From 7dfde7a02d108ded1de78ddec02fcc473ea67ce0 Mon Sep 17 00:00:00 2001 From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com> Date: Tue, 13 Oct 2026 19:42:10 -0700 Subject: [PATCH 1/7] row 155 F25 REHOME: the misc non-money rows on their 1.6 homes Ports coverage-map-v2 REHOME rows to the served plane door and the composition root, each test under its legacy name with the figures the map records and a RED line: plane-llm: alloc_gate (39, 40), exchange_shaping (43), plane_door (98, 99, 100, 375, 643), exchange_probe (220, 230), exchange_user_agent (325), refusal_envelopes (330, 682). root: egress_ports (44, 45, 46, 47, 542, 612), declared_credentials (73), linked_auth (402), door_steps (463), policy (603), docs_examples (101), metrics_scrape_boot_window (137), metrics_routes_across_export_reload (138), metrics_cross_plane (604). Tests only; not run locally. --- crates/busbar-plane-llm/tests/alloc_gate.rs | 135 ++++++++ .../busbar-plane-llm/tests/exchange_probe.rs | 90 +++++ .../tests/exchange_shaping.rs | 51 +++ .../tests/exchange_user_agent.rs | 104 ++++++ crates/busbar-plane-llm/tests/plane_door.rs | 162 +++++++++ .../tests/refusal_envelopes.rs | 204 +++++++++++ .../src/root/tests/declared_credentials.rs | 58 ++++ crates/busbar/src/root/tests/door_steps.rs | 44 +++ crates/busbar/src/root/tests/egress_ports.rs | 321 ++++++++++++++++++ crates/busbar/src/root/tests/linked_auth.rs | 126 +++++++ crates/busbar/src/root/tests/policy.rs | 58 ++++ crates/busbar/tests/docs_examples.rs | 74 ++++ crates/busbar/tests/metrics_cross_plane.rs | 66 ++++ .../metrics_routes_across_export_reload.rs | 93 +++++ .../tests/metrics_scrape_boot_window.rs | 69 +++- 15 files changed, 1654 insertions(+), 1 deletion(-) diff --git a/crates/busbar-plane-llm/tests/alloc_gate.rs b/crates/busbar-plane-llm/tests/alloc_gate.rs index 73f13612f9..4be3fa0ed5 100644 --- a/crates/busbar-plane-llm/tests/alloc_gate.rs +++ b/crates/busbar-plane-llm/tests/alloc_gate.rs @@ -144,3 +144,138 @@ fn same_dialect_relay_does_not_reparse_the_request() { work on a document it is about to send back unchanged" ); } + +// ── F25 REHOME: the whole forward the served door runs, bounded (coverage map v2) ───────────────── + +/// The generation the served door holds: one openai far end, under a pool that names it. +fn served_generation() -> busbar_plane_llm::exchange::shaping::Shaping { + busbar_plane_llm::exchange::shaping::Shaping::from_settings(&serde_json::json!({ + "providers": { "oai": { "protocol": "openai", "base_url": "https://openai.invalid" } }, + "models": { "gpt-4o": { "provider": "oai" } }, + "pools": { "p": { "members": ["gpt-4o"] } } + })) + .expect("a well-formed generation reads") +} + +/// A canned far-end chat completion (the 1.5.5 gate's upstream answer). +const FAR_OK: &[u8] = br#"{"id":"chatcmpl-gate","object":"chat.completion","created":0,"model":"gpt-4o","choices":[{"index":0,"message":{"role":"assistant","content":"ok"},"finish_reason":"stop"}],"usage":{"prompt_tokens":1,"completion_tokens":1,"total_tokens":2}}"#; + +/// ONE served forward, as the plane's door runs it for a unit: the arrival read off the caller's +/// head and body, the far-end request the attempt writes for the member, and the far end's whole +/// answer relayed back to the caller. Answers the caller's status. +fn one_forward(shaping: &busbar_plane_llm::exchange::shaping::Shaping, body: &[u8]) -> u16 { + use busbar_plane_llm::exchange::attempt::{build, stream_intent}; + use busbar_plane_llm::exchange::reply::{At, Reply, ReplyCtx}; + use busbar_plane_llm::exchange::{arrive::arrive, handler_of}; + let caller: &[(&[u8], &[u8])] = &[(b"content-type", b"application/json")]; + let arrived = arrive("POST", "/v1/chat/completions", caller, body, shaping) + .expect("the caller's request arrives"); + let far = build(&arrived, caller, shaping, "p", "gpt-4o").expect("the attempt is written"); + assert!(!far.body.is_empty(), "the far end is sent a body"); + let lane = shaping.lane("gpt-4o").expect("the member's lane"); + let ctx = ReplyCtx { + arrived: &arrived, + lane, + intent: handler_of(&arrived) + .map(|h| stream_intent(h, arrived.parsed.as_ref())) + .unwrap_or_default(), + passthrough: false, + }; + let head: &[(&[u8], &[u8])] = &[(b"content-type", b"application/json")]; + let mut reply = Reply::new(&ctx, 200, head); + let at = At { + now_s: 1_752_000_000, + elapsed_ms: Some(1), + }; + let piece = reply.feed(&ctx, FAR_OK, true, at); + assert!(piece.done, "a whole answer ends on its last piece"); + piece.head.map_or(0, |h| h.status) +} + +/// COMMITTED BOUND (1.5.5's `FORWARD_PASSTHROUGH_MAX_ALLOCS`): the most allocations ONE warmed +/// openai>openai passthrough forward may make, measured as the minimum over several iterations. +const FORWARD_PASSTHROUGH_MAX_ALLOCS: u64 = 107; + +/// LEGACY `crates/busbar-llm/src/engine/tests/alloc_gate_tests.rs::alloc_gate_openai_passthrough_forward` +/// (coverage map v2 row 39). 1.5.5: one warmed, steady-state openai->openai chat forward through the +/// served path (the arrival, the far-end exchange and the relay of the answer, 200 each) allocates +/// at most 107 times, the minimum over the measured iterations. +/// +/// RED: a new per-request allocation on the served forward (a builder per send, a codec boxed per +/// call, a scaling allocation) pushes the warmed minimum over 107. +#[test] +fn alloc_gate_openai_passthrough_forward() { + let shaping = served_generation(); + let body = br#"{"model":"p","messages":[{"role":"user","content":"hi"}],"max_tokens":16}"#; + // WARM UP: first-touch statics are per process, not per request. + assert_eq!(one_forward(&shaping, body), 200, "passthrough must be 200"); + let mut min_allocs = u64::MAX; + for _ in 0..4 { + let mut status = 0; + let count = allocations_of(|| status = one_forward(&shaping, body)); + assert_eq!(status, 200, "passthrough must be 200"); + min_allocs = min_allocs.min(count); + } + println!("served forward openai>openai steady-state min allocations = {min_allocs}"); + assert!( + min_allocs <= FORWARD_PASSTHROUGH_MAX_ALLOCS, + "OPENAI>OPENAI FORWARD-PATH ALLOCATION COUNT REGRESSED: measured {min_allocs} > committed \ + bound {FORWARD_PASSTHROUGH_MAX_ALLOCS}. A new per-request allocation on the forward path \ + (or a scaling one) pushed it over." + ); +} + +/// How many `messages` entries the large body carries (1.5.5's `ECHO_SCALING_MESSAGES`). +const ECHO_SCALING_MESSAGES: usize = 4_000; + +/// COMMITTED BOUND (1.5.5's `ECHO_BODY_SCALING_MAX_ALLOCS`): how many more allocations a request of +/// [`ECHO_SCALING_MESSAGES`] messages may cost than the same request with one, on the buffered +/// delivery arm (the caller asked to stream, the far end answered one body). +const ECHO_BODY_SCALING_MAX_ALLOCS: u64 = 92_000; + +/// An openai chat request with `n` messages, asking to STREAM. +fn openai_stream_body(n: usize) -> Vec { + let messages: Vec = (0..n) + .map(|i| serde_json::json!({ "role": "user", "content": format!("message {i}") })) + .collect(); + serde_json::to_vec(&serde_json::json!({ + "model": "p", + "messages": messages, + "max_tokens": 16, + "stream": true, + })) + .expect("serializes") +} + +/// LEGACY `crates/busbar-llm/src/engine/tests/alloc_gate_tests.rs::alloc_gate_request_echo_body_materialized_once` +/// (coverage map v2 row 40). 1.5.5: on the buffered delivery arm (an openai caller asking to +/// stream, answered one JSON body, 200 each), a body of 4000 messages costs at most 92000 +/// allocations more than the same body with one: the client-chosen node count multiplies no added +/// per-node wave (the deep clone of the parsed request it once paid). +/// +/// RED: the served forward gains a whole-body materialization (a second parse, a deep clone of the +/// request) whose cost scales with the caller's message count past the 92000 delta. +#[test] +fn alloc_gate_request_echo_body_materialized_once() { + let shaping = served_generation(); + let small_body = openai_stream_body(1); + let large_body = openai_stream_body(ECHO_SCALING_MESSAGES); + // WARM both shapes outside the measured window. + assert_eq!(one_forward(&shaping, &small_body), 200); + assert_eq!(one_forward(&shaping, &large_body), 200); + let mut status = (0, 0); + let small = allocations_of(|| status.0 = one_forward(&shaping, &small_body)); + let large = allocations_of(|| status.1 = one_forward(&shaping, &large_body)); + assert_eq!(status, (200, 200), "the arm under test must be 200"); + let delta = large.saturating_sub(small); + println!( + "buffered delivery arm: small={small} large={large} delta={delta} over \ + {ECHO_SCALING_MESSAGES} messages" + ); + assert!( + delta <= ECHO_BODY_SCALING_MAX_ALLOCS, + "THE BUFFERED DELIVERY ARM GAINED A PER-NODE ALLOCATION WAVE: a body with \ + {ECHO_SCALING_MESSAGES} messages cost {delta} allocations more than a one-message body, \ + over the committed bound {ECHO_BODY_SCALING_MAX_ALLOCS}." + ); +} diff --git a/crates/busbar-plane-llm/tests/exchange_probe.rs b/crates/busbar-plane-llm/tests/exchange_probe.rs index 7bf6145a96..c1e9b4da39 100644 --- a/crates/busbar-plane-llm/tests/exchange_probe.rs +++ b/crates/busbar-plane-llm/tests/exchange_probe.rs @@ -62,3 +62,93 @@ fn a_lane_under_a_path_base_is_not_probed_and_a_fixed_path_is_kept() { "/fixed/chat" ); } + +/// The value of the head field `name` on `r`. +fn field_value<'a>(r: &'a busbar_plane_llm::exchange::attempt::FarRequest, name: &str) -> &'a [u8] { + r.fields + .iter() + .find(|(n, _)| n.eq_ignore_ascii_case(name)) + .map(|(_, v)| v.as_slice()) + .unwrap_or_else(|| panic!