Repository navigation
Q1: cold auth verify and login deleted; 1.5.5's 401/4003-4009 parity; kernel-identity CredentialCache deleted (Q134 closed) - #532
Merged
Merged
Conversation
# Conflicts: # Cargo.toml # crates/plugin-loader/Cargo.toml # crates/plugin-loader/src/lib.rs # crates/plugin-loader/src/tests/auth_conformance_tests.rs
…ynAuth, ColdAuth, the registry's cold openers and Boundary rows, the raw JSON-lane load, the cold auth wire and its SDK glue); the kernel half in progress
…ore-run hop loop, the cold-row branches); the hosted login and chain open every auth row on its door
# Conflicts: # crates/plugin-loader/src/lib.rs # crates/plugin-loader/src/tests/lib_tests.rs
…p tests deleted with the cold login loop (the plugin makes its own exchange on the door), ledger regenerated
…d method, false by default); the loader's begin and complete steps set it from the dispatcher's outcome, the short re-call included
…ges the oidc library once per call (the scenarios raced on one file)
…declining plugin says nothing); the client secret is lent at open and rides nothing the host makes; the kernel's verdict cache and cold offload deleted with the cold lane (inbound flush sums the doors' refresh)
…thod, false by default); the loader's submitted verify sets it from the dispatcher's outcome, the short re-call included
…5's words (warn once, then debug) and deny; an unjudged admin verify is 1.5.5's 401
…e and AdminUnavailable retired; the operator door and every admin door answer 1.5.5's 401 under verify overload); the QUESTIONS row records the close
…h` plugin answers to '<module>'); the registry's refusal stays internal; RED arm pins the text
…ache.rs and its tests, the cache parameter of the chain walk and Auth::resolve, the root's AuthBindings::cache, the sha256 feature; tests that only passed a cache keep every assertion
…oot OTLP policy and the cold carrier (loopback plaintext, secure elsewhere, metadata in every spelling, alternate IPv4, one verdict named or written, http/https only) and the deleted login hop's no-redirect rule
# Conflicts: # crates/busbar/tests/mcp_stdio_serve.rs # crates/plugin-loader/src/tests/both_ways.rs
…here to 1.5.5's verdicts, ARCHITECT A1-A5)
# Conflicts: # crates/busbar-kernel/src/appbuild.rs # crates/busbar-kernel/src/auth/mod.rs # crates/busbar-kernel/src/auth/tests/tests.rs # crates/busbar-kernel/src/preflight.rs # crates/busbar-kernel/src/router.rs # crates/plugin-loader/build.rs # crates/plugin-loader/src/lib.rs # crates/plugin-loader/src/registry.rs # crates/plugin-loader/src/tests/lib_tests.rs # docs/design/1.6.0-QUESTIONS.md
MattJackson
enabled auto-merge
October 7, 2026 09:00
promote into
|
| crate | test | step | first panic |
|---|---|---|---|
| `` | clippy rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:root-test-harness | |
| `` | clippy rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:timing | |
| `` | test rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:timing | |
| `` | clippy rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:core-duplex-ws | |
| `` | test rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:core-duplex-ws | |
| `` | clippy rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:oauth2-test-support | |
| `` | clippy rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
build:clippy | |
| `` | clippy rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:admin-test-support | |
| `` | clippy rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:no-default-features | |
| `` | test rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:no-default-features | |
| `` | clippy rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:openapi-schema | |
| `` | test rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:openapi-schema | |
| `` | nextest rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:workspace | |
| `` | check rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
build:workspace-compile | |
| `` | clippy rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:loader-pack | |
| `` | clippy rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs |
test:contract-test-seal |
Denied because (12)
- shard 1/4: gate:test:core-duplex-ws: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs, test: rustc error[E0061]: this function takes 6 arguments but 5 arguments were suppl
- shard 1/4: gate:test:oauth2-test-support: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs)
- shard 1/4: gate:test:root-test-harness: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs)
- shard 1/4: gate:test:timing: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs, test: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ cr
- shard 2/4: gate:build:clippy: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs)
- shard 2/4: gate:test:admin-test-support: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs)
- shard 2/4: gate:test:no-default-features: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs, test: rustc error[E0061]: this function takes 6 arguments but 5 arguments were
- shard 2/4: gate:test:openapi-schema: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs, test: rustc error[E0061]: this function takes 6 arguments but 5 arguments were suppl
- shard 3/4: gate:test:workspace: green at base, red now (nextest: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs)
- shard 4/4: gate:build:workspace-compile: green at base, red now (check: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs)
- shard 4/4: gate:test:contract-test-seal: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs)
- shard 4/4: gate:test:loader-pack: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs)
Judged against base 350e107c6: 12 new red, 0 worse, 6 standing (excused).
