        .iter()
+        .map(|(_, ua)| *ua)
+        .chain([busbar_contract::protocol::EGRESS_UA_DEFAULT])
+        .collect();
+    for ua in every {
+        assert!(!ua.is_empty(), "an egress UA must never be empty");
+        assert!(
+            ua.chars().any(|ch| ch.is_ascii_digit()),
+            "an egress UA must carry a version number: {ua}"
+        );
+    }
+    for ua in ["Anthropic/Python 0.39.0", "OpenAI/Python 1.54.0"] {
+        let (title, rest) = ua.split_once('/').expect("Python-SDK UA contains a '/'");
+        assert!(
+            title
+                .chars()
+                .next()
+                .is_some_and(|ch| ch.is_ascii_uppercase()),
+            "Stainless Python SDK UA must start with a capitalized Title: {ua}"
+        );
+        assert!(
+            rest.starts_with("Python "),
+            "Stainless Python SDK UA must be `<Title>/Python <ver>`: {ua}"
+        );
+    }
+}