("the request carries `{name}`")) +} + +/// LEGACY `crates/busbar-llm/src/engine/tests/health_tests.rs::test_probe_sends_native_user_agent_and_accept_headers` +/// (coverage map v2 row 220). 1.5.5: an active probe of an anthropic lane sends the SAME native-SDK +/// fingerprint organic traffic sends: `user-agent: Anthropic/Python 0.39.0` and the non-streaming +/// `accept: application/json`, so a far end cannot tell busbar's probes from its clients. +/// +/// RED: the probe's `user-agent` or `accept` value differs from the one an organic (UA-less, +/// non-streaming) anthropic request carries, or either moves off the pinned literal. +#[test] +fn test_probe_sends_native_user_agent_and_accept_headers() { + use busbar_plane_llm::exchange::arrive::arrive; + use busbar_plane_llm::exchange::attempt::build; + let s = Shaping::from_settings(&json!({ + "providers": { "ant": { "protocol": "anthropic", "base_url": "https://b" } }, + "models": { "claude": { "provider": "ant" } }, + "pools": { "p": { "members": ["claude"] } } + })) + .expect("reads"); + let lane = s.lane("claude").expect("lane"); + let probe = request(lane).expect("probed"); + + // Organic traffic on the same lane: a native caller that sent no user-agent, not streaming. + let head: Vec<(&[u8], &[u8])> = + vec![(b"content-type".as_slice(), b"application/json".as_slice())]; + let body = br#"{"model":"claude","max_tokens":5,"messages":[{"role":"user","content":"hi"}]}"#; + let arrived = arrive("POST", "/v1/messages", &head, body, &()).expect("arrives"); + let organic = build(&arrived, &head, &s, "p", "claude").expect("built"); + + assert_eq!( + field_value(&probe, "user-agent"), + field_value(&organic, "user-agent"), + "probe must send the native User-Agent organic traffic sends" + ); + assert_eq!( + field_value(&probe, "user-agent"), + b"Anthropic/Python 0.39.0" + ); + assert_eq!( + field_value(&probe, "accept"), + field_value(&organic, "accept"), + "probe must send the native Accept organic traffic sends" + ); + assert_eq!(field_value(&probe, "accept"), b"application/json"); +} + +/// LEGACY `crates/busbar-llm/src/engine/tests/health_tests.rs::test_probe_signs_and_sends_same_encoded_path_for_reserved_chars` +/// (coverage map v2 row 230). 1.5.5: a probe of a bedrock model id carrying a reserved `:` sends +/// the `%3A`-encoded path, never the raw `:0/converse`, and the signature's canonical path is +/// computed from that SAME wire path, so the signed and sent paths cannot diverge +/// (`SignatureDoesNotMatch` would park every such lane dead). +/// +/// RED: the raw colon reaches the wire, the probe sends a path other than the one the signature +/// is computed from, or the canonical path stops being the wire path's own encoding. +#[test] +fn test_probe_signs_and_sends_same_encoded_path_for_reserved_chars() { + use busbar_plane_llm::exchange::attempt::{uri_encode_path, wire_and_canonical_path}; + let s = shaping(); + let lane = s.lane("bed").expect("lane"); + let probe = request(lane).expect("probed"); + let (wire_path, canonical) = wire_and_canonical_path(&probe_path(lane)); + assert!( + probe.target.contains("%3A"), + "Bedrock modelId ':' must be percent-encoded on the wire path: {}", + probe.target + ); + assert!( + !probe.target.contains(":0/converse"), + "the raw ':' must NOT survive on the wire path (would diverge from the signed URI): {}", + probe.target + ); + assert_eq!( + probe.target, wire_path, + "the probe sends exactly the wire path the signature is computed from" + ); + assert_eq!( + canonical, + uri_encode_path(&wire_path), + "the signed canonical path is the transmitted wire path's own encoding (signed == sent)" + ); + assert_eq!(probe.target, "/model/anthropic.claude-3%3A0/converse"); +} diff --git a/crates/busbar-plane-llm/tests/exchange_shaping.rs b/crates/busbar-plane-llm/tests/exchange_shaping.rs index 260a41726c..6cf8f2a34c 100644 --- a/crates/busbar-plane-llm/tests/exchange_shaping.rs +++ b/crates/busbar-plane-llm/tests/exchange_shaping.rs @@ -112,3 +112,54 @@ fn the_glob_takes_prefix_suffix_and_middle_wildcards() { assert!(!glob_match("a*c*e", "abde")); assert!(glob_match("exact", "exact") && !glob_match("exact", "exactly")); } + +/// LEGACY `crates/busbar-llm/src/engine/tests/attempt_timeout_precedence_tests.rs::effective_reasoning_member_override_wins` +/// (coverage map v2 row 43). 1.5.5: the pool member's `reasoning` override wins over the model's +/// flag in both directions (true over false AND false over true); a member with no override +/// inherits the model's flag, true or false; a pool or member with no candidate row uses the +/// model's flag. +/// +/// RED: a member's `reasoning: false` stops beating a model's `reasoning: true` (the arm the +/// neighbouring test never drives), or a route with no member row stops reading the model's flag. +#[test] +fn effective_reasoning_member_override_wins() { + let mut v = settings(); + // `claude` states `reasoning: true` at the model level; `quiet` turns it off in its pool only. + v["pools"]["quiet"] = json!({ "members": [ { "model": "claude", "reasoning": false } ] }); + let s = Shaping::from_settings(&v).expect("reads"); + assert_eq!( + s.reasoning("main", "gpt"), + Some(true), + "member true beats model false" + ); + assert_eq!( + s.reasoning("quiet", "claude"), + Some(false), + "member false beats model true" + ); + assert_eq!( + s.reasoning("main", "claude"), + Some(true), + "no member override inherits model true" + ); + assert_eq!( + s.reasoning("alt", "gpt"), + Some(false), + "no member override inherits model false" + ); + assert_eq!( + s.reasoning("alt", "claude"), + Some(true), + "a pool with no row for the member uses the model flag" + ); + assert_eq!( + s.reasoning("no-such-pool", "gpt"), + Some(false), + "no candidate row uses the model flag" + ); + assert_eq!( + s.reasoning("no-such-pool", "claude"), + Some(true), + "no candidate row uses the model flag" + ); +} diff --git a/crates/busbar-plane-llm/tests/exchange_user_agent.rs b/crates/busbar-plane-llm/tests/exchange_user_agent.rs index 08579b8010..7c20285d29 100644 --- a/crates/busbar-plane-llm/tests/exchange_user_agent.rs +++ b/crates/busbar-plane-llm/tests/exchange_user_agent.rs @@ -105,3 +105,107 @@ fn a_translated_far_end_sees_the_far_dialect_s_fingerprint_never_the_caller_s() } } } + +/// One member per far dialect, so every dialect's fingerprint is read off a request the plane builds. +fn every_dialect() -> Shaping { + Shaping::from_settings(&json!({ + "providers": { + "oai": { "protocol": "openai", "base_url": "https://api.example" }, + "ant": { "protocol": "anthropic", "base_url": "https://anthropic.example" }, + "goo": { "protocol": "gemini", "base_url": "https://gemini.example" }, + "bed": { "protocol": "bedrock", "base_url": "https://bedrock.example" }, + "res": { "protocol": "responses", "base_url": "https://responses.example" }, + "coh": { "protocol": "cohere", "base_url": "https://cohere.example" } + }, + "models": { + "gpt": { "provider": "oai" }, + "claude": { "provider": "ant" }, + "gem": { "provider": "goo", "upstream_model": "gemini-pro" }, + "bedrock-claude": { "provider": "bed", "upstream_model": "anthropic.claude-3" }, + "resp": { "provider": "res" }, + "command": { "provider": "coh" } + }, + "pools": { "p": { "members": ["gpt", "claude", "gem", "bedrock-claude", "resp", "command"] } } + })) + .expect("reads") +} + +/// LEGACY `crates/busbar-llm/src/engine/tests/ingress_indistinguishability_tests.rs::test_egress_ua_versions_are_pinned_and_present` +/// (coverage map v2 row 325). 1.5.5: every egress request carries the pinned native-SDK +/// `user-agent` of its far dialect, as a golden literal: anthropic `Anthropic/Python 0.39.0`, +/// openai and responses `OpenAI/Python 1.54.0`, gemini `google-genai-sdk/0.8.0 gl-python/3.11`, +/// bedrock `Boto3/1.35.0 md/Botocore#1.35.0`, cohere `cohere-python/5.11.0`, and a far end no +/// declaration names `okhttp/4.12.0`. None is ever empty or versionless, and the two Stainless +/// Python SDKs share the `/Python <ver>` grammar. +/// +/// RED: any far dialect's request goes out with another (or no) `user-agent`, the foreign default +/// moves, or a pinned version string is edited without touching this table. +#[test] +fn test_egress_ua_versions_are_pinned_and_present() { + let s = every_dialect(); + let pinned = [ + ("claude", "Anthropic/Python 0.39.0"), + ("gpt", "OpenAI/Python 1.54.0"), + ("resp", "OpenAI/Python 1.54.0"), + ("gem", "google-genai-sdk/0.8.0 gl-python/3.11"), + ("bedrock-claude", "Boto3/1.35.0 md/Botocore#1.35.0"), + ("command", "cohere-python/5.11.0"), + ]; + // An anthropic caller that sent no user-agent: every far end below sees its own fingerprint, + // the same-dialect one included (1.5.5 sent the native fingerprint to a UA-less caller's far end). + let head: Vec<(&[u8], &[u8])> = + vec![(b"content-type".as_slice(), b"application/json".as_slice())]; + let arrived = arrive("POST", "/v1/messages", &head, MESSAGES.as_bytes(), &()).expect("arrives"); + for (member, want) in pinned { + let r = build(&arrived, &head, &s, "p", member).expect("built"); + assert_eq!( + user_agent(&r), + [want.as_bytes()], + "{member} egress UA drifted from the pinned native-SDK string" + ); + } + // The foreign far end (a dialect no declaration names) still gets a present, plausible UA. + assert_eq!