Repository navigation
a2a push trust: the operator's agent_push.ca through the connector's per-connection trust - #1001
Merged
Merged
Conversation
…lm, switched on by the plane's own webhooks: section, verified by the auth kind, answered ROUTE_LOCAL (ARCHITECT 2026-10-14 option A)
…, stacked on #787: the prepass lifts a plane's owned section raw
… per-connection trust (owned.<section>.<key>)
ARCHITECT ruling 2026-10-14: no new connector knob and no a2a key in core or in agents:. The a2a
plane owns a section beside agents:, `agent_push: { ca: <PEM> }`, lifted raw by #966's prepass, and
its push need's trust_from names it in a namespace of its own, `owned.agent_push.ca`.
- busbar-contract: section::OWNED_PATH_PREFIX / owned_path (the owned namespace, no fallback to
settings.); abi::plane::EXT_OWNED, the refresh extensions key carrying the owned sections (the
open already carries them in PlaneOpenIn::owned; §11, no version bump; busbar_plugin.h follows).
- plugin-loader: declare_targeted resolves an owned. trust_from against the plane's owned sections
(PlaneOpenIn::owned at open, EXT_OWNED at refresh), never the settings; refresh_door carries the
owned sections under EXT_OWNED.
- busbar-core-connector: an owned. trust_from is optional by definition (absent = the public roots
alone); a written one that does not parse is refused, as a settings. one is. settings. paths keep
their required semantics.
- root: an owned trust anchor the operator wrote that the table refused refuses the boot, naming the
key; a config apply hands a door plane its owned sections from the generation's projection (the
raw sections join DoorConfig.sections).
- busbar-plane-a2a: SECTIONS states agent_push beside agents:; NEED_OPEN_WEB's trust_from is
PUSH_TRUST_FROM; open and refresh judge the section's shape (ca alone, non-empty text).
- REDs: root cells (a delivery to a webhook under the operator's agent_push.ca is made; one under
another CA is refused; without the section a delivery trusts the public roots alone; a malformed
agent_push.ca refuses the boot), connector trust_from_tests (absent owned anchor declared over the
public roots; written anchor serves its CA and refuses another; written unparseable anchor refused;
settings. stays required), loader conn_services_tests (an owned trust_from resolves against the
owned sections alone), contract conn_tests (the owned namespace), plane push/conformance pins.
- CHANGELOG Added line; docs/a2a.md says which certificates a delivery trusts.
… a malformed anchor is refused and the running anchor kept ARCHITECT ruling 2026-10-14 on #1001: boot validity and apply validity are one rule. - busbar-kernel appbuild: set_config_check, the composition root's own check of a resolved configuration, run by build_app_from_config before any part of it is built or installed. A refusal returns the check's words and leaves the running generation untouched: no swap, so no door refresh and no re-declaration. - root door_steps: owned_anchor_refusal, the one rule (the connector's own reading, operator_ca_config), and owned_anchors_refusal over a configuration's sections; boot's compose judges a plane's owned anchors by it (replacing the connection-table read) and registers them; owned_anchor_check, bound in main, judges every registered anchor as an apply's configuration writes it. The same words at boot and apply: "`agent_push.ca` is not a usable trust anchor: ...". - REDs: kernel a_configuration_the_root_check_refuses_is_refused_by_the_build; root an_owned_anchor_the_boot_would_refuse_is_refused_by_the_same_rule; a2a root cell an_apply_carrying_a_malformed_agent_push_ca_is_refused_and_deliveries_keep_the_anchor (the apply is refused in the boot's words and the running door still delivers under the CA it was composed with). - CHANGELOG and docs/a2a.md say an apply carrying an unusable ca is refused with the same words.
…in place of the process-global check; the retry doc names the three attempts Coordinator ruling on #1001: no new process-global seam. - busbar-kernel appbuild: `pub trait RootRules { fn check(&self, cfg) -> Result<(), String> }` and `AcceptAll`; build_app_from_config takes `rules: &Arc<dyn RootRules>` and judges the configuration by it first. The static CONFIG_CHECK and set_config_check are gone. - App keeps `root_rules`, the rules it was built under; every admin apply, reset, settings and named-map rebuild passes the running App's (core-admin handlers.rs, named_map.rs), and the config dry run (service_operations.rs validate_config_blocking) judges by them too. The kernel fixture and the busbar build tests pass AcceptAll. - root door_steps::Rules holds the owned trust anchors of the composed door planes (main holds them from Served::need_trust once the planes are composed) and implements RootRules with the one rule, owned_anchors_refusal; the static registry is gone. CONFIG_PROJECTION is untouched. - REDs kept: kernel a_configuration_the_root_rules_refuse_is_refused_by_the_build (refusing rules passed to the build; the built App keeps the rules), root an_owned_anchor_the_boot_would_refuse_is_refused_by_the_same_rule, a2a cell an_apply_carrying_a_malformed_agent_push_ca_is_refused_and_deliveries_keep_the_anchor (the root's Rules passed to the apply's build). - docs/a2a.md: a failed push delivery is retried, at most three attempts (250 ms, then 500 ms, each moved by up to 20%), only on a transport error, a 5xx or a 429 (busbar-plane-a2a push.rs:48-52).
