Repository navigation
row 166 PR2a: a disk-declared secret source resolves on the one disk lane at config time only - #864
Merged
Merged
Conversation
…disk lane at config time only, and is refused on a request path THE DESIGN §11.11 R4 as the OWNER amended it (2026-10-13), row 166 PR2a (design B), on #863: - plugin-loader: declares.disk (left off the wire when false), refused at phase 1 on any kind but secret; Candidate carries it (a dropped-in manifest's, or a linked row's through the new linked-declares conduit, SecretRows::declare_linked). LoadedSecret is split by it: a disk source's resolve is refused (DENIED, RESOLVE_OFF_CONFIG_TIME); its resolve_at_config runs the plugin's resolve ticket-less on the lane thread through the host's DiskRun hook, the caller waiting with its own bound; no lane wired refuses every resolve. A source with no disk need is unchanged. - busbar-kernel: DiskLane runs a generic job in order with the appends (a panicking job never ends the lane); KernelServices takes the process's one lane (with_disk_lane). OpenedSecrets and the dropped-in resolver carry the caller's proof (with_scoped_plugin), opening the plugin's own references at config time too. - busbar root: the process's one disk lane, shared by the kernel's services and the secret axis; LINKED.secret_declares generated from [package.metadata.busbar.linked-declares]. - REDs: (a) request-path refused, linked and dropped in; (b) the config-time resolve runs as one lane job, and a lane job runs on the lane thread; (c)/(e) no disk need answers byte-identically and never reaches the lane; (d) a full or dropping lane answers at once; an unwired host refuses; a non-secret kind declaring disk is refused; OpenedSecrets hands the proof through.
This was referenced Oct 13, 2026
Merged
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
… from the gates log of 80d5f03 - hooks parity (#989): the v1.5.5 hook corpus moves out of the kernel's source into testing/hook-parity/v1.5.5-hook-corpus.tsv, read by the count test; its origins are `proxy`/`core` and the constants PROXY_ORIGIN/CORE_ORIGIN (gate hook-parity-count reads them). The listing named plane, hook and export instances in a neutral crate: kernel x plane +84, x hooks +18, and the instance-noun-neutrality llm census. - config-schema: a section a plane owns beside its declaring one is the endpoint DOOR only for the plane the kernel names its owner (EndpointSection::OWNER); any other is RAW, carried by DeployCfg::plane_raw, as the pre-pass lifts it since #966 (a2a's agent_push, #1001). Selftest: two doors under the owner stay RED; a non-owner's beside section is carried. - reachability: serve_datagram.rs is the module `serve_datagram`, named for its file like serve_framed. - teller-steps / libtest_path: door cells are read off the linked rows on the plane-door axis, the rows build.rs mounts since #1006 deleted [package.metadata.busbar.door-cells]. - plane-purity dialect / neutral-no-dialect: LegacyLaneKeys flattens ProviderLaneCaps rather than spelling its fields (#957). - structure-lint: stand_in.rs's inline tests move to tests/stand_in_tests.rs (#1010). - config-scope: auth/mod.rs's test-idp-module arm is braced like its sibling, so the scanner sees the `new` construction in the arm after it. - instance-noun-neutrality mcp: the a2a client cell's rationale (and its capability-equality row) names no other plane. - hold-escapes: host_disk.rs::start (#864's disk lane job loop) is a reviewed known site. - hook-parity-count: the TODO's M4 row reads 181. - design-bindings: PB-50's config.migrate family is 158 cells (#1026 added two). - kind-isolation law0: busbar auth 24, instance:auth 10, instance:export 25, plane 525, transport 97 are the merged tree's measure (#1038's figures were T+O-B over a virtual base carrying #993, #1017, #1020, which w2 does not carry); busbar-contract export 1 -> 0 and transport 226 -> 225 (slack).
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…eld; clippy; the six Law 0 cells the merge grew; config-schema snapshot - busbar-core-connector dialled.rs (#837 over #893's Piece): the datagram leg's body piece states `fault: None` and `declared_len: None` (E0063). - busbar-kernel appbuild: build_app_from_config takes the root's rules as an eighth input (#1001); allowed too_many_arguments with that reason. plugin-loader secret_disk_tests: let-else for the refused declare (clippy err_expect). - Law 0 growth over the merge-base (gates log of 3598829 and the group measures): kernel x plane: the failover predicate's docs and test say verdict, not decision (#890); kernel x instance:secret: the two new SecretRef literals key on SECRET_MODULE_ENV (#863/#864); kernel x auth: the resolved provider's and the token endpoint's docs name the client-credentials style without spelling the module (#957, #876); connector x transport: spawn_env's doc says program members (#865); contract x plane: section.rs's trust_from doc names a plane's push trust (#1001); busbar x vendor: the health-probe cell's catalog entry is testing/root-fixtures data (#1039); busbar x instance:secret: the pinned-cells selftest builds its fixture citing the pinned file rather than re-keying it (#1006). - config-schema: the RAW carrier records each section as the map's value type; the snapshot gains DeployCfg.agent_push (serde_yaml::Value, #1001), ProviderLaneCaps (its Deserialize, round 2) and the `type ProviderTable` alias (#957). - qa/scripts-allowlist.toml: the three twilio conformance legs (#998), oracle-driver like their siblings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #863. Row 166 design B, PR2a (THE DESIGN §11.11 R4 as the OWNER amended it 2026-10-13).
declares.disk(off the wire when false; refused at phase 1 on any kind but secret). Carried onCandidatefrom a dropped-in manifest, or from a linked row through the new linked-declares conduit (LINKED.secret_declares->SecretRows::declare_linked).resolveis refused (DENIED,RESOLVE_OFF_CONFIG_TIME), andresolve_at_configruns the plugin's resolve ticket-less on the lane thread through the host'sDiskRunhook, the caller waiting with its own bound. A host with no lane refuses. A source with no disk need is unchanged.DiskLane::run(job)runs in order with the appends, and a panicking job never ends the lane.KernelServices::with_disk_lane: the root hands its ONE lane to both the services and the secret axis.OpenedSecretsand the dropped-in resolver carry the caller's proof (with_scoped_plugin).busbar-disk-lane; (c)/(e) no disk need answers byte-identically and never reaches the lane; (d) a full or dropping lane answers at once. Also: an unwired host refuses; a non-secret kind declaring disk is refused;OpenedSecretshands the proof through.No behaviour changes until PR3 declares busbar-secret-file's disk need. PR3 lands only after PR2b (the stdio member spawn-env cache).