( + busbar_contract::protocol::EGRESS_UA_DEFAULT, + "okhttp/4.12.0", + "the foreign/default egress UA drifted from the pinned literal" + ); + // Every declaration states its pinned literal, so no far dialect can fall to the default. + for d in busbar_plane_llm::codec::DECLS { + let want = match d.name { + "anthropic" => "Anthropic/Python 0.39.0", + "openai" | "responses" => "OpenAI/Python 1.54.0", + "gemini" => "google-genai-sdk/0.8.0 gl-python/3.11", + "bedrock" => "Boto3/1.35.0 md/Botocore#1.35.0", + "cohere" => "cohere-python/5.11.0", + other => panic!("a dialect this table does not pin: {other}"), + }; + assert_eq!(d.egress_user_agent, want, "{}", d.name); + } + let every: Vec<&str> = pinned + .iter() + .map(|(_, ua)| *ua) + .chain([busbar_contract::protocol::EGRESS_UA_DEFAULT]) + .collect(); + for ua in every { + assert!(!ua.is_empty(), "an egress UA must never be empty"); + assert!( + ua.chars().any(|ch| ch.is_ascii_digit()), + "an egress UA must carry a version number: {ua}" + ); + } + for ua in ["Anthropic/Python 0.39.0", "OpenAI/Python 1.54.0"] { + let (title, rest) = ua.split_once('/').expect("Python-SDK UA contains a '/'"); + assert!( + title + .chars() + .next() + .is_some_and(|ch| ch.is_ascii_uppercase()), + "Stainless Python SDK UA must start with a capitalized Title: {ua}" + ); + assert!( + rest.starts_with("Python "), + "Stainless Python SDK UA must be `<Title>/Python <ver>`: {ua}" + ); + } +} diff --git a/crates/busbar-plane-llm/tests/plane_door.rs b/crates/busbar-plane-llm/tests/plane_door.rs index aa3b53e919..97c58e678f 100644 --- a/crates/busbar-plane-llm/tests/plane_door.rs +++ b/crates/busbar-plane-llm/tests/plane_door.rs @@ -404,3 +404,165 @@ fn every_open_class_becomes_one_reported_count_at_its_tail_index() { ); } } + +// ── F25 REHOME: the registry facts and the plane's published identity (coverage map v2) ────────── + +/// The declaration of the dialect named `name`, from the one table the plane serves through. +fn decl_named(name: &str) -> Option<&'static busbar_contract::protocol::ProtocolDecl> { + busbar_plane_llm::codec::DECLS + .iter() + .copied() + .find(|d| d.name == name) +} + +/// The six dialects 1.5.5 shipped, by the names its registry keyed them under. +const SHIPPED_DIALECTS: [&str; 6] = [ + "openai", + "anthropic", + "gemini", + "bedrock", + "cohere", + "responses", +]; + +/// LEGACY `crates/busbar-llm/src/engine/tests/dialect_registry_facts_tests.rs::registry_resolves_openai_and_its_moderation_handler` +/// (coverage map v2 row 98). 1.5.5: the openai registration resolves a handler whose protocol name +/// is its own and which serves the moderation operation; a protocol nobody registered resolves to +/// nothing. +/// +/// RED: the openai declaration loses its handler or its moderation cell, its handler answers to +/// another protocol's name, or an unknown name resolves to some declaration. +#[test] +fn registry_resolves_openai_and_its_moderation_handler() { + use busbar_contract::operation::OpVerb; + let handler = decl_named("openai") + .and_then(|d| d.handler) + .expect("the shipped protocol's handler is registered"); + assert_eq!(handler.protocol_name(), "openai"); + assert!(handler.operation_handler(OpVerb::MODERATION).is_some()); + assert!( + decl_named("zzz-unknown").is_none(), + "unknown protocol -> None" + ); +} + +/// LEGACY `crates/busbar-llm/src/engine/tests/dialect_registry_facts_tests.rs::every_protocol_serves_chat_via_its_request_handler` +/// (coverage map v2 row 99). 1.5.5: chat is reached through the same registry as every other +/// operation, and all six shipped protocols resolve a handler with a chat operation handler. +/// +/// RED: any of the six dialects stops resolving a handler, or its handler stops serving chat. +#[test] +fn every_protocol_serves_chat_via_its_request_handler() { + use busbar_contract::operation::OpVerb; + for proto in SHIPPED_DIALECTS { + let handler = decl_named(proto) + .and_then(|d| d.handler) + .unwrap_or_else(|| panic!("{proto}: protocol registered")); + assert_eq!(handler.protocol_name(), proto); + assert!( + handler.operation_handler(OpVerb::CHAT).is_some(), + "{proto} must serve chat via operation_handler(Chat)" + ); + } + let mut stated: Vec<&str> = DIALECTS.iter().map(|d| d.name).collect(); + stated.sort_unstable(); + let mut shipped = SHIPPED_DIALECTS.to_vec(); + shipped.sort_unstable(); + assert_eq!( + stated, shipped, + "the plane states exactly the six shipped dialects" + ); +} + +/// LEGACY `crates/busbar-llm/src/engine/tests/dialect_registry_facts_tests.rs::chat_declares_its_capabilities` +/// (coverage map v2 row 100). 1.5.5: the chat cell as production resolves it (openai, chat) streams, +/// taps usage from a non-stream body, reads the body's `stream` boolean as the caller's intent, and +/// takes a non-empty top-level `system` as its body affinity key (an empty one is no key). +/// +/// RED: chat stops streaming, stops tapping non-stream usage, misreads the stream flag, or derives +/// an affinity key from an empty `system` (or none from a non-empty one). +#[test] +fn chat_declares_its_capabilities() { + use busbar_contract::operation::OpVerb; + let chat = decl_named("openai") + .and_then(|d| d.handler) + .and_then(|h| h.operation_handler(OpVerb::CHAT)) + .expect("the shipped protocol serves chat"); + assert!(chat.streaming(), "chat streams"); + assert!(chat.taps_usage(), "chat bills tokens from the body"); + assert!( + chat.wants_stream(&serde_json::json!({"stream": true})), + "chat reads the stream boolean" + ); + assert!(!chat.wants_stream(&serde_json::json!({}))); + assert!(!chat.wants_stream(&serde_json::json!({"stream": false}))); + assert_eq!( + chat.body_affinity_key(&serde_json::json!({"system": "you are helpful"})), + Some("you are helpful") + ); + assert_eq!( + chat.body_affinity_key(&serde_json::json!({"system": ""})), + None + ); +} + +/// LEGACY `crates/busbar-llm/src/engine/tests/ingress_integration_tests.rs::test_affinity_header_session_mode_without_name_uses_default` +/// (coverage map v2 row 375). 1.5.5: a pool whose `affinity` is `mode: session` with no +/// `header_name` keys its sticky routing on `x-session-id`. +/// +/// RED: a session-mode pool with no header name reads another header (or none), so a client's +/// `x-session-id` stops pinning its session. +#[test] +fn test_affinity_header_session_mode_without_name_uses_default() { + use busbar_plane_llm::plane_door::affinity_key; + let shaping = read_settings( + br#"{"providers":{"ant":{"protocol":"anthropic","base_url":"https://anthropic.example"}}, + "models":{"claude":{"provider":"ant"}}, + "pools":{"p":{"members":["claude"],"affinity":{"mode":"session"}}}}"#, + ) + .expect("a session-mode pool with no header name reads"); + assert_eq!(shaping.affinity_header("p"), "x-session-id"); + let session: &[(&[u8], &[u8])] = &[(b"x-session-id", b"s-7")]; + assert_eq!( + affinity_key(shaping.affinity_header("p"), session, None, None), + Some("s-7".to_string()), + "the default header is the one the pool keys on" + ); +} + +/// A `'static` string the door states, as its bytes. +fn abi_text(s: busbar_contract::abi::mechanism::call::AbiStr) -> &'static [u8] { + // SAFETY: every `AbiStr` the door states names a `'static` string of `len` bytes. + unsafe { std::slice::from_raw_parts(s.ptr, s.len) } +} + +/// LEGACY `crates/busbar-llm/src/tests/plane_decl_identity_tests.rs::the_plane_declares_its_published_key_and_is_the_fallback` +/// (coverage map v2 row 643). 1.5.5: the plane's operator-visible identity, as literals: the key +/// every metric, log and record carries is `llm`, it is the one fallback catch-all, its config +/// section is `pools`, and a grant on it names a `pool`. +/// +/// RED: the published key, the fallback flag, the declaring section or the scope kind moves. +#[test] +fn the_plane_declares_its_published_key_and_is_the_fallback() { + use busbar_contract::abi::mechanism::door::SECTION_DECLARING; + assert_eq!(abi_text(STATEMENT.name), b"llm"); + assert_ne!( + TAIL.flags & TAIL_FALLBACK, + 0, + "the fallback catch-all every unclaimed path falls through to" + ); + assert_eq!(abi_text(TAIL.scope), b"pools"); + // SAFETY: the Statement's sections are a `'static` list of `sections_len` entries. + let sections = + unsafe { std::slice::from_raw_parts(STATEMENT.sections, STATEMENT.sections_len) }; + let declaring: Vec<&[u8]> = sections + .iter() + .filter(|s| s.flags & SECTION_DECLARING != 0) + .map(|s| abi_text(s.name)) + .collect(); + assert_eq!(declaring, vec![b"pools".as_slice()]); + // SAFETY: the tail's `'static` scope-kind list of `scope_kinds_len` entries. + let kinds = unsafe { std::slice::from_raw_parts(TAIL.scope_kinds, TAIL.scope_kinds_len) }; + let kinds: Vec<&[u8]> = kinds.iter().map(|k| abi_text(*k)).collect(); + assert_eq!(kinds, vec![b"pool".as_slice()]); +} diff --git a/crates/busbar-plane-llm/tests/refusal_envelopes.rs b/crates/busbar-plane-llm/tests/refusal_envelopes.rs index 659740a4bc..9fd9660920 100644 --- a/crates/busbar-plane-llm/tests/refusal_envelopes.rs +++ b/crates/busbar-plane-llm/tests/refusal_envelopes.rs @@ -256,3 +256,207 @@ fn a_refusal_never_names_the_internal_reason() { } } } + +// ── F25 REHOME: the rendered refusal's status and head (coverage map v2) ───────────────────────── + +/// The dialect codec of the dialect named `name`. +fn dialect_codec(name: &str) -> &'static dyn busbar_contract::protocol::DialectCodec { + busbar_plane_llm::codec::DECLS + .iter() + .find(|d| d.name == name) + .and_then(|d| d.dialect()) + .unwrap_or_else(|| panic!