From 1aafa7fc8d94b52aa7f1f156daf988a18a73011a Mon Sep 17 00:00:00 2001 From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com> Date: Tue, 13 Oct 2026 15:32:08 -0700 Subject: [PATCH 1/2] kind-isolation: no plugins.yaml alias under three characters is an instance needle The hole (row 159, gate false positive): the instance vocabulary reads plugins.yaml aliases, and the C-built secret plugin's alias `c` became a whole-literal needle. Literals are folded to lower case, so every `extern "C"` ABI string and every one-letter `"c"` key in a neutral crate counted as a busbar x instance:secret hit: 262 of the axis's 444 Law 0 hits on predev 5c99befcfa. The fix: a LEARNED name (census id or registry alias) shorter than MIN_NEEDLE_LEN = 3 is no needle. Every other alias and census id of the five neutral kinds is 3+ characters (shortest: `env`), so the floor drops `c` and nothing else. The short name still attributes a module-name constant that spells it; module-name constants themselves count at any length. --report prints each dropped name as a `short` line. RED plants (matrix battery, instances::selftest): - GREEN case: the fixture crate writes `extern "C"`, `c == "c"` and every live short axis alias as a literal; its x secret cell stays 0. On predev the `c` alias makes it an unlisted-instance, so the case is red without this fix. - RED case: the same plant plus `module == ""` (`vault`) is still the fixture's x secret unlisted-instance: long registry aliases keep counting. - unit test an_alias_under_three_characters_is_no_needle_and_a_longer_one_still_is. [[law0]] instance:secret rows re-measured (exact both ways), alias needle min length (false positive), ARCHITECT 2026-10-13: busbar 35 -> 19, busbar-contract 133 -> 45, busbar-core-admin 50 -> 38, busbar-kernel 114 -> 67, busbar-plugin-loader 107 -> 12; busbar-core-connector 3 -> 0 and busbar-kernel-egress 1 -> 0 (rows dropped: a neutral cell at 0 with no row is held at 0). --- qa/kind-isolation.toml | 32 ++--- .../gates/kind_isolation/matrix/instances.rs | 133 ++++++++++++++++++ 2 files changed, 143 insertions(+), 22 deletions(-) diff --git a/qa/kind-isolation.toml b/qa/kind-isolation.toml index 1e97362c49..203a0739ac 100644 --- a/qa/kind-isolation.toml +++ b/qa/kind-isolation.toml @@ -1578,8 +1578,8 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain [[law0]] crate = "busbar" axis = "instance:secret" -count = "35" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 34 -> 35, the measure at the arming SHA dc83ff1553 (#597; Law 9). Predev 9c0a394771 measures 36: #560 (7b5f5d8be4) grew it after the row was live, invisible to a figure that counted findings. That excess is a Law 0 rise, so it stays RED until drained; this row does not raise to cover it" +count = "19" +cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 34 -> 35, the measure at the arming SHA dc83ff1553 (#597; Law 9). Predev 9c0a394771 measures 36: #560 (7b5f5d8be4) grew it after the row was live, invisible to a figure that counted findings. That excess is a Law 0 rise, so it stays RED until drained; this row does not raise to cover it; LOWERED 35 -> 19, alias needle min length (false positive), ARCHITECT 2026-10-13: the plugins.yaml alias `c` (busbar-secret-c) is under the three-character needle floor, so `extern \"C\"` and one-letter `\"c\"` literals no longer count as a secret instance (row 159)" [[law0]] crate = "busbar" @@ -1638,8 +1638,8 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain [[law0]] crate = "busbar-contract" axis = "instance:secret" -count = "133" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 128 -> 133 (Law 9, BUSBAR-1.6.0.md: it pins its ceiling at TODAY'S MEASURED VALUE): the row went live on predev at dc83ff1553 (#597) and measured 133 there; the 128 was f830faa691's, nine hours older than the arming, so the row armed red. 133 is predev 9c0a394771's measure, at or under the arming value" +count = "45" +cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 128 -> 133 (Law 9, BUSBAR-1.6.0.md: it pins its ceiling at TODAY'S MEASURED VALUE): the row went live on predev at dc83ff1553 (#597) and measured 133 there; the 128 was f830faa691's, nine hours older than the arming, so the row armed red. 133 is predev 