Repository navigation
P3 FLIP-A2A: the a2a plane served through its door; busbar-a2a deleted (stacked on #778) - #787
Open
MattJackson wants to merge 432 commits into
Open
MattJackson wants to merge 432 commits into
MattJackson wants to merge 432 commits into
Conversation
`linked_door()` picked the linked plane door whose `served().owns` contains the fixture's section (`agents`). `owns` is the Statement's sections that are neither declaring nor consumed (plugin-loader dispatch/kinds/plane.rs, tail_facts: `flags & (SECTION_DECLARING | SECTION_CONSUMED) == 0`), and the agent door states `agents` as its one DECLARING section (busbar-plane-a2a door.rs SECTIONS), so `owns` is empty and `linked_door()` was `None` in every build: every agent_door cell took its "a build that links no agent door" early return and asserted nothing. The lookup now compares `served().section`, the declaring section, as core-admin's publish_door and the root's own serve rows read it. RED arm: without this line every agent_door cell, and the cells moved here from core-admin in the next commit, returns before its first assertion.
…d here busbar-core-admin links no loader (P2 D4), so the two things its harness did through the loader now live in the composition root's agent_door cells, where linking core-admin and the loader is legitimate: - the_agent_doors_trust_verbs_refuse_in_their_declared_taxonomy: moved from busbar-core-admin's `drive_door_verb_errors` (src/tests/tests.rs), which opened the real door through the loader. The door, published as the root publishes it, answers through the admin router: an unknown name 404 not_found on connect and approve; an approve body with a field beside `fingerprint` 400 invalid_request naming `fingerprint`; an approve for an agent whose card cannot be fetched (nothing listens on its port) 400 invalid_request "nothing to approve". The same assertions as before; core-admin keeps witnessing the declared taxonomy over its door double. - the_admin_crates_door_double_states_the_linked_doors_statement: the linked door's registration, read through the loader's one load and registration reader as the root folds it, projected to data, equals busbar-core-admin/src/tests/door_double_statement.json. core-admin's openapi drift test held the real door's OpenAPI fragment before; it now holds the double's, and this pins the double to the door, so the chain still ends at the door.
…g at boot again predev refused, at boot and on every apply, a deployment whose present agents.rate_card is silent about a registered agent, naming a paste-ready stub for exactly the agents it misses (#42, #77(5)). On the door the section is a DoorSection, whose ledger_lanes was the empty default, so the kernel's completeness rule (config_validate, "EVERY REGISTRATION A PLANE BILLS FROM CONFIG IS PRICED") never saw a lane and the gap surfaced only at run time, per unit. The card is lifted off the section before the door sees it (#40), so the door's own validate cannot judge it; the kernel's judge of the door's section now names the section's registrations as the lanes a present card of the door's plane is held to: each under the resource a grant and an audit row name it by (<first scope kind>:<name>, the lane the door names its unit's ledger lane with), qualified by the plane's key. A door that states no scope kind, or prices no class beside its fee units, bills none. Ported origin/predev billed_bytes_tests.rs:: a_present_agents_card_silent_about_an_agent_refuses_the_config as a root cell over the linked door, predev's refusal words unchanged.
… bytes or spend The R2 cell as ruled (the kernel owns metering; 1.5.5's llm rule, its golden cells cooldown|trip-then-serve, concurrency|lane-atcapacity|n4 and queue|timeout|n2): an agent hop refused by its tripped breaker is counted as one admitted request, its fee unit is refunded because the door reported none for a hop that never left, and no byte or spend is ledgered. Ported from origin/predev metered_verbs_tests.rs:: a_hop_the_breaker_refused_bills_nothing, diverging on purpose from its "no metering row" (the admission consumed the request). The RED arm is the first hop, which reached the failing agent and keeps its fee unit and its bytes.
…ot from the filesystem The plane performs no input or output (tests/purity.rs the_plane_performs_no_input_or_output refuses std::fs and env! anywhere in the crate's sources, its tests included); the ratchet now include_str!s a2a/config.rs and trust.rs, so a moved file fails the build instead of the scan.
…JSON-RPC and HTTP+JSON, refusal rendering on all three lines); a far-end task id equal to busbar's own records no pair and needs no translation, as on predev
…d kernel The coordinator ruled 17 deleted busbar-a2a tests customer-visible (the 18th, the lease Debug line, is another helper's). Each now asserts the same behaviour where it lives on 1.6.0: - root agent-door cells (serve_tests.rs agent_door): no agents section mounts no agent route; an anonymous caller's 401 names the RFC 9728 document; the document advertises the audience the admission demands; a credential of another kind is 401 naming no backend; the caller's key is absent from the streamed hop's wire (busbar's leased credential is the control); a stream hop failing before its first event is busbar's 502; scope decides the extended card's agents, a pool-only key sees none; no principal sees another's; a key no longer live sees none; a card under another key than the pinned one is refused at connect and never served. - the harness gains a Facing knob (no section; the App's plane table binding the door's claims and audience as build_dispatch does), the routes the door mounted, far ends answering in events, and an upstream_credential entry. - kernel trust_verify_tests: busbar's card key (the sign service over sign_in_domain) judged by trust.verify: another deployment's card, the token key, and a rotated key do not verify; a two-signature rotation verifies under either pinned key and no third. The inbound-JWS seam ports point at the existing verify cells. Each port is marked with the busbar-a2a test it replaces.
…n forbids interior state in its source)
… cells
The callback floor (registration) and push delivery now take the destination
decision from the host's dest.judge, the ONE check of BUSBAR-1.6.0.md §5
("Destination guard — ONE check for every outbound connection"). The plane's
own ip_is_internal / is_alternate_ipv4_encoding calls are gone from
local::judge_callback. The door keeps predev's refusal words for each
verdict: scheme, alternate IPv4 encoding, internal address, resolved to
nothing, malformed. Both the registration judge and the delivery judge ask
with DEST_REFUSE_PRIVATE, so an internal callback is refused whatever the
deployment's private-address setting, as predev's pushnotify guard refused
it with no knob (pushnotify.rs:281-306). The allow-list still stands.
