Repository navigation
row 166 PR1: secret resolve takes a config-time proof (ConfigScope) and the config-scope gate - #863
Merged
Merged
Conversation
…act, the *_at_config forms, every boot/apply/refresh/pre-flight/validate resolve switched, and the config-scope gate holds each construction to its (file, fn) allow-list THE DESIGN §11.11 R4 as the OWNER amended it (2026-10-13): the disk lane serves the secret kind's file source only at config time, never from a request path. This is PR1 of row 166 (design B): - busbar-contract: config_time::ConfigScope, a private-field, non-Copy, non-Default proof made only by ConfigScope::config_time(); SecretResolve and SecretCalls gain resolve_at_config (and resolve_string_at_config) defaulting to the request-path forms, so every source that does not read the disk answers byte-identically. - busbar-kernel: SecretResolver threads the proof to the linked axis; resolve_settings takes it; appbuild, auth chain load, hook settings, pre-flight, config_validate and tls read_pem pass it. - busbar root: a door plane's member credentials and token-exchange subject resolve with it. - xtask gate config-scope: every ConfigScope construction sits in an allowed (file, fn); every allowance names a live construction. Selftest REDs: a request-path construction, an aliased one, an allowed file's other fn, an unused allowance; a comment, literal or cfg(test) is green. - tests: resolve_settings asks through the config-time form (a resolver refusing the request-path form answers); the kernel resolver answers a built-in identically through both forms.
This was referenced Oct 13, 2026
Merged
Collaborator
Author
|
FYI (queue rule 20): $ draft #870 also edits crates/busbar-kernel/src/config_validate/{mod.rs:1553 rate-refusal message, tests/tests.rs:4178-4216 rate test}; hunks are disjoint from yours and merge clean. |
This was referenced Oct 14, 2026
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…eld; clippy; the six Law 0 cells the merge grew; config-schema snapshot - busbar-core-connector dialled.rs (#837 over #893's Piece): the datagram leg's body piece states `fault: None` and `declared_len: None` (E0063). - busbar-kernel appbuild: build_app_from_config takes the root's rules as an eighth input (#1001); allowed too_many_arguments with that reason. plugin-loader secret_disk_tests: let-else for the refused declare (clippy err_expect). - Law 0 growth over the merge-base (gates log of 3598829 and the group measures): kernel x plane: the failover predicate's docs and test say verdict, not decision (#890); kernel x instance:secret: the two new SecretRef literals key on SECRET_MODULE_ENV (#863/#864); kernel x auth: the resolved provider's and the token endpoint's docs name the client-credentials style without spelling the module (#957, #876); connector x transport: spawn_env's doc says program members (#865); contract x plane: section.rs's trust_from doc names a plane's push trust (#1001); busbar x vendor: the health-probe cell's catalog entry is testing/root-fixtures data (#1039); busbar x instance:secret: the pinned-cells selftest builds its fixture citing the pinned file rather than re-keying it (#1006). - config-schema: the RAW carrier records each section as the map's value type; the snapshot gains DeployCfg.agent_push (serde_yaml::Value, #1001), ProviderLaneCaps (its Deserialize, round 2) and the `type ProviderTable` alias (#957). - qa/scripts-allowlist.toml: the three twilio conformance legs (#998), oracle-driver like their siblings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Row 166, design B, PR1 (THE DESIGN §11.11 R4 as the OWNER amended it 2026-10-13: the secret kind's file source runs on the disk lane only at config time, never on a request path).
busbar-contract::config_time::ConfigScope: private field, not Copy, not Default; made only byConfigScope::config_time().SecretResolve/SecretCallsgainresolve_at_config(andresolve_string_at_config) defaulting to the request-path forms, so every source that does not read the disk answers byte-identically.SecretResolverthreads the proof to the linked axis;resolve_settingstakes it; appbuild, auth chain load, hook settings, pre-flight, config_validate and tlsread_pempass it. Root: door member credentials and the token-exchange subject pass it. Contended files (appbuild.rs, door_steps.rs) carry call-site hunks only.cargo xtask gate config-scope: every construction sits in an allowed (file, fn); every allowance names a live construction. Selftest REDs: request-path construction, aliased construction, allowed file but other fn, unused allowance. A comment, literal or cfg(test) construction stays green.settings_resolve_through_the_config_time_form_with_the_proof(RED ifresolve_settingsgoes back toresolve_string),the_kernel_resolver_answers_the_same_at_config_time_for_a_built_in.PR2 (the disk-need fact, the refused request-path resolve, the DiskLane job, REDs a-e, PerHop::refresh) builds on this.