Repository navigation
P3 FLIP-LLM: the llm plane served through its door on the plane driver (dev-only llm-on-driver switch) - #464
Merged
Merged
Conversation
…ess walk, and the driver's flip seams (BUSBAR-1.6.0.md Part 3 section 12, lines 2573-2576 "the route step is the kernel's existing egress walk ... the driver builds no second walk", 2655-2659 "A far end exposes its candidates and a constraint the hooks apply") Ported from the lane-dg-llm snapshot onto the foundation (5e0560f) without its a2a/h2/DEL-LLM pieces: - busbar-kernel-egress: the walk takes the unit's hook Shape (Walk::next_shaped): each pick's admissible members as the hooks keep and order them (the order is the pick's preference), a required restrict no member satisfies sheds Shed::restrict_no_lane; Walk::walking names the pool the walk is in. Member.passthrough (a pool's upstream_credentials: passthrough), the latency port. - EgressFarEnd: candidates/constrain/remaining/failure (the routing tap's untried count and last failover label), MemberFacts (tags, tier, cost), the restrict's veto at the fallback boundary, the exhaustion terminal's own words (Pick/End::Exhausted carry Shed::detail), a terminal's dispatch relayed and never failed over or counted as an attempt, the latency signal at the response head, the pool-passthrough credential lending (an empty credential when the caller presented none). - the driver: DriverSteps::refused_words and ::attempting, render_as's Retry-After, the head stated once; hooks.rs binds the unit's dialect, reads the current generation (HostSource), the production EngineCaller, a taps-only unit proceeds over an unreadable request, the access amendment names the caller's governance key. - the kernel's own tables view (ConfigTables) and the root's config projection on App; ingress: any_body_ingress; telemetry, core_routes, router and caller-credential seams the door path uses. - tests: the K5 far-end constraint and restrict cases, the least-bad relay, the pool-passthrough lending, the K5 hook cases over the driver double's project (plane_driver_hook_cases.rs).
…t module, its door's tail facts, and the dialect auth parameters (BUSBAR-1.6.0.md Part 3 section 12 lines 2568-2571 "`project`. A pure plane op that writes the hook kind's own `RequestView`"; lines 2655-2658 "`project` may return a rewrite, which the plane applies and re-projects; `PromptView` carries plane-flattened messages; the projection may carry the end user") Ported from the lane-dg-llm snapshot (f804c37, d6bca87, cd46f09, b0b7299 and the plane parts of 24cda1e/5ac7cc8790/b26be1ca6d/99d4dd92e9/e581423073), without the LLM-UA, DEL-LLM or a2a pieces: - busbar-plane-llm exchange/project.rs: the hook view read through the operation's own reader, as 1.5.5's hook seam read it (turns, screenable characters, tools, end user, the system field and one (role, text) per wire turn); a request-stage rewrite applied in the unit's own dialect and kept as the unit's request, so every attempt is written from it; an unreadable body REFUSED, the unit's refusal then reading 1.5.5's unreadable-body sentence; a gate veto rendered as the gate's own words. - plane_door: the `project` slot (strings in the host arena, turns in the host turn buffer, the one re-call when short); an arrival names its route (the model as a pool first, else a direct entry; ARCHITECT Q-SW6/Q-FL2/Q-FL3); the token classes under the card names 1.5.5 priced (input, output, cache_read, cache_write); `pool` as the registration noun and the grant's scope kind; each dialect's default outbound style and one need per style (ARCHITECT Q-L1-AUTH (A)). - AUTHPARAMS (ARCHITECT RULINGS 2026-10-03 14:45Z, Q-L6-AUTHPARAMS): DialectAuth.params appended (layout golden and C header follow), checked by check_dialect_auth and kept by the loader; the anthropic key-family and bedrock sigv4 parameters the dialects state. - the far request carries its dialect's declared static fields (ARCHITECT SD-3 (1)) and lays a same-dialect caller's fields over busbar's as 1.5.5's header map did; a whole rendered answer states its length. - the auth plugins' compiled-in entries (busbar-auth-sigv4, busbar-auth-oauth) for the `auths` row.