9c0a394771's measure, at or under the arming value; LOWERED 133 -> 45, alias needle min length (false positive), ARCHITECT 2026-10-13: the plugins.yaml alias `c` (busbar-secret-c) is under the three-character needle floor, so `extern \"C\"` and one-letter `\"c\"` literals no longer count as a secret instance (row 159)" [[law0]] crate = "busbar-contract" @@ -1698,8 +1698,8 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain [[law0]] crate = "busbar-core-admin" axis = "instance:secret" -count = "50" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance" +count = "38" +cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; LOWERED 50 -> 38, alias needle min length (false positive), ARCHITECT 2026-10-13: the plugins.yaml alias `c` (busbar-secret-c) is under the three-character needle floor, so `extern \"C\"` and one-letter `\"c\"` literals no longer count as a secret instance (row 159)" [[law0]] crate = "busbar-core-admin" @@ -1725,12 +1725,6 @@ axis = "export" count = "1" cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance" -[[law0]] -crate = "busbar-core-connector" -axis = "instance:secret" -count = "3" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance" - [[law0]] crate = "busbar-core-connector" axis = "transport" @@ -1776,8 +1770,8 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain [[law0]] crate = "busbar-kernel" axis = "instance:secret" -count = "114" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance. -2 for R-FIX3 (the kernel's plugin tests move onto in-crate doubles); lowered 115 -> 114 by the deletion of the kernel's dead ask-state seal (audit K2-H3), the gate's measure on this branch merged with predev 1617e9f019" +count = "67" +cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance. -2 for R-FIX3 (the kernel's plugin tests move onto in-crate doubles); lowered 115 -> 114 by the deletion of the kernel's dead ask-state seal (audit K2-H3), the gate's measure on this branch merged with predev 1617e9f019; LOWERED 114 -> 67, alias needle min length (false positive), ARCHITECT 2026-10-13: the plugins.yaml alias `c` (busbar-secret-c) is under the three-character needle floor, so `extern \"C\"` and one-letter `\"c\"` literals no longer count as a secret instance (row 159)" [[law0]] crate = "busbar-kernel" @@ -1821,12 +1815,6 @@ axis = "transport" count = "134" cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance" -[[law0]] -crate = "busbar-kernel-egress" -axis = "instance:secret" -count = "1" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance" - [[law0]] crate = "busbar-kernel-egress" axis = "plane" @@ -1878,8 +1866,8 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain [[law0]] crate = "busbar-plugin-loader" axis = "instance:secret" -count = "107" -cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance. -1: dispatch/plugin.rs no longer edits a member's `env` map in place (a member's env references resolve at the spawn). predev -1: the secret shared-instance open moved to OpenOnce (f664bca2cf) -2 (GetBusbar/busbar#532, Q1; 109 - 2 = 107): the raw JSON-lane loader and the cold auth lane are deleted (111 -> 109 on #532 merged with predev 1617e9f019); #532 touches neither of predev's two drains above" +count = "12" +cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance. -1: dispatch/plugin.rs no longer edits a member's `env` map in place (a member's env references resolve at the spawn). predev -1: the secret shared-instance open moved to OpenOnce (f664bca2cf) -2 (GetBusbar/busbar#532, Q1; 109 - 2 = 107): the raw JSON-lane loader and the cold auth lane are deleted (111 -> 109 on #532 merged with predev 1617e9f019); #532 touches neither of predev's two drains above; LOWERED 107 -> 12, alias needle min length (false positive), ARCHITECT 2026-10-13: the plugins.yaml alias `c` (busbar-secret-c) is under the three-character needle floor, so `extern \"C\"` and one-letter `\"c\"` literals no longer count as a secret instance (row 159)" [[law0]] crate = "busbar-plugin-loader" diff --git a/xtask/src/gates/kind_isolation/matrix/instances.rs b/xtask/src/gates/kind_isolation/matrix/instances.rs index c785c12dac..070703e3be 100644 --- a/xtask/src/gates/kind_isolation/matrix/instances.rs +++ b/xtask/src/gates/kind_isolation/matrix/instances.rs @@ -43,6 +43,18 @@ //! compiler reads it (escapes decoded, adjacent literals joined — [`super::decoded_line`]), so //! `"\x6f\x74lp"` and `concat!