busbar-kernel: tests drop the plugin dev-deps (export-prometheus, auth-oidc); doubles in-crate, real-plugin proofs at the root

[MattJackson]

busbar-kernel's [dev-dependencies] on the plugin crates busbar-export-prometheus, busbar-auth-oidc and busbar-auth-oidc-plugin are removed. PR #502 puts the pinned plugin checkouts into the kind-isolation census, and that exposed these edges as kind-isolation-ship findings.

Ruling. Coordinator, 2026-10-07: the edges are MOVED, not granted. Spec BUSBAR-1.6.0.md l.3870 (FIXTURES step (3)) says only the in-repo LOADER conformance tests pin real plugin repos as dev-deps. R-FIX3 (l.3894) says the kernel's own tests use in-crate test-support doubles and are linked only. This PR adds no ledger row, no grant and no ceiling change. It strikes the two [[dep]] rows whose drain clauses this work completes (the gate had reported both as dead-dep-edge).

What changed

• test_support::export_axis: when no installed row answers the frozen scrape module word, the stand-in export axis answers it with ScrapeDouble. The word comes from the legacy table's export_module_streams row that maps to metrics. The double is first-party and one_instance, carries the metrics stream, and declares /metrics and /metrics/hooks. It serves them from the host snapshot service under content types of its own, and its one-instance refusal is in its own words. It is test code only (cfg(any(test, feature = "test-support"))): not a plugin, not a door. A test binary that links the real sink is still answered by the sink.
• The kernel's scrape, config, migrate, projection and plugin tests resolve module: prometheus against the double. metrics_source_tests and snapshot_hooks_tests read through the test view (test_support::export_axis::lines) instead of the prometheus renderer.
• auth/tests/plugin_chain_tests.rs: the role-binding test runs on an in-process module (PlatformRole at provider idp). The untrusted-plugin test uses an unsigned auth row whose bytes are not a library. The 5 tests that load the real OIDC cdylib move to the composition root.
• The real-plugin proofs now live in crates/busbar/tests/auth_plugin_chain.rs, export_scrape_linked_sink.rs and export_settings_refusal_1_5_5.rs::a_second_scrape_sink_instance_is_refused_as_1_5_5_printed_it.
• qa/kind-isolation.toml: the busbar-kernel -> busbar-export-prometheus and busbar-kernel -> busbar-auth-oidc test rows are struck.

Mapping (old path::fn -> new path::fn)

Kernel paths are crates/busbar-kernel/src/...; busbar paths are crates/busbar/tests/....

