From 0653060e5da746c463a69a7e182d5f27b3c7d44a Mon Sep 17 00:00:00 2001 From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com> Date: Tue, 13 Oct 2026 23:21:50 -0700 Subject: [PATCH 1/2] Law 0 root (PR1): the root's prod source names no plane, transport or auth instance The composition root's shipped source stops naming instances (BUSBAR-1.6.0.md l.104-120, l.172-182); every customer-visible byte stays v1.5.5's. - The line carrier is the linked transport claim whose row opens its unit 0 on its first line (TransportFacts.lines, LinkedTransport.lines, root::serve::lines::line_carrier); two such claims refuse the boot. The session credential variable and the serve's sentences are spelled from the plane's and the carrier's keys (BUSBAR___CREDENTIAL, as 1.5.5 printed them). - The request wire the root listeners log and the admin/gauntlet arrival chains carry is the admin plane's declared claim transport (root::listener::REQUEST_WIRE). - The operator credential's provider word is the manifest's operator row's linked-name ([package.metadata.busbar.operator-auth]); the row that states FACT_OPERATOR is checked against it. - The `--list-plugins` header is v1.5.5's line as one constant (root::cli::LIST_PLUGINS_HEADER), proven to head the row format's columns. - Test cfgs ride the linked auth axis; collision-only identifiers renamed; plane-naming prose reworded. - kind-isolation: an export entry's frozen 1.5.x `streams: [` key is the export projection, not the plane (EXPORT_STREAMS_KEY, selftest pair); law0 rows lowered to the measure. --- crates/busbar-core-admin/src/lib.rs | 2 +- crates/busbar/Cargo.toml | 8 ++ crates/busbar/src/linked_gen.rs | 18 ++- crates/busbar/src/main.rs | 61 +++++----- crates/busbar/src/root/auth_bindings.rs | 27 ++--- crates/busbar/src/root/boot.rs | 2 +- crates/busbar/src/root/cli.rs | 17 +-- crates/busbar/src/root/dispatch.rs | 10 +- crates/busbar/src/root/door_steps.rs | 18 +-- crates/busbar/src/root/doors.rs | 14 +++ crates/busbar/src/root/gauntlet_kernel.rs | 19 +-- crates/busbar/src/root/harness.rs | 4 +- crates/busbar/src/root/kernel.rs | 8 +- crates/busbar/src/root/linked.rs | 12 +- crates/busbar/src/root/listener.rs | 29 +++-- crates/busbar/src/root/registry.rs | 4 +- crates/busbar/src/root/serve.rs | 10 +- crates/busbar/src/root/serve_lines.rs | 108 ++++++++++++++---- crates/busbar/src/root/tests/auth_bindings.rs | 44 ++++++- crates/busbar/src/root/tests/cli.rs | 15 +++ crates/busbar/src/root/tests/registry.rs | 1 + crates/busbar/src/root/tests/secret_source.rs | 7 +- crates/busbar/src/root/tests/serve_framed.rs | 2 +- crates/busbar/src/root/tests/serve_lines.rs | 73 ++++++++++++ crates/busbar/src/root/transports.rs | 2 +- crates/busbar/src/root/units_admin/bound.rs | 6 +- crates/busbar/src/root/units_admin/mod.rs | 11 +- .../src/root/units_admin/tests/units_admin.rs | 8 ++ crates/busbar/tests/admin_cross_plane/main.rs | 2 +- ...composition_root_names_no_linked_plugin.rs | 6 +- .../plugin-loader/src/dispatch/kinds/auth.rs | 12 ++ .../src/dispatch/kinds/transport.rs | 11 ++ qa/kind-isolation.toml | 32 +++--- xtask/src/gates/kind_isolation/matrix.rs | 84 ++++++++++++++ 34 files changed, 525 insertions(+), 162 deletions(-) create mode 100644 crates/busbar/src/root/tests/serve_lines.rs diff --git a/crates/busbar-core-admin/src/lib.rs b/crates/busbar-core-admin/src/lib.rs index 3e0815c383..100bc6eb47 100644 --- a/crates/busbar-core-admin/src/lib.rs +++ b/crates/busbar-core-admin/src/lib.rs @@ -144,7 +144,7 @@ mod test_seams { // The operator credential's test registry row, before anything resolves the auth axis. // This binary links the operator plugin the composition root links and pins the root's // bytes, so it hands in the root's words as the root does (crates/busbar's legacy - // table, `root::auth_bindings::OPERATOR_AUTH_MODULE`; ARCHITECT 2026-09-30, + // table, `root::auth_bindings::operator_auth_module`; ARCHITECT 2026-09-30, // KERNEL-AUTH-ZERO Q2). for_each_operator_auth_row!(install_operator_row); fn install_operator_row(door: busbar_kernel::test_support::AuthDoor) { diff --git a/crates/busbar/Cargo.toml b/crates/busbar/Cargo.toml index dcddd8b2d3..6ceea946ce 100644 --- a/crates/busbar/Cargo.toml +++ b/crates/busbar/Cargo.toml @@ -490,6 +490,14 @@ auth-oauth = "busbar-auth-oauth" [package.metadata.busbar.linked-canonical] auth-admin-tokens = "busbar-auth-admin-tokens" +# THE OPERATOR CREDENTIAL'S ROW: the `auths` row whose registry key (its `linked-name`) is the +# operator credential's provider word — the `auth.admin_auth:` default, the one `module:` whose +# definition may carry `token:`, a reserved hook name, and the word in 1.5.5's refusals when the row +# is not linked. Frozen 1.5.5 configuration text, stated here in packaging so the root's source names +# no auth module (`root::auth_bindings::operator_words`; BUSBAR-1.6.0.md l.108-113). +[package.metadata.busbar.operator-auth] +row = "auth-admin-tokens" + # The root's own unit modules (the kernel-loop halves of planes that still live in the root), each # compiled when its row's cargo feature is on (the node, keyed `node`, in every build) and exporting # a `ROOT_UNIT` (`root::linked::RootUnit`). Order is diff --git a/crates/busbar/src/linked_gen.rs b/crates/busbar/src/linked_gen.rs index 2103c800f6..6bd3a17fbb 100644 --- a/crates/busbar/src/linked_gen.rs +++ b/crates/busbar/src/linked_gen.rs @@ -408,7 +408,7 @@ pub(crate) fn linked_source( .filter(|(_, a)| a.iter().any(|x| x == TRANSPORT_AXIS)) .enumerate() { - let (build, claims, upgrades) = if axes.iter().any(|x| x == DOOR_AXIS) { + let (build, claims, upgrades, lines) = if axes.iter().any(|x| x == DOOR_AXIS) { door_builds.push_str(&format!( "fn __door_build_{n}(\n lower: Option>,\n \ settings: &busbar_contract::transport::TransportSettings,\n\ @@ -417,12 +417,15 @@ pub(crate) fn linked_source( fn __door_claims_{n}() -> Vec<&'static str> {{\n \ crate::root::doors::claims_of({e}::door)\n}}\n\ fn __door_upgrades_{n}() -> Vec<&'static str> {{\n \ - crate::root::doors::upgrades_of({e}::door)\n}}\n" + crate::root::doors::upgrades_of({e}::door)\n}}\n\ + fn __door_lines_{n}() -> Vec<&'static str> {{\n \ + crate::root::doors::lines_of({e}::door)\n}}\n" )); ( format!("__door_build_{n}"), format!("__door_claims_{n}"), format!("__door_upgrades_{n}"), + format!("__door_lines_{n}"), ) } else { door_builds.push_str(&format!( @@ -433,11 +436,14 @@ pub(crate) fn linked_source( format!("{e}::build"), format!("__row_claims_{n}"), format!("__row_upgrades_{n}"), + // A row with no door states no claim rows: it carries no lines, as no upgrades. + format!("__row_upgrades_{n}"), ) }; out.push_str(&format!( "crate::root::linked::LinkedTransport {{ key: {e}::KEY, composes_over: \ - {e}::COMPOSES_OVER, build: {build}, claims: {claims}, upgrades: {upgrades} }}, " + {e}::COMPOSES_OVER, build: {build}, claims: {claims}, upgrades: {upgrades}, \ + lines: {lines} }}, " )); } out.push_str("],\n"); @@ -458,6 +464,12 @@ pub(crate) fn linked_source( } } out.push_str("],\n"); + // The operator credential's provider word: the `linked-name` of the row the manifest's + // `operator-auth` table names, whether or not this build links it (its 1.5.5 refusals spell it). + let operator = metadata_value(manifest, "package.metadata.busbar.operator-auth", "row") + .and_then(|row| metadata_value(manifest, "package.metadata.busbar.linked-name", &row)) + .unwrap_or_default(); + out.push_str(&format!(" operator_auth: {operator:?},\n")); out.push_str(" export_doors: &["); for ((entry, list), (_, krate)) in linked.iter().zip(&on) { if list.iter().any(|a| a == EXPORT_DOOR_AXIS) { diff --git a/crates/busbar/src/main.rs b/crates/busbar/src/main.rs index 0385d60dac..285a7e8db9 100644 --- a/crates/busbar/src/main.rs +++ b/crates/busbar/src/main.rs @@ -110,11 +110,11 @@ fn safe_mode_requested(mut args: impl Iterator) -> bool { /// its spelling, and the root reads it off the plane's declared rows. A scanner like /// `safe_mode_requested` rather than a `handle_cli_flags` exit arm, because it modifies how `run()` /// serves rather than replacing the run. -fn stdio_serve_requested(args: impl Iterator) -> bool { +fn line_flag_passed(args: impl Iterator) -> bool { line_serve_requested(&root::cli::help_rows(), args) } -/// [`stdio_serve_requested`] over the `Flags:` rows `planes` declare. +/// [`line_flag_passed`] over the `Flags:` rows `planes` declare. fn line_serve_requested( planes: &[&[root::linked::CliHelpRow]], mut args: impl Iterator, @@ -370,8 +370,8 @@ fn main() { register_planes(); // HOST-SELECTION SEAM INSTALL (loop unification, DECISIONS #28), after the planes are registered // and mirroring `busbar_admin::install()`: inject the kernel-loop runners into the neutral - // per-capability-keyed seam. LIVE — it flips every plane in the build (mcp, a2a, llm-native, - // voice) onto the unified kernel loop, whose runner opens a zero hold and reports no evidence, so + // per-capability-keyed seam. LIVE — it flips every plane in the build onto the unified kernel + // loop, whose runner opens a zero hold and reports no evidence, so // each plane's own metering inside `drive` stays what settles (item 125, measured money-neutral). root::gauntlet_install::install(); // DIAGNOSTICS REGISTRATION, same slot and the same reason: a rendered catalog or a `by_code` @@ -600,8 +600,8 @@ async fn run(data_workers: usize, late_services: std::sync::Arc`) so // detached work spawned at any moment — including after the signal — can still observe // that shutdown has fired. Each data worker registers a clone - // (`busbar_kernel::detached::set_worker_shutdown`) beside its detached tracker, and an MCP task - // runner selects on it to write its CANCELLED terminal status within the drain grace + // (`busbar_kernel::detached::set_worker_shutdown`) beside its detached tracker, and a plane's + // task runner selects on it to write its CANCELLED terminal status within the drain grace // instead of being aborted with a caller left polling forever. let (worker_shutdown_tx, worker_shutdown_rx) = tokio::sync::watch::channel(false); { @@ -1516,7 +1519,7 @@ const ROOT_BIND_LIMITS: AcceptLimits = AcceptLimits { handshake_timeout: DEFAULT_HANDSHAKE_TIMEOUT, }; -/// Bind a TCP listener or `die` with a clear, address-named message. Shared by the data and admin +/// Bind a listener or `die` with a clear, address-named message. Shared by the data and admin /// listeners so both fail fast and identically on a bad bind. #[cfg(not(unix))] async fn bind_listener(addr: &str) -> tokio::net::TcpListener { @@ -1617,13 +1620,13 @@ fn serve_thread_per_core( // stripes per worker (the egress client shard today; SWRR/breaker scratch in later // stages) indexes by this id. Set after the pin, before the runtime serves. busbar_kernel::topology::set_worker_id(i); - // Detached-work