row 130 E2: net_guard leaves busbar-kernel; the kernel resolves no name itself (stacked on #796) by MattJackson · Pull Request #800 · GetBusbar/busbar

MattJackson · 2026-10-12T21:12:35Z

/status row 130 (E2): net_guard leaves busbar-kernel, and the kernel no longer resolves names itself. Stacked on the E1 PR (#796): its diff includes E1's commit until that lands.

busbar-kernel/src/net_guard.rs was two things: a glob re-export of the egress unit's guard (busbar_kernel_egress::trust::net), and SystemResolver, which ran getaddrinfo on its own thread. The resolver was the only part that touched the network. This PR deletes the file. The design rule it follows is THE DESIGN §5: "Every scattered check (net_guard, the SSRF helpers, per-plugin checks) is deleted"; the connector holds the network.

Call sites, same items. Each kernel call site now names the guard where it actually lives:
- The pure host checks come from busbar_contract::net: observability, config_validate and plane_host/guard.
- The pre-dial guard comes from busbar_kernel_egress::trust::net: plane_host/egress, egress/duplex_ws, and config_validate's ssrf_blocked_host re-export.
- trust::net glob-re-exports contract::net and shadows none of these names, so every call reaches the same function as before.
The resolver is the connector's. busbar_core_connector::process::SystemNames is the deleted SystemResolver, moved verbatim, implementing the unit's Resolver seam.
- The root installs it behind the egress-trust capability (GuardedEgressTrust's third field), at the same boot step as the guard and the TLS wrap.
- The kernel's two resolve-then-pin dials (the plane-host egress open and the duplex_ws dial) ask plane_host::egress_trust::InstalledResolver, which reads that capability.
- With no guarded capability installed, a production kernel refuses the name (fails closed). A test build resolves through egress::fixtures::system_names instead: the same body, kept in test scaffolding.
- No new static, because door-only:static-seam forbids one.
Edges.
- The connector now reads split_url from the unit and depends on busbar-kernel-egress. This adds a kind-isolation [[dep]] row (cleanliness -> kernel, allowed).
- core-oauth2 reads parse_url from busbar_contract::net.
- busbar-a2a and busbar-voice are legacy crates that P3 FLIP-A2A: the a2a plane served through its door; busbar-a2a deleted (stacked on #778) #787 and FLIP-STREAMING: the streaming plane served through its door; busbar-voice deleted #503 delete. They now reach the unit through the kernel's existing busbar_kernel::proxy::egress_unit re-export, so no new edge.
Tests.
- Four rows from the shim's suites were not already in the unit's suite. They move to busbar-kernel-egress trust/tests/net_tests.rs. The other 32 were duplicates of it.
- New: the_guarded_seam_resolves_by_the_resolver_behind_it.
- The root's net_guard_one_judge now compares config_validate's re-exports with the unit.
- no_socket strikes ("src/net_guard.rs", "lookup_host").
The population floor goes 948 -> 947: one non-test file deleted.

Behaviour: the same guard and the same resolution body give the same answers. #780 touches other parts of the same two connector files (guard.rs, process.rs); the hunks do not overlap.

Proof: ModernCI (owner rule 2026-10-12, no hand runs on the M3). The kernel-egress suite gains four rows; the root's net_guard_one_judge and the kernel's no_socket cover the moved paths.

…o-socket pin armed (E7) The inbound listener's accept/serve loop (hyper-util's auto builder, graceful shutdown, the body read bounds, the accept backoff and the connection-placement balancer) moves verbatim from busbar-kernel/src/tls.rs into the composition root, crates/busbar/src/root/listener.rs. The connector binds every listener (Listening::bind_stream) and hands each admitted stream up; the accept-source trait (Admits, Admitted) moves to busbar-core-connector's listen.rs beside the listener that implements it. tls.rs keeps read_pem for its outbound callers. The kernel drops tokio-util. BUSBAR-1.6.0.md l.475-483 (INBOUND-LISTEN: the root's stream hand-up) and the ARCHITECT ruling on #710 (2026-10-10). This is #741's change on current predev; it supersedes #741. Tests move with the code: the kernel's tls_tests.rs and busbar/tests/tls_listener_h2.rs become root/tests/listener_tests.rs and listener_h2_tests.rs; the connector's TLS-listener rows join them (their scratch PEM name keeps predev's unique-per-call suffix). Ledgers: law0 busbar-kernel x transport 285 -> 268 and busbar x transport 208 -> 225 (the move, total flat, per the #710 ruling); population floor 947 -> 948 (root/listener.rs is a new file; tls.rs stays). E7: crates/busbar-kernel/tests/no_socket.rs holds busbar-kernel to a drain-only pin of every (file, needle) naming a socket, resolver or HTTP client/server stack, and every manifest ask for one; tls.rs is not in it. A new offender is RED, a drained pin left standing is RED, and the RED arm plants a dial, a resolver and a server stack and sees each.