("{name} declares a dialect codec")) +} + +/// The host's entropy, so a dialect that mints a request id mints one (constant bytes, so every +/// test in this binary still reads the same document twice). +fn entropy() { + busbar_contract::codec::install_entropy_source(|out| { + out.fill(7); + true + }); +} + +/// The value of the head field `name` (compared without case), if the refusal carries one. +fn head_value<'a>(fields: &'a [(String, Vec<u8>)], name: &str) -> Option<&'a [u8]> { + fields + .iter() + .find(|(n, _)| n.eq_ignore_ascii_case(name)) + .map(|(_, v)| v.as_slice()) +} + +/// LEGACY `crates/busbar-llm/src/engine/tests/ingress_indistinguishability_tests.rs::test_anthropic_ingress_error_request_id_header_matches_body` +/// (coverage map v2 row 330). 1.5.5: an anthropic-dialect refusal carries a `request-id` head field +/// in Anthropic's `req_` shape, EQUAL to the body's `request_id`; no other dialect's refusal +/// carries a `request-id` field. +/// +/// RED: the header and the body mint two different ids, the header goes missing, or another +/// dialect's refusal starts carrying Anthropic's field. +#[test] +fn test_anthropic_ingress_error_request_id_header_matches_body() { + use busbar_contract::protocol::KIND_INVALID_REQUEST; + use busbar_plane_llm::exchange::refuse::render; + entropy(); + let rendered = render("anthropic", 400, KIND_INVALID_REQUEST, "bad json", 0); + let header_rid = std::str::from_utf8( + head_value(&rendered.fields, "request-id") + .expect("anthropic error must carry a request-id header"), + ) + .expect("the request id is text") + .to_string(); + assert!( + header_rid.starts_with("req_"), + "request-id header carries the Anthropic req_ shape; got {header_rid}" + ); + let body: serde_json::Value = + sonic_rs::from_slice(&rendered.body).expect("a refusal is a document"); + assert_eq!( + body["request_id"].as_str(), + Some(header_rid.as_str()), + "the request-id header MUST equal the body request_id so they agree" + ); + for dialect in DIALECTS.iter().filter(|d| **d != "anthropic") { + let other = render(dialect, 400, KIND_INVALID_REQUEST, "bad json", 0); + assert_eq!( + head_value(&other.fields, "request-id"), + None, + "a {dialect} refusal carries no Anthropic request-id field" + ); + } +} + +/// LEGACY `crates/busbar-llm/src/unit/tests/audit.rs::every_refusal_class_renders_byte_identically_on_both_paths` +/// (coverage map v2 row 682). 1.5.5: every refusal class (exactly eight: unauth 401, wrong-scope +/// 403, over-budget 429 `insufficient_quota`, rate-limit 429 with `Retry-After: 30`, unpriced 400, +/// no-pool 404, oversize-body 413, context-overflow 400 carrying the breaker's +/// `context_length_exceeded` code) renders in each of the six dialects with its own status, its +/// dialect's native head fields over the very envelope it sends, the dialect writer's own envelope +/// bytes, and a non-empty body. +/// +/// RED: a class renders another status, drops or invents `retry-after`, wears head fields that do +/// not belong to its own envelope, leaves the writer's vocabulary (over-budget not +/// `insufficient_quota`, the context-length code reaching an openai caller as a raw `type`), renders +/// an empty body, or a class leaves the table. +#[test] +fn every_refusal_class_renders_byte_identically_on_both_paths() { + use busbar_contract::protocol::{ + KIND_AUTHENTICATION, KIND_INSUFFICIENT_QUOTA, KIND_INVALID_REQUEST, KIND_NOT_FOUND, + KIND_PERMISSION, KIND_RATE_LIMIT, KIND_REQUEST_TOO_LARGE, PROVIDER_CODE_CONTEXT_LENGTH, + }; + use busbar_plane_llm::exchange::refuse::render; + entropy(); + // (class, status, kind, message, retry-after seconds) + let classes: [(&str, u16, &str, &str, u32); 8] = [ + ( + "unauth", + 401, + KIND_AUTHENTICATION, + "Invalid API key provided.", + 0, + ), + ( + "wrong-scope", + 403, + KIND_PERMISSION, + "Your API key does not have permission to use pool 'p'.", + 0, + ), + ( + "over-budget", + 429, + KIND_INSUFFICIENT_QUOTA, + "You have exceeded your current quota (group 'bgrp' budget per total exhausted). \ + Please check your plan and billing details.", + 0, + ), + ( + "rate-limit", + 429, + KIND_RATE_LIMIT, + "Rate limit exceeded (group 'g': requests per minute). Please retry after the \ + indicated time.", + 30, + ), + ( + "unpriced", + 400, + KIND_INVALID_REQUEST, + "no configured rate for model 'm'", + 0, + ), + ( + "no-pool", + 404, + KIND_NOT_FOUND, + "The model 'm' does not exist or you do not have access to it.", + 0, + ), + ( + "oversize-body", + 413, + KIND_REQUEST_TOO_LARGE, + "Request body is too large.", + 0, + ), + ( + "context-overflow", + 400, + PROVIDER_CODE_CONTEXT_LENGTH, + "prompt is too long: 300000 tokens > 200000 maximum", + 0, + ), + ]; + assert_eq!(classes.len(), 8, "every refusal class stays in the table"); + assert_eq!(PROVIDER_CODE_CONTEXT_LENGTH, "context_length_exceeded"); + for (name, status, kind, message, retry) in classes { + for dialect in DIALECTS { + let codec = dialect_codec(dialect); + let rendered = render(dialect, status, kind, message, retry); + assert_eq!( + rendered.status, status, + "{name}/{dialect} wears its own status" + ); + assert!( + !rendered.body.is_empty(), + "{name}/{dialect} renders an envelope, not an empty body" + ); + // The body is the dialect writer's own envelope for the class's (status, kind, message). + let own = sonic_rs::to_vec(&codec.write_error(status, kind, message)) + .expect("the envelope serializes"); + assert_eq!( + without_minted_id(&rendered.body), + without_minted_id(&own), + "{name} on the {dialect} wire is not the dialect's own envelope" + ); + // The head: the JSON content type, the dialect's native error fields over the very + // envelope sent (so a minted id in the head is the body's), then the class's own wait. + let sent: serde_json::Value = + sonic_rs::from_slice(&rendered.body).expect("a refusal is a document"); + let mut head = vec![("content-type".to_string(), b"application/json".to_vec())]; + head.extend(codec.error_response_fields(kind, &sent)); + if retry != 0 { + head.push(("retry-after".to_string(), b"30".to_vec())); + } + assert_eq!( + rendered.fields, head, + "{name} on the {dialect} wire carries other head fields than its own" + ); + assert_eq!( + head_value(&rendered.fields, "retry-after"), + (name == "rate-limit").then_some(b"30".as_slice()), + "{name}/{dialect}: only the rolling window advises a wait, and it is 30 seconds" + ); + } + } + // The openai wire, read as its SDK reads it: the over-budget class is the native quota type and + // code, and the breaker's context-length token is projected into the writer's own vocabulary. + let over = render("openai", 429, KIND_INSUFFICIENT_QUOTA, "quota", 0); + let over: serde_json::Value = sonic_rs::from_slice(&over.body).expect("a document"); + assert_eq!(over["error"]["type"], "insufficient_quota"); + assert_eq!(over["error"]["code"], "insufficient_quota"); + let ctx = render("openai", 400, PROVIDER_CODE_CONTEXT_LENGTH, "too long", 0); + let ctx: serde_json::Value = sonic_rs::from_slice(&ctx.body).expect("a document"); + assert_eq!(ctx["error"]["type"], "invalid_request_error"); + let no_pool = render("openai", 404, KIND_NOT_FOUND, "no pool", 0); + assert_eq!(no_pool.status, 404); +} diff --git a/crates/busbar/src/root/tests/declared_credentials.rs b/crates/busbar/src/root/tests/declared_credentials.rs index f1a4af49ca..4385a61291 100644 --- a/crates/busbar/src/root/tests/declared_credentials.rs +++ b/crates/busbar/src/root/tests/declared_credentials.rs @@ -1030,3 +1030,61 @@ fn the_main_log_sink_writes_a_declared_diagnostic_in_its_one_five_five_shape() { ] ); } + +/// LEGACY the retiring engine crate's `src/engine/tests/auth_style_tests.rs::test_keyless_lane_sends_no_auth_header` +/// (coverage map v2 row 73). 1.5.5: a lane whose provider declared `api_key: none` (a keyless +/// local upstream) holds an empty key, and an empty key presents NO auth header at all under any +/// auth style (the dialect's default, `bearer`, `api-key`): never `Authorization: Bearer ` with an +/// empty token, never an empty `api-key` field. A non-empty credential is unaffected and presents +/// its one header. +/// +/// Here every non-signing binding the fixture records (each dialect's default and the `auth: +/// api-key` override) and the `auth: bearer` override are bound on the linked auth plugins with +/// the empty key, in both credential modes, and asked for their fields. +/// +/// RED: a linked auth plugin presents a field for an empty credential (a bare `Bearer`, an empty +/// key header), or a real credential stops presenting its one header. +#[test] +fn test_keyless_lane_sends_no_auth_header() { + let ctx = |upstream_creds| SigningContext { + host: "upstream.internal", + canonical_uri: "/", + body: b"{}", + timestamp_epoch: 0, + upstream_creds, + }; + let bearer = StyleBinding { + style: "bearer".to_string(), + params: serde_json::json!({}), + uses_key: true, + statics: &[], + sent: Vec::new(), + }; + let mut bindings: Vec<(String, StyleBinding)> = fixture()["bindings"] + .as_object() + .expect("bindings") + .keys() + .map(|name| (name.clone(), binding_of(name, "upstream.internal", &[]))) + .filter(|(_, binding)| binding.style != "sigv4") + .collect(); + bindings.push(("bearer override".to_string(), bearer.clone())); + assert!( + bindings.len() >= 3, + "the default, `bearer` and `api-key` styles are all bound" + ); + for (name, binding) in &bindings { + for mode in [UpstreamCreds::Own, UpstreamCreds::Passthrough] { + assert_eq!( + present_bound(binding, "", &ctx(mode)), + Vec::<(String, String)>::new(), + "an empty credential must send NO auth header ({name}, style {}, {mode:?