tracker (request-outliving spawns: webhook/tap deliveries, MCP - // runners, A2A watchers) — the post-drain grace below waits on it so a graceful + // Detached-work tracker (request-outliving spawns: webhook/tap deliveries, plane + // task runners and watchers) — the post-drain grace below waits on it so a graceful // stop gives such work a bounded window instead of an instant abort. let detached = busbar_kernel::detached::DetachedTasks::new(); busbar_kernel::detached::set_worker_detached(detached.clone()); // The shutdown level, registered beside the tracker: detached work spawned on - // this worker captures it and can settle its own terminal state (an MCP task + // this worker captures it and can settle its own terminal state (a plane's task // runner writes CANCELLED) inside the drain grace below instead of being aborted // silently when the runtime drops. busbar_kernel::detached::set_worker_shutdown(worker_shutdown); diff --git a/crates/busbar/src/root/auth_bindings.rs b/crates/busbar/src/root/auth_bindings.rs index dc4531364d..04e185e9e1 100644 --- a/crates/busbar/src/root/auth_bindings.rs +++ b/crates/busbar/src/root/auth_bindings.rs @@ -214,22 +214,23 @@ pub const ADMIN_PRINCIPAL_ID: &str = "admin"; /// THE ROOT LEGACY TABLE: the operator credential's provider, as configuration spells it (the /// `auth.admin_auth:` default, the one `module:` whose definition may carry `token:`, and a reserved -/// hook name). Frozen operator-visible config text naming an auth module no crate in this tree -/// declares (GetBusbar/busbar-auth-admin-tokens); the root hands it to the kernel with its linked -/// auth rows, so the kernel spells it nowhere (ARCHITECT 2026-09-30, KERNEL-AUTH-ZERO Q2; -/// BUSBAR-1.6.0.md:173, "sit in the root legacy table"). Moved from busbar-kernel's -/// `data/operator_credential.toml`, value unchanged. A module name a build compiles in is declared -/// as a `*_MODULE` constant, which is how the kind-isolation instance axis learns it. -/// v1.5.5:crates/busbar/src/config/mod.rs:795 (ADMIN_TOKENS_MODULE); :1874,1891 (the hook-name -/// reservation). -pub const OPERATOR_AUTH_MODULE: &str = "admin-tokens"; - -/// THE OPERATOR CREDENTIAL'S WORDS, off the root legacy table: [`OPERATOR_AUTH_MODULE`] and -/// [`ADMIN_PRINCIPAL_ID`] (v1.5.5:crates/auth-admin-tokens/src/lib.rs:19, ADMIN_TOKENS_PRINCIPAL_ID). +/// hook name). Frozen operator-visible config text the root hands to the kernel with its linked auth +/// rows, so the kernel spells it nowhere (ARCHITECT 2026-09-30, KERNEL-AUTH-ZERO Q2; +/// BUSBAR-1.6.0.md:173, "sit in the root legacy table"). The word is the manifest's: the registry key +/// of the row its `[package.metadata.busbar.operator-auth]` table names, stated in packaging whether +/// or not this build links that row, so no source here names the module. Its value is v1.5.5's +/// (v1.5.5:crates/busbar/src/config/mod.rs:795; :1874,1891, the hook-name reservation). +#[must_use] +pub fn operator_auth_module() -> &'static str { + crate::LINKED.operator_auth +} + +/// THE OPERATOR CREDENTIAL'S WORDS, off the root legacy table: [`operator_auth_module`] and +/// [`ADMIN_PRINCIPAL_ID`] (v1.5.5's operator principal id). #[must_use] pub fn operator_words() -> busbar_kernel_identity::operator::OperatorWords { busbar_kernel_identity::operator::OperatorWords { - provider: OPERATOR_AUTH_MODULE, + provider: operator_auth_module(), principal_id: ADMIN_PRINCIPAL_ID, } } diff --git a/crates/busbar/src/root/boot.rs b/crates/busbar/src/root/boot.rs index dc5e616c42..24f0e604ef 100644 --- a/crates/busbar/src/root/boot.rs +++ b/crates/busbar/src/root/boot.rs @@ -928,7 +928,7 @@ pub fn book( let data_dir = busbar_kernel::preflight::fleet_data_dir(); let (durability, rows, migration) = compose_book(&adapter, lane, data_dir, &mig, now, &token)?; // DEBUG, NOT INFO, and that is a neutrality decision rather than a taste one. The - // boot log's INFO+ line set is part of what "LLM-only ≡ 1.5.5" means — it is pinned + // boot log's INFO+ line set is part of what "one plane alone ≡ 1.5.5" means — it is pinned // by `tests/boot_lines_neutrality.rs` and recorded by the oracle's // `hazard|no-data-dir|logs` cell — so a new line here is a user-visible byte change // on a surface that must not move. The seal is an internal fact an operator can ask diff --git a/crates/busbar/src/root/cli.rs b/crates/busbar/src/root/cli.rs index 3465abb150..13d70989bb 100644 --- a/crates/busbar/src/root/cli.rs +++ b/crates/busbar/src/root/cli.rs @@ -231,10 +231,10 @@ pub(crate) fn handle_cli_flags() -> Option { } Some(0) } - // The STDIO SERVE MODE is not an exit-and-print flag: it proceeds to the ordinary boot and - // is read again inside `run()`, where it swaps the two TCP listeners for the process's own - // stdin/stdout. Recognised here so it is not refused as an unknown argument. - // A flag a linked plane declares (its `Flags:` row) is not an exit-and-print flag either. + // A flag a linked plane declares (its `Flags:` row) is not an exit-and-print flag: it + // proceeds to the ordinary boot and is read again inside `run()`, where the line-serve flag + // swaps the two listeners for the process's own stdin/stdout. Recognised here so it is not + // refused as an unknown argument. Some(arg) if is_plane_flag(&help_rows(), arg) => None, Some("--validate") => Some(validate_config_command()), Some("--generate-signing-key") => Some(generate_signing_key_command()), @@ -422,6 +422,10 @@ fn validate_config_command() -> i32 { 0 } +/// THE `--list-plugins` COLUMN HEADER, v1.5.5's bytes (v1.5.5 crates/busbar/src/main.rs:419-422): +/// the row format's six columns at its widths, then `STATUS`, as the one line it prints. +const LIST_PLUGINS_HEADER: &str = "FILE NAME ALIAS KIND VERSION SIGNATURE STATUS"; + /// `--list-plugins`: MANIFEST-ONLY inventory of every plugin tarball in `plugins.dir` — name, /// alias, kind, version, signature verdict, and load status (including the exact skip/invalid /// reason and which one `store.module` selects). NEVER `dlopen`s anything, so an untrusted @@ -472,10 +476,7 @@ fn list_plugins_command() -> i32 { println!("no plugin tarballs found"); return 0; } - println!( - "{:<34} {:<24} {:<12} {:<6} {:<9} {:<24} STATUS", - "FILE", "NAME", "ALIAS", "KIND", "VERSION", "SIGNATURE" - ); + println!("{LIST_PLUGINS_HEADER}"); for row in rows { let (name, alias, kind, version) = row .manifest diff --git a/crates/busbar/src/root/dispatch.rs b/crates/busbar/src/root/dispatch.rs index 4e6b10242d..c5f228a4c4 100644 --- a/crates/busbar/src/root/dispatch.rs +++ b/crates/busbar/src/root/dispatch.rs @@ -134,10 +134,10 @@ fn conns() -> Arc { #[path = "tests/dispatch.rs"] mod tests; -// The suite binds each dialect's declared scheme on the LINKED auth plugins serving its style: the -// static schemes on `busbar-auth-header`, the signing scheme on `busbar-auth-sigv4` (the default -// distribution links both). A build without either links no plugin serving that style, so the bind -// is refused there, exactly as `door_steps`' positive binding proof is gated on `auth-header`. -#[cfg(all(test, feature = "auth-header", feature = "auth-sigv4"))] +// The suite binds each dialect's declared scheme on the LINKED auth plugins serving its style (the +// static schemes and the signing scheme; the default distribution links a plugin serving each). A +// build that links no auth row links no plugin serving either style, so the bind is refused there: +// the suite rides the linked auth axis. +#[cfg(all(test, linked_axis_auths))] #[path = "tests/declared_credentials.rs"] mod declared_credentials_tests; diff --git a/crates/busbar/src/root/door_steps.rs b/crates/busbar/src/root/door_steps.rs index 3a7492cba9..508fd501f4 100644 --- a/crates/busbar/src/root/door_steps.rs +++ b/crates/busbar/src/root/door_steps.rs @@ -838,7 +838,7 @@ impl Units for DoorSteps<'_> { _ctx: &UnitCtx, _principal: &PrincipalId, ) -> SeatVerdict { - // A UNIT ROUTED BY SCOPE (ROUTE_SCOPE, ARCHITECT Q-DEL-A2A-SELECT: scope seals the + // A UNIT ROUTED BY SCOPE (ROUTE_SCOPE, the ARCHITECT scope-select ruling: scope seals the // destinations): the one entry the principal's grant of the plane's scope kind reaches is // its route, directly; zero or several seal nothing and it is refused at admission, the // several named in its refusal's words. @@ -950,7 +950,7 @@ impl Units for DoorSteps<'_> { // is audited as every unit is. // A local unit whose plane EXPECTS units (its admission estimate) is charged as any keyed // unit is: the plane's own round, on the caller's budget (the served engine charged busbar's - // own ask round before it was asked; lane-dg-mcp 05e053183a). So is one the plane answers + // own ask round before it was asked; 05e053183a). So is one the plane answers // AS AN ADMITTED CALL (ROUTE_COUNTED): a keyed one passes the one check-then-charge on the // plane's pool, counting its request (R2, 1.5.5's rule), and keeps only the fee units the // plane reports. @@ -962,7 +962,7 @@ impl Units for DoorSteps<'_> { .is_some_and(|(class, _)| *class == ROUTE_LOCAL); (local, local && u.counted, !u.expected.is_empty()) }; - // A UNIT ROUTED BY SCOPE that no one entry reached (Q-DEL-A2A-SELECT): refused before + // A UNIT ROUTED BY SCOPE that no one entry reached (the scope-select ruling): refused before // anything is charged, as 1.5.5 chose the agent before its admission. let unrouted_scope = self .lock() @@ -1520,12 +1520,12 @@ impl StyleParams { /// The `auth:` spelling of a provider's style override, as config writes it. fn style_word(auth: busbar_kernel::config::ProviderAuth) -> &'static str { - use busbar_kernel::config::ProviderAuth; + use busbar_kernel::config::ProviderAuth as Style; match auth { - ProviderAuth::Bearer => "bearer", - ProviderAuth::ApiKey => "api-key", - ProviderAuth::JwtBearer => "jwt-bearer", - ProviderAuth::OAuthClientCredentials => "oauth-client-credentials", + Style::Bearer => "bearer", + Style::ApiKey => "api-key", + Style::JwtBearer => "jwt-bearer", + Style::OAuthClientCredentials => "oauth-client-credentials", } } @@ -2221,7 +2221,7 @@ pub fn member_routes( continue; } } - // A PROGRAM MEMBER (Q-L3B-STDIO-UPSTREAM (A)): a registration that names a program is + // A PROGRAM MEMBER (the program-upstream ruling (A)): a registration that names a program is // reached at its own long-lived child, the connector keeps it per member. if let Some(need) = member_program { if registration diff --git a/crates/busbar/src/root/doors.rs b/crates/busbar/src/root/doors.rs index fc215aea88..39c724ca5f 100644 --- a/crates/busbar/src/root/doors.rs +++ b/crates/busbar/src/root/doors.rs @@ -510,3 +510,17 @@ pub fn upgrades_of(door: DoorFn) -> Vec<&'static str> { .map(|facts| facts.upgrades) .unwrap_or_else(|e| panic!