Push (R7):
- Delivery re-judges the callback on every attempt, the plaintext refusal
included (the open-web class admits a secure connection only, the
connector's process.rs named()). push_door::attempt now runs over a small
host seam so the cells can drive it: the refusal arms stop the attempt
before any request is framed or sent.
- A JSON-RPC notification is the plane's own to acknowledge: 202 and no
body, never relayed, no fee kept (predev ingress protocol.rs:259-266,
jsonrpc::accepted). arrival::STATUS_ACCEPTED is that status. Before
this, the door kept it as a relayed unit with no hop and refused it.
- Deleting a push config takes its webhook credential out of plane memory
(predev local.rs:756, pushdeliver::forget). Before this, it was cleared
only by a replacing config or a terminal delivery.
Ported cells (predev local_tests, pushnotify_tests, pushdeliver_tests,
billed_bytes_tests rows of the lane's port list): the local-verb set and its
dialects, the foreign create/list/delete/subscribe refusals, the v0.3 shapes
and delete, the inventory's two names per method, the callback refusals on
the host's verdict, every delivery-attempt arm, the door's fee units, and
root cells for the notification 202, the bytes and fee a served hop
ledgers, a hop refused before the socket ledgering neither, and the
per_session fee refused at validate.
…s in predev's bytes predev minted the lease after opening the task and answered a lease it could not mint with fail_task (receive.rs, the mint_from arm): 502 InvalidAgentResponse "the backend agent did not complete this task" naming the task, the task ended failed; the extended-card read answered "the extended agent card could not be fetched" and opened no task. The door's refusal slot now renders reason 43 that way (Relay::refuse_credential), re-framed on the HTTP+JSON line, audits the unit rejected, and logs A2A_OUTBOUND_CRED_UNLEASED where predev logged it. refusal is ticketless and cannot read the host, so the task is ended over the records its hop's opening left (task_hop::fail_unhosted over the opening's writes, or the row an addressed request read, kept on the hop): the writes are byte-for-byte the ones settle makes over the host (task_hop_tests), carried as the refusal's record puts; its push notification is queued as predev's end_task sent one. The rendering is made once per unit, so a short re-call is the same. Ports creds_tests::the_callers_credential_has_no_path_to_a_delegate (config half) to tests/door.rs.
…ells
PerHop gets a manual Debug that shows its style, settings and handle and never the value, its
digest or where the secret lives (port of creds_tests::the_lease_never_renders_the_secret_in_a_debug_line).
door_steps cells (ports of creds_tests): bearer placement (and none) presents only
authorization: Bearer <secret>, the file's trailing newline trimmed; {header: X-API-Key} presents
the secret verbatim in that header; no block binds nothing (RED); an unresolvable secret refuses the
load naming the member, one that vanishes afterwards answers no handle; a rotated secret is
presented on the next hop with one re-open, an unchanged one never re-opens (counted open_outbound);
hops racing rotations each present one whole value.
agent_door serve cells over a loopback agent that records every request: the relayed hop, the
extended card read via the relay, the ListTasks refresh and the push-config mirror carry the bearer,
connect's and verify-on-call's card fetches carry none; {header: X-API-Key} is presented verbatim;
no upstream_credential is dialled with no credential (R5); rotation is presented on the very next
hop; a vanished secret refuses the task hop and the extended card read in predev's bytes, closes
the task failed, and makes no originated hop.
…end and the conn table Far end: each attempt presents the handle its credential resolves to now; one that resolves to none refuses the unit credential_unavailable before the dial (nothing opened, nothing presented, nothing recorded against the member, no fail-over); a request carrying NO_MEMBER_AUTH_FIELD is opened with no member auth and the field never reaches the wire (RED arm: the same request without it carries the credential). Conn table: the plugin's own requests carry the handle resolved for each; the waiver opens with no member auth and never reaches the table (RED arm as above); an unresolvable credential refuses the request and opens nothing.
…eam_tests The hostless seam adapter (seam.rs buffered, read_capped_over, stream_head/pump) against a direct build_pinned_client hop over the same loopback fixture: byte-identical buffered GET, a 3xx status and Location surfaced as a direct hop surfaces them, all three ReadEnd states of the cap loop matching proxy::read_capped, and the stream concatenation equal to a direct streamed hop.
The section described a lease (header_for refusing Expired / WrongAgent) that no longer exists. It is busbar's own credential, re-resolved on every hop and presented by the auth kind's per-request call; the plane never holds it; card fetches carry none; lease_ttl_ms must be > 0 and has no further effect (predev presented a lease the instant it minted it); a credential that stops resolving refuses the hop (502) in predev's words, and busbar's own requests are not made.
instance-noun-neutrality scans literals and identifiers in every non-family crate, tests included: the root serve cells read the ErrorInfo domain and the task resource type from the agent door's wire fixture (agent_door_wire.txt) as the agent_door module already does, the door_steps cells use a neutral vendor URL, and the kernel seam cell is renamed buffered_adapter_matches_a_direct_pinned_get_byte_for_byte.
…ix a shadowed fixture in the callback-floor cell The capability arm (streaming and pushNotifications, each excluded and each fitting), the input- and output-mode arms with the compatible-both-ways case, and the exhaustive TaskShape destructure guarding content-blindness, from predev catalogue_tests.rs, now over skill::fit.