New reds: gate:test:core-duplex-ws: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs, test: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs), gate:test:oauth2-test-support: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs), gate:test:root-test-harness: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs), gate:test:timing: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs, test: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs), gate:build:clippy: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs), gate:test:admin-test-support: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs), gate:test:no-default-features: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs, test: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs), gate:test:openapi-schema: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs, test: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs), gate:test:workspace: green at base, red now (nextest: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs), gate:build:workspace-compile: green at base, red now (check: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs), gate:test:contract-test-seal: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs), gate:test:loader-pack: green at base, red now (clippy: rustc error[E0061]: this function takes 6 arguments but 5 arguments were supplied @ crates/busbar-kernel/src/auth/tests/acceptance_1_5_5_tests.rs)
Already red on predev, not this PR's: 14
| gate | row | detail |
|---|---|---|
| test:xtask-selftest | ::xtask selftest kind-isolation |
|
| test:xtask-selftest | ::xtask selftest no-deferral-strict-done |
|
| test:xtask-selftest | ::xtask selftest plane-purity-strict |
|
| test:xtask-selftest | ::xtask selftest unconstructed |
|
| test:xtask-selftest | ::xtask selftest structure-lint |
|
| test:xtask-selftest | ::xtask selftest plane-transport-neutrality |
|
| construction | one-pick-site |
3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:358; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8 |
| kind-isolation | kind-isolation:deps |
3 finding(s), 92 shipped edge instance(s) over 29 class(es), 92 declaration(s); 55 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w |
| kind-isolation-ship | kind-isolation:deps |
8 finding(s) over 92 shipped edge(s): ship-edge kernel -> store busbar-kernel -> busbar-store-memory is 'not-allowed': the architecture grants no kernel -> store edge, and the ship criterion is the ar |
| kind-isolation-ship | kind-isolation:test-deps |
5 finding(s) over 31 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship c |
| kind-isolation-ship | kind-isolation:faces |
2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is |
| kind-isolation-ship | kind-isolation:legacy-drain |
3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier) |
| ship-ready | ship-ready:ship-twin |
'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is |
| structure-lint | structure-lint:plane-dup:unledgered |
22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger |
tests passed: 28630, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38349969892 . Artifact verdict-5d120324d142c965d15e45eb714a1baa15c71da6 (failures.json, junit.xml, raw.log; 90 days).
MattJackson
added this pull request to the merge queue
Oct 7, 2026
MattJackson
removed this pull request from the merge queue due to a manual request
Oct 7, 2026
…ledger regenerated (cargo xtask gate design-bindings --write) over both sides
MattJackson
enabled auto-merge
October 7, 2026 11:59
MattJackson
added this pull request to the merge queue
Oct 7, 2026
MattJackson
enabled auto-merge
October 11, 2026 00:05
…ed zero law0 rows The cold auth lane's deletion (contract abi/cold/auth.rs, plugin-loader auth.rs and hostlog.rs) takes three non-test files out of crates/: the population floor 941 -> 938 (blocking-ffi, response-header, settings-leak), the tracing walk 971 -> 968, and no-deferral discovery 932 -> 931. Each floor is a ratchet pinned at the measured count, and these are reviewed removals, not a scan that went blind. The two new [[law0]] rows for busbar-kernel-identity (auth, instance:secret) at count 0 armed the kind-isolation:law0 row on this candidate, which is red on predev by design (standing busbar / plugin-loader rises). A neutral cell at 0 with no row is already held at 0 (any hit is law0-new), so the rows judged nothing; dropping them leaves the gate's verdict unchanged and the ledger edits to lowerings only.