… composed on the serve path and every arrival it claims is served through the kernel's plane driver, its hook stage bound and its egress the model-serving walk (BUSBAR-1.6.0.md Part 3 section 12 lines 2669-2674 "The switch ... a fold adds only its door rows. A development-only cargo feature flips a plane onto the driver during its fold ... The llm flip's gate is every hook test green on the driver"; lines 2573-2576 the route pump is the kernel's existing egress walk) Ported from the lane-dg-llm snapshot's FLIP-LLM (2), (4), (5), (6), (8a), (8b), oracle rounds and follow-ups (24cda1e, e91a20b, 5ac7cc8, b26be1c, c679bf1, 072d65c, 99d4dd9, 8b7b35d, e581423, 8039732, 5613e7b), onto predev's serving slice, without the default flip, DEL-LLM, DECL-FOLD, h2 or K7-door-probe pieces: - root::door_steps: kernel_sections (providers' dialect fields, models, pools, limits) beside the door sections; the plane serving the pools map walks the uniform model-serving section; DoorConfig per generation (the root's ConfigProjection); the destination guard at verify with 1.5.5's words; a blocked admission's message and Retry-After; 1.5.5's flat request fee on that plane; the dialect's auth parameters sealed under the provider's own (sealed_settings). - root::model_egress (new): the model-serving walk over the kernel's own lane cells, every bound the configuration states (weights, attempt timeouts, max_concurrent, context windows, failover budget, on_exhausted, per-pool breaker ladders), outcomes through the lane store's record calls. - root::serve: the HookStage (HostHooks over the current generation's engine host, EngineCaller), a config apply refreshing the door-served llm, the open front door admitting anonymously on the pools plane, the forward span, the request families and translation counter. - busbar Cargo.toml: `llm-on-driver` carries the sigv4 and oauth auth rows (auth-sigv4, auth-oauth on the `auths` axis, ARCHITECT Q-L1-AUTH (A)), so the default build is unchanged. - tests: tests/hook_parity_driver (the 1.5.5 hook tests of llm origin, 69, verbatim names and values, plus the 16 held legacy-crate hook tests; 85/85 green on the driver), root::serve hook-seat tests, the AUTHPARAMS seal test, computed_refusal_sites pins the hook-stage and destination-guard sites.
…text (RefusalIn::text is the kernel's own message: the reason's spelling or the walk terminal's own words, BUSBAR-1.6.0.md Part 3 section 12 line 2573 the route pump's exhaustion terminals); the kernel sections' providers key is read off Kind::Transport.root() (root_key_spelling)
… now held twice (the legacy crate's and the driver's verbatim home) name their legacy file, the switch's auth rows and instance-noun leaks are written down, the config projection sits above the boot build's blocking-ffi exemption - design-bindings: PB-1/6/28/46/84 and their siblings cite the busbar-llm test by path.rs::name (the pattern PB-5 already uses), since the hook parity suite on the driver repeats each 1.5.5 name verbatim (BUSBAR-1.6.0.md Part 3 section 12 "The switch": the hook tests run verbatim); the ledger regenerated, 104 mapped, none unproven. - kind-isolation: busbar -> busbar-auth-sigv4 / busbar-auth-oauth, each 1 declaration, carried by the `llm-on-driver` switch (ARCHITECT Q-L1-AUTH (A)). - instance-noun-neutrality: the switch's three files that name the plane under proof (the parity suite's main.rs, the serve hook-seat tests and their cfg in serve.rs), each struck with the switch at the llm fold's D3 (1.6.0-TODO.md "the `llm-on-driver` dev cargo feature"). - blocking-ffi: set_config_projection moves above the boot build's allow marker, which exempts the call directly below it only.
