secret-source leak check (status row 127): a credential that cannot be presented reaches every door plane's caller as one fixed-class refusal; kernel cell + all-doors scan with its RED arm kept

[MattJackson]

What (status row 127)

The secret-source leak check is back. A failing secret resolution must reach every door plane's caller as a fixed-class refusal, with no source, ref, env or path text in it.

History: #511 deleted busbar-mcp's leak test and the SetupRefusal::client_message redaction. #590 then restored a root scan over every linked door plane. That scan checks that the source is absent. It does not check that the refusal is a fixed class. It has no kernel cell, and its RED was a one-off mutation in a Latchkey job, not kept in the tree. This PR adds those three things.

Where a failing secret meets a caller on predev (measured by reading, e1694a8)

seam	what crosses	free text?
auth call (OutboundAuth::fields)	Fields::Refused / Failed	none: the variant carries no payload
connector open (a member program whose env ref did not resolve)	ConnError::Refused	ConnError::text() is &'static str
far end to walk	FarEnd::failure	&'static str
walk terminal	Pick::Exhausted { status, retry_after }	none
kernel to plane refusal	RefusalIn.text	the reason's own word (render_as), a hook veto's sanitised words, or a scope route's entry names. Never resolver text
compose / apply (member_routes, token_exchange_binding, registration_anchors)	operator String naming the source	boot refused, or apply logged and the old generation kept. Never on a caller's wire

No caller-facing leak exists today. This PR makes that a checked property, not a structural accident.

Changes (tests only; no production line changes)

1. Kernel cell, crates/busbar-kernel/tests/plane_driver.rs: a_credential_that_cannot_be_presented_reaches_the_caller_as_a_fixed_class_refusal.
   • Plants three failing secrets, each with its own markers: an unset variable, a missing file, and a module that no secret plugin answers.
   • Control: for each one, the kernel's resolver refuses with operator text that names the marker.
   • A unit is driven through the one loop over a far end whose members' credentials cannot be presented. The first member's auth call is refused, so nothing is sent. The second member's program is never spawned, so its attempt fails over.
   • Asserts the unit ends at the walk's terminal, with breaker_open, class Unreachable.
   • Asserts the plane is handed that reason's own word: the double renders the kernel's text verbatim and FAULTs on any other.
   • Asserts the caller's render is byte-identical across all three sources and carries no marker.
   • Kind-neutral: no plane, secret or transport instance is named.
2. All-doors scan, fixed-class half and kept RED arm, crates/busbar/src/root/tests/secret_source_class.rs. This is a child of secret source: a failing secret reference never hands a caller its source, on every linked door plane; fixture messages name their build command #590's secret_source.rs, which gets one appended mod line and nothing else.
   • two_failing_sources_reach_the_caller_as_one_fixed_refusal: an unset variable and a missing file, each as a member program's env reference, reach the caller as the same status and the same body. Both renders are clean of both sources.
   • the_scan_catches_a_source_spliced_into_a_real_door_render (the RED arm, kept): a real tool-door caller render for a failing reference is first proven clean. Then the operator's text is spliced in place of the connector's fixed words. That is exactly the leak P3 FLIP-MCP: the mcp plane served through its door on the kernel plane driver #511's redaction stood in front of. The scan's detector must name the source, and the same assert_clean every door's cell runs must fail.

every_linked_door_plane_is_driven (#590) still makes sure every linked door joins the scan.

Relation to #727 (open)

This PR stays clear of #727. #727 edits four hunks of secret_source.rs. This PR only appends a mod line at the end of that file, and its new cells live in their own file. With #727, a member's env resolves at the spawn and the connector refuses the open. The caller still gets ConnError::Refused's fixed text, so both new root cells hold unchanged.

Proof (M3 prover)

Head 3f2c428, base predev e1694a8. One job, own checkout and target dir.

check	result
cargo test -p busbar-kernel --test plane_driver	61 passed, 0 failed (the new cell included)
cargo test -p busbar --bin busbar secret_source	32 passed, 0 failed (#590's cells and the two new ones)
cargo clippy -p busbar-kernel -p busbar --all-targets -- -D warnings	clean
cargo fmt --all --check	clean
xtask gate construction --posture	EXCUSED (its one standing row, unchanged)
xtask gate instance-noun-neutrality --posture	green
xtask gate qa-names --posture	green
xtask gate kind-isolation --posture	RED on law0 / deps / test-deps, all already red on predev. law0-base PASSES: no neutral Law 0 cell grew over the merge-base

What the caller gets (measured, tool door, both sources): 200, isError text ...could not reach it to verify its tool list: the connection was refused. The bytes are identical for the unset variable and the missing file.

The kept RED arm firing (the spliced render, which the scan caught and assert_clean failed on):
...verify its tool list: secret env:BUSBAR_SECRET_SOURCE_TOOLS_RED_ENV_683586 cannot resolve: environment variable '...' is unset
...verify its tool list: secret file:/tmp/busbar-secret-source-tools-red-file-683586 cannot resolve: No such file or directory (os error 2)

[github-actions]

promote into predev: all green @984c16ccc

Already red on predev, not this PR's: 11

gate	row	detail
construction	one-pick-site	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	kind-isolation:deps	3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	kind-isolation:test-deps	3 finding(s), 35 test edge instance(s) over 21 class(es), 35 declaration(s); 20 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is a test edge
kind-isolation	kind-isolation:law0	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:deps	10 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	kind-isolation:test-deps	10 finding(s) over 35 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship
kind-isolation-ship	kind-isolation:law0	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:faces	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	kind-isolation:legacy-drain	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	ship-ready:ship-twin	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	structure-lint:plane-dup:unledgered	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

tests passed: 16569, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38221153815 . Artifact verdict-984c16cccbc68ea1959856ccaf087c4896c96bb1 (failures.json, junit.xml, raw.log; 90 days).