Collaborator
Author
|
Claim released by busbar-release: the |
- plugin-loader lib.rs: the raw JSON lane stays deleted. predev's #745 worker asserts are kept in dlopen_on_worker, dlclose_on_worker and ffi_guard_confined; its set_log_sink assert went with wire_up and hostlog. - xtask population FLOOR: 938, re-measured on the merged tree (predev 941 less the three cold-auth files), with predev's one_file_short plant note.
MattJackson
added this pull request to the merge queue
Oct 12, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to a conflict with the base branch
Oct 12, 2026
MattJackson
added a commit
that referenced
this pull request
Oct 12, 2026
…-auth-replay-strip; the data-plane walk carries this branch's replay claim and strips beside #532's overloaded verifier handed back apart (Q134 503)
MattJackson
added a commit
that referenced
this pull request
Oct 12, 2026
…, and every line an auth names is struck before a plane sees the request
THE DESIGN §6, Inbound verify: "a verified identity may carry a replay_key and replay_ttl_secs, and
the verify caller claims the record ... already TAKEN is 401". §6.4: the auth names its credential
lines and query keys, and they are stripped so the plane never sees a credential.
Root cause: every reader of a verify answer reduced it to a bare verdict. The data-plane walk's
chain_verdict_of and the operator credential's judgement kept Verified::Identity's principal and
dropped its replay claim and VerifyAnswer.strips, so nothing in the kernel ever claimed an
auth-replay record (a signed message replayed inside its ttl was admitted again) and a header or
query key a plugin auth named crossed to the plane.
- busbar-kernel-identity operator::Judgement is a struct: the outcome (a verdict, or the admin
503's AdminUnavailable), the identity's replay claim and the named lines, whatever the verdict.
- busbar-kernel auth:
- the data-plane walk reads each position as a Position (verdict, an overloaded verifier still
handed back apart for Q134's 503, the claim, the lines); it collects every position's lines;
- an identity with a replay claim is admitted only once the walk wins <provider>/<key> in
governance's record store (kind auth-replay, standing ttl_secs). Fail-closed: a claim already
taken, a store that cannot answer, and no governance each deny;
- the signed pre-step's verifier claims its identity's replay the same way, under its module;
- the admin chain carries the identifying module's claim and every module's lines out; the
admin door (the middleware and the sync probe the root's admin loop uses) wins the claim
before it admits; the dry run claims nothing;
- the middleware joins named field lines to the consumed credentials (stripped at every
handoff) and strikes named query keys from the URI and OriginalUri, once.
Based on predev: the defect and the fix are independent of #532's cold-auth deletion; predev's
admin 503 (AdminUnavailable) and Q134's data-plane 503 are kept as they are.
REDs (claim and strike disabled, the judgement dropping both):
the_replay_claim_and_the_named_lines_ride_the_judgement,
a_replayed_signed_message_inside_its_ttl_is_denied,
a_replayed_signed_delivery_is_answered_401_the_second_time,
an_auth_named_header_and_query_key_never_reach_the_plane,
an_admin_identity_replayed_is_denied_and_its_named_lines_ride_out.
Brings predev 872b6ae, with #681 (sec-auth-replay-strip). Conflicts: - kernel-identity operator.rs and its tests, kernel auth/mod.rs and its tests: #681 named its own resolution over this branch, lane-sec-auth-replay-strip-on-532 (a8c2772), whose versions of these four files are #532 and #681 merged; #681 landed with those files unchanged and this branch's are unchanged since, so they are taken whole. - population 945 and tracing 975: predev's lines, re-pinned by this branch's three deleted non-test files.
Brings predev c89729d (#798). Conflict: qa/kind-isolation.toml, busbar-kernel x transport, by the ledger merge rule: base 285, predev 284 (row 157), this branch 284 (the cold auth path's "http" scheme check in auth/token.rs, a different hit): 284 + 284 - 285 = 283; predev's cite kept, this branch's clause appended.
