FLIP-STREAMING: the streaming plane served through its door; busbar-voice deleted

CHANGELOG.md

@@ -405,6 +405,11 @@ Each of these is an owner-accepted difference from 1.5.5: additive, or strictly
   series by their labels; a histogram's or summary's lines stay together in their usual order
   (buckets ascending, then `_sum`, then `_count`). Every name, label and value is unchanged, and
   the order served is one 1.5.5 could already print.
+- **The streaming plane serves the protected-resource metadata its challenge points at.** A caller
+  refused at a realtime door is pointed at
+  `<public_url>/.well-known/oauth-protected-resource/v1/realtime`, and nothing served that path. It
+  now answers the RFC 9728 document: the plane's audience as `resource` and
+  `bearer_methods_supported: ["header"]`, the same document the MCP route serves.
 - **A wedged hook comes back.** A hook that wedged is no longer lost until restart: it is
   quarantined, backed off from 1 s doubling to 30 s, and then given one trial call on a fresh
   instance, and a successful trial returns it to service. 1.5.5 had no quarantine to exit.

Cargo.toml

@@ -7,7 +7,6 @@ members = [
     "crates/busbar-core-oauth2",
     "crates/busbar-llm",
     "crates/busbar-a2a",
-    "crates/busbar-voice",
     "crates/busbar-contract",
     "crates/busbar-kernel",
     "crates/busbar-kernel-identity",
@@ -26,6 +25,7 @@ members = [
     "crates/busbar-transport-stdio",
     "crates/busbar-transport-webrtc",
     "testing/ws-conformance/subject",
+    "testing/voice-conformance/harness",
     "xtask",
 ]
 

crates/busbar-kernel/Cargo.toml

@@ -190,13 +190,12 @@ plane-mcp = ["egress-seam", "jsonrpc-ingress", "dispatch"]
 # other relocated `#[cfg(feature = "plane-a2a")]` sites now live in substrate, so this must turn the
 # substrate marker on with it.
 plane-a2a = ["egress-seam", "egress-stream", "card-signing", "jsonrpc-ingress", "relay"]
-# THE NEUTRAL INBOUND WS-ACCEPT CAPABILITY — arms the core-side `mount_ws_arrivals` seam (router.rs)
-# that mounts a plane's gauntlet-gated inbound-WebSocket arrivals. NAMES NO PLANE: any duplex plane
-# (streaming today, a future telephony/stream plane tomorrow) turns on the same capability. Forwards to
-# substrate's neutral `runtime` (which arms `axum/ws` + the `duplex_ws` acceptor and the `WsArrival`
-# newtype/registry). OFF by default and pulled ONLY by the binary's `plane-streaming`, so the default/shipped
-# money-path build carries no `axum/ws` edge (no tokio-tungstenite/sha1/base64) and this seam is
-# compiled out entirely — byte-identical assembly, strong-form deletable.
+# THE NEUTRAL INBOUND WS CAPABILITY — arms the core-side duplex session mount (router.rs,
+# `mount_plane_session`) that answers a door plane's session upgrade. NAMES NO PLANE: any duplex
+# plane turns on the same capability. Forwards to the neutral `runtime` (which arms `axum/ws` and the
+# `duplex_ws` acceptor). OFF by default and pulled ONLY by the binary's `plane-streaming`, so the
+# default/shipped money-path build carries no `axum/ws` edge (no tokio-tungstenite/sha1/base64) and
+# this capability is compiled out entirely — byte-identical assembly, strong-form deletable.
 duplex-ws  = ["runtime"]
 # The neutral capability markers. `dispatch`/`relay` gate the `#[cfg]`/dead-code-allowance sites in
 # this crate's engine source; `runtime` arms the full-duplex WS transport (client handshake +

crates/busbar-kernel/src/config/config-schema.snapshot.json

@@ -433,6 +433,10 @@
           "optional": true,
           "type": "ConfigMgmtCfg"
         },
+        "decisions": {
+          "optional": true,
+          "type": "DeclaredSections"
+        },
         "export": {
           "optional": true,
           "type": "ExportDefs"

crates/busbar-kernel/src/egress/tests/duplex_ws_tests.rs

@@ -578,7 +578,7 @@ async fn dial_refuses_unpinned_and_guard_failing_targets() {
     );
 }
 