# Conflicts: # crates/busbar-kernel/tests/plane_driver.rs
…eports it exactly where 1.5.5 billed the flat request fee; the plane's report is the one fee decider on the door (owner #77, money-B1 ruling on the p3-flip-llm park, option (b); BUSBAR-1.6.0.md Part 0 "money = f(ledger, ratecard)": the ledger must carry what 1.5.5 billed) - busbar-plane-llm: `per_request` (busbar_contract::plane::PER_REQUEST, family `request`) is the tail's last billable class and its one fee unit. The answer that opens the caller's reply under a success status incurs it (1.5.5's finish kept the fee for a 2xx caller status and refunded it otherwise); from then every answer that carries counts carries the far end's last cumulative counts and the fee unit's 1. A non-2xx reply, a far-end request and a probe incur none. - root door_steps: every door plane's fee refund is its reported fee units (FeeRefund::PlaneFeeUnits); the pools plane's caller-status special case is gone, so one decider remains. - the ledger identity holds on the switch build: the node's books carry the 4 x 30000 micro-units of flat fee the legacy rows carry (tests/ledger_identity.rs green under `llm-on-driver`).
…tored the behaviour on predev): the ruling's pins ported from lane-llm-ua (6adf6fb, 0830cf1, bffce13) — tests/exchange_user_agent.rs (a same-dialect far end sees exactly the caller's user-agent, a caller that sent none carries the dialect's 1.5.5 fingerprint, a translated hop writes the far dialect's), and each dialect's egress_user_agent and head_fields state where the fingerprint is written
…e kernel plane registry before the config prepass (ARCHITECT RULING 2026-10-03 Q-DEL-A2A-DECL; BUSBAR-1.6.0.md #49 OWNER-LOCKED: a plane's config section comes from its Statement `sections.owns`; R2-C), ported from 9b277c5 with the fallback/probe facts of 2deb3c9 - contract: plane_calls::PlaneRegistration (the registry facts a door states, its own validate, and `fallback`: the tail's TAIL_FALLBACK). - loader: the plane kind keeps the tail's nouns, billable families, TAIL_PROBES and TAIL_FALLBACK at bind; kinds::plane::registration builds one registration for a linked and a dropped door. - kernel: plane::door::fold turns a registration into a PlaneDecl whose every word is the door's. - root: plane_rows folds every door candidate beside the linked rows; a key a linked row registers keeps that row, so under `llm-on-driver` the proto-llm row keeps the llm key until the default flip. Not taken: the a2a pieces (DECL-FOLD 2's facing/audience, CLAIM_PATTERN, caller_credential_refusal), which are not on the plane ABI of this tree.
…rough the kernel's probe unit (BUSBAR-1.6.0.md Part 3 section 12 "Nested units, work continuations and probes are units of their own ... a health probe is a kernel-originated unit pinned to one member"; "Probes (K7). A pure probe schedule, bound to the far end; a member's health follows the 1.5.5 lane health configuration"), ported from 2deb3c9 - root::model_egress: each model's provider `health:` over the process defaults resolved per lane (ModelPools.probes), and ModelServing::probe_members for the schedule. - root::serve: the plane serving the `pools` map whose tail states TAIL_PROBES arms a PlaneProbes target per generation over its sealed egress and spawns the kernel probe service's probers on a schedule phase-stable across a config apply; probe unit keys come from the node's one mint (Node::kernel_and_keys). - main: under `llm-on-driver` the legacy row's on-host probers are not spawned beside them, so a lane is probed once, as 1.5.5 probed it.
…eutrality ruling: the http door writes no default accept, so the plane writes it where 1.5.5 did — every llm request carried its own explicit accept, the single answer's or the dialect's stream framing, never a client default); a same-dialect caller's accept no longer replaces it (1.5.5's bytes: the oracle's same-dialect cells carry application/json, not the caller's */*). Conformance pins the per-request fee unit beside the far end's counts.