Brings predev 235e1a3 (#795, #783). Conflicts: qa/DESIGN-BINDINGS.md and qa/design-bindings.json, the generated design-bindings ledger: predev's files taken, then only this branch's own rows re-applied in the generator's format: PB-35 cites every_request_is_verified_by_the_door_and_the_kernel_caches_no_verdict; PB-100 drops the three deleted hop tests (execute_hop_refuses_non_allowlisted_host, vet_hop_url_enforces_https_allowlist_and_blocks_metadata, execute_hop_does_not_follow_redirect); mapped test checks 430 -> 428 (+1 -3). The .md and .json agree row for row (104 bindings, 428 test checks).
qa/kind-isolation.toml busbar-kernel x transport: base 284, predev 267 (#710's REBALANCE -17), this branch 283 (-1, #532 Q1 cold auth path) -> 267 + 283 - 284 = 266 (ledger merge rule). Predev's cite kept whole; this branch's clause appended as LOWERED 267 -> 266. The clause's quoted scheme is now escaped inside the TOML string (this branch's head wrote it unescaped, which no TOML reader parses).
MattJackson
added a commit
that referenced
this pull request
Oct 13, 2026
qa/kind-isolation.toml busbar-kernel x transport: base 267, ours 261 (E5a: -5 drained, -1 ruled MOVE to busbar-core-connector), theirs 266 (#532: auth/token.rs's "http" check deleted, a different hit): theirs + ours - base = 260, predev's cite kept with E5a's clause renumbered 266 -> 260.
MattJackson
added a commit
that referenced
this pull request
Oct 13, 2026
qa/kind-isolation.toml, by the ledger merge rule (result = T + O - B; predev's cite kept whole, this branch's clause appended with its numbers rewritten): - busbar x transport: B 207, predev 224 (#710 REBALANCE +17), ours 183 (FLIP-A2A -24) -> 200 - busbar-kernel x instance:secret: B 115, predev 114 (K2-H3 -1), ours 112 (extern ABI strings -3) -> 111 - busbar-kernel x plane: B 1141, predev 1128 (row 156 -9, K2-H3 -4), ours 1118 (FLIP-A2A -23) -> 1105 - busbar-plugin-loader x instance:secret: B 109, predev 107 (#532 -2), ours 23 (-85 extern ABI strings, -1 durable_tests rename) -> 21 - dep rows: predev's deleted busbar-kernel -> busbar-store-memory and this branch's deleted busbar-a2a edges both stay deleted. Cargo.toml: predev's deleted fixture-store pin and this branch's deleted a2a-lf/a2a-pb block both stay deleted; the busbar-transport-http pin stays a6e29e36da. crates/busbar-kernel/src/tls.rs: predev's (the listener moved to root::listener). crates/busbar-kernel/src/test_support/engine_kit/mod.rs: predev's, with this branch's removal of the card-issuer pass-throughs re-applied (TestAppSeam states neither). crates/busbar-a2a/src/a2a/tests/adminverbs_tests.rs: deleted with the crate.
MattJackson
added a commit
that referenced
this pull request
Oct 14, 2026
…erged with predev (460be4d77d) Drains: busbar x instance:secret 25 -> 22, busbar x plane 772 -> 770, busbar-kernel x plane 1100 -> 1099, busbar-kernel x transport 266 -> 220, busbar-kernel-breaker x plane 2 -> 0, busbar-kernel-breaker x transport 134 -> 1 (the #561/#778 breaker work this branch stacks on, row 66, and FLIP-A2A). busbar-plugin-loader x instance:secret 21 -> 23 is a correction of the merge figure, not a rise: predev's -2 (#532, 40a4080) removed two `extern "C"` ABI strings (host_log_sink and its doc line) that this branch's scanner fix had already stopped counting, so the two drains overlap by those two; 23 is this branch's own pre-merge measure, and no hit was added.
MattJackson
added a commit
that referenced
this pull request
Oct 14, 2026
…hat read as the c secret plugin are named for what they are Ruling on 60dd171: no raise. The 23 ModernCI measured is no hit #787 added (#787 adds no secret-instance literal to the loader; it removes one, the durable_tests rename): the merge figure 21 counted predev's -2 (#532, two extern "C" ABI strings) that the scanner fix behind #787's -85 had already stopped counting. The ceiling returns to 21 by draining two real hits: store_money_acceptance.rs the_floor_makes_arrival_order_matter's .expect("c") messages (the charge), now "the charge", and their refund pair "the refund".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Q1 (ARCHITECT rulings: cold auth verify AND login deleted right after p4-oidc-repin; Q134; the 2026-10-06 cold-auth rulings 1–6). #486 (p4-oidc-repin) is merged; this branch carries predev 70776f1 (merge 47ea84c, every conflicted hunk checked against both parents).
