Repository navigation
row 155 oracle: llm stream_upstream_cut cells and their 1.5.5 goldens (stacked on L1#2 #891 and on #861) - #893
Merged
Merged
Conversation
…te seal (K2-H3) The caller-facing ask-state seal is the plane's own: its crate seals the payload over the host's `sign` (ARCHITECT Q-L3B-ASK). The kernel still carried a dead copy, with AskState, Sealer, Rejected, digest_arguments and the two MAC domains, spelled with the plane token escaped. Nothing called it. Core keeps the spent-approval ledger, DEFAULT_TTL_SECS and nonce. The copy's tests (askstate_tests.rs) go with it, and the signing_secret docs no longer name the deleted sealer. RED: approvals_tests the_kernel_holds_no_plane_named_seal_domain scans the kernel's sources for the escaped plane token and the seal's domain segment.
… 117 -> 116 Deleting the kernel's dead ask-state seal (K2-H3) drained one secret-instance hit from busbar-kernel, leaving a law0-slack finding that raised the kind-isolation:law0 figure 18 -> 19 on both kind-isolation and kind-isolation-ship. Lower the ceiling in the commit that drained it. Proved with busbar-release dev cargo xtask gate kind-isolation and kind-isolation-ship: law0 back to 18 (base figure).
Deleting the kernel's dead ask-state seal (K2-H3) drains four plane hits from busbar-kernel: the two crate::mcp::roots doc links and the two \x6dcp seal domains (the decoded scanner reads them as mcp). The re-armed ledger (#725) pinned the row at predev's 1175, so the drain read as 4 hits of law0 slack (figure 29 -> 33 on kind-isolation and kind-isolation-ship). Not proved on Latchkey: the run budget is spent (RUN_CAP); reasoned from the CI verdict and the deleted source, and the PR's CI is the proof.
The kind-isolation:law0 row this branch arms reported law0-slack busbar-kernel × plane 1169 hit(s) under a ceiling of 1171; the ledger row now sits at the measured value (Law 9). Not proved on Latchkey: the run budget is spent (RUN_CAP), so the PR's CI is the proof.
qa/kind-isolation.toml: two busbar-kernel [[law0]] rows conflicted. - instance:secret: predev lowered it 117 -> 115 (R-FIX3); this branch lowered it by the dead ask-state seal. Merged tree measures 114. - plane: predev lowered it 1175 -> 1173 (#570); this branch lowered it by the seal's two crate::mcp::roots doc links and two \x6dcp domains. Merged tree measures 1169. Both rows are pinned at the merged measure, both reasons kept in the cite (Law 9: the ceiling ratchets down to today's number).
…ed (audit plane-decisions#1, #2) THE DESIGN section 2, the decisions bullet: "a request routes by its model; one configured model and none named is the default (byte-identical); more than one and none named is 400; an unknown model is 404. `upstream_model` rewrites only the top-level model value, by span splice, when it is set and differs; otherwise the body passes through." DECISIONS D8b (BUSBAR-1.6.0.md:4798, :4802) lifts the exactly-one-model mount and adds /model to REQUEST_PTRS. plane-decisions#1: the snapshot claimed POST /v1/systemone only when exactly one model was configured, and arrive routed every request over that one model whatever its body named. Now the claim is published whenever at least one model is configured (none: nothing is claimed, and the kernel's unclaimed-route 404 stands byte for byte), and arrive reads the top-level `model` (driven::route_model): the named model routes ROUTE_DIRECT; one configured and none named is the default; several and none named is a refused arrival at 400; a name no model has is 404; a `model` that is not a string is 400. The refusals render in jev's error shape through the refusal slot. The door keeps every configured model of the latest generation (name -> upstream_model) in place of the single routed name. plane-decisions#2: `decisions.models.<m>.upstream_model` was read nowhere. The routed model's upstream_model is kept on the unit at arrive, and the caller's body bound for the far end has its top-level `model` value alone replaced (driven::spliced) when the two differ; every other byte is the caller's. The jev rig gains a second boot with two models (one with upstream_model) and three checks: models.unnamed-400, models.unknown-404, models.upstream-model; the plane's conformance inputs expect the claim on the two-model refresh. RED: tests/door.rs every_generation_with_a_model_claims_systemone, a_request_routes_by_its_model, upstream_model_is_spliced_into_the_top_level_model (over the door's ABI); src/tests/driven.rs one_or_more_models_mount_the_claim.