("a linked transport door is refused: {e}")) } + +/// The claims a linked row's door opens on their FIRST LINE (their row's `unit0_trigger`), read off +/// the door's Statement: the carriers of whole lines, one of which the process's own stdin/stdout +/// serves (`crate::root::serve::lines::line_carrier`). +/// +/// # Panics +/// +/// The build's own door is refused, as [`build`] panics for it. +#[must_use] +pub fn lines_of(door: DoorFn) -> Vec<&'static str> { + super::loader::dispatch::kinds::transport::linked_facts(door) + .map(|facts| facts.lines) + .unwrap_or_else(|e| panic!("a linked transport door is refused: {e}")) +} diff --git a/crates/busbar/src/root/gauntlet_kernel.rs b/crates/busbar/src/root/gauntlet_kernel.rs index 7f100971f1..e6de94e19d 100644 --- a/crates/busbar/src/root/gauntlet_kernel.rs +++ b/crates/busbar/src/root/gauntlet_kernel.rs @@ -5,14 +5,14 @@ //! //! [`run_gauntlet_via_kernel`] drives the SAME [`GauntletPlane`] the substrate gauntlet drives, but //! through `busbar_kernel::teller::run_unit_async` (the ONE unified loop) instead of the substrate -//! Teller loop. It is the loop-unification rider (DECISIONS #28): MCP is the first WITNESS — its -//! existing [`GauntletPlane`] (`busbar_mcp`'s `ToolCallPlane`) rides UNCHANGED, so its governance, -//! per-round metering, breaker, reroute and JSON-RPC envelope stay byte-identical inside `drive`. +//! Teller loop. It is the loop-unification rider (DECISIONS #28): the first plane to ride it was its +//! WITNESS — its existing [`GauntletPlane`] rides UNCHANGED, so its governance, per-round metering, +//! breaker, reroute and envelope stay byte-identical inside `drive`. //! //! NEUTRAL BY CONSTRUCTION: this file names NO plane. It reaches every plane through the neutral //! [`GauntletPlane`] seam and returns the neutral [`PlaneAnswer`] out of the neutral -//! [`PlaneInFlight`] table, keyed by the bare `ctx.key`. a2a/voice/llm ride this IDENTICAL rider -//! with zero new code — only a re-point of their gauntlet call. +//! [`PlaneInFlight`] table, keyed by the bare `ctx.key`. Every other plane rides this IDENTICAL +//! rider with zero new code — only a re-point of its gauntlet call. //! //! MONEY-NEUTRAL, AND THE SHIPPED PATH: the rider opens an EMPTY admit hold //! ([`Admission::ZeroHold`]) and reports ZERO [`Evidence`] at the kernel exit, so the kernel loop @@ -37,10 +37,11 @@ use busbar_kernel::plane_host::{ use busbar_kernel::slice::GroupLeaseSlip; use busbar_kernel::teller::{AccrualMeter, Evidence, RouteAwait, RouteLeg, UnitCtx, Units}; -/// The transport stack every gauntlet request arrives over — one HTTP layer, named rather than -/// empty (mirrors the LLM plane's arrival record). The value only reaches the audit/record surface, -/// which this rider posts nothing onto. -const TRANSPORT_CHAIN: [&str; 1] = ["http"]; +/// The transport stack every gauntlet request arrives over — the one request/response wire the +/// data listener speaks ([`crate::root::listener::REQUEST_WIRE`], read off a declared claim), named +/// rather than empty (mirrors a served plane's arrival record). The value only reaches the +/// audit/record surface, which this rider posts nothing onto. +const TRANSPORT_CHAIN: [&str; 1] = [crate::root::listener::REQUEST_WIRE]; /// The neutral per-request counter for the rider's `ctx.key`. Each call takes the next value; /// nothing outside this file reads it, so a process-global monotonic is enough. diff --git a/crates/busbar/src/root/harness.rs b/crates/busbar/src/root/harness.rs index 8a5c75764b..f05898797b 100644 --- a/crates/busbar/src/root/harness.rs +++ b/crates/busbar/src/root/harness.rs @@ -29,8 +29,8 @@ //! that asked each leg a differently-shaped question would not be comparing them. //! //! The per-leg CONSTRUCTORS are not here, and deliberately not faked. Building a leg's node means -//! assembling the ten-odd collaborators its own fixture already assembles (`VoiceNodeParts` alone -//! names plane, groups, pricer, auth, auth bindings, scope, meter policy, durability, io, origin), +//! assembling the ten-odd collaborators its own fixture already assembles (one leg's node parts alone +//! name plane, groups, pricer, auth, auth bindings, scope, meter policy, durability, io, origin), //! and the two ways to get them are: //! //! 1. re-implement each leg's fixture here — which forks the fixture, so the harness would be diff --git a/crates/busbar/src/root/kernel.rs b/crates/busbar/src/root/kernel.rs index d42851747b..11c13b62f8 100644 --- a/crates/busbar/src/root/kernel.rs +++ b/crates/busbar/src/root/kernel.rs @@ -843,7 +843,7 @@ impl RootHistory { /// The process's history holder, reached by the root's units and by nothing below them. /// -/// A `static` for the same reason the LLM node is one: the seam a unit is driven through is a bare +/// A `static` for the same reason the plane node is one: the seam a unit is driven through is a bare /// `fn` and a bare `fn` cannot capture, so the holder has to be reachable by name. It exists before /// the boot that reads the configuration finishes, holding no history, which is exactly the state a /// report arriving that early should be priced in — it isn't. @@ -858,9 +858,9 @@ pub static ROOT_CARD: LazyLock = LazyLock::new(RootHistory::default /// it. No plane sees a rate at all. /// /// THE ROOT'S, NOT A PLANE'S. The card this builds is the one every plane's exit prices against — -/// the holder above is the process's, reached by mcp, a2a, voice and admin exactly as it is by llm — +/// the holder above is the process's, reached by every plane and by admin exactly as by the node — /// so the relay belongs beside the holder and the repricer rather than in one plane's unit file. It -/// lived in the node's file (now `plane_node`) while llm was the only leg switched over, and a +/// lived in the node's file (now `plane_node`) while the node was the only leg switched over, and a /// plane's unit file is compiled out with its plane: any build without that plane's feature lost the /// root's ability to price a card at all. The deletability of a plane is the whole point of the feature, so the thing /// that must survive every deletion lives on the ungated side of the seam. @@ -2336,7 +2336,7 @@ const OP_UNCLAIMED: &str = "unclaimed"; /// /// The admin plane's "the verb did not resolve" facts used to answer here, and they name an /// administrative READ — so every unit of every other plane that reached this door was sealed as -/// one. A voice turn or a chat completion refused at the root is not an operator reading a +/// one. A session turn or a completion refused at the root is not an operator reading a /// configuration page, and a record that says it was is wrong about the one thing an audit record /// exists to state. Nothing here is derived from the admin plane, because nothing about this unit /// is administrative. diff --git a/crates/busbar/src/root/linked.rs b/crates/busbar/src/root/linked.rs index 0a11788b11..389e6050de 100644 --- a/crates/busbar/src/root/linked.rs +++ b/crates/busbar/src/root/linked.rs @@ -111,6 +111,9 @@ pub struct Linked { pub hook_doors: &'static [busbar_contract::abi::mechanism::door::DoorFn], /// The auth axis: each linked `kind: auth` plugin's `(registry key, SDK boundary)`. pub auths: &'static [LinkedAuth], + /// The operator credential's provider word: the key the manifest's operator row states + /// (`[package.metadata.busbar.operator-auth]`), linked in this build or not. + pub operator_auth: &'static str, /// The kernel-loop axes (#28): the declaration key of each plane `gauntlet_install::install()` /// flips onto the unified loop's ONE-SHOT runner, and of each it flips onto the SESSION runner. pub gauntlet_one_shot: &'static [&'static str], @@ -185,6 +188,9 @@ pub struct LinkedTransport { /// The claims whose unit 0 opens at an UPGRADE, read off the door's Statement: the data door's /// upgrade lines (`crate::root::serve::upgrade_carriers`; ARCHITECT ruling Q128 U7). pub upgrades: ClaimsOf, + /// The claims whose unit 0 opens on the FIRST LINE, read off the door's Statement: the line + /// carrier the process's own stdin/stdout serves (`crate::root::serve::lines::line_carrier`). + pub lines: ClaimsOf, } /// A row's claims, read when the seal runs. @@ -611,7 +617,7 @@ pub(crate) fn door_probe_dispatcher() -> Arc PlaneResponse { let mut held = Held { head: None, @@ -1487,7 +1493,7 @@ mod tests; #[path = "tests/linked_secret_sources.rs"] mod secret_source_tests; -#[cfg(all(test, feature = "auth-admin-tokens", linked_axis_body_ingress))] +#[cfg(all(test, linked_axis_auths, linked_axis_body_ingress))] #[path = "tests/linked_auth.rs"] mod auth_tests; diff --git a/crates/busbar/src/root/listener.rs b/crates/busbar/src/root/listener.rs index 98fb552af5..a37c71a89d 100644 --- a/crates/busbar/src/root/listener.rs +++ b/crates/busbar/src/root/listener.rs @@ -5,8 +5,8 @@ //! //! This module is a thin transport wrapper around the *ingress* listener. It does NOT touch routing, //! request translation, the breaker, or failover — it only decides, once at startup, whether the -//! accepted TCP stream is handed to axum as-is (plain HTTP, the historical default) or first put -//! through a rustls server handshake. +//! accepted stream is handed to axum as-is (plain, the historical default) or first put through a +//! rustls server handshake. //! //! ## Why we drive hyper directly here instead of `axum::serve` //! @@ -199,6 +199,11 @@ impl AcceptBackoff { } } +/// The wire a plain root listener speaks, as its log lines name it: the request/response transport +/// the admin plane's one claim is declared over (`busbar_core_admin::admin_codec::claims`). Both +/// root listeners serve that one wire, and the root holds no transport's name of its own. +pub const REQUEST_WIRE: &str = busbar_core_admin::admin_codec::claims::TRANSPORT; + /// A tokio socket listener as an accept source, its accept errors absorbed by [`AcceptBackoff`]: /// what [`serve`] and [`serve_plain`] are handed, and what a build without the connector's /// listener serves on. @@ -215,7 +220,7 @@ impl SocketAdmits { Self { listener, backoff: AcceptBackoff::new(), - scheme: "http", + scheme: REQUEST_WIRE, } } } @@ -431,7 +436,7 @@ async fn accept_loop( let Ok(stream) = tokio::net::TcpStream::from_std(a.stream) else { return; }; - let conn = served.clone().tcp(stream, a.peer, graceful.watcher()); + let conn = served.clone().accepted(stream, a.peer, graceful.watcher()); let hold = a.hold; tokio::spawn(async move { conn.await; @@ -690,7 +695,7 @@ fn hardened_conn_builder() -> ConnBuilder { } /// Plain-HTTP serve loop — the no-`tls`-block default path. Mirrors `serve` (and the historical -/// `axum::serve(listener, router).with_graceful_shutdown(shutdown)`) but over