SECURITY: P1b: a door plane's open, refresh, owned sections and facing probe cross through the deal's one strip

[MattJackson]

SECURITY: P1b — a door plane's open, refresh, owned sections and facing probe cross through the deal's one strip

Spec BUSBAR-1.6.0.md :561-570: "A plane's settings reach it as ONE validated JSON object {section: value} per open/refresh, reserved keys and secrets stripped; upstream_credentials is kernel-owned".

Measured on predev 5e672d1 (Latchkey cli-d43752e9):

• serve.rs open removed only the top-level work;
• refresh handed the section as written;
• the owned sections and the kernel's facing probe were handed as written.

So a door plane received every reserved core-owned key, at the section, at each registration and at each pool: breaker, on_exhausted, gates, hooks, upstream_credentials (kernel-owned credentials), affinity, tier, repeatable, rate_card, fees, work and pools.

Commits

• 3d3cf7534a P1b-a: the pool affinity projection. PlaneOpenIn.pool_affinity and PlaneRefreshIn are tail-appended, and the golden and C header are regenerated. The kernel derives it with deal::crossing, and the llm plane reads it with Shaping::with_affinity.
• 20caaca14c RED: the test plane records the bytes it is handed at the ABI (settings.capture_to).
• 8b99a8f34d the fix:
  • serve.rs crossed: open and both refresh paths go through config_validate::deal::strip, which also covers the owned sections;
  • kernel door.rs: the facing probe and DoorOwned::bytes go through it.
• 0590041b9d merges origin/p6-k1-strip (ed7e8de). This stacks on K1-10 / Q-STEP9-a: pools is reserved; the strip runs at exact depths; an entry named after a reserved key is refused #599, which is not in predev yet, so this PR targets p6-k1-strip.

Secrets are not touched here. The secret references stack on this branch (sec-plane-secret-refs-p1b).

Proof (Latchkey cli-71242500-a61a-4a3d-acc6-afa318bbe615, head 0590041)

• cargo fmt --all --check: clean.
• cargo clippy --workspace --exclude busbar-auth-oauth --all-targets --all-features -D warnings: clean.
• cargo build --workspace --examples: green.
• cargo test, every crate run --no-fail-fast:
  • -p busbar-contract: 0 failed.
  • -p busbar --bin busbar: 0 failed.
  • -p busbar --all-features --bin busbar -- root::serve: 0 failed.
  • -p busbar-plane-llm -p busbar-plane-decisions -p busbar-plane-mcp: 0 failed.
  • -p busbar --test plane_driver --test plane_rider: 0 failed.
  • -p busbar-kernel: every target green except root_key_spelling::no_production_source_spells_a_kind_s_root_key_beyond_its_armed_count, the base's known red. It goes green with DEL 913fb20, which is not in this base.
  • -p busbar-plugin-loader: 612 passed, 2 failed. The two are the known environment reds at both_ways.rs: the external pinned busbar_secret_env_plugin twin is not built in a Latchkey job.
• That run's RED filter matched no test (the module is planes_tests), so it was re-run in Latchkey cli-e9b0fca8-bf75-43dc-8d7e-5a2cf03df5c1:
  • with 8b99a8f34d's source reverted, root::serve::planes_tests::a_door_planes_open_and_refresh_carry_no_reserved_key FAILED (the plane recorded the reserved keys);
  • restored, it passes.

Oracle (base p6-k1-strip ed7e8de vs this head, strict replay against golden 1.5.5)

chunk	base	head	moved
^(llm|decisions|boot\.refusal|config|) (Latchkey cli-78749b8f)	319 recorded: 301 PASS, 35 FAIL, 20 UNBASELINED	identical	none: each per-cell hash (classes, first diff, detail) equal
^mcp|(stdio|fence)| (cli-c85b4a53)	1 recorded: 2 PASS, 1 FAIL, 457 UNBASELINED	identical	none
^mcp|streamable-http| (cli-8b758f83)	0 recorded, 456 UNBASELINED	identical	none

The 913 mcp cells have no 1.5.5 golden and record nothing in this harness on either build, so they carry no signal here. Their judge is the merge group's conformance and oracle shards.

[github-actions]

promote into p6-k1-strip: NO VERDICT @0590041b9

The hop ended without writing a verdict (runner lost, timeout, cancel, or it died before the engine judged): preflight: failure at step Run cargo run --locked --release --no-default-features -p busbar-release-cli --bin busbar-release -- ci preflight; publish: runner lost at step Run bash "$GITHUB_WORKSPACE/busbar-release/ci/promote/fallback.sh", Post Run actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1.

No failing-test list exists for this run. Run: https://github.com/GetBusbar/busbar/actions/runs/37718926503 . Re-run the hop, or read the job's step list in the run page.