…in family decision (audit plane-decisions#4, #5) THE DESIGN section 7, owner money rulings 2026-09-28: "The decisions plane bills one `decision` per successful, settled answer from every provider; its card prices `decision`, `input_tokens` and `output_tokens` (family `decision`, all three required, 0 = free); the hosted provider keeps 1.5.5's `/usage/units` as the decision count (DECISIONS D9, 2026-09-30)." DECISIONS Q1-5 (BUSBAR-1.6.0.md:4780): the usage pointers /usage/units, /usage/input_tokens and /usage/output_tokens are dialect data. Finding 395 is kept (:4690): a usage member present but not a whole count is located, never dropped. plane-decisions#4: the decision count was read with no regard to the status (a 500 carrying /usage/units billed decisions), a success with no count billed no decision at all, and a count that was negative, fractional, a string or past i64::MAX was dropped silently. Now one success rule (FarEndReading::success: a 2xx status and no /error member, a null one being none) gates every count: a non-success bills nothing; a success bills its whole /usage/units, or one decision when it reports none, and its request fee; a usage member that is present but not a whole count fails the far end's last piece (Outcome::Failed, the plane fault the kernel ends the unit on) naming the member, never a silent 0. plane-decisions#5: the tail declared `decision` and the fee unit only. It now declares `input_tokens` and `output_tokens` in family `decision`, appended after the fee unit (the fee keeps index 1), and a success reports each where its answer carries a whole count. The jev rig's cards price both at 0, and the docs' declared-class list names them. RED: tests/door.rs a_success_with_no_count_bills_one_decision, a_non_success_bills_nothing, a_success_with_an_unreadable_count_fails_loudly, the_tokens_a_success_reports_are_billed_in_family_decision (over the door's ABI); src/tests/driven.rs a_success_bills_one_decision_or_the_count_it_reports, a_non_success_bills_nothing, a_usage_member_that_is_not_a_whole_count_fails_loudly, a_success_bills_the_tokens_it_reports, the_tail_names_the_decision_class_at_its_index.
…icted, and an answer is read as it passes (audit plane-decisions#6, #8) THE DESIGN section 11.2 (the shared mechanism): "memory a plugin returns is plugin-owned and valid until that plugin's next refresh generation; no allocation and no blocking on the hot path". And section 7: a settled success's count is billed, so a live unit's reading must not be lost. plane-decisions#6: arrive kept state for every claimed unit, but only a unit's last far-end piece removed it: a refused unit (rate limit, budget, grant) or a cancelled one stayed until eviction, and past 4096 the smallest key was popped, which in steady state was a live unit (its ATTEMPT or its reading lost, so its body was held or its count unbilled). `cancel` dropped nothing and answered CANCEL_ABORTED even after far-end bytes were relayed. Now `refusal` drops its unit (RefusalIn.unit); each piece records its ticket and `cancel` drops the unit on the cancelled ticket, answering CANCEL_ABORTED before the far end answered and CANCEL_OK_PARTIAL after; at MAX_UNITS a new arrival is refused at 503 about the entry it routed over (the ABI's refused-arrival rule 6, before anything is charged) and no live unit is dropped. A unit that arrived and never crossed a piece while MAX_UNITS arrivals followed is reclaimed, so an arrival the kernel never started cannot leave the instance refusing every arrival for good. plane-decisions#8: every far-end piece was appended to a growing whole-answer buffer (no bound) and copied again into the unit's owed bytes before it was written; the caller's fields were a vector of vectors per arrival. Now the answer is read as it passes (FarEndReading scans the JSON structure in fixed space for /error and the three /usage counts, wherever the pieces split it), a piece is written straight into the host's reply buffer and only what does not fit is kept for the `more` re-calls, and the caller's relayed fields are one buffer sized once per unit. Nothing caps the answer's size (#41: never a size-based refusal). RED: tests/door.rs a_refused_unit_is_dropped_and_a_live_unit_kept, a_cancelled_unit_is_dropped_and_a_live_unit_kept, a_unit_cancelled_after_its_far_end_answered_is_cut_partway, past_the_cap_an_arrival_is_refused_and_no_live_unit_dropped (over the door's ABI); tests/door_alloc.rs relaying_an_answer_piece_by_piece_allocates_nothing; src/tests/driven.rs the_reading_is_the_pointers_reading_wherever_the_pieces_split.