the bare TCP stream +/// `axum::serve(listener, router).with_graceful_shutdown(shutdown)`) but over the bare stream /// (no TLS handshake). Routed through the SAME `hardened_conn_builder` so the plain listener gets the /// identical slow-loris header-read bound the TLS listener has — the previous `axum::serve` path /// exposed no such timeout, leaving a plain-HTTP edge deployment open to header-trickle clients. @@ -703,7 +708,7 @@ pub async fn serve_plain( let admits = SocketAdmits { listener, backoff: AcceptBackoff::new(), - scheme: "http", + scheme: REQUEST_WIRE, }; accept_loop(admits, shutdown, balancer, Served::new(router, None)).await } @@ -722,7 +727,11 @@ struct Served { impl Served { fn new(router: Router, security: Option>) -> Self { let builder = Arc::new(hardened_conn_builder()); - let scheme = if security.is_some() { "tls" } else { "http" }; + let scheme = if security.is_some() { + "tls" + } else { + REQUEST_WIRE + }; Self { builder, router, @@ -731,10 +740,10 @@ impl Served { } } - /// Serve a single accepted TCP connection: as it arrived on a plain listener (the stream itself, + /// Serve a single accepted connection: as it arrived on a plain listener (the stream itself, /// no compat layer), through the wrap on a TLS one. Any failure is contained to this connection. - async fn tcp(self, stream: tokio::net::TcpStream, peer: SocketAddr, watcher: Watcher) { - // TCP_NODELAY parity with axum::serve (which sets it by default on accepted streams). + async fn accepted(self, stream: tokio::net::TcpStream, peer: SocketAddr, watcher: Watcher) { + // No-delay parity with axum::serve (which sets it by default on accepted streams). if let Err(e) = stream.set_nodelay(true) { tracing::debug!(error = %e, %peer, "{}: set_nodelay failed; continuing", self.scheme); } diff --git a/crates/busbar/src/root/registry.rs b/crates/busbar/src/root/registry.rs index e1ce7d5bf4..3fd0563d45 100644 --- a/crates/busbar/src/root/registry.rs +++ b/crates/busbar/src/root/registry.rs @@ -47,11 +47,11 @@ //! **164 of the cross-plane pairs overlap** — 100 across selector families and 64 within the path //! family. Both numbers follow from the overlap rule as the design writes it, and neither is a //! rounding of the other. (The decisions plane joining the seal, item 251, added eleven: its two -//! exact paths against every header claim, and its `/v1/models` against the llm plane's +//! exact paths against every header claim, and its `/v1/models` against the model-serving plane's //! `v1/models/` pattern — which the order settles in the exact path's favour.) //! //! The 90 are the conservative arm, and they are conservative because a request really does carry -//! both a path and a header: `HeaderPresent("x-api-key")` and `ExactPath("/mcp")` can be true of one +//! both a path and a header: `HeaderPresent("x-api-key")` and `ExactPath("/tools")` can be true of one //! arrival, so an overlap is the honest answer rather than a limitation. The 63 are what is left //! inside the path family once the grammar reads a suffix and a substring as the segment //! constraints they are: a suffix pins a pattern's last segments, a substring carrying slashes asks diff --git a/crates/busbar/src/root/serve.rs b/crates/busbar/src/root/serve.rs index 9c18e4da54..003f4dbe1a 100644 --- a/crates/busbar/src/root/serve.rs +++ b/crates/busbar/src/root/serve.rs @@ -546,7 +546,7 @@ pub struct ApplyReach { upgrades: Vec<&'static str>, } -/// A CONFIG APPLY ON ONE SERVED DOOR PLANE (ARCHITECT Q-DEL-A2A-APPLY; THE DESIGN §11, plugin +/// A CONFIG APPLY ON ONE SERVED DOOR PLANE (the ARCHITECT ruling on a door plane's apply; THE DESIGN §11, plugin /// memory is "valid to its next refresh generation"): every apply refreshes the plane onto a new /// generation of the section the installed generation writes, so the plane re-reads it and its /// generation-scoped memory resets with it, as predev rebuilt the plane on every apply; its pools @@ -1376,7 +1376,7 @@ pub(crate) fn compose_planes_over( for (instance, plugin) in doors { let served_facts = plugin.served(); // A door plane is configured when the document writes ANY section it owns: its own, or - // another its Statement owns (an `mcp:`-class block alone makes the deployment that plane's + // another its Statement owns (a block of a class it owns alone makes the deployment that plane's // server, its own section then read as written empty). let empty = serde_yaml::Value::Mapping(serde_yaml::Mapping::new()); let section = match sections.get(served_facts.section) { @@ -2237,7 +2237,7 @@ pub fn door_mounts( for (i, claim) in plane.snapshot.claims.iter().enumerate() { // A claim over the line carrier is served on the process's own stdin/stdout // ([`lines`]), never on the data listener. - if claim.carrier == lines::LINE_CARRIER { + if lines::carrier() == Some(claim.carrier.as_str()) { continue; } let rung = @@ -2504,7 +2504,7 @@ pub(crate) fn line_routes( let mut of_line = std::collections::HashMap::new(); for (p, plane) in served.planes.iter().enumerate() { for (i, claim) in plane.snapshot.claims.iter().enumerate() { - if claim.carrier == lines::LINE_CARRIER { + if lines::carrier() == Some(claim.carrier.as_str()) { continue; } let rung = @@ -3815,7 +3815,7 @@ fn framed_by( carrier: &str, framer_for: impl Fn(&str) -> Option>, ) -> Option> { - if carrier == lines::LINE_CARRIER { + if lines::carrier() == Some(carrier) { return None; } serve_framed::stream_framer(carrier, framer_for) diff --git a/crates/busbar/src/root/serve_lines.rs b/crates/busbar/src/root/serve_lines.rs index 9c56d2f8fc..e578793a3a 100644 --- a/crates/busbar/src/root/serve_lines.rs +++ b/crates/busbar/src/root/serve_lines.rs @@ -1,10 +1,11 @@ // SPDX-License-Identifier: Apache-2.0 // Copyright (C) 2026 Busbar Inc and contributors -//! THE LINE CARRIER (SEAM-S1; ARCHITECT Q1a, consistent with round 4 Q-L3B-STDIO-SHAPE (B)): the +//! THE LINE CARRIER (SEAM-S1; ARCHITECT Q1a, consistent with round 4's line-shape ruling (B)): the //! process's own stdin/stdout, held open as ONE carrier session for one caller. busbar is somebody's //! child process here, binds no listener, and serves the door claim a served plane makes over the -//! line carrier's key ([`LINE_CARRIER`]). +//! line carrier's key ([`carrier`]): the one linked transport claim whose row opens its unit 0 on +//! the first line, read off the transport's own declared rows, never named here. //! //! - The session is only the CARRIER ([`LineCaller`], the driver's one `SessionCaller` for a held //! carrier): each line it reads is ONE unit, opened exactly as a data-listener arrival is (its own @@ -20,7 +21,8 @@ //! stderr, not one frame first. //! - EOF on stdin ends the session: every unit still open ends, and the serve returns `0`. //! -//! Every meaning a line has is the plane's; this module names no plane. +//! Every meaning a line has is the plane's, and every name the carrier answers by is the +//! transport's; this module names neither. use std::sync::Arc; @@ -31,50 +33,99 @@ use tokio::sync::{mpsc, Mutex as AsyncMutex}; use super::{DoorRequest, Served}; -/// The line transport's claim key: the claims made over it are the line carrier's. -pub const LINE_CARRIER: &str = "stdio"; +/// THE LINE CARRIER'S CLAIM KEY among `transports`: the one claim whose row opens its unit 0 on +/// the first line (`unit0_trigger` `FIRST_LINE`, read off each linked door's Statement). `None` when +/// no linked transport carries lines. Two such claims are refused: the process has one +/// stdin/stdout, and which claim it carries is never decided by picking one. +/// +/// # Errors +/// +/// Two linked claims open on the first line. +pub fn line_carrier( + transports: &[crate::root::linked::LinkedTransport], +) -> Result, String> { + let mut lines = transports.iter().flat_map(|t| (t.lines)()); + let one = lines.next(); + match (one, lines.next()) { + (Some(one), Some(other)) => Err(format!( + "the linked transport claims `{one}` and `{other}` both open a session on their first \ + line, and the process's own stdin/stdout carries one" + )), + (one, _) => Ok(one), + } +} + +/// This build's line carrier, read once off its linked transports ([`line_carrier`]). `Err` when +/// two linked claims open on the first line; boot refuses that build before anything is served +/// ([`refusal`]). +fn installed() -> &'static Result, String> { + static CARRIER: std::sync::OnceLock, String>> = + std::sync::OnceLock::new(); + CARRIER.get_or_init(|| line_carrier(crate::LINKED.transports)) +} + +/// The line carrier's claim key in this build: the claims made over it are served on the +/// process's own stdin/stdout. `None` when no linked transport carries lines. +#[must_use] +pub fn carrier() -> Option<&'static str> { + installed().as_ref().ok().copied().flatten() +} -/// The environment variable carrying the session credential for the plane keyed `plane` (its -/// instance's key, never a literal here): argv is world-readable, and the launching client's `env` -/// block has exactly this shape. +/// The refusal a build whose linked transports state two line carriers boots to, `None` for every +/// other build. #[must_use] -pub fn env_credential(plane: &str) -> String { - format!("BUSBAR_{}_STDIO_CREDENTIAL", plane.to_ascii_uppercase()) +pub fn refusal() -> Option<&'static str> { + installed().as_ref().err().map(String::as_str) +} + +/// The environment variable carrying the session credential for the plane keyed `plane` over the +/// line carrier keyed `carrier` (both instances' keys, never a literal here): argv is +/// world-readable, and the launching client's `env` block has exactly this shape. +#[must_use] +pub fn env_credential(plane: &str, carrier: &str) -> String { + format!( + "BUSBAR_{}_{}_CREDENTIAL", + plane.to_ascii_uppercase(), + carrier.to_ascii_uppercase() + ) } /// The `(plane, claim)` a served plane claims over the line carrier, the first in binding order. #[must_use] pub fn line_claim(served: &Served) -> Option<(usize, u32)> { + let carrier = carrier()?; served.planes.iter().enumerate().find_map(|(p, plane)| { plane .snapshot .claims .iter() - .position(|c| c.carrier == LINE_CARRIER) + .position(|c| c.carrier == carrier) .and_then(|i| u32::try_from(i).ok()) .map(|claim| (p, claim)) }) } /// The one line a refused serve writes to stderr before it exits nonzero. -pub fn refuse(plane: &str, sentence: &str) { - eprintln!("busbar: {plane} stdio serve refused to start: {sentence}"); +pub fn refuse(plane: &str, carrier: &str, sentence: &str) { + eprintln!