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
… from the gates log of 80d5f03 - hooks parity (#989): the v1.5.5 hook corpus moves out of the kernel's source into testing/hook-parity/v1.5.5-hook-corpus.tsv, read by the count test; its origins are `proxy`/`core` and the constants PROXY_ORIGIN/CORE_ORIGIN (gate hook-parity-count reads them). The listing named plane, hook and export instances in a neutral crate: kernel x plane +84, x hooks +18, and the instance-noun-neutrality llm census. - config-schema: a section a plane owns beside its declaring one is the endpoint DOOR only for the plane the kernel names its owner (EndpointSection::OWNER); any other is RAW, carried by DeployCfg::plane_raw, as the pre-pass lifts it since #966 (a2a's agent_push, #1001). Selftest: two doors under the owner stay RED; a non-owner's beside section is carried. - reachability: serve_datagram.rs is the module `serve_datagram`, named for its file like serve_framed. - teller-steps / libtest_path: door cells are read off the linked rows on the plane-door axis, the rows build.rs mounts since #1006 deleted [package.metadata.busbar.door-cells]. - plane-purity dialect / neutral-no-dialect: LegacyLaneKeys flattens ProviderLaneCaps rather than spelling its fields (#957). - structure-lint: stand_in.rs's inline tests move to tests/stand_in_tests.rs (#1010). - config-scope: auth/mod.rs's test-idp-module arm is braced like its sibling, so the scanner sees the `new` construction in the arm after it. - instance-noun-neutrality mcp: the a2a client cell's rationale (and its capability-equality row) names no other plane. - hold-escapes: host_disk.rs::start (#864's disk lane job loop) is a reviewed known site. - hook-parity-count: the TODO's M4 row reads 181. - design-bindings: PB-50's config.migrate family is 158 cells (#1026 added two). - kind-isolation law0: busbar auth 24, instance:auth 10, instance:export 25, plane 525, transport 97 are the merged tree's measure (#1038's figures were T+O-B over a virtual base carrying #993, #1017, #1020, which w2 does not carry); busbar-contract export 1 -> 0 and transport 226 -> 225 (slack).
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…eld; clippy; the six Law 0 cells the merge grew; config-schema snapshot - busbar-core-connector dialled.rs (#837 over #893's Piece): the datagram leg's body piece states `fault: None` and `declared_len: None` (E0063). - busbar-kernel appbuild: build_app_from_config takes the root's rules as an eighth input (#1001); allowed too_many_arguments with that reason. plugin-loader secret_disk_tests: let-else for the refused declare (clippy err_expect). - Law 0 growth over the merge-base (gates log of 3598829 and the group measures): kernel x plane: the failover predicate's docs and test say verdict, not decision (#890); kernel x instance:secret: the two new SecretRef literals key on SECRET_MODULE_ENV (#863/#864); kernel x auth: the resolved provider's and the token endpoint's docs name the client-credentials style without spelling the module (#957, #876); connector x transport: spawn_env's doc says program members (#865); contract x plane: section.rs's trust_from doc names a plane's push trust (#1001); busbar x vendor: the health-probe cell's catalog entry is testing/root-fixtures data (#1039); busbar x instance:secret: the pinned-cells selftest builds its fixture citing the pinned file rather than re-keying it (#1006). - config-schema: the RAW carrier records each section as the map's value type; the snapshot gains DeployCfg.agent_push (serde_yaml::Value, #1001), ProviderLaneCaps (its Deserialize, round 2) and the `type ProviderTable` alias (#957). - qa/scripts-allowlist.toml: the three twilio conformance legs (#998), oracle-driver like their siblings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft (rule 19), stacked on #787 (base
lane-p3-flip-a2a) with #966 (lane-llm-responses-webhook4f31fc8) merged in: #966's prepass lifts a plane-owned section raw, which this uses. Conformance-gaps item 1, ARCHITECT ruling 2026-10-14.The a2a plane owns
agent_push: { ca: <PEM> }besideagents:; its push need'strust_fromisowned.agent_push.ca, a namespace of its own (no fallback tosettings.). No new connector knob, no a2a key in core or inagents:.section::OWNED_PATH_PREFIX/owned_path;abi::plane::EXT_OWNED, the refresh extensions key for the owned sections (open already carriesPlaneOpenIn::owned; §11, no version bump;busbar_plugin.hupdated by hand to the generator's form).declare_targetedresolves anowned.path against the owned sections only (open:PlaneOpenIn::owned; refresh:EXT_OWNED);refresh_doorcarries them.owned.anchor is optional (absent = public roots alone); written but unparseable is refused, as before.settings.stays required.agent_pushin SECTIONS;NEED_OPEN_WEB.trust_from = owned.agent_push.ca; open/refresh judge the section's shape.trust_from_tests(4), loaderconn_services_tests, contractconn_tests, plane push/conformance pins.