Skip to content

row 159: kind-isolation admits no one-letter alias as a free-text needle (gate false positive) #860

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MattJackson merged 2 commits into from
Oct 15, 2026
Merged

row 159: kind-isolation admits no one-letter alias as a free-text needle (gate false positive) #860

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1aafa7f
kind-isolation: no plugins.yaml alias under three characters is an in…
MattJackson Oct 13, 2026
c429b4f
kind-isolation selftest: the registry aliases on an axis filter with …
MattJackson Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 10 additions & 22 deletions qa/kind-isolation.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1578,8 +1578,8 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain
[[law0]]
crate = "busbar"
axis = "instance:secret"
count = "35"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 34 -> 35, the measure at the arming SHA dc83ff1553 (#597; Law 9). Predev 9c0a394771 measures 36: #560 (7b5f5d8be4) grew it after the row was live, invisible to a figure that counted findings. That excess is a Law 0 rise, so it stays RED until drained; this row does not raise to cover it"
count = "19"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 34 -> 35, the measure at the arming SHA dc83ff1553 (#597; Law 9). Predev 9c0a394771 measures 36: #560 (7b5f5d8be4) grew it after the row was live, invisible to a figure that counted findings. That excess is a Law 0 rise, so it stays RED until drained; this row does not raise to cover it; LOWERED 35 -> 19, alias needle min length (false positive), ARCHITECT 2026-10-13: the plugins.yaml alias `c` (busbar-secret-c) is under the three-character needle floor, so `extern \"C\"` and one-letter `\"c\"` literals no longer count as a secret instance (row 159)"

[[law0]]
crate = "busbar"
Expand Down Expand Up @@ -1638,8 +1638,8 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain
[[law0]]
crate = "busbar-contract"
axis = "instance:secret"
count = "133"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 128 -> 133 (Law 9, BUSBAR-1.6.0.md: it pins its ceiling at TODAY'S MEASURED VALUE): the row went live on predev at dc83ff1553 (#597) and measured 133 there; the 128 was f830faa691's, nine hours older than the arming, so the row armed red. 133 is predev 9c0a394771's measure, at or under the arming value"
count = "45"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; RE-ARMED 128 -> 133 (Law 9, BUSBAR-1.6.0.md: it pins its ceiling at TODAY'S MEASURED VALUE): the row went live on predev at dc83ff1553 (#597) and measured 133 there; the 128 was f830faa691's, nine hours older than the arming, so the row armed red. 133 is predev 9c0a394771's measure, at or under the arming value; LOWERED 133 -> 45, alias needle min length (false positive), ARCHITECT 2026-10-13: the plugins.yaml alias `c` (busbar-secret-c) is under the three-character needle floor, so `extern \"C\"` and one-letter `\"c\"` literals no longer count as a secret instance (row 159)"

[[law0]]
crate = "busbar-contract"
Expand Down Expand Up @@ -1698,8 +1698,8 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain
[[law0]]
crate = "busbar-core-admin"
axis = "instance:secret"
count = "50"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance"
count = "38"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance; LOWERED 50 -> 38, alias needle min length (false positive), ARCHITECT 2026-10-13: the plugins.yaml alias `c` (busbar-secret-c) is under the three-character needle floor, so `extern \"C\"` and one-letter `\"c\"` literals no longer count as a secret instance (row 159)"

[[law0]]
crate = "busbar-core-admin"
Expand All @@ -1725,12 +1725,6 @@ axis = "export"
count = "1"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance"

[[law0]]
crate = "busbar-core-connector"
axis = "instance:secret"
count = "3"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance"

[[law0]]
crate = "busbar-core-connector"
axis = "transport"
Expand Down Expand Up @@ -1776,8 +1770,8 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain
[[law0]]
crate = "busbar-kernel"
axis = "instance:secret"
count = "114"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance. -2 for R-FIX3 (the kernel's plugin tests move onto in-crate doubles); lowered 115 -> 114 by the deletion of the kernel's dead ask-state seal (audit K2-H3), the gate's measure on this branch merged with predev 1617e9f019"
count = "67"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance. -2 for R-FIX3 (the kernel's plugin tests move onto in-crate doubles); lowered 115 -> 114 by the deletion of the kernel's dead ask-state seal (audit K2-H3), the gate's measure on this branch merged with predev 1617e9f019; LOWERED 114 -> 67, alias needle min length (false positive), ARCHITECT 2026-10-13: the plugins.yaml alias `c` (busbar-secret-c) is under the three-character needle floor, so `extern \"C\"` and one-letter `\"c\"` literals no longer count as a secret instance (row 159)"

[[law0]]
crate = "busbar-kernel"
Expand Down Expand Up @@ -1821,12 +1815,6 @@ axis = "transport"
count = "134"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance"

[[law0]]
crate = "busbar-kernel-egress"
axis = "instance:secret"
count = "1"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance"