("busbar: {plane} {carrier} serve refused to start: {sentence}"); } /// RESOLVE THE SESSION IDENTITY from the boot credential, against `audience`: `Err` is a sentence -/// for stderr and a refusal to serve. Every operator sentence names the plane by `plane`. +/// for stderr and a refusal to serve. Every operator sentence names the plane by `plane` and the +/// carrier by `carrier`. async fn session( app: Arc, plane: &str, + carrier: &str, audience: Option<&str>, credential: Option<&str>, ) -> Result { - let env = env_credential(plane); + let env = env_credential(plane, carrier); // The setting a refusal points the operator at: the plane's canonical resource, by its key. let canonical_uri = format!("{plane}.canonical_uri"); let Some(resource) = audience else { return Err(format!( - "this deployment's `{plane}:` block states no canonical resource, so a stdio session \ + "this deployment's `{plane}:` block states no canonical resource, so a {carrier} session \ has no audience to be bound to." )); }; @@ -112,7 +163,7 @@ async fn session( Ok((_principal, gov)) => { if !gov.is_governed() { eprintln!( - "[warn] {plane} stdio session is UNGOVERNED: no enforcement key is bound, so no \ + "[warn] {plane} {carrier} session is UNGOVERNED: no enforcement key is bound, so no \ budget applies and audit rows attribute to `anonymous`. Configure \ `auth.chain` and set {env} to bind the session to a key." ); @@ -121,7 +172,7 @@ async fn session( } Err(busbar_kernel::auth::IdentityRefusal::Denied) => Err(if credential.is_none() { format!( - "this deployment's `auth.chain` is configured, so an unauthenticated stdio session \ + "this deployment's `auth.chain` is configured, so an unauthenticated {carrier} session \ is refused exactly as an unauthenticated POST is. Set {env} to a credential the \ chain admits (audience-bound to `{canonical_uri}`)." ) @@ -197,8 +248,14 @@ where R: AsyncRead + Unpin + Send + 'static, W: AsyncWrite + Unpin + Send + 'static, { + let Some(carrier) = carrier() else { + eprintln!("busbar: no linked transport carries lines: nothing to serve on stdin"); + return 1; + }; let Some((plane, claim)) = line_claim(&served) else { - eprintln!("busbar: no served plane claims the stdio transport: nothing to serve on stdin"); + eprintln!( + "busbar: no served plane claims the {carrier} transport: nothing to serve on stdin" + ); return 1; }; let instance = served.planes[plane].instance.clone(); @@ -207,12 +264,13 @@ where .clone(); let audience = served.planes[plane].snapshot.audience.clone(); let kernel = Arc::clone(&served.planes[plane].kernel); - let credential = std::env::var(env_credential(&instance)) + let credential = std::env::var(env_credential(&instance, carrier)) .ok() .filter(|c| !c.is_empty()); let gov = match session( app.load(), &instance, + carrier, audience.as_deref(), credential.as_deref(), ) @@ -220,18 +278,18 @@ where { Ok(gov) => gov, Err(sentence) => { - refuse(&instance, &sentence); + refuse(&instance, carrier, &sentence); return 1; } }; tracing::info!( governed = gov.is_governed(), - "stdio serve: session bound; serving on stdin/stdout" + "{carrier} serve: session bound; serving on stdin/stdout" ); let routes = match super::line_routes(served, pin) { Ok(routes) => routes, Err(e) => { - eprintln!("busbar: stdio serve refused to start: {e}"); + eprintln!("busbar: {carrier} serve refused to start: {e}"); return 1; } }; @@ -372,3 +430,7 @@ fn trim(line: &[u8]) -> &[u8] { } &line[..end] } + +#[cfg(test)] +#[path = "tests/serve_lines.rs"] +mod tests; diff --git a/crates/busbar/src/root/tests/auth_bindings.rs b/crates/busbar/src/root/tests/auth_bindings.rs index a88bfd5a2c..98f37c36f5 100644 --- a/crates/busbar/src/root/tests/auth_bindings.rs +++ b/crates/busbar/src/root/tests/auth_bindings.rs @@ -159,11 +159,49 @@ fn hand_in_the_root_words() { busbar_kernel::preflight::install_linked_auth(crate::LINKED.auths, operator_words()); } +/// THE OPERATOR'S PROVIDER WORD IS THE MANIFEST'S: the registry key of the row the manifest's +/// operator table names, and — where this build links that row — the row whose own Statement states +/// it is the operator credential, identifying the operator as the principal the words carry. The +/// root's source spells neither. #[test] -fn the_legacy_table_spells_the_operator_credential_as_1_5_5_did() { +fn the_operator_provider_is_the_row_the_manifest_names() { let words = operator_words(); - assert_eq!(words.provider, "admin-tokens"); - assert_eq!(words.principal_id, "admin"); + assert!( + !words.provider.is_empty(), + "the manifest names an operator row" + ); + assert_eq!(words.provider, crate::LINKED.operator_auth); + assert_eq!(words.principal_id, ADMIN_PRINCIPAL_ID); + let stating: Vec<&str> = crate::LINKED + .auths + .iter() + .filter(|&&(_, _, door)| { + crate::root::loader::dispatch::kinds::auth::operator_principal(door).is_some() + }) + .map(|&(key, _, _)| key) + .collect(); + if crate::LINKED.auths.iter().any(|r| r.0 == words.provider) { + assert_eq!( + stating, + [words.provider], + "the named row is the one that states it" + ); + let (_, _, door) = crate::LINKED + .auths + .iter() + .find(|r| r.0 == words.provider) + .copied() + .expect("linked"); + assert_eq!( + crate::root::loader::dispatch::kinds::auth::operator_principal(door).as_deref(), + Some(words.principal_id) + ); + } else { + assert!( + stating.is_empty(), + "no unnamed row states the operator: {stating:?}" + ); + } } #[test] diff --git a/crates/busbar/src/root/tests/cli.rs b/crates/busbar/src/root/tests/cli.rs index e92721dca9..b14f2509ef 100644 --- a/crates/busbar/src/root/tests/cli.rs +++ b/crates/busbar/src/root/tests/cli.rs @@ -129,3 +129,18 @@ fn a_declared_plane_flag_is_accepted_and_nothing_else_is() { } } } + +/// THE `--list-plugins` HEADER IS THE ROW FORMAT'S: its six column names at the widths every row +/// prints at, then `STATUS`, so each name heads its own column. +#[test] +fn the_list_plugins_header_heads_the_row_formats_columns() { + let names: Vec<&str> = super::LIST_PLUGINS_HEADER.split_whitespace().collect(); + assert_eq!(names.len(), 7, "six columns and STATUS"); + assert_eq!( + super::LIST_PLUGINS_HEADER, + format!( + "{:<34} {:<24} {:<12} {:<6} {:<9} {:<24} {}", + names[0], names[1], names[2], names[3], names[4], names[5], names[6] + ) + ); +} diff --git a/crates/busbar/src/root/tests/registry.rs b/crates/busbar/src/root/tests/registry.rs index b92922c8f4..355129c707 100644 --- a/crates/busbar/src/root/tests/registry.rs +++ b/crates/busbar/src/root/tests/registry.rs @@ -873,6 +873,7 @@ fn the_wires_linked_row(wire: &DroppedDoor) -> LinkedTransport { build: |_, _| dropped_doors()[0].wire.clone(), claims: || vec![dropped_doors()[0].key], upgrades: Vec::new, + lines: Vec::new, } } diff --git a/crates/busbar/src/root/tests/secret_source.rs b/crates/busbar/src/root/tests/secret_source.rs index a095c597c4..be6fa69f9e 100644 --- a/crates/busbar/src/root/tests/secret_source.rs +++ b/crates/busbar/src/root/tests/secret_source.rs @@ -135,7 +135,12 @@ fn member_secrets_installed() { /// `program_member::script` serves, its environment's `TOKEN` the reference `secret`. fn program_section(secret: &SecretRef) -> serde_yaml::Value { let mut fs = serde_yaml::Mapping::new(); - fs.insert("transport".into(), super::lines::LINE_CARRIER.into()); + fs.insert( + "transport".into(), + super::lines::carrier() + .expect("this build links a line carrier") + .into(), + ); fs.insert("command".into(), "/bin/sh".into()); fs.insert( "args".into(), diff --git a/crates/busbar/src/root/tests/serve_framed.rs b/crates/busbar/src/root/tests/serve_framed.rs index c15c303611..15d56f24b0 100644 --- a/crates/busbar/src/root/tests/serve_framed.rs +++ b/crates/busbar/src/root/tests/serve_framed.rs @@ -294,7 +294,7 @@ fn the_line_carrier_is_never_handed_to_a_framer_that_claims_its_name() { unreachable!("never crossed: only the choice is judged") } } - let line = super::lines::LINE_CARRIER; + let line = super::lines::carrier().expect("this build links a line carrier"); let door: Arc = Arc::new(Claims(DoorFacts { name: "claims-the-line".into(), claims: vec![line, "framed"], diff --git a/crates/busbar/src/root/tests/serve_lines.rs b/crates/busbar/src/root/tests/serve_lines.rs new file mode 100644 index 0000000000..273dc1392b --- /dev/null +++ b/crates/busbar/src/root/tests/serve_lines.rs @@ -0,0 +1,73 @@ +//! Tests for `serve_lines.rs`: the line carrier is the transports' declared fact, never a name the +//! root holds. + +use super::*; +use crate::root::linked::LinkedTransport; + +/// A transport row whose claims are `claims` and whose first-line claims are `lines`, built never. +fn row( + key: &'static str, + claims: fn() -> Vec<&'static str>, + lines: fn() -> Vec<&'static str>, +) -> LinkedTransport { + LinkedTransport { + key, + composes_over: &[], + build: |_, _| unreachable!("the carrier is read off the rows, never off a built wire"), + claims, + upgrades: Vec::new, + lines, + } +} + +/// THE CARRIER IS WHAT THE ROWS DECLARE: the one claim whose row opens on the first line, whatever +/// it is called; a build with none carries no lines. +#[test] +fn the_line_carrier_is_the_claim_a_row_declares_opening_on_its_first_line() { + let rows = [ + row( + "framed-wire", + || vec!["framed-wire", "framed-too"], + Vec::new, + ), + row("pipe-wire", || vec!["pipe-wire"], || vec!["pipe-wire"]), + ]; + assert_eq!(line_carrier(&rows), Ok(Some("pipe-wire"))); + assert_eq!(line_carrier(&rows[..1]), Ok(None)); + assert_eq!(line_carrier(&[]), Ok(None)); +} + +/// TWO LINE CARRIERS ARE REFUSED, naming both: the process has one stdin/stdout, and which claim it +/// carries is never decided by picking the first. +#[test] +fn two_claims_opening_on_their_first_line_are_refused() { + let rows = [ + row("pipe-wire", || vec!["pipe-wire"], || vec!["pipe-wire"]), + row("other-pipe", || vec!["other-pipe"], || vec!["other-pipe"]), + ]; + let refusal = line_carrier(&rows).expect_err("two line carriers are ambiguous"); + assert!(refusal.contains("`pipe-wire`"), "{refusal}"); + assert!(refusal.contains("`other-pipe`"), "{refusal}"); +} + +/// The build's own carrier is read off its linked rows, and a build that links one serves it. +#[test] +fn the_builds_carrier_is_read_off_its_linked_rows() { + assert_eq!(refusal(), None, "the build states one line carrier at most"); + assert_eq!( + carrier(), + line_carrier(crate::LINKED.transports).expect("one line carrier") + ); + assert!(carrier().is_some(), "this build links a line carrier"); +} + +/// THE SESSION CREDENTIAL'S VARIABLE is spelled from the plane's key and the carrier's key, both +/// upper-cased: the shape the launching client's `env` block has always carried. +#[test] +fn the_credential_variable_is_spelled_from_the_plane_and_the_carrier() { + assert_eq!( + env_credential("tool-door", "pipe"), + "BUSBAR_TOOL-DOOR_PIPE_CREDENTIAL" + ); + assert_eq!