…akes (a folded door's &'static registry row, the door rows' probe dispatcher) are reviewed hold-escape known_sites; main.rs's switch-scoped skip of the legacy probers is a recorded llm instance-noun row, struck with the switch at D3
MattJackson
enabled auto-merge
October 5, 2026 01:33
promote into
|
| gate | row | detail |
|---|---|---|
| construction | one-pick-site |
3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:358; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8 |
| kind-isolation | kind-isolation:deps |
3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w |
| kind-isolation | kind-isolation:law0 |
5 hit(s) off the [[law0]] ceilings, 3 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabulary |
| kind-isolation-ship | kind-isolation:deps |
10 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a |
| kind-isolation-ship | kind-isolation:test-deps |
8 finding(s) over 32 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship c |
| kind-isolation-ship | kind-isolation:law0 |
5 hit(s) off the [[law0]] ceilings, 3 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabulary |
| kind-isolation-ship | kind-isolation:faces |
2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is |
| kind-isolation-ship | kind-isolation:legacy-drain |
3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier) |
| ship-ready | ship-ready:ship-twin |
'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is |
| structure-lint | structure-lint:plane-dup:unledgered |
22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger |
tests passed: 24629, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38305789535 . Artifact verdict-561c69a3fdeb64fed00507d6731f95a9d0c152f9 (failures.json, junit.xml, raw.log; 90 days).
…e switch's code names no plane, the stand-in hook axis keeps its own dispatcher - main.rs: the config-apply refresh of the door planes is gated on `linked_axis_node` (Served::post exists only there), so --no-default-features and every single-plane-* leg compile again. - instance-noun-neutrality:llm green again, no debt row: build.rs emits `linked_fold_on_driver` (a `<plane>-on-driver` fold switch is on, BUSBAR-1.6.0.md Part 3 section 12 "The switch") and `LINKED_PLANE_DOORS` (each linked plane-door row's door, resolved as the root resolves its entry). The hook parity suite and the serve hook-seat tests gate on the cfg and find the plane under proof as the linked door whose Statement declares the `pools` map; its dialects and op classes are read off the door's tail; the seat tests install the legacy row's seams through the manifest's `node_plane` alias; main.rs's legacy-prober skip reads the cfg. The 1.5.5 test reject_kind_mapping_matches_status_semantics keeps its name and values, now proven end to end through the door (each gate status's Anthropic error type). The four switch rows added to qa/instance-noun-neutrality.toml are gone. - busbar-kernel test_support: hook_axis_stand_in opens each registry's rows on a dispatcher of its own again (adeb523, which a port had reverted to one shared dispatcher): a slow-gate test's wedged worker no longer FAULTs dlopen_decide_order_and_abstain in the timing and core-duplex-ws legs.
MattJackson
added a commit
that referenced
this pull request
Oct 5, 2026
…to its dev): the http door writes no default accept (transport neutrality) The door writes only the fields its caller wrote. Every caller that sent 1.5.5's client default accept: */* now carries it in its own fields, in the place 1.5.5 put it: - the auth mint request: already done in 11dd91b (after content-type); - the llm plane: writes its own accept in its dialect fields (PR #464, the llm flip); - every other plane and plugin that sends over an http need must write it where 1.5.5 sent it. Lock: only the transport-http source line moved. Run on Latchkey: root connector/door_steps/serve/ oauth 108/108, root plane_driver 47/47, auth-oauth conformance 4/4, default build ok.
… as main's first act, before any plane registers), not a leaked probe dispatcher of their own, so the switch build's thread count is the configured dispatcher's (root_dispatcher_boot) and no hold escapes; the hold-escapes exemption for door_rows is withdrawn
…der the llm flip The plane ABI the seam lane owns is taken whole (PlaneRegistration's owns/secret_refs/admin routes/facing, DoorApply's per-generation refresh, the gate-first hook order, the held far end and its session routes, the registration probe binds), and the flip's own facts ride on it (BUSBAR-1.6.0.md Part 3 section 12, lines 2542-2680): - PlaneRegistration keeps `fallback` (TAIL_FALLBACK) beside the seam's fields; the door fold states it. - The registration probe binds go on the process's one dispatcher (booted first in main), so the fold adds no worker to the process's thread count (root_dispatcher_boot). - ServedFacts keeps `consumed`, the dialect_auth parameters (Q-L6-AUTHPARAMS), `probes` and `fallback` beside the seam's `owns`, `caller_credential_refusal` and `tail_flags`. - The plane serving the `pools` map binds the kernel's hook stage in 1.5.5's order (K5); a plane whose tail states TAIL_HOOKS_GATED binds the gate-first stage. - DoorLive carries the generation's facts (translation dialects) and its K7 probe target; the model-serving plane is refreshed from the configuration projection (DoorAppliers::refresh_models, on the handle's appliers), every other plane by DoorApply::apply. - The driver's refusal rendering keeps the walk terminal's words and the steps' Retry-After beside the seam's steps' words and the vetoing hook's name.