old	new	how
export/tests/scrape_tests.rs::the_scrape_sink_renders_the_recorder_snapshot_byte_identically	export_scrape_linked_sink.rs::the_scrape_sink_renders_the_recorder_snapshot_byte_identically	moved, real plugin (the linked busbar_export_prometheus door)
export/tests/scrape_tests.rs::the_metrics_instance_is_the_scrape_sink	same	double (ScrapeDouble)
export/tests/scrape_tests.rs::metrics_route_declared_only_when_configured	same	double
export/tests/scrape_tests.rs::a_granted_scrape_is_the_sinks_rendering_of_the_snapshot	same (asserts the double's own content types, passed through verbatim)	double
export/tests/scrape_tests.rs::an_ungranted_crossing_reads_no_snapshot	same	double
config/tests/tests.rs::export_named_map_allows_two_instances_of_one_module	same (asserts the double's own one-instance words, rendered verbatim)	double
(1.5.5 words of that refusal, previously asserted only by the kernel test above)	export_settings_refusal_1_5_5.rs::a_second_scrape_sink_instance_is_refused_as_1_5_5_printed_it (new, via busbar --validate)	moved, real plugin
config/tests/tests.rs::test_limits_set_value_overrides_default	same	double
config/tests/migrate_tests.rs::migrate_observability_export_rewrites_old_to_new	same	double
config/tests/migrate_tests.rs::golden_migrate_type_keyed_export_becomes_a_named_map	same	double
config/tests/migrate_tests.rs::migrate_export_adds_the_explicit_streams_projection	same	double
export/tests/plugin_tests.rs::a_module_on_the_axis_resolves_and_an_unregistered_one_is_refused_as_before	same	double
export/tests/plugin_tests.rs::a_sink_that_will_not_open_refuses_naming_the_instance	same	double (axis install only)
export/tests/projection_tests.rs::{produced_streams_are_accepted, stream_the_module_cannot_carry_is_a_loud_error, fields_on_metrics_is_a_loud_error}	same	double
tests/metrics_source_tests.rs::the_source_holds_what_1_5_5s_recorder_held	same (both snapshots read through one stable test view)	double (test_support::export_axis::lines)
tests/snapshot_hooks_tests.rs::{counter_renders_with_hook_label_and_verbatim_name, histogram_renders_as_summary, histogram_with_buckets_renders_as_native_histogram, busbar_prefix_is_reserved, two_hooks_same_name_share_header_split_by_label, type_conflict_for_shared_name_is_dropped, label_values_are_escaped, hook_labels_cannot_shadow_renderer_labels}	same (the fold read through the test view)	double (test_support::export_axis::lines)
auth/tests/plugin_chain_tests.rs::a_v1_auth_plugin_is_refused_at_boot_and_the_current_one_builds_browser_login	auth_plugin_chain.rs::a_v1_auth_plugin_is_refused_at_boot_and_the_current_one_builds_browser_login (the browser_login half now builds through build_app_from_config over a config read from disk, since LoginMethods::build is crate-private)	moved, real plugin
auth/tests/plugin_chain_tests.rs::auth_plugin_setting_secret_ref_is_resolved_and_delivered	auth_plugin_chain.rs::auth_plugin_setting_secret_ref_is_resolved_and_delivered	moved, real plugin
auth/tests/plugin_chain_tests.rs::auth_plugin_root_level_secret_marked_setting_resolves_and_authenticates	auth_plugin_chain.rs::auth_plugin_root_level_secret_marked_setting_resolves_and_authenticates	moved, real plugin
auth/tests/plugin_chain_tests.rs::auth_plugin_loads_and_identifies_through_middleware	auth_plugin_chain.rs::auth_plugin_loads_and_identifies_through_middleware	moved, real plugin
auth/tests/plugin_chain_tests.rs::admin_modules_rebuilt_on_reload	auth_plugin_chain.rs::admin_modules_rebuilt_on_reload	moved, real plugin
auth/tests/plugin_chain_tests.rs::auth_plugin_role_binding_and_scope_cap_apply	same	double (in-process PlatformRole module at provider idp)
auth/tests/plugin_chain_tests.rs::untrusted_auth_plugin_fails_closed_not_open	same	double (an unsigned auth row whose bytes are not a library)

Unchanged and still in the kernel: the 13 other plugin_chain_tests.rs tests (they never loaded the plugin), scrape_tests.rs::the_lend_lasts_exactly_the_crossing, metrics_source_tests.rs::{escapes_and_names_are_1_5_5s, the_window_rolls_while_count_and_sum_never_reset}.

Count: kernel 6 fewer (1 scrape + 5 auth moved); busbar 7 more (the 6 moved + the 1.5.5 one-instance line split out of the kernel named-map test). Net +1; none retired.

Proof

Base is origin/predev e107253. Its merge-group CI run 37613414676 (promote.yml) is green. Head measurements are from Latchkey (large).

• cargo fmt --all --check: exit 0.
• cargo clippy -p busbar-kernel --all-targets -- -D warnings: exit 0. cargo clippy -p busbar --all-targets -- -D warnings: exit 0.
• cargo test -p busbar-kernel --no-fail-fast (unfiltered): exit 0. The lib suite is 2688 passed, 0 failed, 1 ignored; every other kernel test binary is ok.
• cargo test -p busbar --no-fail-fast (unfiltered): all 7 moved/new tests pass (auth_plugin_chain 5/5, export_scrape_linked_sink 1/1, export_settings_refusal_1_5_5 2/2). 16 tests fail, and all 16 are pre-existing:
  • 15 root::registry / root::serve::{framed,money,planes}_tests in the bin unit tests;
  • ledger_identity::the_ledger_and_the_legacy_rows_reconcile_on_the_shipped_binary, which needs GitHub credentials to fetch the oracle.
    The same command on base (e107253) fails those 16 plus one more (planes_tests::a_door_plane_whose_section_is_absent_stays_unopened). Head adds no failure.
• cargo xtask gate --all, base vs head:
  • Exit 1 on both, RED in kind-isolation, kind-isolation-ship, ship-ready on both.
  • All 559 row → status pairs are identical.
  • kind-isolation-ship:test-deps goes from 22 findings over 48 test edges to 20 over 46. busbar-kernel -> busbar-export-prometheus and busbar-kernel -> busbar-auth-oidc are gone from the census. busbar-auth-oidc-plugin is not a census crate, so it never had a finding.
  • kind-isolation:test-deps: 6 findings on base and 6 on head, with 46 test edges and 28 [[dep]] rows (base: 48 edges, 30 rows). Before the two dead rows were struck, head showed 8 findings: the gate reported them as dead-dep-edge.
• cargo xtask gate kind-isolation --selftest: exit 0. cargo xtask selftest: exit 0 (64 gates, every one proven able to go RED). Both are required because qa/kind-isolation.toml is touched.
• Red before green: one Latchkey run applied 7 kernel mutations, each breaking the behaviour a doubled test proves, then ran those tests. All 9 failed. On head they pass.

