Make kernel and core-admin tests fail on an absent subject

[MattJackson]

Status row 114 (kernel and core-admin share). Governing lines: BUSBAR-1.6.0.md l.1929-1931 (when an instrument must choose, it false-fails), l.2038 (an instrument that cannot produce a NO is not a check), l.3904 (R-FIX2).

Change

• crates/busbar-kernel/src/auth/tests/plugin_chain_tests.rs: auth_cdylib() returns PathBuf and panics in every run when the cdylib is absent ("the busbar_auth_oidc_plugin cdylib is not built: run cargo test -p busbar-kernel --no-run first (its dev-dependency edge builds it; this test never skips)"). The CI special case is gone. write_auth_plugin and write_auth_plugin_with_root_secret_schema return (). All seven skip: guards are deleted. PR busbar-kernel: tests drop the plugin dev-deps (export-prometheus, auth-oidc); doubles in-crate, real-plugin proofs at the root #570 has not merged, so the tests stay in the kernel.

• crates/busbar-kernel/src/plane_host/pipe_tests.rs: each platform return is now an assertion that names the missing prerequisite: /bin/cat and /usr/bin/env must exist, and HOME must be set and non-empty.

• crates/busbar-core-admin/src/v1/tests/service_tests.rs (catalog_unreadable_dir_does_not_serve_stale_cache): the chmod 000 injection is replaced. After the first empty, readable read and its cache assertion, the test removes the directory and writes a regular file at the same path. An RAII guard removes that file at the end, and RestorePermsOnDrop is gone. The test then asserts std::fs::read_dir(&dir).is_err() before the two reads. The row assertions are unchanged.

• New crates/busbar-kernel/tests/no_silent_skip.rs and crates/busbar-core-admin/tests/no_silent_skip.rs. Each scans its own crate's test sources: every .rs under any tests/ directory, plus src/**/{*_tests.rs,tests.rs}, excluding itself. It fails with file:line on any of these:

  • (a) a skip: or SKIP print;
  • (b) var_os("CI") or var("CI");
  • (c) an if or let-else guard on auth_cdylib, write_auth_plugin, Path::new("/, var("HOME") or read_dir(&dir).is_ok() whose body is only comments, prints and return;.

  Comments are blanked before the scan. Each file also has a self-test, so the scan can produce a NO: every shape above is found, and the hard-failure forms that replace them pass.

RED arm: scanner output at the base (origin/predev 39374ec)

These lines come from applying the scanner's rules to the base sources (each listed line was read at the base). The scanners were not executed locally: the lane rules forbid local cargo build/cargo test, and CI is the proof.

busbar-kernel no_test_in_this_crate_passes_by_skipping_its_subject:

20 test-source site(s) pass by skipping an absent subject; each must be a hard failure (status row 114):
src/auth/tests/plugin_chain_tests.rs:72: (b) a CI probe: if candidate.is_none() && std::env::var_os("CI").is_some() {
src/auth/tests/plugin_chain_tests.rs:143: (c) an early-return guard on an absent subject: let Some(path) = auth_cdylib() else {
src/auth/tests/plugin_chain_tests.rs:144: (a) a `skip:` print: eprintln!("skip: auth-oidc plugin cdylib not built (run under --workspace)");
src/auth/tests/plugin_chain_tests.rs:284: (c) an early-return guard on an absent subject: if !write_auth_plugin(&dir, "idp.tar.gz", "acme-idp", "ref-auth") {
src/auth/tests/plugin_chain_tests.rs:285: (a) a `skip:` print: eprintln!("skip: auth-oidc plugin cdylib not built (run under --workspace)");
src/auth/tests/plugin_chain_tests.rs:360: (c) an early-return guard on an absent subject: if !write_auth_plugin_with_root_secret_schema(&dir, "idp.tar.gz", "acme-idp", "sec-auth") {
src/auth/tests/plugin_chain_tests.rs:361: (a) a `skip:` print: eprintln!("skip: auth-oidc plugin cdylib not built (run under --workspace)");
src/auth/tests/plugin_chain_tests.rs:437: (c) an early-return guard on an absent subject: if !write_auth_plugin(&dir, "idp.tar.gz", "acme-idp", "my-auth") {
src/auth/tests/plugin_chain_tests.rs:438: (a) a `skip:` print: eprintln!("skip: auth-oidc plugin cdylib not built (run under --workspace)");
src/auth/tests/plugin_chain_tests.rs:518: (c) an early-return guard on an absent subject: if !write_auth_plugin(&dir, "idp.tar.gz", "acme-idp", "idp") {
src/auth/tests/plugin_chain_tests.rs:519: (a) a `skip:` print: eprintln!("skip: auth-oidc plugin cdylib not built (run under --workspace)");
src/auth/tests/plugin_chain_tests.rs:595: (c) an early-return guard on an absent subject: if !write_auth_plugin(&dir, "idp.tar.gz", "acme-idp", "admin-oidc") {
src/auth/tests/plugin_chain_tests.rs:596: (a) a `skip:` print: eprintln!("skip: auth-oidc plugin cdylib not built (run under --workspace)");
src/auth/tests/plugin_chain_tests.rs:644: (c) an early-return guard on an absent subject: let Some(path) = auth_cdylib() else {
src/auth/tests/plugin_chain_tests.rs:645: (a) a `skip:` print: eprintln!("skip: auth-oidc plugin cdylib not built (run under --workspace)");
src/plane_host/pipe_tests.rs:135: (c) an early-return guard on an absent subject: if !std::path::Path::new("/bin/cat").exists() {
src/plane_host/pipe_tests.rs:192: (c) an early-return guard on an absent subject: if !std::path::Path::new("/usr/bin/env").exists() {
src/plane_host/pipe_tests.rs:230: (c) an early-return guard on an absent subject: if !std::path::Path::new("/usr/bin/env").exists() {
src/plane_host/pipe_tests.rs:233: (c) an early-return guard on an absent subject: let Ok(home) = std::env::var("HOME") else {
src/plane_host/pipe_tests.rs:323: (c) an early-return guard on an absent subject: if !std::path::Path::new("/bin/cat").exists() {