…ot is PlaneCancelIn/PlaneCancelOut; the llm door states it (BUSBAR-1.6.0.md Part 3 section 12)
…RCHITECT RULING 2026-10-04) A Responses answer restates the request's tools, tool_choice and parallel_tool_calls, at their defaults when the caller set none. A TRANSLATE answer drops them, and the drop walk named each as an egress.control_unrepresentable row, so the 11 llm|*|responses|request|ok(_stream) cells gained three audit rows 1.5.5 never wrote. The answer walk (drops::Carried) now takes the dialect's declared echoed defaults (ANSWER_DEFAULTS for Responses): a member equal to its default names no drop and writes no row; any value the caller set is still named and audited. Test: an_echoed_request_default_names_no_drop_and_a_caller_set_value_still_does (the echo names nothing; RED arm: a real tool, a directed choice and parallel calls off are each still named).
…Q128 U14; BUSBAR-1.6.0.md Part 3 section 12) Eleven cells driven end to end through the data router built with the door's claims, the kernel's hook stage, the model-serving walk over the kernel's lane cells and the node's book, each reading the capability where the kernel keeps it: breaker-trip (the member's (pool, lane) cell stops admitting), breaker-fastfail (a tripped member is never dialled again), failover-reroute (the twin's answer before the first byte), disposition (a far end's refusal of the request is relayed, not failed over, not charged to the cell), egress-auth (the member's bound credential, never the caller's token), metrics (the attempt on the scrape under its pool and lane), governance-budget (the fee on the key; a spent budget refuses with Retry-After before any dial), audit-chain (one record per unit), hooks-gate (refused before dispatch), hooks-tap (the request tap sees the rewritten request) and catalogue (a restricted key lists only the pool it reaches and its member). The cells live in root/tests/serve_door.rs (coordinator ruling: a #[path] test file of a declared root module is a leg file): its decisions items are gated on plane-decisions and the door cells on the fold switch. The shared rig is serve_hook_seats' run(), generalized (members and weights, pooled members, allowed pools, a day budget).
… the five-plane capability columns (Q128 U14), the gated screen inside the teller's chain; the door rows probe on the process's one dispatcher
Conflicts kept both sides' intent:
- serve.rs compose_planes_over: the plane still opens with its keyed
settings and walks the uniform {models, pools} section (this PR), and is
now handed the dialect facts predev added at open. Ruling: the facts are
read off the WALKED section, since under the flip the providers a
model-serving plane references live in the top-level `models:` that only
the walked section carries (BUSBAR-1.6.0.md:567-568, "A plane receives,
at open, the dialect fields of the providers it references and resolves
model -> dialect itself"). For every other plane the walked section is
its own section, as on predev.
- serve_tests.rs: predev's pub(super) helpers under this branch's
plane-decisions gate.