mutation	test	red
M1 scrape detection off (config/mod.rs)	the_metrics_instance_is_the_scrape_sink	[] != ["metrics"]
M1	test_limits_set_value_overrides_default	2000 != 9
M1	golden_migrate_type_keyed_export_becomes_a_named_map	export.recorder.is_some()
M2 one-instance refusal dropped	export_named_map_allows_two_instances_of_one_module	[] != ["export.two: the scrape double takes one instance, and 'one' is it"]
M3 the grant lends nothing (export/scrape.rs)	a_granted_scrape_is_the_sinks_rendering_of_the_snapshot	502 != 200
M4 the source drops HELP (snapshot/source.rs)	the_source_holds_what_1_5_5s_recorder_held	the # HELP lines differ
M5 the hook fold admits busbar_* (snapshot/hooks.rs)	busbar_prefix_is_reserved	panicked at the reserved-name assert
M6 role_bindings never match (auth/mod.rs)	auth_plugin_role_binding_and_scope_cap_apply	Grants(0) != Grants(2)
M7 an unloadable auth module is skipped, fail-open (auth/mod.rs)	untrusted_auth_plugin_fails_closed_not_open	unwrap_err on Ok

[github-actions]

promote into predev: all green @1f6e5f119

Already red on predev, not this PR's: 11

gate	row	detail
test:workspace	::nextest xtask::cli::selftest_runs_every_registered_gates_red_proof
construction	one-pick-site	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	kind-isolation:deps	3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	kind-isolation:law0	9 hit(s) off the [[law0]] ceilings, 4 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabulary
kind-isolation-ship	kind-isolation:deps	10 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	kind-isolation:test-deps	8 finding(s) over 33 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship c
kind-isolation-ship	kind-isolation:law0	9 hit(s) off the [[law0]] ceilings, 4 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabulary
kind-isolation-ship	kind-isolation:faces	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	kind-isolation:legacy-drain	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	ship-ready:ship-twin	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	structure-lint:plane-dup:unledgered	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

tests passed: 24474, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38216791414 . Artifact verdict-1f6e5f11994fc01b536919909f993e078f197c0f (failures.json, junit.xml, raw.log; 90 days).

[MattJackson]

RULING (architect, Law 9, docs/design/BUSBAR-1.6.0.md l.2082-2097: "pins its ceiling at TODAY'S MEASURED VALUE and refuses every rise ... The drain runs behind it, ratcheting the ceiling down"): kind-isolation is judged PER CELL, no-worse-than-base. A PR may not raise any cell above its base; a cell it lowers takes the new, lower ceiling. Lowering or striking one [[law0]] row does NOT arm the whole row, and a PR is NOT required to drain predev's unrelated standing over-ceiling cells. Those are predev's own reds, owned by kind-isolation:law0-base (#747) and drained by their own lanes. No ceiling rises. If the engine's armed-red rule still judges the whole row, that is an engine defect being fixed in busbar-release now; this PR proceeds on its own cells.

[MattJackson]

Claim released by busbar-release: the fixing label had no live agent behind it: no push and no new claim for 18h38m (the longest agent's hard timeout is 2h00m), so it is off and the PR is back in the pipeline.