})", + binding.style + ); + } + } + assert_eq!( + present_bound(&bearer, "SECRETKEY", &ctx(UpstreamCreds::Own)).len(), + 1, + "a real credential still sends its header" + ); +} diff --git a/crates/busbar/src/root/tests/door_steps.rs b/crates/busbar/src/root/tests/door_steps.rs index 675d3401ad..948509765c 100644 --- a/crates/busbar/src/root/tests/door_steps.rs +++ b/crates/busbar/src/root/tests/door_steps.rs @@ -151,6 +151,50 @@ fn the_grant_is_judged_over_the_named_pool_then_its_fallback() { ); } +/// LEGACY the retiring engine crate's `src/engine/tests/ingress_integration_tests.rs::test_adhoc_governance_pool_acl_403_via_router` +/// (coverage map v2 row 463). 1.5.5: the ad-hoc (direct) route runs the same governance guard, +/// keyed on the resolved MODEL: a key allowed only on `other-pool` that names the configured model +/// directly is refused 403 (a permission refusal, the dialect's own `permission_error` envelope). +/// +/// Held here on the door's grant over a direct route and the refusal the seat answers for it: the +/// grant is denied, the seat refuses it as `ScopeDenied`, and the driver's status for that reason +/// is 403 (the plane renders it as its dialect's permission refusal; its own suite holds that). +/// +/// RED: a direct route escapes the key's pool grant (the model served to a key scoped elsewhere), +/// or its refusal stops being a 403. +#[test] +fn test_adhoc_governance_pool_acl_403_via_router() { + use busbar_contract::records::{ScopeRef, VirtualKey}; + let p = pools("models:\n configured-model: {provider: p}\npools:\n other-pool:\n members: [configured-model]"); + let elsewhere = VirtualKey { + allowed_scopes: Some(vec![ScopeRef::pool("other-pool")]), + ..VirtualKey::default() + }; + assert!( + !p.granted( + Some("pool"), + Some(&elsewhere), + ROUTE_DIRECT, + Some(b"configured-model") + ), + "a key allowed only on `other-pool` may not name the configured model directly" + ); + assert!( + p.granted( + Some("pool"), + Some(&elsewhere), + ROUTE_POOL, + Some(b"other-pool") + ), + "the same key is served on the pool it is granted" + ); + assert_eq!( + busbar_kernel::plane_driver::refusal_status(busbar_contract::caps::ReasonCode::ScopeDenied), + 403, + "ad-hoc governance pool-ACL => 403" + ); +} + /// THE MEMBER'S TIER (the core-owned per-member `tier`, `BUSBAR-1.6.0.md` l.4196 (b), R2-G /// l.4285): read off a member written `{name, tier}`, `0` for a bare name, for one with no tier, and /// for a tier that is no unsigned integer; a pool's entries are its members' names either way. diff --git a/crates/busbar/src/root/tests/egress_ports.rs b/crates/busbar/src/root/tests/egress_ports.rs index 90988db16c..a9e4af6252 100644 --- a/crates/busbar/src/root/tests/egress_ports.rs +++ b/crates/busbar/src/root/tests/egress_ports.rs @@ -6,6 +6,7 @@ //! until dropped and handed to the longest waiter; the counters label a member by its name and keep //! each pool's wait depth balanced. +use std::sync::Arc; use std::time::{Duration, SystemTime, UNIX_EPOCH}; use busbar_kernel_egress::ports::{Capacity, Clock, DestinationId, Telemetry}; @@ -94,3 +95,323 @@ fn the_counters_label_a_member_by_name_and_keep_each_pools_depth() { t.queued("p", -5); assert_eq!(t.depth("p"), 0, "a depth never reads below empty"); } + +// ── F25 REHOME: the attempt timeout a sealed member carries, the queue's one wake, the p95 ring ─── + +/// A connection table that opens nothing: the sealing below never dials. +#[derive(Debug, Default)] +struct Shut; + +impl busbar_contract::conn::Conns for Shut { + fn open( + &self, + _: busbar_contract::conn::InstanceId, + _: busbar_contract::conn::NeedId, + _: &busbar_contract::conn::OpenDesc<'_>, + ) -> Result<busbar_contract::conn::ConnId, busbar_contract::conn::ConnError> { + Err(busbar_contract::conn::ConnError::Refused) + } + fn write( + &self, + _: busbar_contract::conn::InstanceId, + _: busbar_contract::conn::ConnId, + _: &[u8], + _: bool, + _: bool, + ) -> Result<usize, busbar_contract::conn::ConnError> { + Err(busbar_contract::conn::ConnError::Closed) + } + fn read( + &self, + _: busbar_contract::conn::InstanceId, + _: busbar_contract::conn::ConnId, + _: u64, + _: &mut [u8], + ) -> Result<busbar_contract::conn::Piece, busbar_contract::conn::ConnError> { + Err(busbar_contract::conn::ConnError::Closed) + } + fn wait( + &self, + _: busbar_contract::conn::InstanceId, + _: &[busbar_contract::conn::ConnId], + _: u64, + ) -> Result<usize, busbar_contract::conn::ConnError> { + Err(busbar_contract::conn::ConnError::Closed) + } + fn facts( + &self, + _: busbar_contract::conn::InstanceId, + _: busbar_contract::conn::ConnId, + ) -> Result<busbar_contract::conn::ConnFacts, busbar_contract::conn::ConnError> { + Err(busbar_contract::conn::ConnError::Closed) + } + fn close( + &self, + _: busbar_contract::conn::InstanceId, + _: busbar_contract::conn::ConnId, + ) -> Result<(), busbar_contract::conn::ConnError> { + Err(busbar_contract::conn::ConnError::Closed) + } +} + +impl busbar_contract::conn::PollConns for Shut { + fn poll_read( + &self, + _: busbar_contract::conn::InstanceId, + _: busbar_contract::conn::ConnId, + _: &mut std::task::Context<'_>, + _: &mut [u8], + ) -> std::task::Poll<Result<busbar_contract::conn::Piece, busbar_contract::conn::ConnError>> + { + std::task::Poll::Ready(Err(busbar_contract::conn::ConnError::Closed)) + } +} + +/// A journal that keeps nothing: the sealing below dispatches nothing. +#[derive(Debug)] +struct Unwritten; + +impl busbar_kernel_egress::ports::Journal for Unwritten { + fn dispatched( + &self, + _: &busbar_kernel_egress::ports::Dispatched, + ) -> Result<(), busbar_kernel_egress::ports::DurabilityUnavailable> { + Ok(()) + } + fn abandoned(&self, _: &busbar_kernel_egress::ports::Dispatched) {} +} + +/// A dialect the root links, read as data off the node's dialect fixture (the root's sources name +/// no dialect). +fn a_linked_dialect() -> String { + let path = concat!( + env!("CARGO_MANIFEST_DIR"), + "/src/root/tests/fixtures/plane_node_dialects.json" + ); + let text = std::fs::read_to_string(path).expect("the dialect fixture reads"); + let fixture: serde_json::Value = serde_json::from_str(&text).expect("the fixture is JSON"); + fixture["body_model"] + .as_object() + .and_then(|dialects| dialects.keys().next().cloned()) + .expect("the fixture names a body-model dialect") +} + +/// THE MODEL-SERVING EGRESS, sealed by [`crate::root::model_egress::compose`] the way the serve +/// path seals it, over a deployment where model `patient` states a 10000 ms attempt timeout and +/// model `plain` states none; pool `fast` overrides `patient` to 50 ms and leaves `plain` bare, and +/// pool `slow` names `patient` with no override. Both models are also routable directly. +fn sealed_timeouts() -> busbar_kernel::plane_driver::Egress { + let dialect = a_linked_dialect(); + let mut defs = std::collections::HashMap::new(); + defs.insert( + "far".to_string(), + serde_yaml::from_str::<busbar_kernel::config::ProviderDef>(&format!( + "protocol: {dialect}\nbase_url: https://far.invalid\n" + )) + .expect("a provider def"), + ); + let yaml = "providers:\n far:\n api_key: { env: BUSBAR_TEST_KEY }\nmodels:\n patient:\n provider: far\n \ + attempt_timeout_ms: 10000\n plain:\n provider: far\npools:\n fast:\n \ + members:\n - model: patient\n attempt_timeout_ms: 50\n - model: \ + plain\n slow:\n members:\n - model: patient\n"; + let deploy = busbar_kernel::config::deploy_from_yaml_str(yaml).expect("parses"); + let cfg = busbar_kernel::config::resolve(&deploy, &defs).expect("resolves"); + let app = busbar_kernel::test_support::TestApp::new().build(); + let serving = crate::root::model_egress::ModelServing { + pools: crate::root::model_egress::ModelPools::of(&cfg), + lanes: [("patient".to_string(), 0), ("plain".to_string(), 1)] + .into_iter() + .collect(), + app: Arc::new(move || Arc::clone(&app)), + }; + let route = |provider: &str| busbar_kernel::plane_driver::MemberRoute { + need: busbar_contract::conn::NeedId(0), + base_url: "https://far.invalid".to_string(), + auth: None, + provider: provider.to_string(), + keep: busbar_kernel::plane_driver::ResponseKeep::default(), + rides: Vec::new(), + anchors: busbar_contract::transport::trust::Anchors::default(), + spelled: Vec::new(), + }; + let routes: std::collections::BTreeMap<String, busbar_kernel::plane_driver::MemberRoute> = + [("patient", route("far")), ("plain", route("far"))] + .into_iter() + .map(|(model, sealed)| (model.to_string(), sealed)) + .collect(); + let facts = + crate::root::door_steps::door_facts("door", &["pool"], &[], &[], "unit", Vec::new()); + let (egress, _shown) = crate::root::model_egress::compose( + &facts, + &serving, + busbar_contract::conn::InstanceId(1), + Arc::new(Shut), + &routes, + Arc::new(Unwritten), + 600, + ) + .expect("the pools seal"); + egress +} + +/// The attempt timeout the sealed `pool`'s member `model` carries. +fn sealed_attempt_ms( + egress: &busbar_kernel::plane_driver::Egress, + pool: &str, + model: &str, +) -> Option<u64> { + egress + .pools + .get(pool) + .unwrap_or_else(|| panic!("pool `{pool}` is sealed")) + .members + .iter() + .find(|member| member.name == model) + .unwrap_or_else(|| panic!("`{model}` is a member of `{pool}`")) + .attempt_timeout_ms +} + +/// LEGACY the retiring engine crate's `src/engine/tests/attempt_timeout_precedence_tests.rs::test_member_override_wins_over_model_default` +/// (coverage map v2 row 44). 