kernel-scope: key liveness is the egress gate's for every plane; one scope lattice, one admin matrix; unconsulted policy lookup and unmounted helpers deleted (Q128)

[MattJackson]

Q128 audit ledger, scope crates/busbar-kernel-scope/src: closes the round-2 HIGH and the six LOWs.

HIGH: key liveness is the egress gate's, for every plane, and no plane can switch it off (THE DESIGN §1: every plane gets every capability).

• EgressSubject::REQUIRE_LIVE_KEY let a plane opt out of the caller-key liveness check, and one plane shipped with it off.
• On that plane, a key past its own expires_at still had busbar's outbound credential spent for it, while the sibling plane refused it. Inbound verify does not check a key's own expires_at.
• The const is deleted. authorise refuses a tombstoned, disabled or expired key unconditionally.
• The A2A plane already set it to true, so its behaviour does not change.
• Test every_plane_gets_the_liveness_check_and_none_can_switch_it_off: RED on base code with the subject opting out, green here. It replaces a_plane_whose_policy_omits_liveness_does_not_have_it_imposed, which asserted the opt-out.

LOWs.

• One lattice: Scope/Grants are re-exported from busbar_contract::authz. The kernel-scope copy is deleted, and its bit-layout, chain and narrowing tests move to busbar-contract/src/tests/authz_tests.rs. kernel-identity's admin.rs still holds a third spelling; that is the kernel-identity scope's.
• One admin matrix: the kernel admin gate's required_scope calls admin_required_scope.
• Deleted, never consulted: PolicyView/required_scope, and the root's ScopePolicy, which was built empty and read by nothing. The tests that pinned them go with them, and the assembly test drops its scope_policy.is_empty() assertion.
• Deleted, never mounted: EgressRefusal::audit_resource/caller. The kernel chain test now spells its resource inline.
• Stale prose corrected; no plane's grant kinds named.

Proof (Latchkey cli-6f674c20, cli-a72462c9, cli-2d05afd1, cli-93f58fa0):

• Unfiltered tests:
  • busbar-kernel-scope: 12 passed.
  • busbar-contract: 1245 passed.
  • busbar-kernel: 2951 passed.
  • busbar-a2a: 16 passed.
  • busbar: 991 passed, 19 failed. Base predev 5e672d1 fails the identical 19 when run the same way, unbuilt dropped-in cdylibs (framed_tests, money_tests, planes_tests, registry dropped-in, ledger_identity), so none is new.
• clippy -D warnings and fmt are clean.
• kind-isolation: the same FAIL rows as base.
• No admin scope answer changes: the one matrix is the same function the root already enforced, and it is pinned row for row against the 66 1.5.5 operations.

[github-actions]

promote into predev: DENY @9c49c9d90: 0 failing test row(s), 11 DENY row(s)

DENY rows (11)

gate	row	detail
construction	one-pick-site	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	kind-isolation:deps	3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	kind-isolation:test-deps	3 finding(s), 35 test edge instance(s) over 21 class(es), 35 declaration(s); 20 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is a test edge
kind-isolation	kind-isolation:law0	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:deps	10 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	kind-isolation:test-deps	10 finding(s) over 35 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship
kind-isolation-ship	kind-isolation:law0	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:faces	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	kind-isolation:legacy-drain	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	ship-ready:ship-twin	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	structure-lint:plane-dup:unledgered	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

Denied because (2)

• shard 1/4: armed red: gate:kind-isolation row kind-isolation:law0: a ledger row this candidate arms is red at its own tree (Law 9: arm at today's number): 11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35:
• shard 1/4: armed red: gate:kind-isolation-ship row kind-isolation:law0: a ledger row this candidate arms is red at its own tree (Law 9: arm at today's number): 11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling o

Judged against base 17b55f973: 0 new red, 0 worse, 3 standing (excused).

tests passed: 24391, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38096889359 . Artifact verdict-9c49c9d909847a2f4590840a5f7bb14fc13c2635 (failures.json, junit.xml, raw.log; 90 days).

[MattJackson]

RULING (architect, Law 9, docs/design/BUSBAR-1.6.0.md l.2082-2097: "pins its ceiling at TODAY'S MEASURED VALUE and refuses every rise ... The drain runs behind it, ratcheting the ceiling down"): kind-isolation is judged PER CELL, no-worse-than-base. A PR may not raise any cell above its base; a cell it lowers takes the new, lower ceiling. Lowering or striking one [[law0]] row does NOT arm the whole row, and a PR is NOT required to drain predev's unrelated standing over-ceiling cells. Those are predev's own reds, owned by kind-isolation:law0-base (#747) and drained by their own lanes. No ceiling rises. If the engine's armed-red rule still judges the whole row, that is an engine defect being fixed in busbar-release now; this PR proceeds on its own cells.

[MattJackson]

Claim released by busbar-release: the fixing label had no live agent behind it: no push and no new claim for 18h33m (the longest agent's hard timeout is 2h00m), so it is off and the PR is back in the pipeline.

[MattJackson]

Re-run by busbar-release: the engine pin ENGINE_REF 937eae641 now contains busbar-release 5a1380d, which the owner question this PR was held on names; the failed jobs of 9c49c9d are re-run and the hold is lifted.