…c, and registration members riding every member-target need The a2a plane is one dialect whose JSON-RPC, REST and gRPC are its lines (spec, 2026-09-30: transport de-frames, plane transcodes protobuf<->ProtoJSON). predev's engine dialled gRPC agents (relay::GrpcFraming); the door refused a gRPC-only card as unspeakable. Now: - binding.rs: GRPC is speakable; a card listing it first is reached on it. - framed.rs: the outbound codec on the same generated messages: the hop's params written as the rpc's request message, each length-prefixed answer read back as its ProtoJSON result, and the status the trailers state (grpc-status-details-bin's google.rpc.Status and ErrorInfo). - door.rs: NEED_GRPC, outbound, member-target (settings.*.url), transport grpc, the same trust anchors (client identity) as NEED_AGENT. - relay.rs: the gRPC binding composes /lf.a2a.v1.A2AService/<rpc> with the request message; a unary answer is read whole, an error status is the backend's refusal (its A2A code where its reason or status binds one), no message and no status is the engine's Unframable; the two streaming rpcs re-frame each message as a JSON-RPC event through the one event reader. Trailers (PIECE_FIELDS) are read for the status and never appended to the answer. - plane_door.rs: an attempt on a gRPC-bound agent names NEED_GRPC; the door's own requests (push-config mirror, ListTasks refresh) dial NEED_GRPC and transcode the answer. - root door_steps.rs (approved root change): a registration member rides EVERY member-target need its plane states (the providers' rides pattern); its anchors and private reach are sealed, and its auth binding bound, on each ridden need. Ports the engine's grpc client legs (client_leg_tests grpc_client_issues_*, pushback grpc_client_issues_*_task_push_notification_config(s)) and the port-f rows at unit level.
…rce_cites_the_design_in_words_not_in_symbols test refuses the section sign)
… plane's purity and design-citation rules hold over the new cells The task_hop inline-callback cell answered DEST_ALLOWED for a plaintext and an internal-literal callback and relied on the plane's own scheme and literal checks; with the destination decision the host judge's (the design's one destination guard), the cell's host answers DEST_PLAINTEXT and DEST_INTERNAL, and the refusal words are unchanged. The push attempt seam takes &mut self so the test host keeps its log without a cell (the plane holds no interior state, tests/purity.rs); the internal-address refusal names the host as read, with no std::net parse; the design is cited in words; a clippy type_complexity alias. Root: a cell that a key no longer live never dials its agent (predev's authorise_egress KeyNotLive).
…own name (a local named desk shadowed the desk() helper)
… to end, and port the refresh, no-hop, terminal and token-lifetime cells - serve_tests agent_door: a loopback agent serving its card over HTTP/1.1 and its rpcs over HTTP/2 on one port; an agent whose card names only GRPC is approved and a relayed SendMessage reaches it on the door's gRPC need (its registration riding that need): the rpc's path, one length-prefixed message carrying the caller's content, the answer back under busbar's task identity. - The rig's Agent can answer per request; the engine's the_refreshed_state_reaches_the_callers_own_list, a_list_with_no_open_task_of_this_callers_makes_no_hop, a_terminal_task_is_not_armed_at_the_backend, a_token_is_not_spent_by_being_used_while_the_task_is_live and a_token_for_a_task_that_has_ended_authorises_nothing ported as root cells. - The plane's wire words these cells use are fixture data (agent_door_wire.txt), as the rig's others. - relay_grpc_tests: a request message whose fields are all default is zero bytes (nothing sent beside the head; the transport frames the empty message).
…ent DECLARES the agents section (served().section), not one that merely owns it; the cells never ran since 40ccb45 because the probe read the owned-section list and found no door. A missing door is now a failure through door(), never a silent skip (33 early returns removed)
…es the agents section linked_door() matched only a door that OWNS the fixture's section (a section kept beside its declaring one), but the agent door DECLARES it: its ServedFacts.owns is empty. So linked_door() was None in every build and every agent_door cell returned at its guard and passed without driving anything (witnessed on Latchkey: neither of two probe prints past the guard ran, and a cell with its kernel fix reverted still passed). It now matches the declaring section or an owned one.
…led on its trait object)
…s predev's did Without a store block the config also refuses "store is required", beside the agents-card refusal the cell pins (seen on Latchkey once the cell was actually driven).
… so the transport names no plane (kind-isolation vocab back to predev's: zero findings)
…oot path installs (root::connector::install_io_reactor, now one function both call). The door's own requests (its card fetch, a mirrored push config) run on a dispatcher worker off any runtime, so with no process reactor their sockets were refused registration (io::NOT_ON_A_WORKER) and every connect failed as a host fault
…e, card signing, JWS verify) into p3-flip-a2a; its cells sit after helper e's at the agent-door module's end, and every early return on a missing door is struck (a missing door fails through door())
Brings predev 561c69a (FLIP-LLM, #464) through #778. Conflicts, resolved in favour of predev's design with this branch's additions carried: - kernel plane_driver far_end.rs: State keeps both the credential refusal and predev's failover word; the attempt counter is predev's degraded-aware count, stated with the plane's labels. - plane_driver mod.rs: DriverSteps keeps counterparty and resolved beside predev's affinity, refused_words and attempting. - plane_driver route.rs: predev's AttemptSteps bound and exhaustion detail; the exhaustion terminal still names BreakerOpen on the refused piece and takes the plane's stated wait. - busbar serve.rs: predev's seal_live, with the plane's declared metric lanes set inside it; DoorFar keeps stated and member_wait beside predev's walk facts; the door-cells comment keeps naming no plane. - busbar Cargo.toml and build.rs: door-cells and driver-proofs tables, both emitted. - main.rs: DoorReach keeps the shared secret resolver; auths is predev's clone. - secret_source.rs, kernel tests/plane_driver.rs: both sides kept. - population 939, tracing 969, seal-witness 2177, no-deferral 931: the merged tree's measures.
…metric-lane test kind-isolation:law0-base: busbar-contract x transport grew 226 -> 229 over merge-base 561c69a. The fault-reading doc comments (sdk_hyper.rs, tests/sdk_hyper.rs, tests/fault_reading.rs) describe the bare status line without naming a wire, and the metric-lane test uses neutral lane words. The cell returns to the base's count.