-// ── THE INBOUND WS-ACCEPT ARRIVAL SEAM (WsArrival newtype + accept_gauntlet + registry) ──────────
+// ── THE GAUNTLET-GATED WS ACCEPT (accept_gauntlet) ───────────────────────────────────────────────
 
 use std::sync::atomic::{AtomicUsize, Ordering};
 
@@ -664,46 +664,6 @@ async fn accept_gauntlet_refuse_returns_refusal_and_spawns_zero_socket_tasks() {
     );
 }
 
-/// THE WS-ARRIVAL SPEC + PROCESS REGISTRY round-trip: a plane declares a `WsArrivalSpec` (the neutral,
-/// single-compiled seam carrying the substrate-owned `WsArrival` newtype BY VALUE — never `Box<dyn
-/// Any>`), the composition root installs it, and the core router drains it VERBATIM. Witnesses the R1
-/// seam shape (spec is constructible with a by-value accept fn) and the install/take registry.
-#[test]
-fn ws_arrival_spec_installs_and_drains_verbatim() {
-    use crate::ingress::duplex_ws::{
-        install_ws_arrivals, take_ws_arrivals, WsArrival, WsArrivalSpec,
-    };
-    use busbar_contract::abi::mechanism::route::RouteAuth;
-
-    let spec = WsArrivalSpec {
-        path: "/v1/duplex/{id}".to_string(),
-        auth: RouteAuth::Key,
-        slot_key: "test-duplex-plane",
-        // The accept fn takes the newtype BY VALUE — the single-compiled `WsArrival`, never a box — and
-        // is ASYNC (returns a `WsAcceptFuture`) so a plane runs its pre-upgrade hooks before the upgrade.
-        accept: std::sync::Arc::new(|_a: WsArrival| {
-            Box::pin(async move {
-                axum::response::Response::builder()
-                    .status(axum::http::StatusCode::NOT_IMPLEMENTED)
-                    .body(axum::body::Body::empty())
-                    .expect("response builds")
-            }) as crate::ingress::duplex_ws::WsAcceptFuture
-        }),
-    };
-    install_ws_arrivals(vec![spec]);
-    let drained = take_ws_arrivals();
-    assert_eq!(drained.len(), 1, "the installed arrival drains verbatim");
-    assert_eq!(drained[0].path, "/v1/duplex/{id}");
-    assert_eq!(drained[0].slot_key, "test-duplex-plane");
-    assert!(matches!(drained[0].auth, RouteAuth::Key));
-    // Read-many: a second drain still yields the same installed set (the router may build twice).
-    assert_eq!(
-        take_ws_arrivals().len(),
-        1,
-        "take is read-many, not destructive"
-    );
-}
-
 // ── THE DIAL CREDENTIAL: on the upgrade request only, in no error ─────────────────────────────────
 
 use crate::egress::duplex_ws::{CredentialPlacement, DialCredential, DialTarget};