(env_credential("x", "y"), "BUSBAR_X_Y_CREDENTIAL"); +} diff --git a/crates/busbar/src/root/transports.rs b/crates/busbar/src/root/transports.rs index 61caca05b5..47ea222a69 100644 --- a/crates/busbar/src/root/transports.rs +++ b/crates/busbar/src/root/transports.rs @@ -32,7 +32,7 @@ /// /// **THAT IS WHY THE ANSWER IS THE WORK AND NOT THE BYTES.** A status, headers and a byte vector /// would be the honest answer for a plane whose operations are documents. It is the WRONG answer for -/// a plane whose operations are streams: taking the bytes here means draining the body here, and on +/// a plane whose operations are open-ended bodies: taking the bytes here means draining the body here, and on /// the billing planes the instant a body finishes draining is the instant the money is read. A seam /// that buffered would be deciding when a stream ended, which is a decision that moves money. So the /// leg is passed through and the bytes never come near this file. diff --git a/crates/busbar/src/root/units_admin/bound.rs b/crates/busbar/src/root/units_admin/bound.rs index 787a4e31ac..85ab087427 100644 --- a/crates/busbar/src/root/units_admin/bound.rs +++ b/crates/busbar/src/root/units_admin/bound.rs @@ -421,7 +421,7 @@ pub(crate) fn trust_list_effect(desk: &TrustDesk) -> Result Result { let doc: serde_json::Value = @@ -444,7 +444,7 @@ pub(crate) fn trust_decide_effect( let Some(kernel) = desk() else { return not_found(); }; - match kernel.trust_rule(key, decision) { + match kernel.trust_rule(key, ruling) { Ok(row) => answer(&trust_row(&row)), Err(TrustRefused::NoSuchKey) => not_found(), Err(TrustRefused::NothingSighted) => Ok(refused( @@ -464,7 +464,7 @@ pub(crate) fn trust_decide_effect( &format!("trust key `{key}` has no authenticity root"), )), Err(TrustRefused::Store(why)) => { - tracing::error!(key = %key, error = %why, "a trust decision could not be kept"); + tracing::error!(key = %key, error = %why, "a trust ruling could not be kept"); Err(GovernanceError::Store) } } diff --git a/crates/busbar/src/root/units_admin/mod.rs b/crates/busbar/src/root/units_admin/mod.rs index 0159334fa6..bfef60e5e7 100644 --- a/crates/busbar/src/root/units_admin/mod.rs +++ b/crates/busbar/src/root/units_admin/mod.rs @@ -63,9 +63,9 @@ use busbar_kernel_ledger::{ cost::{Money, MoneyError}, }; -/// The transport an admin claim is declared over, and therefore the one a sealed destination for an -/// admin verb carries. -const ADMIN_TRANSPORT: &str = "http"; +/// The transport an admin claim is declared over — read off the admin plane's own claim, never named +/// here — and therefore the one a sealed destination for an admin verb carries. +const ADMIN_TRANSPORT: &str = busbar_core_admin::admin_codec::claims::CLAIMS[0].transport; /// One admin request, exactly as it arrived. /// @@ -1232,13 +1232,12 @@ impl busbar_core_admin::Governance for CoreGovernance { return bound::trust_list_effect(&self.trust).map(|a| a.pack()); } KernelVerb::TrustApprove | KernelVerb::TrustRevoke => { - let decision = if verb == KernelVerb::TrustApprove { + let ruling = if verb == KernelVerb::TrustApprove { busbar_kernel::trust::book::Ruling::Approve } else { busbar_kernel::trust::book::Ruling::Revoke }; - return bound::trust_decide_effect(request, decision, &self.trust) - .map(|a| a.pack()); + return bound::trust_decide_effect(request, ruling, &self.trust).map(|a| a.pack()); } // The two writes replay under contract D-3: a retry carrying the same `Idempotency-Key` // with the same body answers the first answer, byte for byte, and runs nothing again. diff --git a/crates/busbar/src/root/units_admin/tests/units_admin.rs b/crates/busbar/src/root/units_admin/tests/units_admin.rs index dd359aad83..d166d8959c 100644 --- a/crates/busbar/src/root/units_admin/tests/units_admin.rs +++ b/crates/busbar/src/root/units_admin/tests/units_admin.rs @@ -1133,6 +1133,14 @@ fn the_admin_listener_is_exempt_from_the_cap_the_data_listener_is_refused_at() { .into_result(&seal) .expect("an admin unit is never refused at the gate"); assert_eq!(record.transport_chain, vec![ADMIN_TRANSPORT]); + assert_eq!( + record.transport_chain, + busbar_core_admin::admin_codec::claims::CLAIMS + .iter() + .map(|c| c.transport) + .collect::>(), + "the chain is the transport the admin plane's own claim declares" + ); } /// Where an admin unit may go, and what that costs it. diff --git a/crates/busbar/tests/admin_cross_plane/main.rs b/crates/busbar/tests/admin_cross_plane/main.rs index 10648cebea..6fa8f79549 100644 --- a/crates/busbar/tests/admin_cross_plane/main.rs +++ b/crates/busbar/tests/admin_cross_plane/main.rs @@ -38,7 +38,7 @@ pub(crate) fn ensure_seam() { static SEAM_ONCE: std::sync::Once = std::sync::Once::new(); SEAM_ONCE.call_once(|| { // The operator credential's test registry row, before anything resolves the auth axis, in - // the root's own words (`root::auth_bindings::OPERATOR_AUTH_MODULE`; ARCHITECT + // the root's own words (`root::auth_bindings::operator_auth_module`; ARCHITECT // 2026-09-30, KERNEL-AUTH-ZERO Q2). for_each_operator_auth_row!(install_operator_row); fn install_operator_row(door: busbar_kernel::test_support::AuthDoor) { diff --git a/crates/busbar/tests/composition_root_names_no_linked_plugin.rs b/crates/busbar/tests/composition_root_names_no_linked_plugin.rs index 3a35e18df9..60b779022e 100644 --- a/crates/busbar/tests/composition_root_names_no_linked_plugin.rs +++ b/crates/busbar/tests/composition_root_names_no_linked_plugin.rs @@ -293,9 +293,9 @@ host = "unit" 1, "two rows on one crate link it once: {out}" ); - // A row off the door axis claims its own key and opens no upgrade (a door row reads both off - // its door's Statement: `crate::root::doors::{claims_of, upgrades_of}`). - assert!(out.contains("key: busbar_wire::linked::KEY, composes_over: busbar_wire::linked::COMPOSES_OVER, build: busbar_wire::linked::build, claims: __row_claims_0, upgrades: __row_upgrades_0 }"), "{out}"); + // A row off the door axis claims its own key and opens no upgrade and no line (a door row reads + // all three off its door's Statement: `crate::root::doors::{claims_of, upgrades_of, lines_of}`). + assert!(out.contains("key: busbar_wire::linked::KEY, composes_over: busbar_wire::linked::COMPOSES_OVER, build: busbar_wire::linked::build, claims: __row_claims_0, upgrades: __row_upgrades_0, lines: __row_upgrades_0 }"), "{out}"); assert!( out.contains( "fn __row_claims_0() -> Vec<&'static str> {\n vec![busbar_wire::linked::KEY]\n}" diff --git a/crates/plugin-loader/src/dispatch/kinds/auth.rs b/crates/plugin-loader/src/dispatch/kinds/auth.rs index 6422d8cd75..2c13a01a21 100644 --- a/crates/plugin-loader/src/dispatch/kinds/auth.rs +++ b/crates/plugin-loader/src/dispatch/kinds/auth.rs @@ -112,6 +112,18 @@ pub fn declares_chain_module(door: busbar_contract::abi::mechanism::door::DoorFn }) } +/// The principal id the auth plugin behind `door` states as THE OPERATOR CREDENTIAL's +/// (`FACT_OPERATOR` and its `operator_principal`); `None` when it states no operator, or its +/// Statement does not read as an auth Statement. Reads the door's `'static` Statement only; nothing +/// is opened. +#[must_use] +pub fn operator_principal(door: busbar_contract::abi::mechanism::door::DoorFn) -> Option { + crate::dispatch::load::validate::(door) + .ok() + .and_then(|v| facts(&v.statement).ok()) + .and_then(|f| f.operator_principal) +} + /// A `'static` Statement string, copied; `None` when malformed. fn owned(s: AbiStr) -> Option { crate::dispatch::plugin::str_bytes(s).map(|b| String::from_utf8_lossy(b).into_owned()) diff --git a/crates/plugin-loader/src/dispatch/kinds/transport.rs b/crates/plugin-loader/src/dispatch/kinds/transport.rs index b39d701eec..06832af39d 100644 --- a/crates/plugin-loader/src/dispatch/kinds/transport.rs +++ b/crates/plugin-loader/src/dispatch/kinds/transport.rs @@ -62,6 +62,10 @@ pub struct TransportFacts { /// The claims whose row carries a session (`session = 1`): a duplex line, never one request /// and its response. pub sessions: Vec<&'static str>, + /// The claims whose unit 0 opens on the FIRST LINE (their row's `unit0_trigger` is + /// `UNIT0_FIRST_LINE`): a carrier of whole lines, read off the claim rows, as the upgrade + /// lines are. + pub lines: Vec<&'static str>, /// The claims it composes over; empty = directly over the host's socket (a framer) or the /// bottom of its stack (a carrier). pub composes_over: Vec<&'static str>, @@ -131,6 +135,12 @@ fn tail_facts(st: &Statement) -> Result { .map(|c| owned(*c, "claim")) .collect::>()?; // Row `i` describes `claims[i]` (`check_claim_rows` held the counts equal). + let lines = claims + .iter() + .zip(rows) + .filter(|(_, row)| row.unit0_trigger == busbar_contract::abi::transport::UNIT0_FIRST_LINE) + .map(|(name, _)| *name) + .collect(); let upgrades = claims .iter() .zip(rows) @@ -155,6 +165,7 @@ fn tail_facts(st: &Statement) -> Result { claims, upgrades, sessions, + lines, composes_over: under .iter() .map(|s| owned(*s, "composes_over")) diff --git a/qa/kind-isolation.toml b/qa/kind-isolation.toml index a5898f5ce4..f00997bc03 100644 --- a/qa/kind-isolation.toml +++ b/qa/kind-isolation.toml @@ -1548,14 +1548,14 @@ drain = "none: BUSBAR-1.6.0.md grants this class. What this row holds is the N [[law0]] crate = "busbar" axis = "auth" -count = "49" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance. +4 for status row 120 (owner task): root/tests/connector.rs `the_pinned_mint_needs_are_operator_infrastructure` reads the pinned plugin's NEEDS by its crate path and its doc names the divergent pins, 2 hits each (package name + kind-qualified id); test-only, over the granted root -> auth dev edge; RE-ARMED 46 -> 51 (Law 9, BUSBAR-1.6.0.md: it pins its ceiling at TODAY'S MEASURED VALUE): the row went live on predev at dc83ff1553 (#597) and measured 49 there; the 46 was f830faa691's, nine hours older than the arming, so the row armed red. 51 is predev 9c0a394771's measure, at or under the arming value (arming measure 49, plus status row 120 (#704, owner task) at its measured +2 of the +4 its cite approved). LOWERED 51 -> 49: the root-crate no-silent-skip lane (#712) drained two with the skips it removed from crates/busbar/tests, measured 49 on its head (law0-slack)" +count = "43" +cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance. +4 for status row 120 (owner task): root/tests/connector.rs `the_pinned_mint_needs_are_operator_infrastructure` reads the pinned plugin's NEEDS by its crate path and its doc names the divergent pins, 2 hits each (package name + kind-qualified id); test-only, over the granted root -> auth dev edge; RE-ARMED 46 -> 51 (Law 9, BUSBAR-1.6.0.md: it pins its ceiling at TODAY'S MEASURED VALUE): the row went live on predev at dc83ff1553 (#597) and measured 49 there; the 46 was f830faa691's, nine hours older than the arming, so the row armed red. 51 is predev 9c0a394771's measure, at or under the arming value (arming measure 49, plus status row 