What goes
DynAuthandauth.rs,ColdAuth,PluginRegistry::{open_auth, open_login, auth_row_is_cold, image}, the linkedBoundaryentry, the raw JSON-lane load (RawPlugin,Image,wire_up*,free_guarded,reclaim_failed_open),hostlog.rs,login_tests.rs. A dropped-in auth library stating no door is refused naming the rebuild: "it speaks the 1.5.5 JSON auth contract, which this host does not load — rebuild the plugin against the 1.6.0 SDK" (kind_refusal, one mechanism for every kind).abi/cold/auth.rs) and its SDK glue (export_login_plugin!,dispatch_auth*,AuthHandle).abi/cold1138 -> 272 lines (abi-freeze lowered).LoginCall::faulted/Verifying::faulted(provided methods) let the host tell a plugin FAULT from a decline.LoginPlugin::Coldand the core-run login hop loop (execute_hop,vet_hop_url,sanitize_hop_header,MAX_HOPS, the offload), the cold-row branches in the data and admin chains, the kernel verdict cache and cold offload (auth_cache.rs). The inbound flush sums the doors'refresh().CredentialCache(production passedNone) with its digest types, thecacheparameter of the chain walk andAuth::resolve, the root'sAuthBindings::cache(ruling 6).What answers now (1.5.5 parity)
AdminUnavailableare gone; Q134 closed indocs/design/1.6.0-QUESTIONS.md(ruling 4).kind: authplugin answers to ''"; the registry's refusal stays internal. RED arma_login_method_with_no_auth_axis_is_refused_in_1_5_5_words(ruling 2).the_client_secret_is_lent_at_open_and_rides_nothing_the_host_makes).Deleted tests and their new homes (rule 15.3, ruling 5)
Plugin repos at the revs pinned in
Cargo.toml: export-otlpb10cd35, auth-oidc0a7b7a5, export-filec0a2d69. "PORTED" tests are new in this PR.test_validate_otlp_endpoint_error_masks_userinfoonly_an_http_or_https_url_names_a_collector(crates/busbar-core-connector/src/tests/collector_class_tests.rs:287); otlpexport-otlp/src/tests.rs:264,:175test_validate_otlp_endpoint_accepts_none_and_externala_collector_is_reached_in_plaintext_on_loopback_and_over_a_secure_connection_elsewhere(collector_class_tests.rs:135); theNonehalf: no url, no instance (otlptests.rs:150)test_validate_otlp_endpoint_allows_loopback_collectorscollector_class_tests.rs:135otlp_resolve_check_allows_a_name_resolving_to_loopbackcollector_class_tests.rs:135otlp_resolve_check_skips_ip_literalsevery_egress_class_is_judged_by_the_one_guard(crates/busbar-core-connector/src/tests/process_tests.rs:92),the_name_arm_decides_before_resolution(guard_tests.rs:160)otlp_resolved_and_literal_verdicts_agreean_address_is_judged_the_same_named_or_written(collector_class_tests.rs:247)otlp_resolve_check_allows_a_name_that_does_not_resolvea_name_that_does_not_resolve_fails_the_exchange_and_is_never_a_refusal(crates/busbar-core-connector/src/tests/name_dial_tests.rs)test_validate_otlp_endpoint_rejects_cloud_metadata_and_internalcloud_metadata_never_reaches_a_collector_in_any_spelling(collector_class_tests.rs:185); private https collectors are allowed by the loopback-allowed class (ruling CRATES-14,guard_tests.rs:365) — ruled (A2): refused by the guard by default, reached when allowlisted,a_private_collector_is_refused_by_default_and_reached_when_allowlisted(#517); plaintext to them refused (collector_class_tests.rs:135,connector_tests.rs:749)test_validate_otlp_endpoint_rejects_alternate_encoded_internalan_alternate_ipv4_spelling_never_reaches_a_collector(collector_class_tests.rs:223); alternate loopback spellings reach a collector as in 1.5.5,an_alternate_ipv4_spelling_of_loopback_reaches_a_collector_as_in_1_5_5(#517, A3)test_validate_otlp_endpoint_accepts_uppercase_schemeHTTP:///HTTPS://accepted; case never bypasses the