…execution.states (audit plane-decisions#3) THE DESIGN section 2, the decisions bullet: "a second dialect exists only where a provider's request spine really differs (NanoJev is the one, dialect `nanojev`: `/api/evaluate` is its second exact claim; a model's dialect is its override or its provider's protocol; a model of the wrong dialect gets that dialect's existing unknown-model refusal; it meters the upstream's own billing unit, counted from the answer already read (`execution.states`; an answer with no count refuses loudly; `$`, alone), with no extra egress". DECISIONS (BUSBAR-1.6.0.md:4960): "Plane gets its referenced providers' dialect fields at open (PlaneOpenIn list ...); the plane resolves model->dialect and selects itself; no kernel dialect check." :4987: "NanoJev unreadable count = same outcome as item 395 /usage/units". plane-decisions#3: the plane spoke `jev` alone, claimed POST /v1/systemone alone, and refused any other protocol. Now the tail states two dialects (`jev`, `nanojev`, each reached as a bearer), two op classes (`systemone`, `evaluate`) and two exact claims; a generation publishes each dialect's claim when it configures a model of that dialect, wearing that dialect for a refusal before arrive. Each model's dialect is its own `protocol`, else its provider's as the host states it at open (PlaneOpenIn::providers, kept for every refresh), `jev` for a provider the host states none for; a dialect the plane does not speak fails closed at validate, open and refresh, naming the two it does. A request routes among the models of its claim's dialect, so a model of the other dialect is that dialect's unknown model (404), and one model of the dialect is its default. A nanojev unit is sent to POST /api/evaluate, and its answer is read by its dialect's count: `/execution/states` is the decision count, and a success with no count, or one that is not a whole count, fails the unit loudly; jev's /usage members are not read on it. The PII pointer test reads each declared pointer by its segments: `/execution/states` passes through no `state` member. The jev rig gains a third boot (a nanojev provider and model beside the jev one) and three checks: nanojev.served, nanojev.wrong-dialect-404, nanojev.no-count-refused; the extra boots share one leg helper; the registry plan names what the rig serves (registry.toml and manifest.json). The binary's dialect probe in tests/cli_validate.rs reads the two dialects the decisions plane now states. RED: tests/nanojev.rs evaluate_is_claimed_with_a_nanojev_model, a_model_of_the_wrong_dialect_is_an_unknown_model, a_nanojev_unit_is_sent_to_evaluate_and_bills_its_states, an_unspoken_protocol_is_refused_at_validate (over the door's ABI); src/tests/driven.rs a_nanojev_answer_bills_its_execution_states, a_model_of_the_other_dialect_is_this_dialects_unknown_model; src/tests/plane_door.rs each_dialects_claim_is_published_with_a_model_of_it, a_models_dialect_is_its_override_or_its_providers_protocol; crates/busbar/tests/cli_validate.rs validate_ok_on_a_decisions_config_in_the_second_dialect (the binary).
…ernel plane ceiling 1172 -> 1168 (this PR's dead ask-state seal deletion, on predev's 1172)
decisions plane: the nanojev dialect (Q128 finding 3, row 128)
no-silent-skip sweep (status row 114): scrape-sink test gated on its feature
flake (row 160): ledger_identity waits for the admin door before minting
money row 123: a served unit's declared class counts reach its plane's metering row (kernel guard for h2-class-price)
…e 1.5.5 binary Copied unchanged from busbar-release oracle-rerecord run 38471635786 (golden-1.5.5-added artifact): the cell file, its ledger row, and meta.json (recorded 1015 -> 1016). The run added this cell alone (golden-add: 1 new cell, 78 not owed and skipped).
…ease main, carries #348) The judge whose corpus generator adds billing|budget|downgrade; sha256 per architecture from dev-bin's busbar-oracle-linux-{x86_64,aarch64}-db64d9218d8b .sha256 assets.
…ng dialects (status row 155, #62) The cells.json rows of busbar-release #352 (merged into dev at babfdf08bf) at their sorted places (2519 -> 2525; llm +6, llm.wire +6), and their owed-baseline rows, so golden-add records them from the published 1.5.5. Stacked on lane-oracle-budget-downgrade (#861).
…orded from the 1.5.5 binary Copied unchanged from busbar-release oracle-rerecord run 38488778377 (dev babfdf08bf, ref lane-oracle-stream-cut@02ab58f4dd; artifact golden-1.5.5-added): six cell files, their six ledger rows and meta.json (recorded 1016 -> 1022). Add-only: golden-add recorded these six and nothing else (78 not owed and skipped); no existing golden byte changes. 1.5.5 billed no tokens on a cut for anthropic, bedrock, cohere, openai and responses; gemini's first frame states its usage and billed 18.