Brings predev 872b6ae. Conflicts: - busbar-transport-http pin: predev's a715d1ab57 (#780, IPv4 spellings) and this branch's 2d1dbfdabf (fault table, PIECE_END) are merged in the http repo as ebfa033411 (branch lane-p3-flip-a2a-pin); the root pins that. - contract conn.rs and the connector: predev's hold_authority and authority_held beside this branch's member-keyed bind_auth. - busbar-kernel: predev's #686 design taken whole (the kernel links no plane in its tests; tests/linked and build.rs gone; the moved cross-plane cells live in the root, whose test-linked roster carries the a2a door row). - plugin-loader conn_services_tests and the kernel doc comments: both sides kept, predev's wording. - qa/kind-isolation.toml: predev's rows and values, with this PR's own deltas re-applied and cited: busbar x plane 826 -> 772, busbar x transport 207 -> 183, busbar-kernel x plane 1168 -> 1145 (the one llm-plane hit #686 already moved is not counted twice); predev's struck busbar-kernel -> busbar-llm test row stays struck. - floors: predev's lines re-pinned by this PR's own deletions: population 938, tracing 968, seal-witness 2139, no-deferral 921.
Brings predev 86771f6 (#671 loader-pl1-a, #608 kernel-scope, #790). Conflicts: - crates/busbar-a2a/src/a2a/creds.rs: stays deleted with the crate. Predev's change struck the engine's REQUIRE_LIVE_KEY (#608: key liveness is the gate's for every plane); busbar-plane-a2a has no EgressSubject impl, so nothing carries it. - plugin-loader conn_services.rs: predev's request path (the request taken out of the map, the open run with the connector's lock let go) carrying this branch's member-keyed binding, the plugin's waiver, the per-request handle and its CredentialUnavailable refusal; the unused RandomIn import is dropped with #671's random service. - conn_services_tests.rs: the Scripted double keeps predev's auth and lock probe beside this branch's member_auth; auth_of answers the member binding, else predev's; this branch's four-argument request helper is whole_request_with, beside predev's whole_request. - qa/kind-isolation.toml, busbar-plugin-loader x instance:secret: predev's row kept (111 -> 110, #671 drained the random service's extern C fn), with this PR's extern-ABI scanner fix re-applied: 25, as measured on #787's tree, the extern C hit #671 removed being one the fix no longer counts.
Brings predev 350e107 (#727). Conflict: qa/kind-isolation.toml, busbar-plugin-loader x instance:secret: predev's row (109, its two drains cited) kept, with this PR's own delta applied: the extern-ABI scanner fix, -86 as measured on #787's tree (111 -> 25), so 109 - 86 = 23. Neither predev drain is an extern ABI string. The earlier 25 assumed #671's drain was one; predev's cite names it as the OpenOnce move, so it was not.
…e name no transport; one secret-name literal leaves the loader's tests busbar-kernel x transport, the six hits FLIP-A2A's ported cells wrote into the kernel: - src/egress/tests/seam_conformance_tests.rs:39 "Raw TCP" -> "A plain std listener"; - the same file's `sse` local (lines 288, 295, 336, 381) is `event_stream`; - src/plane_driver/tests/far_end_tests.rs:1348 "gRPC hop" -> "trailered hop". busbar-plugin-loader x instance:secret: src/tests/durable_tests.rs:343 joins "leaf" where it joined "c", a secret instance name as a whole literal.
…erged tree's shapes - main.rs config-apply DoorReach lends the shared resolver as Arc<dyn SecretResolve>, as boot does; - root tests door_steps own_reach, the a2a door's root cells: DoorReach names models: None; - serve_door_far: DoorFar names shown: None; - serve_planes: refreshed takes the resolver as Arc<dyn SecretResolve>; - kernel tests/plane_driver: Pick::Exhausted states its detail; REFUSAL_KERNEL is no longer used.
Brings predev c89729d (#798). Conflict: qa/kind-isolation.toml, busbar-kernel x plane, by the ledger merge rule: base 1168, predev 1141 (row 157: the HOT trust and guard slots deleted), this branch 1145 (FLIP-A2A's own drain); the two sides drain different lines, so 1141 + 1145 - 1168 = 1118, predev's cite kept and this branch's clause appended with the new numbers. The plugin-loader x instance:secret cite is corrected to its arithmetic (coordinator ruling): 109 - 85 = 24, the 86 extern ABI strings including #671's 111 -> 110; -1 for the durable_tests.rs directory rename = 23.
…; the breaker never reads it (ARCHITECT ruling on #787) Predev's FLIP-LLM model egress runs 1.5.5's 429 rate-limit ladder and 4xx client-fault count on the numbered status; #561/#778 (row 66) had the port carry the fault reading in its place. Per the ruling (option a; the ABI carries the number beside the class, FrameMeta status_code, BUSBAR-1.6.0.md l.4036-4053) the egress port carries both: - busbar-kernel-egress ports::UpstreamStatus gains code: Option<WireStatus> beside fault; - the far end fills both (wire_code: predev's reserved-numbering rule), and a held relayed answer keeps its code beside the plane's reading; - the kernel breaker still classifies from the fault reading alone; only root/model_egress.rs judge reads code; - root adapters test the_breakers_classification_never_moves_with_the_number_beside_the_fault_reading pins row 66: a fixed class and fault reading classify the same whatever code says, in either reserved numbering or none.
Brings predev 235e1a3 (#795 webrtc framer, #783 store-memory extracted). Conflict: Cargo.toml, both sides kept: predev's busbar-transport-webrtc member and media pins, busbar-store-memory pinned with its fixture-store role; this branch's own deletion of the a2a-lf / a2a-pb pins with busbar-a2a stands. cargo metadata --locked reads the merged lock.