("ot", "lp")` are `"otlp"`. //! +//! ## A NAME SHORTER THAN THREE LETTERS IS NO NEEDLE +//! +//! A name LEARNED off another name — a census id, a `plugins.yaml` alias — is admitted only at +//! [`MIN_NEEDLE_LEN`] characters or more. `plugins.yaml` files the C-built secret plugin as alias +//! `c`, and a whole literal `"c"` (folded to lower case) is every `extern "C"` ABI string and every +//! one-letter test key in core: 262 of the secret axis's 444 Law 0 hits on predev 5c99befcfa were +//! that, not an instance. Three is the floor because every other alias and census id of the five +//! kinds is at least that long (the shortest is the secret alias `env`), so the floor drops `c` and +//! nothing else; one- and two-letter literals (`"c"`, `"id"`, `"ok"`) are keys and fixtures far +//! more often than names. A module-name CONSTANT is not learned, it is the compiled-in name itself, +//! and it counts at any length. +//! //! ## PRESENCE, NOT SIZE //! //! Every non-zero cell carries an `[[instance]]` row in `qa/kind-isolation.toml` — crate and kind, @@ -93,6 +105,19 @@ pub struct Vocab { pub unattributed: Vec, /// Every `[[core-name]]` row that would mask a PLUGIN's name, and so masks nothing. pub refused_core: Vec, + /// `(kind, name, from)`: every learned name under [`MIN_NEEDLE_LEN`], kept out of `names` and + /// printed by `--report` so the floor is read, not silent. + pub short: Vec<(&'static str, String, String)>, +} + +/// THE SHORTEST LEARNED NAME THAT IS A NEEDLE (row 159, ARCHITECT 2026-10-13). See the module +/// header: a census id or `plugins.yaml` alias under three characters (`c`) matches `extern "C"` +/// and one-letter fixtures, not an instance. +pub(super) const MIN_NEEDLE_LEN: usize = 3; + +/// Whether a learned name is long enough to be counted as a whole-literal needle. +fn is_needle(name: &str) -> bool { + name.chars().count() >= MIN_NEEDLE_LEN } /// One `const` declaration a module name was read from. @@ -250,6 +275,10 @@ pub fn vocabulary( }; let Some(id) = super::own_id(c) else { continue }; census.entry(id.clone()).or_default().insert(k); + if !is_needle(&id) { + v.short.push((k, id, c.name.clone())); + continue; + } v.names .entry(k) .or_default() @@ -265,11 +294,16 @@ pub fn vocabulary( // manifest names, so it can see external plugins"). An out-of-tree plugin has no crate here to // teach the census its name; `plugins.yaml` files it under its kind with the `module:` word an // operator writes (`alias`). Owned by its plugin crate, so it is never counted against itself. + // An alias under [`MIN_NEEDLE_LEN`] still attributes a constant that spells it, and is no needle. for (kind, alias, krate) in registry_aliases(registry) { let Some(k) = axes.iter().copied().find(|k| *k == kind) else { continue; }; census.entry(alias.clone()).or_default().insert(k); + if !is_needle(&alias) { + v.short.push((k, alias, format!("plugins.yaml {krate}"))); + continue; + } v.names .entry(k) .or_default() @@ -780,6 +814,11 @@ pub fn render(measured: &Instances, vocab: &Vocab) -> String { s.push_str(&format!("vocab\t{k}\t{name}\t{}\n", from.join(" ; "))); } } + for (k, name, from) in &vocab.short { + s.push_str(&format!( + "short\t{k}\t{name}\t{from} (under {MIN_NEEDLE_LEN} characters: no needle)\n" + )); + } for ((krate, kind), cell) in measured { s.push_str(&format!("cell\t{krate}\t{kind}\t{}\n", cell.count)); } @@ -1106,6 +1145,75 @@ pub fn selftest<'a>( ], )); + // A ONE-LETTER ALIAS IS NO NEEDLE (row 159, ARCHITECT 2026-10-13), AND A REAL ALIAS STILL IS. + // `plugins.yaml` files the C-built secret plugin as alias `c`; read as a needle, the fixture's + // `extern "C"` ABI string and its one-letter `"c"` key were two `× secret` hits, an + // `unlisted-instance` on a crate that names no plugin. Every alias the live registry gives an + // axis under [`MIN_NEEDLE_LEN`] is planted the same way, and the cell stays at zero: GREEN. + // The same plant plus one comparison against a real registry alias of the same tree (`vault` + // today, read off `plugins.yaml`, never typed here) is that axis's `unlisted-instance`: RED. + let axis_aliases: Vec<(String, String, String)> = + registry_aliases(&cx.read(REGISTRY).unwrap_or_default()) + .into_iter() + .filter(|(k, _, _)| axes().iter().any(|a| *a == k.as_str())) + .collect(); + let mut short_body = String::from( + "pub extern \"C\" fn planted_one() {}\n\ + pub fn planted_two(c: &str) -> bool {\n c == \"c\"\n}\n", + ); + for (i, (_, alias, _)) in axis_aliases + .iter() + .filter(|(_, a, _)| !is_needle(a)) + .enumerate() + { + short_body.push_str(&format!