guardcollector_class_tests.rs:185; acceptance half:only_an_http_or_https_url_names_a_collectoracceptsHTTP:///HTTPS://as 1.5.5 did (#517, A3)test_validate_otlp_endpoint_rejects_bad_schemecollector_class_tests.rs:287test_validate_otlp_endpoint_requires_https_for_remote_collectorcollector_class_tests.rs:135;loopback_allowed_refuses_plaintext_off_loopback(connector_tests.rs:749)test_validate_otlp_endpoint_rejects_trailing_dot_internal_hostscollector_class_tests.rs:185,:135the_egress_carrier_refuses_what_the_host_policy_refuseshttp_to_a_public_host_under_open_web_is_refused(connector_tests.rs:717),a_private_address_is_refused_for_providers_and_request_data_unless_allowlisted(process_tests.rs:108),a_metadata_target_is_refused_before_any_dial(connector_tests.rs:136,:271); also PORTED incollector_class_tests.rs:135the_collector_policy_carries_octets_to_a_loopback_collector_and_nothing_elsethe_shipped_binary_posts_its_spans_to_an_otlp_collector(crates/busbar/tests/export_otlp_delivers_spans.rs:136, bytes at:223–230); refusals PORTEDcollector_class_tests.rs:135,:185;connector_tests.rs:749,:717a_carrier_that_implements_no_policy_but_the_open_web_refuses_the_restdest_judge_tests.rs:226; bytes exactcompose_tests.rs:76,wire_tests.rs:46; verdict without carryingprocess_tests.rs:190; refused target never on the wirecrates/plugin-loader/src/tests/export_conformance_tests.rs:1462(RED arm)a_destination_is_a_declared_key_the_operator_setdisk_append_writes_only_to_a_granted_bound_destination(crates/plugin-loader/src/tests/host_services_tests.rs:1387),export_conformance_tests.rs:1377(RED arm)a_write_appends_and_rotates_first_at_its_limit_keeping_its_archivescrates/busbar-kernel/src/tests/host_disk_tests.rs:33,:72,:91;crates/plugin-loader/src/tests/host_tests.rs:19;export_conformance_tests.rs:1377an_unopenable_destination_is_a_reported_failurean_unopenable_path_fails_the_open_step(host_disk_tests.rs:58)execute_hop_refuses_non_allowlisted_hostcrates/busbar-kernel/src/auth/tests/token_tests.rs:1656), no core exchange (token_tests.rs:1462); token need is open-web (connector_tests.rs:717,process_tests.rs:108); the token need is loopback-allowed in GetBusbar/busbar-auth-oidc#25 (A4); its busbar re-pin is held for an ARCHITECT call (a loopback-allowed need is granted to first-party plugins only, so a third-party oidc build would be refused at scan)execute_hop_refuses_a_crlf_injected_headera_pseudo_field_in_a_request_is_refused(crates/busbar-contract/src/abi/sdk/tests/exchange_tests.rs:397)sanitize_hop_header_rejects_crlf_and_hop_controldest_judge_tests.rs:238); NUL and Content-Length/Transfer-Encoding:a_head_carrying_nul_or_its_own_framing_is_refused_before_any_dial(#517, A5)execute_hop_does_not_follow_redirectan_answer_naming_another_place_is_handed_up_and_never_dialled(connector_tests.rs:575)execute_hop_times_out_on_a_hanging_endpointa_silent_far_end_is_held_to_the_framers_deadline(compose_tests.rs:162),:196;framer_tests.rs:65; oidcfetch_tests.rs:103vet_hop_url_enforces_https_allowlist_and_blocks_metadatafetch_tests.rs:145;connector_tests.rs:717;endpoint_tests.rs:17,:85,:103;guard_tests.rs:125hop_loop_runs_at_most_max_hops_timescomplete_loginper callback (token_tests.rs:1462,:1492)client_secret_is_core_injected_onlyfetch_tests.rs:95,:103,conformance.rs:274;the_client_secret_is_lent_at_open_and_rides_nothing_the_host_makes(token_tests.rs:1656)the_secret_placeholder_is_dropped_for_a_public_client_and_filled_for_a_confidential_onefetch_tests.rs:95,:103a_door_less_json_contract_library_is_refused_naming_the_rebuild(new on predev with #486), its kind-gate leg onlyload_imagekind gate refuses a