…he kernel's HostSlots trust service #798 (row 157, on predev) deleted the HOT-lane trust slots (plane_host/trust.rs) and their class test (plane_host/tests/trust_tests.rs), which had no caller; a plane's trust is the HostSlots trust.* service (BUSBAR-1.6.0.md Part 3 §4). G-trust-parameterised now owns crates/busbar-plane-a2a/src/trust.rs (CardPin and jws_refusal) plus that service, and is proved by crates/busbar-plane-a2a/tests/purity.rs::the_a2a_plane_declares_no_trust_state_of_its_own. Tag, remedy and why unchanged. Every choke-point owner, class test and allowed path on the merged tree exists.
…es with no reading #795 (on predev) wrote busbar-transport-webrtc against the transport ABI before row 66 (#561/#778), which appended TransportTail::fault_rows / fault_rows_len and gave FramePiece's spare byte to fault. The door's TAIL states no status rows, so it states the empty fault table (null, 0), as busbar-transport-stdio's carrier does; its pieces and the conformance test's host piece carry fault: 0 (FAULT_NONE) where _reserved was. No transport ABI version constant is declared in the crate.
…D, never an empty piece Row 66's contract (#561, busbar-contract abi/transport/mod.rs:58-64, PIECE_END at :451-456, check_framer at check.rs:256-265): a stream's frames end with their own empty piece carrying PIECE_END and PIECE_END_OF_FRAME; an EMPTY piece without it is an empty message. #795's door turned Event::ChannelClose (framing.rs) into an empty piece with PIECE_END_OF_FRAME, which the host now reads as an empty binary message, never the channel's end. - framing::Piece states end; ChannelClose's piece sets it, every other piece does not; - door::piece_flags states an end as PIECE_END | PIECE_END_OF_FRAME and nothing else; every other piece keeps its bits; - src/tests/door_tests.rs: a closed channel's piece is the end by flag (never text, fields, failed or continued, which check_framer refuses beside an end), an empty binary or text message is a frame and not the end, and messages and field blocks keep their bits.
… the shared resolver, the architecture doc names the a2a door's route - root/serve.rs: line_auth loses the #[cfg(linked_axis_node)] gate this branch carried; predev's 05658f9 serves a door plane in any build that links one, so its one caller is ungated (E0425). This branch's body stands (a CLAIM_OPEN line owes no auth whatever the chain, ARCHITECT FLIP-A2A). - root/tests/serve_hook_seats.rs:894, :946: DoorReach takes the resolver as Arc<dyn SecretResolve>, as boot and the config apply lend it. No other DoorReach literal in the tree borrows it. - docs/architecture.md: the A2A breaker row named the deleted engine's route.rs; it now names the door plane's arrive route (busbar-plane-a2a/src/plane_door.rs) and the kernel's plane-driver walk (plane_driver/far_end.rs). Every path the doc names exists.
The plugin's deny.toml accepts RUSTSEC-2024-0449 with busbar's own reason, the only change over ebfa033411; the code this tree links is unchanged. cargo metadata --locked resolves.
This was referenced Oct 13, 2026
…refreshes the credential once per lease, off the request path ARCHITECT ruling on #787 (THE DESIGN section 11: no blocking; plugin memory valid to its next refresh generation). PerHop::handle_now re-resolved the secret on every hop (SecretCalls::resolve blocks its thread up to its deadline) and re-opened the binding under the mutex every hop locked, from an async send_attempt (far_end.rs) and from inside a plane crossing (conn_services.rs). - root/door_steps.rs: PerHop holds what it presents in an ArcSwapOption swap cell; handle_now is a load (no resolution, no open, no lock). PerHop::refresh re-resolves, re-opens only on a changed digest (outside any lock a hop reads), swaps the cell whole, and EMPTIES it when the secret no longer resolves or its new value will not bind (fail closed: every hop after it is refused in the engine's words). The refresher is one host thread of its own (never a runtime worker or a dispatcher crossing) that refreshes each binding once per its lease, the grammar's `lease_ttl_ms` (busbar_contract::section::CREDENTIAL_LEASE_TTL_KEY, now read and required > 0); it keeps bindings weakly, so a generation a config apply replaced is forgotten. The build still resolves and opens at config apply. - busbar-contract auth_calls.rs / conn.rs, far_end.rs, conn_services.rs: the per-request handle's contract is a load, never a resolution, open or wait. - tests: a rotated secret is presented on the first hop after the next refresh, and a vanished one refuses each hop after the next refresh (root unit cells and the a2a plane's door cells); REDs: a_hop_resolves_nothing_and_takes_no_lock (a counting resolver stays put across 256 hops; a hop answers while a refresh holds the binding's lock) and an_open_runs_under_no_lock_a_hop_waits_on (a hop answers at once while a refresh's open_outbound is parked in the auth plugin). - docs/a2a.md: `secret` is re-resolved once per lease; `lease_ttl_ms` is that cadence.