[[law0]]
crate = "busbar-kernel-egress"
axis = "plane"
Expand Down Expand Up @@ -1878,8 +1866,8 @@ cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain
[[law0]]
crate = "busbar-plugin-loader"
axis = "instance:secret"
count = "107"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance. -1: dispatch/plugin.rs no longer edits a member's `env` map in place (a member's env references resolve at the spawn). predev -1: the secret shared-instance open moved to OpenOnce (f664bca2cf) -2 (GetBusbar/busbar#532, Q1; 109 - 2 = 107): the raw JSON-lane loader and the cold auth lane are deleted (111 -> 109 on #532 merged with predev 1617e9f019); #532 touches neither of predev's two drains above"
count = "12"
cite = "measured on predev f830faa691 (ARCHITECT 2026-10-07, Law 9); the drain is THE DESIGN §1 / DoD item 2: core names no instance. -1: dispatch/plugin.rs no longer edits a member's `env` map in place (a member's env references resolve at the spawn). predev -1: the secret shared-instance open moved to OpenOnce (f664bca2cf) -2 (GetBusbar/busbar#532, Q1; 109 - 2 = 107): the raw JSON-lane loader and the cold auth lane are deleted (111 -> 109 on #532 merged with predev 1617e9f019); #532 touches neither of predev's two drains above; LOWERED 107 -> 12, alias needle min length (false positive), ARCHITECT 2026-10-13: the plugins.yaml alias `c` (busbar-secret-c) is under the three-character needle floor, so `extern \"C\"` and one-letter `\"c\"` literals no longer count as a secret instance (row 159)"

[[law0]]
crate = "busbar-plugin-loader"
Expand Down
133 changes: 133 additions & 0 deletions xtask/src/gates/kind_isolation/matrix/instances.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,18 @@
//! compiler reads it (escapes decoded, adjacent literals joined — [`super::decoded_line`]), so
//! `"\x6f\x74lp"` and `concat!("ot", "lp")` are `"otlp"`.
//!
//! ## A NAME SHORTER THAN THREE LETTERS IS NO NEEDLE
//!
//! A name LEARNED off another name — a census id, a `plugins.yaml` alias — is admitted only at
//! [`MIN_NEEDLE_LEN`] characters or more. `plugins.yaml` files the C-built secret plugin as alias
//! `c`, and a whole literal `"c"` (folded to lower case) is every `extern "C"` ABI string and every
//! one-letter test key in core: 262 of the secret axis's 444 Law 0 hits on predev 5c99befcfa were
//! that, not an instance. Three is the floor because every other alias and census id of the five
//! kinds is at least that long (the shortest is the secret alias `env`), so the floor drops `c` and
//! nothing else; one- and two-letter literals (`"c"`, `"id"`, `"ok"`) are keys and fixtures far
//! more often than names. A module-name CONSTANT is not learned, it is the compiled-in name itself,
//! and it counts at any length.
//!
//! ## PRESENCE, NOT SIZE
//!
//! Every non-zero cell carries an `[[instance]]` row in `qa/kind-isolation.toml` — crate and kind,
Expand Down Expand Up @@ -93,6 +105,19 @@ pub struct Vocab {
pub unattributed: Vec<String>,
/// Every `[[core-name]]` row that would mask a PLUGIN's name, and so masks nothing.
pub refused_core: Vec<String>,
/// `(kind, name, from)`: every learned name under [`MIN_NEEDLE_LEN`], kept out of `names` and
/// printed by `--report` so the floor is read, not silent.
pub short: Vec<(&'static str, String, String)>,
}

/// THE SHORTEST LEARNED NAME THAT IS A NEEDLE (row 159, ARCHITECT 2026-10-13). See the module
/// header: a census id or `plugins.yaml` alias under three characters (`c`) matches `extern "C"`
/// and one-letter fixtures, not an instance.
pub(super) const MIN_NEEDLE_LEN: usize = 3;

/// Whether a learned name is long enough to be counted as a whole-literal needle.
fn is_needle(name: &str) -> bool {
name.chars().count() >= MIN_NEEDLE_LEN
}

/// One `const` declaration a module name was read from.
Expand Down Expand Up @@ -250,6 +275,10 @@ pub fn vocabulary(
};
let Some(id) = super::own_id(c) else { continue };
census.entry(id.clone()).or_default().insert(k);
if !is_needle(&id) {
v.short.push((k, id, c.name.clone()));
continue;
}
v.names
.entry(k)
.or_default()
Expand All @@ -265,11 +294,16 @@ pub fn vocabulary(
// manifest names, so it can see external plugins"). An out-of-tree plugin has no crate here to
// teach the census its name; `plugins.yaml` files it under its kind with the `module:` word an
// operator writes (`alias`). Owned by its plugin crate, so it is never counted against itself.
// An alias under [`MIN_NEEDLE_LEN`] still attributes a constant that spells it, and is no needle.
for (kind, alias, krate) in registry_aliases(registry) {
let Some(k) = axes.iter().copied().find(|k| *k == kind) else {
continue;
};
census.entry(alias.clone()).or_default().insert(k);
if !is_needle(&alias) {
v.short.push((k, alias, format!("plugins.yaml {krate}")));
continue;
}
v.names
.entry(k)
.or_default()
Expand Down Expand Up @@ -780,6 +814,11 @@ pub fn render(measured: &Instances, vocab: &Vocab) -> String {
s.push_str(&format!("vocab\t{k}\t{name}\t{}\n", from.join(" ; ")));
}
}
for (k, name, from) in &vocab.short {
s.push_str(&format!(
"short\t{k}\t{name}\t{from} (under {MIN_NEEDLE_LEN} characters: no needle)\n"
));
}
for ((krate, kind), cell) in measured {
s.push_str(&format!("cell\t{krate}\t{kind}\t{}\n", cell.count));
}
Expand Down Expand Up @@ -1106,6 +1145,75 @@ pub fn selftest<'a>(
],
));