crates/busbar-kernel/src/ingress/duplex_ws.rs

@@ -255,104 +255,3 @@ where
         serve_messages(stream, sink, plane).await;
     })
 }
-
-// ─────────────────────────────────────────────────────────────────────────────────────────────
-// THE INBOUND WS-ACCEPT ARRIVAL SEAM — the neutral, substrate-owned vocabulary a plane DECLARES an
-// inbound gauntlet-gated WS-accept route through, and the process registry the composition root
-// installs those declarations into for the core router to drain. The plane names only this neutral
-// seam; the CORE-side `mount_ws_arrivals` (behind `duplex-ws`) mounts a real WS-accept route per
-// spec and hands the plane's accept fn a [`WsArrival`] by value. NONE of this is a `PlaneReqCtx` /
-// `PlaneRouteSpec` field, so the always-compiled request path names no WS type (money-path byte-
-// identity), and the upgrade is a substrate-owned newtype carried BY VALUE (never `Box<dyn Any>`), so
-// there is no dual-compile `TypeId` trap.
-// ─────────────────────────────────────────────────────────────────────────────────────────────
-
-/// THE SUBSTRATE-OWNED NEWTYPE the WS upgrade rides on across the accept boundary — NEVER
-/// `Box<dyn Any>`. Single-compiled in substrate, so its type identity is the same in both dual-
-/// compiled core instances (no downcast, no `TypeId` to diverge). Carries the upgrade BY VALUE plus
-/// the verbatim per-request facts the plane's accept fn needs to build its `GauntletRequest` and open
-/// its session — sourced from the SAME extractors the non-WS adapter reads, but assembled by the WS-
-/// aware core mount. The only type-erased field is `slot`, the already-proven-safe plane-slot crossing
-/// the non-WS `PlaneReqCtx::slot` already uses.
-pub struct WsArrival {
-    /// The axum WS-upgrade extractor the route received. The ONLY way to consume it into a live socket
-    /// is [`serve_gauntlet`] / [`accept_gauntlet`]; a plane's accept fn never calls a bare `on_upgrade`.
-    pub upgrade: WebSocketUpgrade,
-    /// The middleware-resolved governance request context (`None` on a `RouteAuth::None` route).
-    pub gov: Option<busbar_contract::records::PlaneRequestCtx>,
-    /// The middleware-resolved auth principal (`None` on a `RouteAuth::None` route).
-    pub principal: Option<busbar_contract::auth::AuthPrincipal>,
-    /// The resolved caller principal id, lifted from `gov` — the identity a plane binds session state to.
-    pub caller_principal: Option<String>,
-    /// The request path this route was matched at.
-    pub path: String,
-    /// The full request URI (path + query).
-    pub uri: axum::http::Uri,
-    /// The request headers.
-    pub headers: axum::http::HeaderMap,
-    /// Any path-template captures (`{name}` → value), in match order.
-    pub path_params: Vec<(String, String)>,
-    /// The neutral engine host, minted core-side over the request's live engine snapshot.
-    pub host: Arc<dyn crate::plane_host::EngineHost>,
-    /// The plane's own per-generation runtime slot (the same `Arc<dyn Any>` the plane's `build` produced),
-    /// captured by the core mount from the router's `plane_slots` and cloned into every arrival.
-    pub slot: Arc<dyn std::any::Any + Send + Sync>,
-}
-
-/// The finished-`Response` FUTURE a [`WsAcceptFn`] returns — ASYNC (the mirror of the data-plane
-/// `PlaneRouteFuture`), so a plane's accept fn can run its `async` operator hooks (gate/tap) BEFORE the
-/// upgrade, exactly as the one-shot request path does, and still return the 101 (or a pre-upgrade
-/// refusal) as its resolved value.
-pub type WsAcceptFuture = std::pin::Pin<Box<dyn std::future::Future<Output = Response> + Send>>;
-
-/// ONE PLANE'S WS-ACCEPT HANDLER: a neutral fn that receives a [`WsArrival`] BY VALUE and returns a
-/// finished axum [`Response`] (as a [`WsAcceptFuture`]). It MUST reach [`serve_gauntlet`] /
-/// [`accept_gauntlet`] internally (the only path that consumes the upgrade into a live socket); it never
-/// sees a bare `on_upgrade`. `Arc` so the core mount clones it into the per-request axum closure it
-/// wires. ASYNC so the plane runs its pre-upgrade admission (operator hooks + the destination gauntlet)
-/// before any socket binds — a hook/gauntlet refusal resolves to a pre-upgrade refusal Response.
-pub type WsAcceptFn = Arc<dyn Fn(WsArrival) -> WsAcceptFuture + Send + Sync>;
-
-/// ONE WS-ACCEPT ARRIVAL a plane DECLARES: the exact path, the admission bar recorded VERBATIM in the
-/// `CoreRouteTable` (identical shape to `PlaneRouteSpec::auth`, so the auth middleware enforces it
-/// BEFORE the accept fn), the neutral accept fn, and the plane's registry `slot_key` so the core mount
-/// resolves the live per-generation slot to carry on each [`WsArrival`] (exactly as the non-WS adapter
-/// resolves it from `plane_slots`). Names only `axum`, `busbar_contract` and this crate —
-/// no plane token, so adding a duplex plane is a new-crate-only diff.
-#[derive(Clone)]
-pub struct WsArrivalSpec {
-    /// The exact axum path pattern this WS-accept route is mounted at.
-    pub path: String,
-    /// The admission bar the core auth middleware enforces BEFORE the accept fn runs.
-    pub auth: busbar_contract::abi::mechanism::route::RouteAuth,
-    /// The plane's registry decl key — the core mount looks the live runtime slot up under it and,
-    /// when absent (the plane is unconfigured this generation), mounts nothing, exactly as the non-WS
-    /// route loop skips a plane with no slot.
-    pub slot_key: &'static str,
-    /// The neutral accept fn the core mount hands a [`WsArrival`], returning the finished response.
-    pub accept: WsAcceptFn,
-}
-
-/// THE PROCESS-WIDE INSTALLED WS ARRIVALS — set once by the composition root
-/// ([`install_ws_arrivals`]), read (cloned) by the core router at build ([`take_ws_arrivals`]). A
-/// `OnceLock<Vec<_>>`, mirroring `ingress::arrival::install_path_ingress`: the composition root
-/// ASSEMBLES it from whichever duplex-plane crates are linked, install-once + read-many so a test that
-/// builds several routers each mounts the same arrivals.
-static INSTALLED_WS_ARRIVALS: std::sync::OnceLock<Vec<WsArrivalSpec>> = std::sync::OnceLock::new();
-
-/// INSTALL THE INBOUND WS-ACCEPT ARRIVALS — the composition root's one write, mirroring
-/// [`crate::ingress::arrival::install_path_ingress`]. First-writer-wins (idempotent): a second call is
-/// ignored rather than panicking, so a test harness that composes twice does not abort. Only the
-/// composition root (or a test) calls this; a build with no duplex plane never does, and
-/// [`take_ws_arrivals`] then yields nothing.
-pub fn install_ws_arrivals(arrivals: Vec<WsArrivalSpec>) {
-    let _ = INSTALLED_WS_ARRIVALS.set(arrivals);
-}
-
-/// DRAIN (by clone) THE INSTALLED WS-ACCEPT ARRIVALS — the core router's one read at build. Returns an
-/// empty vec when no duplex plane installed any, so the router mounts no WS-accept route (byte-
-/// identical assembly). Cloning (not taking) keeps it read-many so repeated router builds are stable.
-#[must_use]
-pub fn take_ws_arrivals() -> Vec<WsArrivalSpec> {
-    INSTALLED_WS_ARRIVALS.get().cloned().unwrap_or_default()
-}