…me itself busbar-kernel/src/net_guard.rs was a glob re-export of the egress unit's guard (busbar_kernel_egress::trust::net) plus SystemResolver, a getaddrinfo on a thread of its own: the one piece of the guard that touched the network. Deleted. - The kernel's call sites name the guard in its homes: the pure host atoms from busbar_contract::net (observability, config_validate, plane_host/guard), the pre-dial guard from busbar_kernel_egress::trust::net (plane_host/egress, egress/duplex_ws, config_validate's ssrf_blocked_host re-export). Same items, same answers. - The name lookup is the connector's. busbar_core_connector::process::SystemNames is the deleted SystemResolver, verbatim, implementing the unit's Resolver seam. The root installs it behind the egress-trust capability (GuardedEgressTrust's third field) with the guard and the TLS wrap, at the same boot step. The kernel's two resolve-then-pin dials (the plane-host egress open and the duplex_ws dial) ask plane_host::egress_trust::InstalledResolver, which reads the capability. With no guarded capability, a production kernel refuses the name (fail closed); a test build resolves through egress::fixtures::system_names, the same body, in test scaffolding. No new static. - The connector reads split_url from the unit instead of through the shim, and depends on busbar-kernel-egress (kind-isolation [[dep]] row, cleanliness -> kernel, allowed). core-oauth2 reads parse_url from busbar_contract::net. busbar-a2a and busbar-voice (legacy, deleted by #787 and #503) reach the unit through the kernel's existing busbar_kernel::proxy::egress_unit re-export, so no new legacy edge. - Tests: the shim suites' four rows the unit's suite did not already hold move to busbar-kernel-egress trust/tests/net_tests.rs; the other 32 were duplicates of it. egress_trust_tests gains the_guarded_seam_resolves_by_the_resolver_behind_it. The root's net_guard_one_judge compares config_validate's re-exports with the unit. no_socket strikes ("src/net_guard.rs", "lookup_host"). - Population floor 948 -> 947 (one non-test file deleted, reviewed).

github-actions · 2026-10-12T21:25:36Z

promote into `predev`: DENY @028c1d735: 5 failing test row(s), 0 DENY row(s)

Failing tests (5)

crate	test	step	first panic
`no_io_outside_hostio`	`a_dial_planted_outside_the_hosts_io_is_named`	test:no-default-features	crates/busbar-core-connector/tests/no_io_outside_hostio.rs:132:5: assertion 'left == right' failed: [("compose.rs", 1652, "TcpStream::connect"), ("process.rs", 389, "tokio::net")]
`no_io_outside_hostio`	`no_source_file_but_the_hosts_io_touches_an_os_handle`	test:no-default-features	crates/busbar-core-connector/tests/no_io_outside_hostio.rs:116:5: assertion 'left == right' failed
`-p busbar-core-connector --test no_io_outside_hostio`	`test target failed`	test:no-default-features
``	`nextest busbar-core-connector::no_io_outside_hostio::a_dial_planted_outside_the_hosts_io_is_named`	test:workspace
``	`nextest busbar-core-connector::no_io_outside_hostio::no_source_file_but_the_hosts_io_touches_an_os_handle`	test:workspace

Denied because (2)

shard 2/4: gate:test:no-default-features: green at base, red now (test: no_io_outside_hostio (tests/no_io_outside_hostio.rs)::a_dial_planted_outside_the_hosts_io_is_named, test: no_io_outside_hostio (tests/no_io_outside_hostio.rs)::no_source_file_but_the_hosts_io_touches_an_os_handle, test: target -
shard 3/4: gate:test:workspace: green at base, red now (nextest: busbar-core-connector::no_io_outside_hostio::a_dial_planted_outside_the_hosts_io_is_named, nextest: busbar-core-connector::no_io_outside_hostio::no_source_file_but_the_hosts_io_touches_an_os_handle)

Judged against base 0f49f8375: 2 new red, 0 worse, 6 standing (excused).