120 (#704, owner task) at its measured +2 of the +4 its cite approved). LOWERED 51 -> 49: the root-crate no-silent-skip lane (#712) drained two with the skips it removed from crates/busbar/tests, measured 49 on its head (law0-slack); LOWERED 49 -> 43: the Law 0 root lane (lane-law0-root PR1) drains the root's prod naming: the operator credential's provider word is read off the manifest's operator row (root::auth_bindings::operator_auth_module), test cfgs ride the linked auth axis, and a config-style enum is imported under a neutral name (law0-slack)" [[law0]] crate = "busbar" axis = "export" -count = "15" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance" +count = "14" +cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; LOWERED 15 -> 14: the Law 0 root lane (lane-law0-root PR1): the metrics opt-in comment names the scrape exporter by its role (law0-slack)" [[law0]] crate = "busbar" @@ -1566,20 +1566,20 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain [[law0]] crate = "busbar" axis = "instance:auth" -count = "24" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 22 -> 24 (Law 9, BUSBAR-1.6.0.md: it pins its ceiling at TODAY'S MEASURED VALUE): the row went live on predev at dc83ff1553 (#597) and measured 24 there; the 22 was f830faa691's, nine hours older than the arming, so the row armed red. 24 is predev 9c0a394771's measure, at or under the arming value" +count = "22" +cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 22 -> 24 (Law 9, BUSBAR-1.6.0.md: it pins its ceiling at TODAY'S MEASURED VALUE): the row went live on predev at dc83ff1553 (#597) and measured 24 there; the 22 was f830faa691's, nine hours older than the arming, so the row armed red. 24 is predev 9c0a394771's measure, at or under the arming value; LOWERED 24 -> 22: the Law 0 root lane (lane-law0-root PR1): the operator credential's provider word is read off the manifest's operator row, no literal in root source (law0-slack)" [[law0]] crate = "busbar" axis = "instance:export" -count = "33" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance" +count = "32" +cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; LOWERED 33 -> 32: the Law 0 root lane (lane-law0-root PR1): the `--list-plugins` column header, v1.5.5's bytes (v1.5.5 crates/busbar/src/main.rs:419-422), is printed as the one line it is (root::cli::LIST_PLUGINS_HEADER), no `file` literal (law0-slack)" [[law0]] crate = "busbar" axis = "instance:secret" -count = "35" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 34 -> 35, the measure at the arming SHA dc83ff1553 (#597; Law 9). Predev 9c0a394771 measures 36: #560 (7b5f5d8be4) grew it after the row was live, invisible to a figure that counted findings. That excess is a Law 0 rise, so it stays RED until drained; this row does not raise to cover it" +count = "34" +cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 34 -> 35, the measure at the arming SHA dc83ff1553 (#597; Law 9). Predev 9c0a394771 measures 36: #560 (7b5f5d8be4) grew it after the row was live, invisible to a figure that counted findings. That excess is a Law 0 rise, so it stays RED until drained; this row does not raise to cover it; LOWERED 35 -> 34: the Law 0 root lane (lane-law0-root PR1): the `--list-plugins` column header, v1.5.5's bytes (v1.5.5 crates/busbar/src/main.rs:419-422), is printed as the one line it is (root::cli::LIST_PLUGINS_HEADER), no `file` literal (law0-slack)" [[law0]] crate = "busbar" @@ -1590,8 +1590,8 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain [[law0]] crate = "busbar" axis = "plane" -count = "826" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 798 -> 822 (Law 9, BUSBAR-1.6.0.md: it pins its ceiling at TODAY'S MEASURED VALUE): the row went live on predev at dc83ff1553 (#597) and measured 826 there; the 798 was f830faa691's, nine hours older than the arming, so the row armed red. 822 is predev 9c0a394771's measure, at or under the arming value; REBALANCED 822 -> 826 (Q128, PR #686 architect ruling, BUSBAR-1.6.0.md l.475-483): the 4 hits busbar-kernel × plane gave up (1172 -> 1168), carried verbatim by the cross-plane cells that moved from crates/busbar-kernel/tests/ into crates/busbar/tests/ (the `LLM`/`llm-plane` prose in auth_cross_plane.rs, alarm_silence_cross_plane.rs, key_expires_at_cross_plane.rs and residual_envelope_cross_plane.rs); the law0 total does not rise" +count = "774" +cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 798 -> 822 (Law 9, BUSBAR-1.6.0.md: it pins its ceiling at TODAY'S MEASURED VALUE): the row went live on predev at dc83ff1553 (#597) and measured 826 there; the 798 was f830faa691's, nine hours older than the arming, so the row armed red. 822 is predev 9c0a394771's measure, at or under the arming value; REBALANCED 822 -> 826 (Q128, PR #686 architect ruling, BUSBAR-1.6.0.md l.475-483): the 4 hits busbar-kernel × plane gave up (1172 -> 1168), carried verbatim by the cross-plane cells that moved from crates/busbar-kernel/tests/ into crates/busbar/tests/ (the `LLM`/`llm-plane` prose in auth_cross_plane.rs, alarm_silence_cross_plane.rs, key_expires_at_cross_plane.rs and residual_envelope_cross_plane.rs); the law0 total does not rise; LOWERED 826 -> 774: the Law 0 root lane (lane-law0-root PR1) drains the root's prod plane naming: plane-naming prose reworded, the line carrier read off the transports' declared rows (law0-slack)" [[law0]] crate = "busbar" @@ -1602,8 +1602,8 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain [[law0]] crate = "busbar" axis = "transport" -count = "224" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; LOWERED 215 -> 208, predev 9c0a394771's measure: the drain landed without giving its row back (Law 9: the ceiling ratchets down); REBALANCED 207 -> 224 (+17), the verbatim listener serve loop moved out of busbar-kernel into the root (#710), paired with busbar-kernel x transport 285 -> 268 (-17) so the law0 total does not rise (ARCHITECT RULING 2026-10-10, https://github.com/GetBusbar/busbar/pull/710#issuecomment-6096420101; BUSBAR-1.6.0.md l.475-483 INBOUND-LISTEN: the root's stream hand-up)" +count = "192" +cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; LOWERED 215 -> 208, predev 9c0a394771's measure: the drain landed without giving its row back (Law 9: the ceiling ratchets down); REBALANCED 207 -> 224 (+17), the verbatim listener serve loop moved out of busbar-kernel into the root (#710), paired with busbar-kernel x transport 285 -> 268 (-17) so the law0 total does not rise (ARCHITECT RULING 2026-10-10, https://github.com/GetBusbar/busbar/pull/710#issuecomment-6096420101; BUSBAR-1.6.0.md l.475-483 INBOUND-LISTEN: the root's stream hand-up); LOWERED 224 -> 192: the Law 0 root lane (lane-law0-root PR1): the line carrier is the linked claim whose row opens on its first line (root::serve::lines::line_carrier), the request wire is the admin plane's declared claim transport (root::listener::REQUEST_WIRE) (law0-slack)" [[law0]] crate = "busbar" @@ -1788,8 +1788,8 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain [[law0]] crate = "busbar-kernel" axis = "plane" -count = "1122" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; LOWERED 1193 -> 1175, predev 9c0a394771's measure: the drain landed without giving its row back (Law 9: the ceiling ratchets down); LOWERED 1175 -> 1173, the merge-base d7929b661d's measure, which GetBusbar/busbar#570 holds (its scrape double spells no plane alias) (Law 9: the ceiling ratchets down to today's number); LOWERED 1173 -> 1172, the gate's measure on this branch merged with predev 1617e9f019: Q128 A4's plane_driver/gated.rs drain; REBALANCED 1172 -> 1168 (Q128, PR #686 architect ruling, BUSBAR-1.6.0.md l.475-483): the cross-plane cells moved verbatim into the composition root's crates/busbar/tests/, which takes the same 4 hits (busbar × plane 822 -> 826); LOWERED 1168 -> 1141 by row 157: the hits drained with the deleted HOT trust and guard slots (plane_host/trust.rs, plane_host/guard.rs); LOWERED 1141 -> 1132 by row 156: the hits drained with the deleted kernel call log (calllog.rs, plane/calllog.rs); LOWERED 1132 -> 1128 by this PR: the deletion of the kernel's dead ask-state seal (audit K2-H3) removes four hits, its two `crate::mcp::roots` doc links and its two `\\x6dcp` seal domains; LOWERED 1128 -> 1122 by status row 130 E2: net_guard.rs and its two suites deleted (six plane hits, the gate's measure on the E2 candidate)" +count = "1100" +cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; LOWERED 1193 -> 1175, predev 9c0a394771's measure: the drain landed without giving its row back (Law 9: the ceiling ratchets down); LOWERED 1175 -> 1173, the merge-base d7929b661d's measure, which GetBusbar/busbar#570 holds (its scrape double spells no plane alias) (Law 9: the ceiling ratchets down to today's number); LOWERED 1173 -> 1172, the gate's measure on this branch merged with predev 1617e9f019: Q128 A4's plane_driver/gated.rs drain; REBALANCED 1172 -> 1168 (Q128, PR #686 architect ruling, BUSBAR-1.6.0.md l.475-483): the cross-plane cells moved verbatim into the composition root's crates/busbar/tests/, which takes the same 4 hits (busbar × plane 822 -> 826); LOWERED 1168 -> 1141 by row 157: the hits drained with the deleted HOT trust and guard slots (plane_host/trust.rs, plane_host/guard.rs); LOWERED 1141 -> 1132 by row 156: the hits drained with the deleted kernel call log (calllog.rs, plane/calllog.rs); LOWERED 1132 -> 1128 by this PR: the deletion of the kernel's dead ask-state seal (audit K2-H3) removes four hits, its two `crate::mcp::roots` doc links and its two `\\x6dcp` seal domains; LOWERED 1128 -> 1122 by status row 130 E2: net_guard.rs and its two suites deleted (six plane hits, the gate's measure on the E2 candidate); LOWERED 1122 -> 1100: the gate's EXPORT_STREAMS_KEY exemption (xtask matrix.rs; ARCHITECT ruling, Law 0 root lane): an export entry's frozen 1.5.x `streams: [` key (v1.5.5 crates/busbar/src/config/migrate_export.rs:17) is the export projection, not the plane; 22 in the kernel's export projection and migration (law0-slack)" [[law0]] crate = "busbar-kernel" diff --git a/xtask/src/gates/kind_isolation/matrix.rs b/xtask/src/gates/kind_isolation/matrix.rs index c1f7b1641e..eaeda13a7a 100644 --- a/xtask/src/gates/kind_isolation/matrix.rs +++ b/xtask/src/gates/kind_isolation/matrix.rs @@ -978,6 +978,11 @@ fn mask_chain(m: MaskInputs<'_>) -> String { let masked = external::mask_kernel_facade(rel, &masked); // English words that are also instance names are not counted as English prose. let masked = mask_english_prose(rel, &masked); + // An export entry's frozen 1.5.x `streams: [` key is the export projection, not the plane. + let masked = match mask_export_streams_key(&masked) { + Some(owned) => std::borrow::Cow::Owned(owned), + None => masked, + }; // Instance ids that are also a crate's or an abbreviation's name count only as references. let masked = mask_colliding_words(rel, &masked); // `unix` as the operating system (a cfg, `std::os::unix`, the clock) is not the carrier. @@ -1346,6 +1351,51 @@ fn mask_english_prose<'a>(rel: &str, text: &'a str) -> std::borrow::Cow<'a, str> std::borrow::Cow::Owned(out) } +/// THE FROZEN 1.5.x EXPORT KEY (ARCHITECT ruling, Law 0 root lane: a gate exemption only for frozen +/// 1.5.x bytes, modelled on [`BARE_WORD_COLLISIONS`]). `streams` is the streaming plane's section-key +/// alias, and it is also the key of an `export:` entry's projection list — `streams: [logs, +/// identity, decisions, …]` (v1.5.5 crates/busbar/src/config/migrate_export.rs:17, :178), frozen +/// operator config text every export entry carries. The two are told apart by the value the key +/// takes: an export entry's `streams:` is a flow LIST, and a plane's section is a mapping. So a +/// `streams` standing on its own (not joined to a neighbouring name by `-`, `_`, `.