1.5.5: the pool member's `attempt_timeout_ms` override wins over the +/// model-level default, so one model carries 10000 ms in one pool and 50 ms in another. +/// +/// RED: the sealed member carries the model's 10000 ms (or nothing) instead of its pool's 50 ms. +#[test] +fn test_member_override_wins_over_model_default() { + let egress = sealed_timeouts(); + assert_eq!( + sealed_attempt_ms(&egress, "fast", "patient"), + Some(50), + "the pool-member override must beat the model-level default" + ); +} + +/// LEGACY the retiring engine crate's `src/engine/tests/attempt_timeout_precedence_tests.rs::test_model_default_applies_when_member_has_no_override` +/// (coverage map v2 row 45). 1.5.5: a member without an override inherits the model-level default. +/// +/// RED: a member that states no override loses its model's 10000 ms cap (or takes another pool's). +#[test] +fn test_model_default_applies_when_member_has_no_override() { + let egress = sealed_timeouts(); + assert_eq!( + sealed_attempt_ms(&egress, "slow", "patient"), + Some(10_000), + "a member with no override must fall back to the model-level cap" + ); +} + +/// LEGACY the retiring engine crate's `src/engine/tests/attempt_timeout_precedence_tests.rs::test_no_cap_anywhere_is_none` +/// (coverage map v2 row 46). 1.5.5: with neither level set the attempt is uncapped (`None`): it +/// runs under the walk's budget alone. +/// +/// RED: a member whose pool and model state no cap is sealed with one. +#[test] +fn test_no_cap_anywhere_is_none() { + let egress = sealed_timeouts(); + assert_eq!(sealed_attempt_ms(&egress, "fast", "plain"), None); +} + +/// LEGACY the retiring engine crate's `src/engine/tests/attempt_timeout_precedence_tests.rs::test_empty_cands_uses_model_default` +/// (coverage map v2 row 47). 1.5.5: a single-model route has no member rows at all, so the +/// model-level value is the only source: 10000 ms where the model states it, uncapped where it +/// states none. +/// +/// RED: a route naming a model directly drops the model's own attempt timeout (or invents one). +#[test] +fn test_empty_cands_uses_model_default() { + let egress = sealed_timeouts(); + assert_eq!( + sealed_attempt_ms(&egress, "patient", "patient"), + Some(10_000) + ); + assert_eq!(sealed_attempt_ms(&egress, "plain", "plain"), None); +} + +/// LEGACY the retiring engine crate's `src/engine/tests/on_exhausted_tests.rs::queue_two_waiters_one_freed_permit_wakes_exactly_one` +/// (coverage map v2 row 542). 1.5.5: with two waiters parked on a saturated one-slot member, +/// freeing ONE slot lets EXACTLY ONE dispatch; the other stays parked (no thundering herd, the cap +/// never exceeded) until the winner's slot frees in turn. +/// +/// RED: one freed slot wakes both waiters, hands out a second slot, or loses the wake so neither +/// (or only the first) ever proceeds. +#[tokio::test] +async fn queue_two_waiters_one_freed_permit_wakes_exactly_one() { + let permits = std::sync::Arc::new(MemberPermits::new([(A, 1)])); + let held = permits.try_acquire(A).expect("the one slot"); + let (woke, mut wakes) = tokio::sync::mpsc::unbounded_channel(); + let waiters: Vec<_> = (0..2) + .map(|_| { + let (permits, woke) = (std::sync::Arc::clone(&permits), woke.clone()); + tokio::spawn(async move { + let got = permits.acquire_any(&[A]).await; + let _ = woke.send(got); + }) + }) + .collect(); + tokio::time::sleep(Duration::from_millis(20)).await; + assert!( + wakes.try_recv().is_err(), + "both waiters park on the full member" + ); + + drop(held); + let first = tokio::time::timeout(Duration::from_secs(5), wakes.recv()) + .await + .expect("exactly one waiter must win the freed slot") + .expect("a waiter answered") + .expect("the slot was handed over"); + assert_eq!(first.0, A); + tokio::time::sleep(Duration::from_millis(50)).await; + assert!( + wakes.try_recv().is_err(), + "while the winner holds the only slot, the surviving waiter must still be parked (no herd)" + ); + assert!( + permits.try_acquire(A).is_none(), + "the single freed slot is held by the one winner — none left for a second dispatcher" + ); + + drop(first); + let second = tokio::time::timeout(Duration::from_secs(5), wakes.recv()) + .await + .expect("the survivor wins the slot the winner freed") + .expect("a waiter answered") + .expect("the slot was handed over"); + assert_eq!(second.0, A); + for waiter in waiters { + tokio::time::timeout(Duration::from_secs(5), waiter) + .await + .expect("both waiters resolve") + .expect("joined"); + } +} + +/// LEGACY the retiring engine crate's `src/engine/tests/signal_catalog_tests.rs::latency_reservoir_p95_is_nearest_rank_and_bounded` +/// (coverage map v2 row 612). 1.5.5: the reservoir behind `CandidateLatencyP95Ms` reads `None` +/// until a sample lands (never a fabricated 0); its p95 is nearest-rank in whole milliseconds +/// rounded up (1..=100 ms gives 95, a 0.2 ms sample gives 1); NaN, zero and negative samples are +/// ignored; and the ring is bounded, so after 1000 samples of 7 ms only those decide (7). +/// +/// RED: an empty ring reads 0, the rank or the rounding moves, a garbage sample is counted, or the +/// ring stops evicting its oldest samples. +#[test] +fn latency_reservoir_p95_is_nearest_rank_and_bounded() { + use crate::root::model_egress::LatencyReservoir; + let ring = LatencyReservoir::default(); + assert_eq!(ring.p95_ms(), None); + for ms in 1..=100u32 { + ring.record(f64::from(ms)); + } + assert_eq!(ring.p95_ms(), Some(95)); + ring.record(f64::NAN); + ring.record(0.0); + ring.record(-3.0); + assert_eq!(ring.p95_ms(), Some(95)); + let tiny = LatencyReservoir::default(); + tiny.record(0.2); + assert_eq!(tiny.p95_ms(), Some(1)); + for _ in 0..1000 { + ring.record(7.0); + } + assert_eq!(ring.p95_ms(), Some(7)); +} diff --git a/crates/busbar/src/root/tests/linked_auth.rs b/crates/busbar/src/root/tests/linked_auth.rs index 416ccc25e8..24f246c3ad 100644 --- a/crates/busbar/src/root/tests/linked_auth.rs +++ b/crates/busbar/src/root/tests/linked_auth.rs @@ -963,3 +963,129 @@ fn bearer(token: &str) -> axum::http::HeaderMap { ); headers } + +/// LEGACY the retiring engine crate's `src/engine/tests/ingress_integration_tests.rs::test_role_bound_principal_governed_like_a_virtual_key` +/// (coverage map v2 row 402). 1.5.5: with governance on and an external data-plane module on the +/// chain, a role-bound principal is governed through a SYNTHESIZED key exactly like a virtual key: +/// its binding's pool ACL admits the granted pool (200) and refuses another (403); a binding that +/// omits `allowed_pools` grants every pool; an explicit `allowed_pools: []` grants nothing (401); +/// and an identified principal whose roles earn no binding is refused outright (401, fail closed). +/// +/// Walked here through the served steps: the data-plane chain judges the request's credential +/// (the test chain's `grp:<role>` module), the verdict resolves to a governance key through the +/// module's `role_bindings` (`resolve_data_plane_identity`), and the door's grant judges the pool +/// the unit names with that key. +/// +/// RED: a role binding's pool ACL stops gating (an ungranted pool served), an omitted grant stops +/// meaning every pool, or an empty or absent binding admits the principal. +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn test_role_bound_principal_governed_like_a_virtual_key() { + use busbar_contract::abi::plane::ROUTE_POOL; + use busbar_kernel::auth::{ + resolve_data_plane_identity, AuthMiddleware, ChainHead, IdentityRefusal, + }; + link(); + let module = "test-groups-module"; + let mut table = std::collections::BTreeMap::new(); + table.insert( + "pool-users".to_string(), + RoleBindingCfg { + allowed_pools: Some(vec!["gpool-a".to_string()]), + ..Default::default() + }, + ); + // OMITTED allowed_pools = ALL pools. + table.insert("batch".to_string(), RoleBindingCfg::default()); + // Explicit [] = NO pools (the empty set, fail closed). + table.insert( + "locked".to_string(), + RoleBindingCfg { + allowed_pools: Some(vec![]), + ..Default::default() + }, + ); + let mut role_bindings = config::RoleBindings::new(); + role_bindings.insert(module.to_string(), table); + let auth = Arc::new(AuthMiddleware::new_builtin(&AuthCfg::with_chain(vec![ + AuthChainEntry::bare(module), + ]))); + let app = busbar_kernel::test_support::TestApp::new() + .auth(Arc::clone(&auth)) + .role_bindings(role_bindings) + .build(); + let pools = crate::root::door_steps::DoorPools::of( + &serde_yaml::from_str( + "models:\n rekey-model: {provider: p}\npools:\n gpool-a:\n members: \ + [rekey-model]\n gpool-b:\n members: [rekey-model]", + ) + .expect("the section"), + ); + // What the caller reads: the identity refusal's 401, the grant's 403, else served. + let answer = |credential: &'static str, pool: &'static str| { + let (auth, app, pools) = (Arc::clone(&auth), Arc::clone(&app), pools.clone()); + async move { + let headers = bearer(credential); + let head = ChainHead::of_parts("POST", "/v1/chat/completions", &headers); + let verdict = AuthMiddleware::run_chain_on_request_path( + &auth, + Some(credential.to_string()), + head, + None, + None, + ) + .await; + match resolve_data_plane_identity(&app, verdict) { + Err(IdentityRefusal::NoGrant | IdentityRefusal::Denied) => 401, + Ok((_, gov)) => { + if pools.granted( + Some("pool"), + gov.key.as_deref(), + ROUTE_POOL, + Some(pool.as_bytes()), + ) { + 200 + } else { + busbar_kernel::plane_driver::refusal_status( + busbar_contract::caps::ReasonCode::ScopeDenied, + ) + } + } + } + } + }; + + // Pool ACL from the role binding: gpool-a serves, gpool-b is denied. + assert_eq!