[MattJackson]

Row 163 lane. Not $: no money code; the 1.5.5 golden and oracle-rust.pin are untouched.

What: on Linux, bin/oracle's judge is the binary busbar-release published, and no other.

• Which pin: release_ref and sha256_linux_<uname -m> are read from the BASE pin, $MODERNCI_TO_SHA:testing/shadow-oracle/oracle-rust.pin, when ModernCI names a base that holds one. Otherwise they come from the checked-out tree: that's the first predev→dev move, since dev holds no pin (row 163: the predev→dev move is judged absolute and from predev's own oracle pin (dev holds no xtask, ledgers, pin or golden) #909).
• Download: busbar-oracle-linux-<arch>-<release_ref>, plus its .sha256 and .sig when present, from busbar-release's dev-bin release over the GitHub API. The token (BUSBAR_RELEASE_TOKEN, else GH_TOKEN, else GITHUB_TOKEN) reaches curl on stdin as a -K - config line. It never appears on an argv and is never written to disk, the same discipline as git_with_token.
• Checks, before the bytes are ever made executable:
  • It refuses unless the binary's sha256 equals the pin's line.
  • It refuses a .sha256 that disagrees with the pin.
  • A present .sig must verify against busbar-release's release key: Ed25519 over "<asset name>\n<sha256>\n", RELEASE_KEY_SPKI in busbar-release-cli update.rs, checked with openssl pkeyutl -rawin.
• Cache: ${XDG_CACHE_HOME:-~/.cache}/busbar-oracle-judge/<sha256>/busbar-oracle, re-hashed on every use, so a cache cannot substitute a judge.
• No line, no judge: a pin with no sha256_linux_<arch> line fails with "no judge". It never falls back to another architecture or to a source build.
• Unchanged: BUSBAR_ORACLE_RUST_BIN keeps precedence 1, and verify-1.6.0-done.sh still refuses a DONE run with it set. Non-Linux (laptops) keeps the source build.
• scripts/verify-1.6.0-done.sh: the judge step's label and its refusal text describe the fetch. assert_bless_env_empty does not list BUSBAR_RELEASE_TOKEN, and shouldn't: it's a credential, not a repoint. The judge is fixed by the pin's sha256, and the cache dir isn't a repoint either because every use is re-hashed.

Why: OWNER 2026-10-13 (to ModernCI): no hand-installed tools for tenants. ModernCI removed BUSBAR_ORACLE_RUST_BIN and its installed engines, so .ci/predev.yaml's oracle and verify-done checks must obtain the judge themselves. #909 is updated to rely on this.

RED-able test: crates/busbar/tests/oracle_one_pin.rs::the_fetched_judge_is_the_pinned_digests_or_none runs bin/oracle fetch-selftest, offline (a fixture release dir and a throwaway Ed25519 key). It checks that:

• the pinned digest's judge is fetched, cached and run, and the cache is reused with no source;
• a wrong sha refuses;
• a missing pin line says "no judge";
• a disagreeing .sha256 refuses;
• a good .sig is accepted, and another key's .sig refuses;
• the base's pin wins over the tree's.

Checked once against the live release: the API path fetched the pinned judge 7ab21912… (aarch64, sha aa1ee227…, which has no .sig). Main's 7e606a7a… asset verified against the real release key. No laptop cargo was run.

Ledger rows: none.