New reds: gate:test:no-default-features: green at base, red now (test: no_io_outside_hostio (tests/no_io_outside_hostio.rs)::a_dial_planted_outside_the_hosts_io_is_named, test: no_io_outside_hostio (tests/no_io_outside_hostio.rs)::no_source_file_but_the_hosts_io_touches_an_os_handle, test: target -p busbar-core-connector --test no_io_outside_hostio), gate:test:workspace: green at base, red now (nextest: busbar-core-connector::no_io_outside_hostio::a_dial_planted_outside_the_hosts_io_is_named, nextest: busbar-core-connector::no_io_outside_hostio::no_source_file_but_the_hosts_io_touches_an_os_handle)

Already red on predev, not this PR's: 14

gate	row	detail
test:xtask-selftest	`::xtask selftest kind-isolation`
test:xtask-selftest	`::xtask selftest plane-purity`
test:xtask-selftest	`::xtask selftest no-deferral-strict-done`
test:xtask-selftest	`::xtask selftest plane-purity-strict`
test:xtask-selftest	`::xtask selftest unconstructed`
test:xtask-selftest	`::xtask selftest plane-transport-neutrality`
construction	`one-pick-site`	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:358; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	`kind-isolation:deps`	3 finding(s), 93 shipped edge instance(s) over 29 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation-ship	`kind-isolation:deps`	8 finding(s) over 93 shipped edge(s): ship-edge kernel -> store busbar-kernel -> busbar-store-memory is 'not-allowed': the architecture grants no kernel -> store edge, and the ship criterion is the ar
kind-isolation-ship	`kind-isolation:test-deps`	5 finding(s) over 31 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship c
kind-isolation-ship	`kind-isolation:faces`	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	`kind-isolation:legacy-drain`	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	`ship-ready:ship-twin`	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	`structure-lint:plane-dup:unledgered`	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

tests passed: 36299, failed: 2. Run: https://github.com/GetBusbar/busbar/actions/runs/38346116048 . Artifact verdict-028c1d7352e846dcd57b5e3b7ad7eb88fbe0bd33 (failures.json, junit.xml, raw.log; 90 days).

- design bindings PB-68: the shared-predicate row names its surviving copy in the egress unit's suite (crates/busbar-kernel-egress/src/trust/tests/net_tests.rs, same test), not the deleted kernel suite; qa-names and design-bindings:regen-clean follow. - law0 busbar-kernel x plane 1172 -> 1166: the shim and its suites carried six plane words. - The moved NAT64 row's doc names no plane (busbar-kernel-egress x plane stays at 5).

…ener # Conflicts: # xtask/src/gates/population.rs

# Conflicts: # xtask/src/gates/population.rs

…guard # Conflicts: # qa/kind-isolation.toml # xtask/src/gates/population.rs

…guard # Conflicts: # xtask/src/gates/population.rs

…guard

no_io_outside_hostio holds that no connector file but the host's I/O touches the OS, and SystemNames (the system name lookup the kernel's remaining resolve-then-pin dials ask through the egress-trust capability) called tokio::net::lookup_host from process.rs. It moves, unchanged, into hostio.rs, the host's I/O; the root installs busbar_core_connector::hostio::SystemNames. The test's allowlist is unchanged.

#798 (row 157) deleted plane_host/guard.rs and the guard_url slot, and moved the egress-trust capability to egress::trust: the kernel's resolve-then-pin dials ask egress::trust::InstalledResolver. Ledger by the merge rule (theirs + ours - base): busbar-kernel x plane 1168/1162/1141 -> 1135, busbar-kernel x transport 285/268/284 -> 267.

…guard

#741 landed the same E1 listener move on predev (7fe0203, 5f189a7), so every E1 conflict takes predev's side: crates/busbar/src/root/listener.rs and crates/busbar-kernel/src/tls.rs (predev's comments name a plane's outbound identity, not busbar-a2a), xtask/src/gates/population.rs (predev replaced the hand-pinned FLOOR with the tracked-set reconciliation). qa/kind-isolation.toml: busbar x transport and busbar-kernel x transport each carry the same +17/-17 move on both sides, so theirs (224, 266) is taken, count and cite: adding both deltas would count the move twice. What this branch still adds over predev is crates/busbar-kernel/tests/no_socket.rs (the kernel's no-socket pin, E7); its PINNED list matches predev's kernel exactly (no new pair, none drained).

… into lane-egress-e2-net-guard qa/kind-isolation.toml: predev's rows, plus this branch's own E2 drain. busbar x transport and busbar-kernel x transport: this branch carries the same E1 +17/-17 move #741 landed on predev, so theirs (224, 266) is taken, count and cite. busbar-kernel x plane: predev 1128 (row 156 and #674 drains since this branch's last predev, 1141) minus E2's own six (net_guard.rs and its two suites deleted: 1141 -> 1135 here) = 1122, predev's cite kept with E2's clause renumbered 1128 -> 1122. Every other row is predev's.

qa/kind-isolation.toml busbar-kernel x plane: base 1128, ours 1124 (E5a's proxy-tunnel drain), theirs 1122 (E2's net_guard deletion): different drains, so theirs + ours - base = 1118, predev's cite kept with E5a's clause renumbered 1122 -> 1118. The kernel no-socket pin (#796) stays exact on the merged tree.