( + answer("grp:pool-users", "gpool-a").await, + 200, + "granted pool serves" + ); + assert_eq!( + answer("grp:pool-users", "gpool-b").await, + 403, + "ungranted pool is denied" + ); + // OMITTED allowed_pools grants every pool. + assert_eq!( + answer("grp:batch", "gpool-a").await, + 200, + "omitted allowed_pools grants all" + ); + assert_eq!( + answer("grp:batch", "gpool-b").await, + 200, + "omitted allowed_pools grants all" + ); + // Explicit [] grants the EMPTY SET: no data-plane access at all. + assert_eq!( + answer("grp:locked", "gpool-a").await, + 401, + "allowed_pools [] grants nothing" + ); + // Fail closed: an identified principal whose roles earn no binding is rejected. + assert_eq!( + answer("grp:strangers", "gpool-a").await, + 401, + "unbound roles grant nothing" + ); +} diff --git a/crates/busbar/src/root/tests/policy.rs b/crates/busbar/src/root/tests/policy.rs index 0204eaef75..4a307eae2d 100644 --- a/crates/busbar/src/root/tests/policy.rs +++ b/crates/busbar/src/root/tests/policy.rs @@ -92,3 +92,61 @@ fn an_unset_body_cap_resolves_to_the_transport_default() { "the transport's own default body cap is the 32 MiB this deployment has always had" ); } + +/// LEGACY the retiring engine crate's `src/engine/tests/runtime_carry_tests.rs::a_changed_upstream_timeout_rebuilds_the_client_an_unrelated_apply_reuses_it` +/// (coverage map v2 row 603). 1.5.5: a hot config apply that changes nothing client-relevant REUSES +/// the prior upstream client (its warm connection pool), and an apply that changes the upstream +/// request timeout REBUILDS it, so the new timeout (here the prior + 7 s) takes effect without a +/// restart. +/// +/// Held here on what the served egress is built from on each apply: the settings a transport door +/// is opened with (`settings_blob`) and the connector's pool posture. An unchanged apply hands the +/// doors byte-identical settings and the same posture (nothing to reopen, the warm pool carries); a +/// changed timeout hands them a different blob carrying the new figure. +/// +/// RED: an apply that changed nothing reads as a change (the warm pool thrown away), or a changed +/// `limits.upstream_request_timeout_secs` never reaches the settings a door is opened with. +#[test] +fn a_changed_upstream_timeout_rebuilds_the_client_an_unrelated_apply_reuses_it() { + const DECLARED: [&str; 2] = [ + "limits.upstream_request_timeout_secs", + "limits.request_body_max_bytes", + ]; + let limits = LimitsResolved::default(); + // Reuse half: an apply with an identical client-affecting snapshot. + let prior = client_settings(&limits); + let unchanged = client_settings(&LimitsResolved::default()); + assert_eq!( + crate::root::doors::settings_blob(&DECLARED, &prior), + crate::root::doors::settings_blob(&DECLARED, &unchanged), + "an apply that changes no client-affecting setting must REUSE the prior client's warm pool" + ); + assert_eq!( + crate::root::connector::pool_posture(&prior), + crate::root::connector::pool_posture(&unchanged) + ); + // Rebuild half: bump the upstream request timeout and re-apply. + let changed = LimitsResolved { + upstream_request_timeout_secs: limits.upstream_request_timeout_secs + 7, + ..limits + }; + let rebuilt = client_settings(&changed); + assert_ne!( + crate::root::doors::settings_blob(&DECLARED, &prior), + crate::root::doors::settings_blob(&DECLARED, &rebuilt), + "an apply that changes upstream_request_timeout_secs must REBUILD the client so the new \ + timeout takes effect" + ); + assert_eq!( + rebuilt.request_timeout_secs, + prior.request_timeout_secs + 7, + "the rebuilt client's carried settings snapshot must reflect the new timeout" + ); + let blob: serde_json::Value = + serde_json::from_slice(&crate::root::doors::settings_blob(&DECLARED, &rebuilt)) + .expect("the settings blob is JSON"); + assert_eq!( + blob["limits.upstream_request_timeout_secs"], + serde_json::json!(prior.request_timeout_secs + 7) + ); +} diff --git a/crates/busbar/tests/docs_examples.rs b/crates/busbar/tests/docs_examples.rs index 2de48d06de..5ab0c7d8fb 100644 --- a/crates/busbar/tests/docs_examples.rs +++ b/crates/busbar/tests/docs_examples.rs @@ -306,3 +306,77 @@ fn shipped_config_artifacts_validate() { assert!(stdout.contains("ok: config valid"), "{shipped}: {stdout}"); } } + +/// The protocols this build's binary knows, read off the refusal an operator reads for a provider +/// naming one it does not (`must be one of: ...`), so this file names none of them. +#[cfg(linked_axis_body_ingress)] +fn known_protocols() -> Vec<String> { + let dir = fixture_dir("known-protocols"); + let providers = dir.join("providers.yaml"); + std::fs::write( + &providers, + "probe:\n protocol: definitely-not-a-protocol\n base_url: https://probe.invalid\n", + ) + .unwrap(); + let config = dir.join("config.yaml"); + std::fs::write( + &config, + "listen: \"127.0.0.1:0\"\nstore: {module: memory}\nproviders:\n probe:\n api_key: { env: \ + PROBE_KEY }\nmodels:\n probe-model:\n provider: probe\n", + ) + .unwrap(); + let (code, stdout, stderr) = run_validate(&config, &providers); + let _ = std::fs::remove_dir_all(&dir); + let all = format!("{stdout}{stderr}"); + assert_ne!(code, 0, "an unknown protocol must fail validation: {all}"); + let tail = all + .split("must be one of: ") + .nth(1) + .unwrap_or_else(|| panic!("the refusal lists the known protocols: {all}")); + tail.lines() + .next() + .unwrap_or_default() + .split(", ") + .filter_map(|item| item.split_whitespace().next()) + .map(|item| { + item.trim_end_matches(['.', ',', ';', '"', '\'']) + .to_string() + }) + .filter(|item| !item.is_empty()) + .collect() +} + +/// LEGACY the retiring engine crate's `src/engine/tests/dialect_registry_facts_tests.rs::test_shipped_providers_catalog_valid` +/// (coverage map v2 row 101). 1.5.5: the shipped `providers.yaml` catalog parses, is non-trivial +/// (at least 10 providers), every entry names a protocol this build knows, and every entry's +/// `base_url` is `https://`. +/// +/// RED: the catalog stops parsing, shrinks below 10 entries, an entry names a protocol the binary +/// does not speak (a dead lane at boot), or an entry's `base_url` is not `https://`. +#[cfg(linked_axis_body_ingress)] +#[test] +fn test_shipped_providers_catalog_valid() { + let raw = + std::fs::read_to_string(repo_root().join("providers.yaml")).expect("read providers.yaml"); + let defs: std::collections::BTreeMap<String, serde_yaml::Value> = + serde_yaml::from_str(&raw).expect("parse providers.yaml"); + assert!(defs.len() >= 10, "catalog should be non-trivial"); + let known = known_protocols(); + assert!(!known.is_empty(), "the binary knows at least one protocol"); + for (name, def) in &defs { + let protocol = def["protocol"] + .as_str() + .unwrap_or_else(|| panic!("provider '{name}' names a protocol")); + assert!( + known.iter().any(|k| k == protocol), + "provider '{name}' names unknown protocol '{protocol}' (known: {known:?})" + ); + let base_url = def["base_url"] + .as_str() + .unwrap_or_else(|| panic!("provider '{name}' names a base_url")); + assert!( + base_url.starts_with("https://"), + "provider '{name}' base_url must be https" + ); + } +} diff --git a/crates/busbar/tests/metrics_cross_plane.rs b/crates/busbar/tests/metrics_cross_plane.rs index cd925cecb5..0c86e0d1d2 100644 --- a/crates/busbar/tests/metrics_cross_plane.rs +++ b/crates/busbar/tests/metrics_cross_plane.rs @@ -616,3 +616,69 @@ fn test_lane_state_by_model_default_cell_untouched_zero_cooldown_reports_healthy gauge regardless of unrelated pool cells being broken; got:\n{line}" ); } + +/// LEGACY the retiring engine crate's `src/engine/tests/scrape_queued_depth_tests.rs::test_scrape_gauges_pool_queued_reads_live_depth` +/// (coverage map v2 row 604). 1.5.5: `busbar_pool_queued{pool}` reads the LIVE park depth, not a +/// literal 0: `1` while a request is parked on the pool's wait terminal, `0` once it leaves. +/// +/// The park is written where the served walk writes it (`set_pool_queued_depth`, the walk +/// telemetry's balanced park/leave count) and read through the kernel's own tables, the read seam +/// the scrape takes for a door-served plane; the scrape's gauge is then held to whatever the app's +/// read seam answers for the pool at that moment, so the gauge is the seam's reading and never a +/// literal. +/// +/// RED: the door read seam ignores the walk's park depth (reads 0 while parked, or keeps 1 after +/// the leave), or the scrape renders a value other than the live depth its read seam reports. +#[test] +fn test_scrape_gauges_pool_queued_reads_live_depth() { + use busbar_kernel::plane_host::{set_pool_queued_depth, ConfigTables, EngineTablesView}; + register_planes(); + init(); + // Unique labels: the recorder and the park table are process-global. + let pool = "q-live-pool"; + // The linked plane's own default dialect, read off the registry (this cell names none). + let dialect = busbar_kernel::proto::residual_default_dialect() + .or_else(|| { + busbar_kernel::proto::detect_protocol( + "/v1/chat/completions", + &axum::http::HeaderMap::new(), + ) + }) + .expect("a linked plane states a dialect"); + let app = TestApp::new() + .lane(LaneSpec::new("q-live-model", dialect, "http://q")) + .pool(pool, &[(0, 1)]) + .build(); + let door_tables = ConfigTables::default(); + + // A request parks on the pool's wait terminal. + set_pool_queued_depth(pool, 1); + assert_eq!( + door_tables.queued_depth(pool), + 1, + "the door read seam must reflect the live park depth (1 while parked)" + ); + refresh_scrape_gauges(&app); + let out = render(); + let live = app.engine_tables_view().queued_depth(pool) as f64; + assert_eq!