` or a letter), +/// followed by `:` (not `::`) and then, past spaces, by `[`, is masked before the scanners read the +/// line; in every other position — a section key over a mapping, an identifier, a literal of its +/// own — it still counts. +const EXPORT_STREAMS_KEY: &str = "streams"; + +/// `text` with every export entry's `streams: [` key masked (same-length filler, so lines and +/// columns hold), or `None` when it holds none; see [`EXPORT_STREAMS_KEY`]. +fn mask_export_streams_key(text: &str) -> Option { + if !text.contains(EXPORT_STREAMS_KEY) { + return None; + } + let b = text.as_bytes(); + let joins = |c: u8| c.is_ascii_alphanumeric() || matches!(c, b'-' | b'_' | b'.'); + let mut out = b.to_vec(); + let mut changed = false; + let mut from = 0; + while let Some(off) = text[from..].find(EXPORT_STREAMS_KEY) { + let i = from + off; + let j = i + EXPORT_STREAMS_KEY.len(); + from = j; + if i > 0 && joins(b[i - 1]) { + continue; + } + if b.get(j) != Some(&b':') || b.get(j + 1) == Some(&b':') { + continue; + } + let mut k = j + 1; + while matches!(b.get(k), Some(b' ' | b'\t')) { + k += 1; + } + if b.get(k) == Some(&b'[') { + out[i..j].fill(b'x'); + changed = true; + } + } + changed.then(|| String::from_utf8(out).expect("ascii-for-ascii")) +} + /// The byte offset of a `//` comment on `line` that is not inside a `"…"` string literal. fn comment_start(line: &str) -> Option { let b = line.as_bytes(); @@ -4453,6 +4503,40 @@ pub fn selftest<'a>( &["unlisted-cell", &fixture_subject("plane")], )); + // AN EXPORT ENTRY'S FROZEN 1.5.x `streams: [` KEY IS THE EXPORT PROJECTION, NOT THE PLANE + // ([`EXPORT_STREAMS_KEY`]). The fixture holds only export entries, in a YAML document and in a + // Rust string, and no row: the plane cell stays at zero (GREEN). The same word keying a mapping + // — the plane's section — beside them is a hit, and the cell becomes an edge nobody listed (RED). + let export_fixture = |extra: Option<(&'static str, &'static str)>| { + let mut files = vec![ + ( + "export.yaml", + "export:\n sink: { module: tail, streams: [logs, costs] }\n other:\n streams: [metrics]\n", + ), + ( + "export.rs", + "pub const E: &str = \" tp: { module: x, streams: [metrics] }\";\n", + ), + ]; + files.extend(extra); + fixture_files(&files) + }; + report.push(prove_rows_green( + cx, + gate, + "an export entry's frozen 1.5.x `streams: [` key is not the plane", + &[ROW_MATRIX], + export_fixture(None), + )); + report.push(prove_rows_red( + cx, + gate, + "`streams:` keying a mapping beside the export entries still counts", + &[ROW_MATRIX], + export_fixture(Some(("section.yaml", "streams:\n gw: {}\n"))), + &["unlisted-cell", &fixture_subject("plane")], + )); + // AN INSTANCE ID THAT IS ALSO A CRATE'S OR AN ABBREVIATION'S NAME COUNTS ONLY AS A REFERENCE // ([`COLLIDING_INSTANCE_WORDS`]). The fixture holds only the non-references and no row: the // `http` crate's paths, `axum::http`, HTTP in a comment, a URL scheme, whitespace called `ws`, From e62566853c96876e406f333e727dd896a17cc8ca Mon Sep 17 00:00:00 2001 From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com> Date: Wed, 14 Oct 2026 05:37:59 -0700 Subject: [PATCH 2/2] PR1: the auth-axis cfgs are declared from the manifest rows (check-cfg) linked_axis_auths was used but never declared, so check-cfg refused the build. build.rs now declares it with the other linked_axis_* cfgs (AUTH_AXIS, the same constant linked_gen reads), and states two more off the same rows: linked_every_auth (every auths row enabled) and linked_operator_auth (the operator-auth table's row enabled). The gates keep 1.5.5's meaning: the declared-credentials suite needs a plugin serving each style (was auth-header + auth-sigv4), so it rides linked_every_auth; the linked operator-credential suite needs the operator row (was auth-admin-tokens), so it rides linked_operator_auth. RED: tests/linked_auth_cfgs.rs holds each cfg to the manifest rows and the build's enabled features. --- crates/busbar/build.rs | 22 ++++++++++ crates/busbar/src/root/dispatch.rs | 6 +-- crates/busbar/src/root/linked.rs | 2 +- crates/busbar/tests/linked_auth_cfgs.rs | 56 +++++++++++++++++++++++++ 4 files changed, 82 insertions(+), 4 deletions(-) create mode 100644 crates/busbar/tests/linked_auth_cfgs.rs diff --git a/crates/busbar/build.rs b/crates/busbar/build.rs index af389df585..ed47258bfc 100644 --- a/crates/busbar/build.rs +++ b/crates/busbar/build.rs @@ -174,6 +174,26 @@ fn main() { if every_plane { println!("cargo::rustc-cfg=linked_every_plane"); } + // `linked_every_auth`: EVERY linked row on the auth axis (`AUTH_AXIS`) is enabled — the shape a + // suite binding every dialect's declared scheme on the plugin serving its style needs (each + // style is then served), read off the same table. + println!("cargo::rustc-check-cfg=cfg(linked_every_auth)"); + let every_auth = metadata_map(&manifest, "package.metadata.busbar.linked-axes") + .iter() + .filter(|(_, axes)| axes.split_whitespace().any(|a| a == AUTH_AXIS)) + .all(|(feature, _)| enabled(feature)); + if every_auth { + println!("cargo::rustc-cfg=linked_every_auth"); + } + // `linked_operator_auth`: the row `[package.metadata.busbar.operator-auth]` names (the operator + // credential's auth plugin) is enabled — what a test that needs the operator credential to + // answer gates on, without spelling the row's feature. + println!("cargo::rustc-check-cfg=cfg(linked_operator_auth)"); + if metadata_value(&manifest, "package.metadata.busbar.operator-auth", "row") + .is_some_and(|row| enabled(&row)) + { + println!("cargo::rustc-cfg=linked_operator_auth"); + } // THE LINKED PLANE ROWS FOR THE INTEGRATION TESTS (tests only include it): each enabled linked // plane crate's registry row, assembled from its `linked` entry exactly as the root assembles it, @@ -471,6 +491,8 @@ fn linked_axis_cfgs(manifest: &str, enabled: &dyn Fn(&str) -> bool) -> (Vec = Vec::new(); diff --git a/crates/busbar/src/root/dispatch.rs b/crates/busbar/src/root/dispatch.rs index c5f228a4c4..796f6173da 100644 --- a/crates/busbar/src/root/dispatch.rs +++ b/crates/busbar/src/root/dispatch.rs @@ -136,8 +136,8 @@ mod tests; // The suite binds each dialect's declared scheme on the LINKED auth plugins serving its style (the // static schemes and the signing scheme; the default distribution links a plugin serving each). A -// build that links no auth row links no plugin serving either style, so the bind is refused there: -// the suite rides the linked auth axis. -#[cfg(all(test, linked_axis_auths))] +// build missing an auth row may link no plugin serving one of the styles, so the bind is refused +// there: the suite rides every linked auth row (`linked_every_auth`, build.rs). +#[cfg(all(test, linked_every_auth))] #[path = "tests/declared_credentials.rs"] mod declared_credentials_tests; diff --git a/crates/busbar/src/root/linked.rs b/crates/busbar/src/root/linked.rs index 389e6050de..c6f6407a1e 100644 --- a/crates/busbar/src/root/linked.rs +++ b/crates/busbar/src/root/linked.rs @@ -1493,7 +1493,7 @@ mod tests; #[path = "tests/linked_secret_sources.rs"] mod secret_source_tests; -#[cfg(all(test, linked_axis_auths, linked_axis_body_ingress))] +#[cfg(all(test, linked_operator_auth, linked_axis_body_ingress))] #[path = "tests/linked_auth.rs"] mod auth_tests; diff --git a/crates/busbar/tests/linked_auth_cfgs.rs b/crates/busbar/tests/linked_auth_cfgs.rs new file mode 100644 index 0000000000..8a6669c769 --- /dev/null +++ b/crates/busbar/tests/linked_auth_cfgs.rs @@ -0,0 +1,56 @@ +// SPDX-License-Identifier: Apache-2.0 +// Copyright (C) 2026 Busbar Inc and contributors + +//! THE AUTH-AXIS CFGS ARE THE MANIFEST'S ROWS, READ AS DATA. `build.rs` declares and sets three +//! cfgs off `[package.metadata.busbar.linked-axes]` and `[package.metadata.busbar.operator-auth]`, +//! and the root's auth suites gate on them instead of spelling a plugin's feature: +//! +//! - `linked_axis_auths`: SOME row on the auth axis is enabled; +//! - `linked_every_auth`: EVERY row on the auth axis is enabled (each scheme's style is served); +//! - `linked_operator_auth`: the row the `operator-auth` table names is enabled. +//! +//! RED: a cfg used but never declared is a compile error (`check-cfg`), and a cfg declared but set +//! from the wrong rows fails here — each is held to the rows and this build's enabled features. + +mod common; + +/// The auth axis's manifest name, as `[package.metadata.busbar.linked-axes]` writes it. +const AUTH_AXIS: &str = "auths"; + +#[test] +fn the_auth_axis_cfgs_are_read_off_the_manifest_rows() { + let on = common::enabled_features(); + let auth_rows: Vec = common::manifest_table("package.metadata.busbar.linked-axes") + .into_iter() + .filter(|(_, axes)| axes.split_whitespace().any(|a| a == AUTH_AXIS)) + .map(|(feature, _)| feature) + .collect(); + assert!( + !auth_rows.is_empty(), + "the manifest links no row on the `{AUTH_AXIS}` axis" + ); + assert_eq!( + cfg!(linked_axis_auths), + auth_rows.iter().any(|f| on.contains(f.as_str())), + "linked_axis_auths: some of {auth_rows:?} enabled in {on:?}" + ); + assert_eq!( + cfg!(linked_every_auth), + auth_rows.iter().all(|f| on.contains(f.as_str())), + "linked_every_auth: all of {auth_rows:?} enabled in {on:?}" + ); + let operator: String = common::manifest_table("package.metadata.busbar.operator-auth") + .into_iter() + .find(|(k, _)| k == "row") + .map(|(_, row)| row) + .expect("`[package.metadata.busbar.operator-auth]` states its `row`"); + assert!( + auth_rows.contains(&operator), + "the operator credential's row `{operator}` is on the `{AUTH_AXIS}` axis" + ); + assert_eq!( + cfg!(linked_operator_auth), + on.contains(operator.as_str()), + "linked_operator_auth: `{operator}` enabled in {on:?}" + ); +}