Repository navigation
kernel D2 K4: the store-backed stream registry leaves plane_host/journal.rs for audit/stream_registry.rs - #982
Merged
Merged
Conversation
…nal.rs for audit/stream_registry.rs R-A (neutral host code stays in the kernel under a home named by its function, law0/c1 0 there): the durable stream registry (record, input, registry, handle, resume-break report) moves out of the HOT plane-host journal family into audit/stream_registry.rs. A stream registers with its decode: Decode::Native for core's own streams, Decode::Seam for a stream registered across the host seam (its JournalReframeFn, opaque to the registry). The admin audit log and the usage residual log now register, append, seed and restore through the registry directly, with no HostCtx, dispatch scope or FFI shim, so plane_host/journal.rs keeps only the vtable slots and dies with the HOT vtable. Deleted with the in-core FFI round trip: reframe_audit_ffi (auditlog's extern "C-unwind"; its one-memory-abi row is struck), reframe_bridge, NativeReframe/reframe_slot, seed_scoped_via_seam, compact_via_seam, journal_append_scoped_full(_hostless) and both pack_bodies. journal_register_capped is test-only. Byte behaviour is unchanged: the native decode re-scopes with the store parent under the stream framing exactly as the bridge did, and a decode fault reads "journal reframe failed: Fault" as before (audit/tests/stream_registry_tests.rs). law0 busbar-kernel x plane 1122 -> 1111: the registry functions no longer spell the streaming alias (5) and the deleted twins' docs and the capped-register doc no longer name a plane's call log (6).
…t an unwind (RED) The stream registry calls its sink without a catch_unwind of its own. Every production RecordStore is the loader's LoadedStore (the only non-test impl), whose calls cross the plugin dispatcher into the store's door; the door trampoline runs the slot body under the SDK's mandatory catch_unwind (busbar-contract/src/abi/sdk/door.rs:411) and answers a panic as Outcome::Fault (:449-455), which LoadedStore::plain reads back as a RecordStoreError (plugin-loader/src/store_v3.rs:1507, :478). The RED opens the kernel's store double THROUGH its door on the test store axis with a panic planted in its append_plane_record slot (a test-only settings knob), registers the admin audit stream over it, and proves the append returns an error and the record stays queued in the recovery queue, exactly as emit_admin_hostless queues a failed write. If the boundary let the panic through, the test would unwind.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Kernel-delete lane, D2 under ruling R-A: neutral host code moves to a kernel home named by its function, and its law0/c1 count there must be 0.
What moves
The durable stream registry moves out of the HOT plane-host journal family (
plane_host/journal.rs) intoaudit/stream_registry.rs. That covers the record and input types (renamedStreamRecord/StreamInput), thekind_idregistry, the handle and the resume-break report.A stream registers with its decode:
Decode::Nativefor core's own streams.Decode::Seamfor a stream registered across the host seam. ItsJournalReframeFnis opaque to the registry.What changes for callers
The admin audit log (
audit/auditlog.rs) and the usage residual log (residual_log.rs) now register, append, seed and restore through the registry directly. They use noHostCtx, no dispatch scope and no FFI shim.plane_host/journal.rskeeps only the vtable slots, which read the ABI buffers and drive the same registry. It is deleted with the HOT vtable (#787, #503 and row 155 C).What is deleted
These existed only for the in-core FFI round trip:
reframe_audit_ffi, the admin audit log'sextern "C-unwind". Itsqa/one-memory-abi.tomlrow is struck.reframe_bridge,NativeReframe/reframe_slot,seed_scoped_via_seamandcompact_via_seam.journal_append_scoped_full/_hostlessand bothpack_bodies.journal_register_cappedis now test-only.Behaviour
Bytes are unchanged:
journal reframe failed: Fault.app.governance's store.MAX_TRACKED_PRINCIPALS.Proof:
audit/tests/stream_registry_tests.rscovers a hostless append, then restart, seed and continue at seq 3; break, fault and refusal cases; and re-scope plus fault text. The existing auditlog and residual suites now run over the native path.Ledgers
busbar-kernel × planegoes from 1122 to 1111. The registry functions no longer spell the streaming alias (5 hits). The deleted twins' docs and the capped-register doc no longer name a plane's call log (6 hits).This PR touches
residual_log.rs, which is money evidence. It is opened as a draft, so the coordinator sequences it.