qa/kind-isolation.toml, by the ledger merge rule (result = T + O - B; predev's cite kept whole, this branch's clause appended with its numbers rewritten): - busbar x transport: B 207, predev 224 (#710 REBALANCE +17), ours 183 (FLIP-A2A -24) -> 200 - busbar-kernel x instance:secret: B 115, predev 114 (K2-H3 -1), ours 112 (extern ABI strings -3) -> 111 - busbar-kernel x plane: B 1141, predev 1128 (row 156 -9, K2-H3 -4), ours 1118 (FLIP-A2A -23) -> 1105 - busbar-plugin-loader x instance:secret: B 109, predev 107 (#532 -2), ours 23 (-85 extern ABI strings, -1 durable_tests rename) -> 21 - dep rows: predev's deleted busbar-kernel -> busbar-store-memory and this branch's deleted busbar-a2a edges both stay deleted. Cargo.toml: predev's deleted fixture-store pin and this branch's deleted a2a-lf/a2a-pb block both stay deleted; the busbar-transport-http pin stays a6e29e36da. crates/busbar-kernel/src/tls.rs: predev's (the listener moved to root::listener). crates/busbar-kernel/src/test_support/engine_kit/mod.rs: predev's, with this branch's removal of the card-issuer pass-throughs re-applied (TestAppSeam states neither). crates/busbar-a2a/src/a2a/tests/adminverbs_tests.rs: deleted with the crate.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
P3 FLIP-A2A: the a2a plane is served through its plugin door (
busbar-plane-a2a), the same way the mcp and decisions planes are. Compiled-in and dropped-in use one table. The legacybusbar-a2acrate is deleted, and its tests are ported into the door.Stacked: #502 → #561 → #778 (row 68) → this PR. The branch carries #778's head e846df4 (predev 740a8f5 merged through #502 and #561), so the diff against predev includes #561 and #778. This PR's own work is its two merge commits (the lane port onto #778, then #778's new head) and the commits after them.
What it carries
p3-flip-a2a-lane(all its coordinator rulings of 2026-10-07), ported onto predev. Not redone.plane-a2a = ["plane-a2a-door", …],plane-a2a-door = ["dep:busbar-plane-a2a"], aplane-doorrow with itslinked-declaresandlinked-sectionagents, and no linked row of the plane's key.busbar-a2ais deleted along with every row that names it (workspace, test-linked lists, served-witness rows, qa ledgers, and row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's two A2A[[dep]]rows). Thea2a-lf/a2a-pbworkspace pins go with it.crates/busbar-plane-a2a/tests/root/mod.rs. They compile into the root's serve module through a[package.metadata.busbar.door-cells]row (build.rsemits one#[path]module per row). The module-tree readers follow that include (xtasklibtest_path,scripts/capability-equality-summary.py, the capability-equality and teller-steps gates), andqa/capability-equality.jsonandqa/teller-steps.jsoncite the new file.ChainBook(host-sealed appends, a verifiedrecords.listread). predev'sChainedKindis removed; its admit check for an unkeepable chain is kept.RefusalCode::CredentialUnavailableis classedUnreachablein predev's single classification.busbar-auth-oauthis pinned atlane-p3-flip-a2a-pin(97627f86): predev's 7022a089 plus theCredentialUnavailablearms.test-linked = ["busbar-llm"]); its two cross-plane tests that need a mounting plane move whole to the composition root, as DEL-MCP did (a2b32ed). The admin crate's door double is gone.200withcontent-type: application/grpc. The call's status is its final status, which the framer renders. A refusal is the door's status block. A refusal that comes beforearriveread the line picks the gRPC line from its target (the contract'sRefusalIn::targetrule). The a2a root harness gives its served planes the connector's framers, as boot does.Architect rulings on #787, applied
headerin neutral crates. The 1.5.5 credential placement key stays byte-identical, as ONE constant in busbar-contract (section::PLACEMENT_HEADER_KEY, Part 2 mcp: a resource is addressable by the URI the protocol defines (A1.3) #83; DoD item 6).[[shape-word]]table. Each row is a NAMED reservation of one spelling: its word, its file, and the line its holder names (aconst <holder>:in a.rsfile, or the object keyed"<holder>"in a.jsonfile). It is never word-wide.manual-de CredentialPlacement. Each cites BUSBAR-1.6.0.md:2284 (mcp: a resource is addressable by the URI the protocol defines (A1.3) #83) and :2020 (DoD 6).shape-word-unused.busbar-contract × instance:authandbusbar-kernel × instance:authare back at the merge-base's 3 and 8.busbar-plane-a2a/src/a2a/creds.rs), not the kernel's. The kernel spells the word only in the generated snapshot. The plane keeps its literal match arms, because the config-schema gate reads a deserializer's wire keys off them.structure-lint:plane-dup:unledgeredis ARMED at the measured 94 (plane_dups::UNLEDGERED_ARMED, Law 9).agents:section, and v1.5.5's source has no a2a crate. So no 1.5.5 golden or oracle cell holds these bytes, and the decider is predev's subject (row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's head) on M3.GetTaskthat its agent refuses with ONE header block::status 200,content-type: application/grpc,grpc-status: 5,grpc-message: the%20backend%20agent%20refused%20this%20task,grpc-status-details-bin: …,content-length: 0.a_grpc_call_refused_before_any_message_closes_trailers_only_as_predevpins those bytes (red before). The OK cell pinscontent-type: application/grpc.A2aTrustView's description is predev's text again. The door's fragment is data (src/admin_openapi.json), andopenapi.json/.gzare byte-identical to row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's.plane_isomorphismallowlist 21 → 4 rowsbusbar-a2a, the retired engine (97 files, 39 of them non-test); the a2a plane crate's in-processPlaneimpl (src/plane.rs, its tests, alloc gate and scaffold); and the anomaly breaker predev never wired.The 81 new plane-dup findings, by file set (for the drain lane)