door-less 1.5.5 library, naming the rebuildcrates/plugin-loader/src/tests/lib_tests.rs:249): the door-lessjson_contract_authlibrary is refused, naming the missingbusbar_plugin_doorand the rebuild; (2) the boot path,a_1_5_5_json_contract_plugin_is_refused_at_boot_naming_the_rebuild(crates/plugin-loader/src/tests/registry_tests.rs:44): a signed 1.5.5 artifact of each kind (store, auth, hook, export) is refused at the scan, naming file, kind, version and the rebuild; (3) the one load path,red_both_origins_refuse_the_same_way(crates/plugin-loader/src/tests/dispatch_tests.rs:1012): a door-less library under a current manifest isLoadError::NoDoor, whose text names the 1.5.5 JSON contract and the rebuild (crates/plugin-loader/src/dispatch/load.rs:299)Other deleted tests had the deleted mechanism as their only subject (the cold auth wire codec and SDK login dispatch, the raw JSON-lane loader's buffer/handle guards, the kernel and kernel-identity verdict caches); tests that only passed a cache keep every assertion.
A1–A5 were ruled by the ARCHITECT and are fixed in #517 (connector parity: a DNS failure is a failed exchange, private collectors under the guard, 1.5.5's loopback spellings and scheme case, head hygiene) and GetBusbar/busbar-auth-oidc#25 (the token need is loopback-allowed; its busbar re-pin is held, see above). The "PORTED" connector tests above (
collector_class_tests.rs,an_answer_naming_another_place_is_handed_up_and_never_dialled) live in #517, corrected there to 1.5.5's verdicts.design-bindings PB-35: predev's #484 cited four kernel verdict-cache tests in PB-35. This PR deletes those tests along with the cache they test, so the regenerated ledger drops the citations:
verdict_rules_and_expiry,bounded_eviction,module_partitions_and_flushandan_unauthenticated_chain_admits_nothing_to_the_cache.PB-35 still has live proofs:
http.crosscut|bearer-and-x-api-key;crates/busbar-kernel/src/auth/tests/tests.rs:test_empty_chain_is_open_front_door:308,test_nonempty_chain_fails_closed_on_all_pass:221,test_keys_in_chain_sets_flag_not_module:327,test_chain_identifies_with_module_and_principal:201;test_admin_v1_credential_cache_and_flush_endpoint(crates/busbar-core-admin/src/tests/tests.rs:1522): the plugins' caches are flushed through the admin endpoint;every_request_is_verified_by_the_door_and_the_kernel_caches_no_verdict(crates/busbar-kernel/src/auth/tests/tests.rs). It covers the behaviour after Q1: a door that statesFACT_CACHEABLEis verified once per request, and its second answer (a revocation) decides the second request. No kernel cache answers for it.cli-9ce5e66d-bc6d-4402-a918-30806c266df7. A local-only mutation, never committed, makesexternal_admin_modulecache a FACT_CACHEABLE door's verdict per credential. On that mutation the test fails:assertion left == right failed: the second request is the door's second answer, never a cached Identified(leftIdentified { module: "ext-door", .. }, right(Denied, None)). Without the mutation it passes.Proof
Latchkey (large, debug) on the exact tree 47ea84c (a git bundle with the tags and origin/predev):
-D warningsis clean; busbar-auth-oauth is excluded because Latchkey strips its key fixture.test-support.cargo test -p busbar --no-fail-fastpasses 59 test binaries. The only failure isledger_identity's shipped-binary test:bin/oraclecannot clone its pinned checkout on the runner. It fails the same way on the pre-merge Q1 base.cargo xtask selftestpasses for each gate whose source or ledger this PR changes.:depsis 3 and:test-depsis 5, both equal to predev. The runner's extrano-basefinding comes from the bundle, not from this PR.