crates/busbar-kernel/src/plane_host/mod.rs

@@ -2920,8 +2920,8 @@ pub trait ContainerGateSink: PlaneSlots {
 }
 
 // ─────────────────────────────────────────────────────────────────────────────────────────────
-// D3 WITNESS — the gauntlet siblings COEXIST and share ONE `admit_open` gate. (That `begin_session`
-// actually CALLS `run_gauntlet_session` at its call site is pinned in busbar-voice's topology tests.)
+// D3 WITNESS — the gauntlet siblings COEXIST and share ONE `admit_open` gate. (That a session
+// open actually CALLS `run_gauntlet_session` at its call site is the serving door's to pin.)
 // ─────────────────────────────────────────────────────────────────────────────────────────────
 #[cfg(test)]
 #[path = "tests/gauntlet_session_tests.rs"]

crates/busbar-kernel/src/plane_host/tests/mod_tests.rs

@@ -660,9 +660,10 @@ fn stale_host_ctx_through_a_real_vtable_slot_fails_closed() {
 /// 1. It admits ANY JSON object as the replacement. It does not know, and cannot check, the TYPE the
 ///    receiving plane will decode into. For MCP and A2A the target is `serde_json::Value`, so bytes
 ///    core commits always parse and their "output I cannot read back" arms are unreachable through
-///    this host. For `busbar-voice` the target is `SessionConfig`, which rejects `{"voice": 7}` as a
-///    type mismatch — so THAT plane's arm is genuinely reachable through core's real host, and its
-///    refusal (`busbar_voice::mount::committed_session_config`) is a live fix, not a dormant one.
+///    this host. For a session plane the target is a typed session configuration, which rejects
+///    `{"voice": 7}` as a type mismatch — so THAT plane's arm is genuinely reachable through
+///    core's real host, and its refusal (its door's `committed_session_config`) is a live fix,
+///    not a dormant one.
 /// 2. The commit is a WHOLESALE REPLACEMENT, not a merge. A hook that names one field produces
 ///    `arguments` carrying ONLY that field — every other key the caller (or the plane's own lock)
 ///    had is gone from the committed bytes. A plane whose target type defaults its absent fields