…the llm plane's hook cases live in its own crate ARCHITECT ruling on #464 (BUSBAR-1.6.0.md l.1995-2006): crates/busbar is Family::Neutral and its law0 ceilings do not move, so the rise this landing made (busbar x plane 857, x transport 209, x vendor 188 against predev's 822/208/90) is drained rather than re-armed. - The 1.5.5 hook cases of llm origin (seam, projection, held, policies) and the words they speak to the plane (its settings, each far end's answer, the plain request the rig fires) move to the llm plane's own crate, crates/busbar-plane-llm/tests/on_driver/. They are still proven through the plugin door: the root's hook_parity_driver suite links the plane's door, loads it through the one loader and drives it on the kernel's plane driver, and compiles the plane's cases beside its rig from the manifest's [package.metadata.busbar.driver-proofs] row (build.rs writes the one #[path]). The rig names no plane and no dialect; its plane open states no provider facts (#722). - The root's pools-door cells (serve_hook_seats.rs, the fold-on-driver cells of serve_tests.rs) read the dialects they speak as data, the plane's own door words (tests/on_driver/words.txt, DRIVER_WORDS), instead of spelling them. - The tool door's exhausted-walk sentences take the plane's key off the fixture's plane_key. - model_egress reads the far end's number in the kernel's first reserved status numbering, as the kernel's far end does, instead of naming the wire. - Comments in the root and the kernel's hook cases name the plane serving the pools map, not the plane; the reviewed refusal-site note names no lane by plane. Customer-visible behaviour is unchanged: no production path changes but the status numbering read, which is the same constant.
…ation and tracing floors re-arm at the measured count - qa/kind-isolation.toml: busbar-kernel x plane LOWERED 1175 -> 1173, predev d7929b6's measure (the law0-base reading on #464); the drain leaves the cell there, so the row takes the slack back (Law 9: the ceiling ratchets down). - gates::population::FLOOR 941 -> 943 and tracing SCAN_FLOOR 971 -> 973: this landing adds two non-test sources (busbar/src/root/model_egress.rs, busbar-plane-llm/src/exchange/project.rs), and the one-file-short plants of settings-leak, response-header, blocking-ffi and tracing are red only when the floor sits AT the count.
#751's computed plant and this PR's 973 Ruling: both sides kept. #751 (predev) makes the floor plant cut the live walk to exactly SCAN_FLOOR - 1, so a growing tree no longer forces every open PR to re-pin; this PR's re-measure (973, after model_egress.rs and exchange/project.rs) stays as the floor value, since a floor set at the count is still refused one file under it. Spec: docs/design/BUSBAR-1.6.0.md l.2053, "A denominator with no floor is a denominator that can be reduced to one without anybody noticing" -- the floor stays armed at the measured count; only the plant's arithmetic changed.
Lowering it (fabf44c) armed the whole [[law0]] row on this candidate, and the row is red at predev's own tree on cells this landing does not touch (busbar x instance:secret, x plane, x vendor, busbar-plugin-loader x transport), so Law 9 refused it as armed red. This landing's law0 figure is predev's again (busbar x plane/transport/vendor and busbar-kernel x plane at the merge-base's measure); the kernel cell's slack is predev's, and its row is left to the drain that owns it.
…ides Both sides' intent is kept, no design choice needed: - door_steps: predev's sealed_params (#756: the service account's token_uri vetted under the provider's metadata posture) and this PR's sealed_settings (the dialect's host-resolved auth parameters) are different steps; the auto-merged call site already runs sealed_params, then sealed_settings over its JSON. Both functions stay. - provider_routes takes predev's metadata posture everywhere, including this PR's door_config projection (MetadataPosture::global of the generation being projected), so a config apply re-seals under the posture that generation states. - main.rs keeps this PR's door_kernel_sections / door_model_pools beside predev's posture-aware door_providers. - population FLOOR stays at this PR's measured 943 with predev's one_file_short wording.
…MetadataPosture at the serve_hook_seats test
…th its breaker word and predev's upstream revision memory; the population and tracing floors take predev's 947/977 plus this line's two non-test sources (949/979)
… merge: the far end's exhausted pick carries its detail, and the plane is handed the walk terminal's own words (the exhausted pool's 1.5.5 sentence, a static str), so the render is exact, identical across sources and names none of them
…t answers tasks/get
A continuation the kernel refuses (its walk exhausted, a tripped server) fails its task in the
instance and owes the host its settle until the next create's sweep. resolve() read the host's
live row back over it, so tasks/get answered `working` until another tools/call arrived. The
served engine's runner answered the failure at once (`-32603`, the upstream call failed, the
reason's word). The instance's unsettled terminal state is newer than the host's live row, so it
answers, as the settled-handle branch beside it already did.
