Repository navigation
#65: the kernel seal reaches the kernel and nothing else; acquire_for_kernel is test-only - #941
Merged
Merged
Conversation
…_kernel is test-only KernelSeal::acquire_for_kernel() was a #[doc(hidden)] pub fn any crate naming busbar-contract could call (caps/token.rs:106-109; SPEC #65 l.2260: "no public/forgeable KernelSeal constructor"). ARCHITECT ruling 2026-10-14 (mechanism approved): - contract: KernelSeal::deliver() (#[inline]) builds a seal and hands it to the extern "Rust" symbol __busbar_kernel_root, which the contract declares and only busbar-kernel defines. - kernel (new src/seal.rs): the #[no_mangle] definition wraps the seal in Held, a type private to the module, and returns it as Box<dyn Any> (zero-sized, no allocation); seal::acquire() (#[inline(never)], beside the definition so the definition is always linked) downcasts it back. A caller outside the kernel gets a box it cannot open; a second definer is a duplicate symbol. - acquire_for_kernel survives only under cfg(test) / the dev-only test-seal feature; the kernel's production sites (teller.rs Kernel::new, host_services.rs idempotency key) and test_support take seal::acquire(); the kernel's own tests reach the test seal through a dev edge. - gates: one-memory-abi excuses __busbar_kernel_root at exactly crates/busbar-kernel/src/seal.rs (planted elsewhere = RED, selftest added); structure-lint's no_mangle ban lists seal.rs. RED: tests/members/seal_tests.rs builds the mechanism with rustc and proves the honest program links and opens its seal while a program defining the root symbol fails to link as a duplicate symbol; the release-path test proves deliver() hands a non-kernel caller no seal. The contract doc carries a compile_fail fixture for acquire_for_kernel outside test-seal.
This was referenced Oct 14, 2026
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…ys forbid(unsafe_code) #941 (#65) put an allow(unsafe_code) on KernelSeal::deliver inside caps, whose #![forbid(unsafe_code)] no inner allow can lift (E0453). The contract's unsafe policy (lib.rs; ARCHITECT ratification, BUSBAR-1.6.0.md l.4073: deny crate-wide, exactly one allow, on pub mod abi; feature_invariance pins no unsafe token outside src/abi/) puts the call in abi: abi declares __busbar_kernel_root and holds the one unsafe call in an #[inline] pub(crate) kernel_root; deliver builds the seal and hands it there. The mechanism is unchanged: deliver stays #[inline], the kernel alone defines the symbol.
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
… crate #941's fixture spelled KernelSeal::acquire_for_kernel( in a doc string literal in caps/token.rs; token-sealed:kernel-seal (max 0 outside the kernel) and seal-witness:single-minter read string literals, so the proof that the minter does not compile counted as a mint. Its text moves to caps/fixtures/no_release_seal.md, read by doc = include_str!, as the lint rule data already lives in fixtures/lint_rules.txt.
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…clippy Two kernel production sites written before #941 landed beside them (plane_driver approve's into_result, far_end's own Route pass) called KernelSeal::acquire_for_kernel, which #941 made test-only: the no-default-features kernel build has no such fn (E0599). They take crate::seal::acquire(), the kernel's one production seal, as teller.rs and host_services.rs do. Contract clippy: Sighting derives Default on Never (derivable_impls); provider_keys hands members' &Value without a re-borrow (needless_borrow).
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…e pinned decisions plane on a busbar rev that holds its contract - busbar-plane-decisions re-pinned 0ac65e1 -> 8b214c02cc: the plugin repo now pins busbar fca71d1 (this branch), whose contract carries the PlaneTail::metric_lanes, RefusalReason::CredentialUnavailable and HostCtx::NONE its ported edits use; its own workspace failed to build at 5c99bef (test check's dropped-in step). One busbar-contract in Cargo.lock (the [patch] path). - kind-isolation:law0: five rows settled to the union's measure, each at or under the merge-base's own row: busbar x instance:secret 13 -> 16, busbar x plane 583 -> 620, busbar-contract x instance:secret 43 -> 45, busbar-kernel x plane 1071 -> 1068, busbar-kernel x transport 203 -> 220. - kind-isolation:law0-base busbar x vendor (143 -> 144): #988's cap.perf.streams-2000 named its upstream's dialect in a root test literal; the provider row is test data (fixtures/streaming_mock_provider.yaml), as fixtures/mock_provider.yaml already is. - kind-isolation:test-deps: the busbar-kernel -> busbar-contract test edge #941 (#65) added (the dev-only test-seal) gets its [[dep]] row, count 1. - kind-isolation:test-deps plane -> plugin-tooling: #981 named the loader from a second busbar-plane-llm test file; its two loader cells move into tests/conformance.rs, the one file the conformance-witness grant covers. - structure-lint:plane-dup: armed at the measured 46 (Law 9; #787's 42 less six drains, plus ten names #503 and #787 each saw only once both homes moved), the stale Outbound and Route rows struck. - plane-secret-blindness: the a2a push.rs exposes-secret-bytes row is struck (drained). - script-allowlist: #972's scripts/store-migration-fixture.sh gets its entry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CONTRACT-ABI lane, item 3 (#65, SPEC l.2260; TODO caps/token.rs:106-109). ARCHITECT ruling 2026-10-14 approved this mechanism.
Before:
KernelSeal::acquire_for_kernel()was a#[doc(hidden)] pub fn— any crate naming busbar-contract (every linked plugin) could mint everyPass/Grant; only a CI text scan stood in the way.After:
KernelSeal::deliver()(#[inline], so only a caller's image references the symbol) hands a fresh seal toextern "Rust" __busbar_kernel_root, declared by the contract, defined only by busbar-kernel.src/seal.rs: the#[no_mangle]definition wraps the seal in a module-privateHeldand returnsBox<dyn Any>(ZST, no alloc);seal::acquire()(#[inline(never)], same object as the definition, so the definition is always linked) downcasts it back. Non-kernel callers get a box they cannot open; a second definer is a duplicate-symbol link error.acquire_for_kernelexists only undercfg(test)/ dev-onlytest-seal; kernel production sites (teller.rsKernel::new, host_services.rs idempotency key) andtest_support::tokens::sealuseseal::acquire(). Kernel gains a dev edgebusbar-contract features=["test-seal"]so its tests mint as before (test_seal_is_dev_onlykeeps the feature off non-dev edges).#[allow(unsafe_code)]items (contractdeliver, kernel definition), each with a SAFETY note.__busbar_kernel_rootat exactlycrates/busbar-kernel/src/seal.rs(planted anywhere else = RED, new selftest); structure-lint'sno_mangleban lists seal.rs.RED:
busbar-kernel/src/tests/members/seal_tests.rs— (1) builds the mechanism with rustc: the honest program links and opens its seal, a program defining the root symbol to catch the seal fails to link as a duplicate symbol; (2)deliver()hands a non-kernel caller no seal. Contract doc:compile_failfixture onacquire_for_kernelwithout test-seal (rendered only when the feature is off).Shared files (disjoint hunks, ruling 20): kernel Cargo.toml (#901 #897 #893 #571 #503), host_services.rs (#864), structure_lint/choke_points.rs (#904).
No customer-visible behaviour; no third-party dependency change.