SECURITY: a plane never receives a credential's bytes (credential-field refs, template refs); a member's env resolves at spawn

[MattJackson]

SECURITY. A door plane is handed a secret reference where it used to be handed a credential's plaintext. Carried onto predev from the orphaned #684 (it sat on #599 → #559 → #554 → #546 → p6-d2-kernel, whose #526 closed unmerged). Supersedes #684.

Authority. BUSBAR-1.6.0.md Part 0, THE DESIGN §6 "Trust boundary" (l.828-834 at predev 9c0a394): "A plane never receives secret bytes. Logs, audit records and metrics carry a secret's reference, never its value." Part 3 §4 (l.2415): "the plane passes a ref and NEVER holds plaintext". SECURITY rulings, 2026-10-07:

• a SecretRef appears only at a credential field;
• url, command, args, cwd and token_url keep load-time interpolation (no narrowing from 1.5.5);
• a credential filled in part becomes a template reference;
• a member's env resolves at the spawn.

What was wrong on predev. ${VAR} is spliced into the config text before it is parsed. Its plaintext then reached a door plane at every crossing:

• the door's validate;
• the facing probe;
• open settings and owned sections;
• the config-apply refresh;
• the stage-3g validate blob.

A member's env was also resolved at the declare, not at the spawn.

Changes

• busbar-kernel config::filled:
  • The interpolation's structural check records each scalar ${VAR} it filled. A record holds the path, the variables, the value as written and a per-process keyed digest. It never holds the value.
  • plane_bound puts a reference at each credential position: {env: VAR} for a whole value, a template reference for a part. Only a value that still matches its digest is replaced.
• Bound crossings on predev:
  • plane/door.rs settings_of, used by the door validate (both paths) and the facing probe;
  • DoorOwned::bytes;
  • root/boot.rs validate_dealt (a plane's verb seats);
  • root/serve.rs handed_settings, used by open and the config-apply refresh;
  • the owned sections at open.
• busbar-contract: SecretRef::template / template_text / resolve_template, and Program::secret_env.
• busbar-core-connector: install_spawn_secrets. Connection::spawn resolves a member's secret_env at the spawn, and nowhere earlier.
• plugin-loader: install_member_secrets and MemberSecretFn are removed. The root installs the linked secret resolver into the connector instead.
• The plane-driver test plane writes the blobs it is handed at open and refresh to disk, and its refresh now returns a snapshot.

What changed from #684's diff. #684 bound the crossings that P1b (#670) had routed through the deal's strip. P1b is not on predev, so this binds the crossings predev has: handed_settings and the door's settings_of. It does not strip reserved keys; that is P1b, which is its own task. Its test plane drops the pool_affinity blob, which belongs to P1b-a.

REDs

• root an_interpolated_credential_reaches_a_door_plane_as_its_reference_never_its_bytes: the open, owned and refresh blobs carry no plaintext and no resolved reference;
• kernel filled_tests;
• connector a_members_secret_environment_resolves_at_the_spawn and a_member_whose_secret_environment_does_not_resolve_is_not_spawned;
• contract a_template_reference_resolves_each_variable_in_place and a_programs_secret_environment_is_held_as_its_reference.

Proof (Latchkey, this tree)

Check	Job	Result
cargo check --workspace --all-targets	cli-1679dbe9	0
clippy -p busbar-contract --all-targets -D warnings	cli-bbab9e6a	0
clippy -p busbar-core-connector --all-targets -D warnings	cli-ef45f9fe	0
clippy -p busbar-kernel --all-targets -D warnings	cli-55b74cc6	0
clippy -p busbar-plugin-loader --all-targets -D warnings	cli-9f4f58c1	0
clippy -p busbar --all-targets -D warnings	cli-2841384a	0
test -p busbar-contract	cli-0df868b7	1286 passed, 0 failed
test -p busbar-kernel	cli-80e1d39c	2884 passed, 0 failed
test -p busbar-core-connector	cli-1ca1921d	244 passed; 7 failed: universal_needs, each "a ... door is built beside the test binary" (the CI cdylib step; not built on a Latchkey runner)
test -p busbar-plugin-loader	cli-02632d77	639 passed; 2 failed: the both-ways secret cells, "the busbar_secret_env_plugin cdylib is not built" (same cause)
test -p busbar	cli-8e178202	653 passed; 23 failed: predev's own 22 on this runner (same set at predev 9c0a394, job cli-e6de4be3: the neutral frame door cdylib is not built, and the leaked serve-framed-wild publication under one-process cargo test). The 23rd is the new cell, refused by that same leaked publication ("admin route ... overlaps serve-framed-wild"); CI's test:workspace runs under nextest, one process per test

RED: shown by #684 on its own base (an_interpolated_credential... read the plaintext at all three blobs before the binding). On a Latchkey runner the one-test filter does not build the example cdylib, so the red/green pair for this cell is CI's.

[github-actions]

promote into predev: all green @d39006c97

Already red on predev, not this PR's: 15

gate	row	detail
test:xtask-selftest	::xtask selftest kind-isolation
test:xtask-selftest	::xtask selftest plane-purity
test:xtask-selftest	::xtask selftest no-deferral-strict-done
test:xtask-selftest	::xtask selftest plane-purity-strict
test:xtask-selftest	::xtask selftest unconstructed
test:xtask-selftest	::xtask selftest structure-lint
test:xtask-selftest	::xtask selftest plane-transport-neutrality
construction	one-pick-site	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:358; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	kind-isolation:deps	3 finding(s), 92 shipped edge instance(s) over 29 class(es), 92 declaration(s); 55 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation-ship	kind-isolation:deps	8 finding(s) over 92 shipped edge(s): ship-edge kernel -> store busbar-kernel -> busbar-store-memory is 'not-allowed': the architecture grants no kernel -> store edge, and the ship criterion is the ar
kind-isolation-ship	kind-isolation:test-deps	5 finding(s) over 31 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship c
kind-isolation-ship	kind-isolation:faces	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	kind-isolation:legacy-drain	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	ship-ready:ship-twin	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	structure-lint:plane-dup:unledgered	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

tests passed: 24853, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38348625115 . Artifact verdict-d39006c974a6bb30975ce674e42da480090a9e28 (failures.json, junit.xml, raw.log; 90 days).

[MattJackson]

Claim released by busbar-release: the fixing label had no live agent behind it: no push and no new claim for 15h57m (the longest agent's hard timeout is 2h00m), so it is off and the PR is back in the pipeline.