Declares::from_declares_json: the one reader of a declares document; needs checked and left out of the manifest

[MattJackson]

ARCHITECT ruling (b), 2026-10-07, extended the same day. declares.json stays the conformance file: the suite test the_declared_needs_are_the_statements and the busbar-release render keep reading needs, and the declares section never carries it, because needs belong to the Statement.

Defect. Two readers parsed a plugin's declares.json straight into sign::Declares, which has deny_unknown_fields. Both refused needs, so the roster repos that state it (store-mysql, store-postgres and store-valkey with tcp; secret-vault and export-webhook with http) broke in two places:

• busbar-plugin-pack --declares-file refused to pack them.
• The root's linked_exports refused at boot. It read a linked sink's DECLARES, and ORACLE-BURN measured this on a build linking export-webhook dev. door_breaker read a linked plane door's row the same way.

Change.

• New Declares::from_declares_json(&[u8]) in sign.rs, beside Declares. It checks needs is a list of DECLARES_NEED_SCHEMES (tcp, http, https), removes it, and reads the rest with deny_unknown_fields kept.
• Every reader of a declares document now goes through it: pack's read_declares, linked_exports, door_breaker, and the test sites that read a linked sink's DECLARES.
• A signed manifest's declares is not a declares document, so it still refuses needs.
• No plugin repo changes are needed.

RED tests. Each fails without the change.

• pack_cli_leaves_the_declares_needs_out_of_the_manifest:
  • a file with needs packs to a manifest with no needs;
  • a malformed needs is refused: not a list, a non-string, or gopher;
  • any other unknown key is still refused;
  • no refusal writes a tarball.
• declares_reader_tests:
  • the same three cases at the reader itself, plus non-JSON input;
  • a signed manifest stating needs is refused;
  • a scan of crates/ and xtask/ fails on any serde_json::from_* that reads declares bytes into Declares outside the one reader. It has a RED arm over its own patterns and was red on linked.rs and export_conformance_tests before this change.
• a_linked_export_declares_stating_needs_boots: every real linked export door, restated with needs, reads to the same manifest section and links into the registry. A malformed needs refuses the rows, naming the plugin.
• a_plane_declares_stating_needs_still_reads_its_breaker_fact: the decisions door's row reads its breaker fact beside needs. A malformed needs is refused, naming the row.

Proof.

• busbar-plugin-loader (--features pack) and busbar tests, unfiltered: all green.
• clippy with -D warnings and fmt --check pass.
• Gate secret-hygiene is green.
• Gates kind-isolation and kind-isolation-ship give the same rows as predev's own base. Both are red there (deps, test-deps, faces, testkit, legacy-drain, control-path), and none of those findings involve the files changed here.

[github-actions]

promote into predev: DENY @8610e68d4: 0 failing test row(s), 11 DENY row(s)

Merge queue group 4627fbfe8 (first in its group, so this PR's own red): it re-enters only with a new head.

DENY rows (11)

gate	row	detail
construction	one-pick-site	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	kind-isolation:deps	3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	kind-isolation:test-deps	3 finding(s), 35 test edge instance(s) over 21 class(es), 35 declaration(s); 20 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is a test edge
kind-isolation	kind-isolation:law0	39 hit(s) off the [[law0]] ceilings, 6 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:deps	10 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	kind-isolation:test-deps	10 finding(s) over 35 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship
kind-isolation-ship	kind-isolation:law0	39 hit(s) off the [[law0]] ceilings, 6 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:faces	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	kind-isolation:legacy-drain	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	ship-ready:ship-twin	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	structure-lint:plane-dup:unledgered	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

Denied because (2)

• shard 1/4: gate:kind-isolation row kind-isolation:law0: figure rose 21 -> 39
• shard 1/4: gate:kind-isolation-ship row kind-isolation:law0: figure rose 21 -> 39

Judged against base e9a1b8fec: 0 new red, 2 worse, 3 standing (excused).

Reused PASS by input key (1, 1 min not re-run)

step	key	produced by
build:deletion-matrix	5f091001188f6c73	81417a5a5

tests passed: 24267, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38036314964 . Artifact verdict-4627fbfe8b28e8437fee5c3172f984dcb2f522ae (failures.json, junit.xml, raw.log; 90 days).

[MattJackson]

Superseded by #737, which carries every commit of this branch plus the fix for its merge-queue DENY (kind-isolation law0 21->39: transport scheme names in neutral crates). Bundle kept: salvage/pr-550.bundle.