…iverging (anthropic's stated input billed)
…erbatim (ARCHITECT: the signed difference cites #62 and l.2252)
…ease main, carries #352's stream_upstream_cut cells)
MattJackson
marked this pull request as ready for review
October 14, 2026 01:03
MattJackson
marked this pull request as draft
October 14, 2026 03:36
This was referenced Oct 14, 2026
Merged
MattJackson
added a commit
that referenced
this pull request
Oct 14, 2026
…372: the nine fixture-backed llm cells as <old id>@fixture) Digests are dev-bin's busbar-oracle-linux-{x86_64,aarch64}-4c47cad0385d .sha256 assets; each asset's .sig (and the macos-aarch64 one) verifies, Ed25519 over "<asset>\n<sha256>\n", against .github/release-key.pub.pem. cells --check with that engine: the nine @fixture cells are byte-equal to the generator; the only drift is the 7 cells #861 and #893 add.
MattJackson
added a commit
that referenced
this pull request
Oct 14, 2026
… plugins.fetch download-cap cells)
Digests are dev-bin's busbar-oracle-linux-{x86_64,aarch64}-f6c22cb4160c .sha256 assets; each .sig
(and the macos-aarch64 one) verifies, Ed25519 over "<asset>\n<sha256>\n", against
.github/release-key.pub.pem. cells --check with that engine: the two new cells are byte-equal to the
generator; the only drift is the 7 cells #861 and #893 add.
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…eld; clippy; the six Law 0 cells the merge grew; config-schema snapshot - busbar-core-connector dialled.rs (#837 over #893's Piece): the datagram leg's body piece states `fault: None` and `declared_len: None` (E0063). - busbar-kernel appbuild: build_app_from_config takes the root's rules as an eighth input (#1001); allowed too_many_arguments with that reason. plugin-loader secret_disk_tests: let-else for the refused declare (clippy err_expect). - Law 0 growth over the merge-base (gates log of 3598829 and the group measures): kernel x plane: the failover predicate's docs and test say verdict, not decision (#890); kernel x instance:secret: the two new SecretRef literals key on SECRET_MODULE_ENV (#863/#864); kernel x auth: the resolved provider's and the token endpoint's docs name the client-credentials style without spelling the module (#957, #876); connector x transport: spawn_env's doc says program members (#865); contract x plane: section.rs's trust_from doc names a plane's push trust (#1001); busbar x vendor: the health-probe cell's catalog entry is testing/root-fixtures data (#1039); busbar x instance:secret: the pinned-cells selftest builds its fixture citing the pinned file rather than re-keying it (#1006). - config-schema: the RAW carrier records each section as the map's value type; the snapshot gains DeployCfg.agent_push (serde_yaml::Value, #1001), ProviderLaneCaps (its Deserialize, round 2) and the `type ProviderTable` alias (#957). - qa/scripts-allowlist.toml: the three twilio conformance legs (#998), oracle-driver like their siblings.
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…onns wrapper follow the merged shapes From the full logs of 2382599: - root door_steps PresentingConns: bind_auth/auth_of take and hand on the registration `member` (the connector's per-member binding, DeclaredConns; E0050/E0061 x2 each). - root tests: the datagram cell's Got states fault/declared_len/end (#893 over #837); the two upgrade-row builds take the settings alone (HostWire build, #932 over #997); the two userinfo cells hand provider_routes a ResolvedProvider (#957 over #876/#936). - tests/plane_blackbox.rs: the step's (key, text) pairs are a type (clippy type_complexity). - config-schema snapshot: `type WakeTicket` is now an alias of ConnWake (#1018), recorded. - Law 0: busbar x instance:export 25 -> 24 (measure); kernel x plane: a test doc names a plane's own webhooks section, not the llm plane's (1050 measured against w2's 1049).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Row 155. This is the oracle half of L1#2 (#62).
llm|<d>|<d>|request|stream_upstream_cut, from busbar-release plane-llm: no substitution on the translate seam (Bedrock image never relabelled png, Gemini 'model decides' never sent as medium; wrong-typed input is the caller's 400) (DF-SITES 1/2) #352 (merged into dev at babfdf08bf), plus their owed-baseline rows.expected_cells: 1. Anthropic's first event states 11 input tokens: 1.6.0 bills them and 1.5.5 billed none. The other five dialects state no usage before the cut. Gemini's first frame states its whole usage, and 1.5.5 billed that too.Stacking: this sits on #891 (L1#2), so the cells land with the fix and never turn predev's oracle red. It also sits on #861 (lane-oracle-budget-downgrade), so the diff includes #861 until #861 lands.
It stays DRAFT until
oracle-rust.pinmoves to the busbar-release main ref that carries #352. That promotion is running, and the coordinator will send the ref and the asset hashes.