- crates/busbar-plane-a2a/src/a2a/config.rs: this branch's wording kept (the cloud-metadata refusal is the host's destination guard's); predev's edit was a doc-link repoint in the deleted engine's copy of the same file. - crates/busbar-a2a/**: predev's edits (net_guard -> busbar_contract::net doc and path repoints) land in files this branch deletes with the crate. - crates/busbar-kernel/src/net_guard.rs: deleted, as predev deletes it (this branch's edit there was one comment). - qa/kind-isolation.toml busbar-kernel x plane: B 1128, predev 1122 (E2: net_guard.rs and its two suites, -6), ours 1105 (FLIP-A2A, -23) -> 1100, not T + O - B = 1099: one of this branch's 23 was net_guard.rs's `busbar-a2a` comment, a hit E2's deletion of the file also drains, so the two drains overlap by one. Predev's cite kept whole; this branch's clause appended as 1122 -> 1100.

The six conflicts are modify/delete in busbar-voice: predev's row 130 E2 (bc8fb93) re-pointed the crate's GuardPolicy imports from busbar_kernel::net_guard to the egress unit's re-export, and #503 deletes the crate. Settled as deleted: the crate is gone, so the re-point has nothing to land on, and no surviving file names busbar_kernel::net_guard. #800's egress move (net_guard out of the kernel, the root's listener serve loop) and #503's flip merge without overlap in the other shared files (Cargo.toml, Cargo.lock, the kernel and root manifests, main.rs, linked.rs, router.rs, duplex_ws_tests.rs); the lock resolves under --locked. qa/kind-isolation.toml, settled by hand: no count row was moved by both sides. #503 keeps its busbar x plane 810 and its struck busbar-voice rows; predev keeps busbar x transport 224, the kernel's auth 48 / instance:secret 114 / plane 1122 / store 1 / transport 266, the plugin loader's auth 2 / instance:secret 107, and the struck kernel -> busbar-store-memory row.

…ress::trust::net, where #800 left them #800 (E2) deleted the kernel's net_guard re-export, so the merge of predev left this stack's crate::net_guard / busbar_kernel::net_guard paths naming a module that no longer exists. They now name busbar_kernel_egress::trust::net directly, as predev's own callers do (plane_host/egress.rs, core-connector guard.rs/process.rs). No behaviour change.

MattJackson added 2 commits October 12, 2026 12:21

MattJackson added 7 commits October 12, 2026 14:28

Merge remote-tracking branch 'origin/predev' into lane-egress-e1-list…

161a883

…ener # Conflicts: # xtask/src/gates/population.rs

Merge branch 'lane-egress-e1-listener' into lane-egress-e2-net-guard

c8c1574

# Conflicts: # xtask/src/gates/population.rs

Merge remote-tracking branch 'origin/predev' into lane-egress-e2-net-…

8fbaf72

…guard # Conflicts: # qa/kind-isolation.toml # xtask/src/gates/population.rs

Merge remote-tracking branch 'origin/predev' into lane-egress-e2-net-…

028c1d7

…guard # Conflicts: # xtask/src/gates/population.rs

Merge remote-tracking branch 'origin/predev' into lane-egress-e2-net-…

f98fb10

…guard

MattJackson mentioned this pull request Oct 13, 2026

row 130 E1+E7: the hyper serve loop leaves busbar-kernel; the kernel's no-socket pin #796

Merged

MattJackson added 2 commits October 13, 2026 06:13

Merge remote-tracking branch 'origin/predev' into lane-egress-e2-net-…

9a66bfa

…guard

MattJackson mentioned this pull request Oct 13, 2026

row 159: a settings-derived need target drops its userinfo; the webhook sink sends it as Basic, as 1.5.5 did (audit export-webhook #1, HIGH) #842

Open

MattJackson added 2 commits October 13, 2026 16:48

MattJackson merged commit 6d5642b into predev Oct 14, 2026
1 check passed

MattJackson deleted the lane-egress-e2-net-guard branch October 14, 2026 00:54

MattJackson mentioned this pull request Oct 14, 2026

row 155 F25 REHOME (kernel): auth at the served door gate, egress, config, telemetry and plane-driver rows, 35 legacy tests #900

Open

Navigation Menu

Repository navigation

row 130 E2: net_guard leaves busbar-kernel; the kernel resolves no name itself (stacked on #796) - #800

row 130 E2: net_guard leaves busbar-kernel; the kernel resolves no name itself (stacked on #796)#800
MattJackson merged 13 commits into
predevfrom
lane-egress-e2-net-guard

MattJackson commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

MattJackson commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

promote into predev: DENY @028c1d735: 5 failing test row(s), 0 DENY row(s)

Failing tests (5)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Oct 12, 2026 •

edited

Loading

promote into `predev`: DENY @028c1d735: 5 failing test row(s), 0 DENY row(s)