The count went from 22 to 94. 9 of predev's findings left with the engine (the duplicates that were the engine's
meter.rs,route.rs,verify.rs, …), and 81 are new, all in the a2a door crate:crates/busbar-plane-a2a/src/jsonrpc.rs+crates/busbar-plane-mcp/src/jsonrpc.rs: symbolEnvelope, symbolIdShape, symbolid_shape, symbolid_value, symbolis_number, symbolread, symbolsuccesscrates/busbar-plane-a2a/src/trust.rs+crates/busbar-plane-mcp/src/trust.rs: moduletrust.rs, symbolObservation, symbolSighting, symbolState, symbolTrustView, symboldriftcrates/busbar-plane-a2a/src/plane_door.rs+crates/busbar-plane-mcp/src/tool_door.rs: symbolLooked, symbolkeep, symbolpublic_url, symbolsection, symbolverify_on_callcrates/busbar-plane-a2a/src/door.rs+crates/busbar-plane-mcp/src/door.rs: moduledoor.rs, symbolRoute, symboladmin_route, symbolop_class_indexcrates/busbar-plane-a2a/src/facts.rs+crates/busbar-plane-mcp/src/tool_facts.rs: symbolcorrelation_for, symbolcorrelation_value, symbolis_canonical_numbercrates/busbar-plane-a2a/src/ops.rs+crates/busbar-plane-decisions/src/ops.rs: moduleops.rs, symbolMethodRow, symbolrow_forcrates/busbar-plane-a2a/src/door.rs+crates/busbar-plane-decisions/src/plane_door.rs: symbolread_settings, symbolsnapshot_speccrates/busbar-plane-a2a/src/plane_door.rs+crates/busbar-plane-decisions/src/plane_door.rs: moduleplane_door.rs, symbolUnitcrates/busbar-plane-a2a/src/plane_door.rs+crates/busbar-plane-mcp/src/door_listen.rs: symbolpiece, symbolstandscrates/busbar-llm/src/arrival.rs+crates/busbar-plane-a2a/src/arrival.rs: modulearrival.rscrates/busbar-llm/src/engine/credential.rs+crates/busbar-plane-a2a/src/binding.rs: symbolBindingcrates/busbar-llm/src/engine/lazy_body.rs+crates/busbar-plane-a2a/src/plane_door.rs+crates/busbar-plane-a2a/src/task_door.rs: symbolHeadcrates/busbar-llm/src/unit/route.rs+crates/busbar-plane-a2a/src/tasks.rs: symbolsealcrates/busbar-llm/src/unit/verify.rs+crates/busbar-plane-a2a/src/trust.rs: symbolverifycrates/busbar-llm/src/unit/walk.rs+crates/busbar-plane-a2a/src/frame.rs: symbolTapcrates/busbar-plane-a2a/src/a2a/task.rs+crates/busbar-plane-mcp/src/tool_tasks.rs: symbolTaskcrates/busbar-plane-a2a/src/arrival.rs+crates/busbar-plane-mcp/src/ask.rs+crates/busbar-plane-mcp/src/tool_arrival.rs: symboldecidecrates/busbar-plane-a2a/src/arrival.rs+crates/busbar-plane-mcp/src/call.rs: symbolnot_grantedcrates/busbar-plane-a2a/src/arrival.rs+crates/busbar-plane-mcp/src/client/negotiate.rs+crates/busbar-plane-mcp/src/tool_arrival.rs: symbolRefusalcrates/busbar-plane-a2a/src/arrival.rs+crates/busbar-plane-mcp/src/tool_arrival.rs: symbolDispositioncrates/busbar-plane-a2a/src/claims.rs+crates/busbar-plane-decisions/src/claims.rs: moduleclaims.rscrates/busbar-plane-a2a/src/diagnostics.rs+crates/busbar-plane-mcp/src/diagnostics.rs: modulediagnostics.rscrates/busbar-plane-a2a/src/door.rs+crates/busbar-plane-a2a/src/surface.rs+crates/busbar-plane-a2a/src/task_hop.rs+crates/busbar-plane-a2a/src/tasks.rs+crates/busbar-plane-mcp/src/door_listen.rs+crates/busbar-plane-mcp/src/tool_claims.rs: symbolopencrates/busbar-plane-a2a/src/door.rs+crates/busbar-plane-mcp/src/door.rs+crates/busbar-plane-mcp/src/tool_claims.rs: symbolclaimcrates/busbar-plane-a2a/src/door.rs+crates/busbar-plane-mcp/src/door.rs+crates/busbar-plane-mcp/src/tool_door.rs: symbolop_classcrates/busbar-plane-a2a/src/events.rs+crates/busbar-plane-mcp/src/adapt.rs+crates/busbar-plane-mcp/src/door_listen.rs: symbolframecrates/busbar-plane-a2a/src/events.rs+crates/busbar-plane-mcp/src/tool_sessions.rs: symbolEventcrates/busbar-plane-a2a/src/facts.rs+crates/busbar-plane-decisions/src/facts.rs: modulefacts.rscrates/busbar-plane-a2a/src/framed.rs+crates/busbar-plane-a2a/src/local.rs+crates/busbar-plane-a2a/src/push_serve.rs+crates/busbar-plane-mcp/src/answer.rs+crates/busbar-plane-mcp/src/client/peer.rs+crates/busbar-plane-mcp/src/door_tasks.rs: symbolanswercrates/busbar-plane-a2a/src/framed.rs+crates/busbar-plane-a2a/src/local.rs+crates/busbar-plane-a2a/src/skill.rs+crates/busbar-plane-a2a/src/task_hop.rs+crates/busbar-voice/src/mount.rs: symbolrefusalcrates/busbar-plane-a2a/src/framed.rs+crates/busbar-plane-a2a/src/relay.rs+crates/busbar-plane-mcp/src/line.rs: symbolReplycrates/busbar-plane-a2a/src/framed.rs+crates/busbar-plane-mcp/src/door_tasks.rs+crates/busbar-plane-mcp/src/line.rs: symbolreplycrates/busbar-plane-a2a/src/framed.rs+crates/busbar-plane-mcp/src/framing.rs: symboleventscrates/busbar-plane-a2a/src/framed.rs+crates/busbar-plane-mcp/src/tool_tasks.rs: symbolStatuscrates/busbar-plane-a2a/src/identity.rs+crates/busbar-plane-mcp/src/identity.rs: moduleidentity.rscrates/busbar-plane-a2a/src/jsonrpc.rs+crates/busbar-plane-mcp/src/call.rs+crates/busbar-plane-mcp/src/jsonrpc.rs: symbolerrorcrates/busbar-plane-a2a/src/jsonrpc.rs+crates/busbar-plane-mcp/src/client/jsonrpc.rs: modulejsonrpc.rscrates/busbar-plane-a2a/src/local.rs+crates/busbar-plane-a2a/src/relay.rs+crates/busbar-plane-mcp/src/answer.rs: symbolAnswercrates/busbar-plane-a2a/src/meta.rs+crates/busbar-plane-decisions/src/meta.rs: modulemeta.rscrates/busbar-plane-a2a/src/push.rs+crates/busbar-plane-a2a/src/relay.rs+crates/busbar-plane-mcp/src/call.rs: symbolSettledcrates/busbar-plane-a2a/src/push.rs+crates/busbar-plane-a2a/src/rest.rs+crates/busbar-plane-mcp/src/trust.rs: symbolhexcrates/busbar-plane-a2a/src/push_door.rs+crates/busbar-plane-mcp/src/door_line.rs+crates/busbar-plane-mcp/src/door_listen.rs: symboltickcrates/busbar-plane-a2a/src/push_door.rs+crates/busbar-plane-mcp/src/door_tasks.rs: symboladvancecrates/busbar-plane-a2a/src/record.rs+crates/busbar-plane-a2a/src/tasks.rs+crates/busbar-plane-mcp/src/record.rs: symbolencodecrates/busbar-plane-a2a/src/record.rs+crates/busbar-plane-a2a/src/tasks.rs+crates/busbar-voice/src/bin/voice-conform.rs: symboldecodecrates/busbar-plane-a2a/src/record.rs+crates/busbar-plane-mcp/src/record.rs: modulerecord.rscrates/busbar-plane-a2a/src/records.rs+crates/busbar-plane-decisions/src/records.rs: modulerecords.rscrates/busbar-plane-a2a/src/records.rs+crates/busbar-plane-mcp/src/tool_records.rs: symboloperations_forcrates/busbar-plane-a2a/src/relay.rs+crates/busbar-plane-mcp/src/tool_door.rs: symbolRelaycrates/busbar-plane-a2a/src/task_door.rs+crates/busbar-plane-a2a/src/tasks.rs+crates/busbar-plane-mcp/src/tool_door.rs: symbolHeldcrates/busbar-plane-a2a/src/task_hop.rs+crates/busbar-plane-decisions/src/plane_door.rs: symbolsettlecrates/busbar-plane-a2a/src/task_hop.rs+crates/busbar-plane-mcp/src/checks.rs: symbolRefusedcrates/busbar-plane-a2a/src/tasks.rs+crates/busbar-plane-mcp/src/subscribe.rs+crates/busbar-plane-mcp/src/tool_door.rs+crates/busbar-plane-mcp/src/tool_program.rs: symbolStepcrates/busbar-plane-a2a/src/tasks.rs+crates/busbar-plane-mcp/src/tool_tasks.rs: symbolsweepcrates/busbar-plane-a2a/src/trust.rs+crates/busbar-plane-decisions/src/codec/mod.rs: symbolviewcrates/busbar-plane-a2a/src/trust.rs+crates/busbar-plane-mcp/src/subscribe.rs: symbolStandingTwo more rulings on #787, applied
extern "C"is not a secret instance (scanner precision fix).externtakes, and anabi = "…"argument. plugins.yaml'sbusbar-secret-chad taught the secret axis the wordc, so everyextern "C"in a neutral crate counted as that plugin.extern "C" fn,extern "C-unwind" fnandabi = "C"count 0."c"literal naming the plugin counts.extern "C"counts.instance:secretbusbar 35 → 25, busbar-contract 133 → 64, busbar-kernel 115 → 112, busbar-plugin-loader 111 → 25.crates/busbar-plane-a2a/tests/alloc_gate.rs, DoD item 6).String;piece.bytes.to_vec());target_ofparsing the agent url (a parse buffer, and a lower-cased copy per path segment, beside the target).Answer::ToFarEndLent): the door writes it from the piece the host lent, keeping only what a short host buffer could not take;a_target_read_without_a_parse_is_the_parsed_targetholds the two equal over 20 urls.Still open
kind-isolation:law0-baseis 3 hits over 1 cell:busbar-contract × transport226 → 229. row 68: the breaker reads a plane fault at the far end (stacked on #561) #778 carries the same cell; nothing in this branch grows it.docs/diagnostics.{json,md}and the C header are regenerated by their writers.Proof (M3 prover VM, this branch's head)
cargo xtask conformance record --suite a2a: pass. Every control leg is green, the subject battery passes, and the subject TCK has no unwaived red. On the run before the last two rulings it measured grpc 64/72, jsonrpc 89/102, http_json 85/96 and agent_card 8/10, which equals predev's subject at row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's head.cargo clippy --workspace --all-targets --locked -D warnings: clean.cargo test --workspace --locked --no-fail-fast: 12,951 passed, 10 failed. All 10 are environment-only and fail the same way on row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's head in that VM:plugin-loader --lib×3,core-connector --test universal_needs×6);ledger_identity, whose oracle clones a private repository.busbar-plane-a2a --test alloc_gate): 2 allocations, at the pin, and its RED arm sees the planted one.cargo xtask gate --all(XTASK_CEILING_BASE=740a8f5db9,XTASK_SHIP_TARGET=predev) is red in exactly row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's gates: kind-isolation, kind-isolation-ship and ship-ready.kind-isolation:law0is 179 hits off the ceilings, against row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's 211.kind-isolation:law0-baseis 3 hits over 1 cell, against row 68: the breaker reads a plane fault at the far end (stacked on #561) #778's 4 over 2.structure-lintis green (row 68: the breaker reads a plane fault at the far end (stacked on #561) #778 has it red).busbar-plane-a2asuite (542 lib cells, the both-ways door conformance and the allocation pin) and the 120 a2a door cells in the root.