( + "pub const PLANTED_SHORT_{i}: &str = \"{alias}\";\n" + )); + } + report.push(prove_rows_green( + cx, + gate, + "`extern \"C\"` and a one-letter `\"c\"` in a neutral crate are no secret instance (an \ + alias under three characters is no needle)", + &[ROW_MATRIX], + super::fixture_files(&[("planted_short_alias.rs", short_body.as_str())]), + )); + let long = axis_aliases + .iter() + .filter(|(_, a, _)| is_needle(a)) + .find(|(k, _, _)| k == "secret") + .or_else(|| axis_aliases.iter().find(|(_, a, _)| is_needle(a))); + match long { + Some((kind, alias, _)) => { + let pick = + format!("pub fn pick(module: &str) -> bool {{\n module == \"{alias}\"\n}}\n"); + report.push(prove_rows_red( + cx, + gate, + format!( + "a real `{kind}` registry alias (`{alias}`) still counts beside the planted short \ + aliases" + ), + &[ROW_MATRIX], + super::fixture_files(&[ + ("planted_short_alias.rs", short_body.as_str()), + ("planted_alias_pick.rs", pick.as_str()), + ]), + &[ + "unlisted-instance", + &super::fixture_subject(kind), + "planted_alias_pick.rs", + ], + )); + } + None => report.push(crate::gates::CasePlan::from(super::super::unplantable( + "the instance registry gives an axis an alias of three characters or more", + &[ROW_MATRIX], + &["instance"], + format!("{REGISTRY} files no alias of {MIN_NEEDLE_LEN}+ characters under any axis"), + ))), + } + // A CRATE IS NEVER MEASURED AGAINST ITS OWN NAME — the store instance writing its own id is // the instance, not a neutral crate naming one. report.push(prove_rows_green( @@ -1389,6 +1497,31 @@ mod tests { assert_eq!(n("crates/k/src/a.yaml", json), 0); } + #[test] + fn an_alias_under_three_characters_is_no_needle_and_a_longer_one_still_is() { + // RED on predev 5c99befcfa: `c` was a secret needle, so every `extern "C"` and one-letter + // `"c"` in a neutral crate counted as a secret instance. + let registry = "plugins:\n - repo: busbar-secret-c\n kind: secret\n alias: c\n \ + crate: busbar-secret-c\n - repo: busbar-secret-vault\n kind: secret\n \ + alias: vault\n crate: busbar-secret-vault-plugin\n - repo: \ + busbar-secret-env\n kind: secret\n alias: env\n crate: \ + busbar-secret-env-plugin\n"; + let v = vocabulary(&[], &[], &[], registry); + let secret = v.names.get("secret").expect("the secret axis"); + assert!(!secret.contains_key("c"), "{secret:?}"); + assert!(secret.contains_key("vault"), "{secret:?}"); + assert!(secret.contains_key("env"), "{secret:?}"); + assert_eq!( + v.short, + vec![( + "secret", + "c".to_string(), + "plugins.yaml busbar-secret-c".to_string() + )] + ); + assert!(render(&Instances::new(), &v).contains("short\tsecret\tc\t")); + } + #[test] fn kind_words_take_both_numbers() { assert!(is_kind_word("HOOK", "hooks")); From c429b4f72ee5146ff50344dc0e4cd80301081fc0 Mon Sep 17 00:00:00 2001 From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com> Date: Tue, 13 Oct 2026 17:58:17 -0700 Subject: [PATCH 2/2] kind-isolation selftest: the registry aliases on an axis filter with contains (clippy manual_contains) --- xtask/src/gates/kind_isolation/matrix/instances.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xtask/src/gates/kind_isolation/matrix/instances.rs b/xtask/src/gates/kind_isolation/matrix/instances.rs index 070703e3be..36823ce0c1 100644 --- a/xtask/src/gates/kind_isolation/matrix/instances.rs +++ b/xtask/src/gates/kind_isolation/matrix/instances.rs @@ -1155,7 +1155,7 @@ pub fn selftest<'a>( let axis_aliases: Vec<(String, String, String)> = registry_aliases(&cx.read(REGISTRY).unwrap_or_default()) .into_iter() - .filter(|(k, _, _)| axes().iter().any(|a| *a == k.as_str())) + .filter(|(k, _, _)| axes().contains(&k.as_str())) .collect(); let mut short_body = String::from( "pub extern \"C\" fn planted_one() {}\n\