RED before: root::serve::door_tests::tools_door::{a_tasks_exhausted_walk_fails_the_task_in_predevs_bytes,
a_task_on_a_tripped_server_fails_in_predevs_bytes} never settle on predev 1617e9f (transplanted)
and on the merge; green after.
…e fold switch predev's every_linked_door_plane_is_driven names each linked door plane with no driver; the fold-on-driver build links the door serving the pools map, so it joins the scan: a provider whose api_key does not resolve refuses the composition naming its source (operator text), and one whose file is gone by an apply keeps the generation it serves and answers the caller clean of the source. The hook-seat rig composes fallibly (try_rig), takes the providers' api_key as a reference, and re-runs the root's model refresh (DoorAppliers::refresh_models) as the apply hook does. The root names no plane or dialect: the cells reach the door by its declaring section and read the far end's answer from the rig.
…eep, #789) into p3-flip-llm: no conflicts
…e recorded entry) into p3-flip-llm: the integration double keeps this line's full projection, which now names the entry its arrive recorded (none) and states the unit's body, as predev's double does, so a gate-first unit is screened over the recorded entry
This was referenced Oct 13, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 3 §12 'The switch': the llm plane's project binding, far-end hook overrides through the kernel's existing egress walk (no second walk), K7 door probes, DECL-FOLD registry fold, per_request fee unit reported by the plane (money-B1; ledger_identity green), PLANELOG accepted difference (owner-signed 2026-10-04, #85), accept written by the plane. Hook gate on the driver: 85/85 llm-origin + 153 kernel/loader/ranking. Default build unchanged (switch never default). Oracle (door vs legacy, golden/1.5.5): door-only fails = 6 h2 cells (t-h2host #459) + 2 mint-refresh cells (seam mint parity) — all owned. instance-noun-neutrality:llm recorded as switch debt struck at D3.
Checks before queue (merge with predev fb5f12a / #511)
The walk's own words, every plane, with predev's bytes for the newer planes. The kernel hands each plane the exhausted walk's sentence in
RefusalIn.text. The llm plane renders it in 1.5.5's words. For mcp, predev is the baseline (spec l.4593/l.4834), so the mcp door's refusal slot answers everyBreakerOpennon-arrival refusal with the reason wordbreaker_open. Four new cells inroot/tests/serve_tests.rstools_door(*_in_predevs_bytes) pin the exact bytes predev serves, each run green on predev first:-32030, unchanged;{"code":-32000,"message":"breaker_open"};the MCP upstream call failed: breaker_open.The mcp conformance battery reads 63/63 on both trees.
Body-ingress convenience routes, positive cell.
crates/busbar/tests/plane_integration.rs::an_audience_bound_token_is_confined_to_its_door_plane, with the llm plane's body ingress installed, asserts:POST /{name}/v1/messagesandPOST /{provider}/{model}/v1/messagesare mounted on the router;RouteAuth::None) and walked: anonymous gets 401, a keyed caller is admitted.The root rig without body ingress counts the kernel's own 3 guarded routes (spec l.4093).
Oracle: strict replay of the llm Responses cells on the #464 tip
bin/oracle record --filter '^llm\|[a-z]+\|responses\|'thenbin/oracle replay --baseline-version 1.5.5 --strict --id-filter '^llm\|[a-z]+\|responses\|'(RELEASE_REF e00d97f659), on Latchkey, #464 tip vs predev fb5f12a:The 10 cells
llm|{anthropic,bedrock,cohere,gemini,openai}|responses|request|ok(_stream)read PASS on #464 (identical or a registered ACCEPTED difference); on predev all 10 FAIL witheffects.audit 0 -> 3(6f6b8d2, codec/drops.rs ANSWER_DEFAULTS). rc stays 1 on both because of the same 5 cells, identical on predev:llm|responses|responses|request|{ok,ok_stream,upstream_down}andllm|anthropic|anthropic|request|{ok,ok_stream},effects.egresssame-dialectacceptheader (owned by #493).ACCEPTED (report count) 6 -> 15: 9 cells pass on #464 by a registered difference. 6 of them are the Responses-door cells above, which FAIL on predev on
effects.audit(a class no entry covers) and now match their body/header entry. The other 3 (llm|openai|anthropic|request|ok,llm|responses|anthropic|request|ok(_stream)) are premise cells that pass the same way on predev. Every entry is predev's, unchanged by #464 (its only register change is the PLANELOG entry,egress.image-detail|high|*, which matches none of these), and each carries an owner signoff:Merge with predev 7d04bf0 (2026-10-07)
Two merges: predev 2bf9d9b (#535, U22 routed hook order), then predev 7d04bf0 (#487 auth split, #589, #594-#600, #610).