(The base guard if home.is_empty() { return; } at pipe_tests.rs:236 is outside rule (c)'s subject list. This change removes it anyway, and it is now assert!(!home.is_empty(), ...).)

busbar-core-admin no_test_in_this_crate_passes_by_skipping_its_subject:

2 test-source site(s) pass by skipping an absent subject; each must be a hard failure (status row 114):
src/v1/tests/service_tests.rs:882: (c) an early-return guard on an absent subject: if std::fs::read_dir(&dir).is_ok() {
src/v1/tests/service_tests.rs:883: (a) a `skip:` print: eprintln!("skip: running with privileges that bypass directory permission bits");

Core-admin, root vs non-root: on the base, catalog_unreadable_dir_does_not_serve_stale_cache returned early under a root runner (the usual CI container shape). Root ignores chmod 000, so read_dir succeeded, and the whole "a failing scan is never memoized" proof was skipped while it reported ok. On the head, the injected path is a regular file, so the assertion read_dir(&dir).is_err() holds for root and non-root alike, and the test always reaches its row assertions.

If CI shows that the catalog answers a not-a-directory path with a different row shape, the injection stays as stated and the assertions stay as they are (per the task). That would be a finding to report, not something to loosen.

Not touched

No #[ignore] and no feature gates. No re-exec child arms or non-test code. Nothing in crates/plugin-loader or crates/busbar. The only assertions changed are the skip replacements above.

[github-actions]

promote into predev: BOARD @37975120d: 0 failing test row(s), 11 DENY row(s)

DENY rows (11)

gate	row	detail
construction	one-pick-site	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	kind-isolation:deps	3 finding(s), 96 shipped edge instance(s) over 32 class(es), 96 declaration(s); 59 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	kind-isolation:test-deps	3 finding(s), 35 test edge instance(s) over 21 class(es), 35 declaration(s); 20 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is a test edge
kind-isolation	kind-isolation:law0	18 finding(s) over 14 neutral crate(s): law0-rise busbar × auth 49 hit(s) against a ceiling of 42: this landing grew a neutral crate's instance vocabulary. Ceilings only fall (measured on predev f830f
kind-isolation-ship	kind-isolation:deps	13 finding(s) over 96 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	kind-isolation:test-deps	10 finding(s) over 35 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship
kind-isolation-ship	kind-isolation:law0	18 finding(s) over 14 neutral crate(s): law0-rise busbar × auth 49 hit(s) against a ceiling of 42: this landing grew a neutral crate's instance vocabulary. Ceilings only fall (measured on predev f830f
kind-isolation-ship	kind-isolation:faces	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	kind-isolation:legacy-drain	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	ship-ready:ship-twin	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	structure-lint:plane-dup:unledgered	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

Judged against base 39374ec00: 0 new red, 0 worse, 5 standing (excused).

tests passed: 21937, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/37991061424 . Artifact verdict-37975120dfd44dc901eccb76740518e72a021ac1 (failures.json, junit.xml, raw.log; 90 days).