// A ONE-LETTER ALIAS IS NO NEEDLE (row 159, ARCHITECT 2026-10-13), AND A REAL ALIAS STILL IS.
// `plugins.yaml` files the C-built secret plugin as alias `c`; read as a needle, the fixture's
// `extern "C"` ABI string and its one-letter `"c"` key were two `× secret` hits, an
// `unlisted-instance` on a crate that names no plugin. Every alias the live registry gives an
// axis under [`MIN_NEEDLE_LEN`] is planted the same way, and the cell stays at zero: GREEN.
// The same plant plus one comparison against a real registry alias of the same tree (`vault`
// today, read off `plugins.yaml`, never typed here) is that axis's `unlisted-instance`: RED.
let axis_aliases: Vec<(String, String, String)> =
registry_aliases(&cx.read(REGISTRY).unwrap_or_default())
.into_iter()
.filter(|(k, _, _)| axes().contains(&k.as_str()))
.collect();
let mut short_body = String::from(
"pub extern \"C\" fn planted_one() {}\n\
pub fn planted_two(c: &str) -> bool {\n c == \"c\"\n}\n",
);
for (i, (_, alias, _)) in axis_aliases
.iter()
.filter(|(_, a, _)| !is_needle(a))
.enumerate()
{
short_body.push_str(&format!(
"pub const PLANTED_SHORT_{i}: &str = \"{alias}\";\n"
));
}
report.push(prove_rows_green(
cx,
gate,
"`extern \"C\"` and a one-letter `\"c\"` in a neutral crate are no secret instance (an \
alias under three characters is no needle)",
&[ROW_MATRIX],
super::fixture_files(&[("planted_short_alias.rs", short_body.as_str())]),
));
let long = axis_aliases
.iter()
.filter(|(_, a, _)| is_needle(a))
.find(|(k, _, _)| k == "secret")
.or_else(|| axis_aliases.iter().find(|(_, a, _)| is_needle(a)));
match long {
Some((kind, alias, _)) => {
let pick =
format!("pub fn pick(module: &str) -> bool {{\n module == \"{alias}\"\n}}\n");
report.push(prove_rows_red(
cx,
gate,
format!(
"a real `{kind}` registry alias (`{alias}`) still counts beside the planted short \
aliases"
),
&[ROW_MATRIX],
super::fixture_files(&[
("planted_short_alias.rs", short_body.as_str()),
("planted_alias_pick.rs", pick.as_str()),
]),
&[
"unlisted-instance",
&super::fixture_subject(kind),
"planted_alias_pick.rs",
],
));
}
None => report.push(crate::gates::CasePlan::from(super::super::unplantable(
"the instance registry gives an axis an alias of three characters or more",
&[ROW_MATRIX],
&["instance"],
format!("{REGISTRY} files no alias of {MIN_NEEDLE_LEN}+ characters under any axis"),
))),
}

// A CRATE IS NEVER MEASURED AGAINST ITS OWN NAME — the store instance writing its own id is
// the instance, not a neutral crate naming one.
report.push(prove_rows_green(
Expand Down Expand Up @@ -1389,6 +1497,31 @@ mod tests {
assert_eq!(n("crates/k/src/a.yaml", json), 0);
}

#[test]
fn an_alias_under_three_characters_is_no_needle_and_a_longer_one_still_is() {
// RED on predev 5c99befcfa: `c` was a secret needle, so every `extern "C"` and one-letter
// `"c"` in a neutral crate counted as a secret instance.
let registry = "plugins:\n - repo: busbar-secret-c\n kind: secret\n alias: c\n \
crate: busbar-secret-c\n - repo: busbar-secret-vault\n kind: secret\n \
alias: vault\n crate: busbar-secret-vault-plugin\n - repo: \
busbar-secret-env\n kind: secret\n alias: env\n crate: \
busbar-secret-env-plugin\n";
let v = vocabulary(&[], &[], &[], registry);
let secret = v.names.get("secret").expect("the secret axis");
assert!(!secret.contains_key("c"), "{secret:?}");
assert!(secret.contains_key("vault"), "{secret:?}");
assert!(secret.contains_key("env"), "{secret:?}");
assert_eq!(
v.short,
vec![(
"secret",
"c".to_string(),
"plugins.yaml busbar-secret-c".to_string()
)]
);
assert!(render(&Instances::new(), &v).contains("short\tsecret\tc\t"));
}

#[test]
fn kind_words_take_both_numbers() {
assert!(is_kind_word("HOOK", "hooks"));
Expand Down