HookStage::routed, LiveHooks + GovCaller). This line's per-unitarrived_indialect binding rides inside it: the routed bind isBind { dialect: arrived_in }, and a gate-first unit carries the arrived dialect's name. The lane's own pools-plane binder (HookStage::binder, kernel EngineCaller/HostSource/KeyLookup) is dropped. LiveHooks + GovCaller give the same facts on the same HostHooks bind path, so the hook sequence is unchanged.door_steps::process_auths). The model-serving pools, their live App handle and the config-apply refresh stay this line's, and so doessealed_settings(the dialect's host-label auth parameters). Manifests, the lock and the kind-isolation rows are predev's: busbar-auth-oauth 98fb861d14 contains 360a0d2c46, the compiled-in entry this line had cherry-picked as 22abf69390.qa/DESIGN-BINDINGS.mdis regenerated.info.auth_moduleslistsdeclares_chain_modulerows only (sigv4 excluded), so 1.5.5's[keys, admin-tokens].auth_tests::the_info_auth_modules_are_the_inbound_rows_onlyis green under--features llm-on-driver. The pin cell for this rides P2 D1: the auth split — auth-kind logic leaves the kernel for the auth plugins (stacked on #484) #487, not this PR.Oracle: the auth-header claim is refuted
Recorded on the pre-merge #464 tip. Regex
^llm\|[a-z]+\|(anthropic|gemini)\|request\|ok(_stream)?$, door build (llm-on-driver), strict replay vs golden 1.5.5: rc 0, 24 PASS. Entry 581 rewrites onlyanthropic-beta/openai-beta/user-agent/accept, and the goldenx-api-key/x-goog-api-keyheaders are reproduced.Oracle: llm cells, predev 7d04bf0 vs this merge (Latchkey cli-c6aba011)
bin/oracle record --filter '^llm\|'thenbin/oracle replay --baseline-version 1.5.5 --strict --id-filter '^llm\|'(engine pin 4d52f387c4; the filter widens to 5 premise cells; 138 cells recorded on each side), default build:Only 10 cells move, all
llm|{anthropic,bedrock,cohere,gemini,openai}|responses|request|ok(_stream). On predev they FAIL oneffects.audit(6f6b8d2, codec/drops.rs ANSWER_DEFAULTS). On this merge they read PASS (gemini ... ok) or ACCEPTED by an existing owner-signed entry: S-4 (anthropic ok, ok_stream), F-014 (bedrock ok), S-1 (bedrock ok_stream), S-9 (cohere ok), E7-1 (cohere, gemini and openai ok_stream), S-5 (openai ok). The other 128 rows are identical, verdict and diff hash. The register is predev's apart from this PR's signed PLANELOG entry. No 1.5.5 cell moves unsigned.Proof (Latchkey, head 6d28214's tree)
cli-c6aba011:
--writethen the gate, green.-D warnings: workspace,-p busbar --features llm-on-driver,-p busbar --no-default-features, all clean.--features llm-on-driver(--bin busbar, hook_parity_driver, plane_driver) 797/0/0.cli-1f654ad8 (the harness prerequisites cli-c6aba011 lacked: the secret-env cdylib built from its pinned checkout, and
BUSBAR_ORACLE_RUST_BIN):a_dropped_in_secret_plugin_is_the_same_plugin_through_the_axisanda_linked_and_a_dropped_in_secret_plugin_resolve_identicallyok.ledger_identity8/0.