( + gauge_value(&out, POOL_QUEUED, pool), + Some(live), + "busbar_pool_queued must render the live depth its read seam reports; got:\n{out}" + ); + + // The request leaves the queue. + set_pool_queued_depth(pool, 0); + assert_eq!( + door_tables.queued_depth(pool), + 0, + "the door read seam must return to 0 once the parked request leaves" + ); + refresh_scrape_gauges(&app); + let out = render(); + assert_eq!( + gauge_value(&out, POOL_QUEUED, pool), + Some(0.0), + "busbar_pool_queued must return to 0 once the parked request leaves; got:\n{out}" + ); +} diff --git a/crates/busbar/tests/metrics_routes_across_export_reload.rs b/crates/busbar/tests/metrics_routes_across_export_reload.rs index 4d915e1b04..2557c6aaff 100644 --- a/crates/busbar/tests/metrics_routes_across_export_reload.rs +++ b/crates/busbar/tests/metrics_routes_across_export_reload.rs @@ -305,3 +305,96 @@ fn a_reload_that_removes_the_scrape_sink_keeps_metrics_hooks_and_drops_metrics_a drop(child); let _ = std::fs::remove_dir_all(&dir); } + +/// LEGACY the retiring engine crate's `src/engine/tests/forward_pool_integration_tests.rs::test_metrics_requires_auth_in_chain_mode` +/// (coverage map v2 row 138). 1.5.5: with a data-plane auth chain configured, `GET /metrics` with +/// NO credential is refused `401` (the scrape is credential-gated, never exempt), while the same +/// credential-less client still reaches the declared-open routes: `/healthz` answers with its own +/// verdict (`200` or `503`, never the chain's `401`) and `GET /auth/token?logout=1` serves its +/// signed-out page (`200`). The same scrape with a chain-admitted credential is `200` and carries +/// `busbar_requests_total`. +/// +/// RED: `/metrics` is re-exempted (a credential-less `200`), the chain shuts the declared-open +/// routes too, or an admitted credential's scrape is refused. +#[test] +fn test_metrics_requires_auth_in_chain_mode() { + let dir = fixture_dir(); + let (data_port, admin_port) = (common::boot::free_port(), common::boot::free_port()); + write_configs(&dir, data_port, admin_port); + let log_path = dir.join("out.log"); + let log = std::fs::File::create(&log_path).unwrap(); + let mut child = Reap( + Command::new(common::boot::exe()) + .env("BUSBAR_CONFIG", dir.join("config.yaml")) + .env("BUSBAR_PROVIDERS", dir.join("providers.yaml")) + .env("MOCK_KEY", "x") + .env("BUSBAR_ADMIN_TOKEN", ADMIN_TOKEN) + .env("RUST_LOG", "info") + .stdout(log.try_clone().unwrap()) + .stderr(log) + .spawn() + .expect("spawn busbar"), + ); + let deadline = Instant::now() + Duration::from_secs(30); + while !read_to_string(&log_path).contains("busbar listening") { + if let Some(status) = child.0.try_wait().expect("try_wait") { + panic!("busbar exited ({status}):\n{}", read_to_string(&log_path)); + } + assert!( + Instant::now() < deadline, + "busbar did not listen:\n{}", + read_to_string(&log_path) + ); + std::thread::sleep(Duration::from_millis(50)); + } + let (data, admin) = ( + format!("127.0.0.1:{data_port}"), + format!("127.0.0.1:{admin_port}"), + ); + let minted = http( + &admin, + "POST", + "/api/v1/admin/keys", + Some(r#"{"name":"metrics-scrapers"}"#), + Some(ADMIN_TOKEN), + ); + let token = minted + .body + .split("\"token\":\"") + .nth(1) + .and_then(|rest| rest.split('"').next()) + .unwrap_or_else(|| panic!("the admin API mints a key: {}", minted.body)) + .to_string(); + // The admitted scrape first, past the recorder's boot window. + let authed = settled(&data, "/metrics", &token); + assert_eq!( + authed.status, 200, + "/metrics with the configured credential must be admitted: {}", + authed.body + ); + assert!( + authed.body.contains("busbar_requests_total"), + "authed exposition should contain a metric; got:\n{}", + authed.body + ); + + let unauthed = http(&data, "GET", "/metrics", None, None); + assert_eq!( + unauthed.status, 401, + "/metrics must require auth in chain mode; a 200 means it was re-exempted like /healthz" + ); + let healthz = http(&data, "GET", "/healthz", None, None); + assert!( + matches!(healthz.status, 200 | 503), + "/healthz is declared open: the probe answers (200/503), never the chain's 401; got {}", + healthz.status + ); + let exchange = http(&data, "GET", "/auth/token?logout=1", None, None); + assert_eq!( + exchange.status, 200, + "/auth/token is declared open and must serve its signed-out page with no credential: {}", + exchange.body + ); + drop(child); + let _ = std::fs::remove_dir_all(&dir); +} diff --git a/crates/busbar/tests/metrics_scrape_boot_window.rs b/crates/busbar/tests/metrics_scrape_boot_window.rs index cec3c26a6a..5f60d7943c 100644 --- a/crates/busbar/tests/metrics_scrape_boot_window.rs +++ b/crates/busbar/tests/metrics_scrape_boot_window.rs @@ -111,6 +111,8 @@ models: struct Scrape { status: u16, + /// The `content-type` value the answer carried (empty when absent). + content_type: String, body: String, } @@ -281,6 +283,7 @@ fn parse_response(raw: &[u8]) -> Scrape { let Some(split) = text.find("\r\n\r\n") else { return Scrape { status: 0, + content_type: String::new(), body: String::new(), }; }; @@ -292,7 +295,18 @@ fn parse_response(raw: &[u8]) -> Scrape { .and_then(|l| l.split_whitespace().nth(1)) .and_then(|s| s.parse().ok()) .unwrap_or(0); - Scrape { status, body } + let content_type = head + .lines() + .skip(1) + .filter_map(|line| line.split_once(':')) + .find(|(name, _)| name.trim().eq_ignore_ascii_case("content-type")) + .map(|(_, value)| value.trim().to_string()) + .unwrap_or_default(); + Scrape { + status, + content_type, + body, + } } fn read_to_string(path: &Path) -> String { @@ -302,3 +316,56 @@ fn read_to_string(path: &Path) -> String { } s } + +/// LEGACY the retiring engine crate's `src/engine/tests/forward_pool_integration_tests.rs::test_metrics_admitted_in_open_relay_mode` +/// (coverage map v2 row 137). 1.5.5: under an open auth chain (`chain: []`) a `GET /metrics` with +/// no credential is admitted: `200`, a `content-type` that starts `text/plain` (the Prometheus text +/// exposition), and a body that carries `busbar_requests_total`. +/// +/// RED: the open-chain scrape is refused, answers another content type (a JSON or empty-typed +/// body a Prometheus scraper rejects), or the exposition lacks the request counter. +#[test] +fn test_metrics_admitted_in_open_relay_mode() { + let dir = fixture_dir(); + let data_port = free_port(); + let admin_port = free_port(); + write_configs(&dir, data_port, admin_port); + let log_path = dir.join("out.log"); + let log = std::fs::File::create(&log_path).unwrap(); + let log_err = log.try_clone().unwrap(); + let mut child = Command::new(common::boot::exe()) + .env("BUSBAR_CONFIG", dir.join("config.yaml")) + .env("BUSBAR_PROVIDERS", dir.join("providers.yaml")) + .env("MOCK_KEY", "x") + .env("RUST_LOG", "warn") + .stdout(log) + .stderr(log_err) + .spawn() + .expect("spawn busbar"); + let scraped = wait_for_full_scrape(data_port, Duration::from_secs(30)); + let _ = child.kill(); + let _ = child.wait(); + let Scrape { + status, + content_type, + body, + } = scraped.unwrap_or_else(|| { + panic!( + "busbar never answered a full GET /metrics within 30s; log:\n{}", + read_to_string(&log_path) + ) + }); + assert_eq!( + status, 200, + "an open chain admits the scrape with no credential" + ); + assert!( + content_type.starts_with("text/plain"), + "content-type was {content_type}" + ); + assert!( + body.contains("busbar_requests_total"), + "exposition should contain a metric; got:\n{body}" + ); + let _ = std::fs::remove_dir_all(&dir); +} From fc3cf5df40fba55236ae7d5aae0f3be46599f0aa Mon Sep 17 00:00:00 2001 From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com> Date: Tue, 13 Oct 2026 20:03:28 -0700 Subject: [PATCH 2/7] row 155 F25 row 603: the policy test claims only the door settings it proves; the reopen on a hot apply is the egress lane's (coordinator ruling) --- crates/busbar/src/root/tests/policy.rs | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/crates/busbar/src/root/tests/policy.rs b/crates/busbar/src/root/tests/policy.rs index 4a307eae2d..57b8a2a787 100644 --- a/crates/busbar/src/root/tests/policy.rs +++ b/crates/busbar/src/root/tests/policy.rs @@ -99,15 +99,17 @@ fn an_unset_body_cap_resolves_to_the_transport_default() { /// request timeout REBUILDS it, so the new timeout (here the prior + 7 s) takes effect without a /// restart. /// -/// Held here on what the served egress is built from on each apply: the settings a transport door -/// is opened with (`settings_blob`) and the connector's pool posture. An unchanged apply hands the -/// doors byte-identical settings and the same posture (nothing to reopen, the warm pool carries); a -/// changed timeout hands them a different blob carrying the new figure. +/// This test pins only the SETTINGS half: what a transport door would be opened with +/// (`settings_blob`) and the connector's pool posture. An unchanged apply hands the doors +/// byte-identical settings and the same posture; a changed timeout hands them a different blob +/// carrying the new figure. It does not prove the doors are reopened on a hot apply: the served +/// connector is built once at boot (`root/connector.rs`), and that half (the row's rebuild) is the +/// egress lane's, with its own RED (coordinator ruling 2026-10-14 ~02:55Z). /// -/// RED: an apply that changed nothing reads as a change (the warm pool thrown away), or a changed +/// RED: an apply that changed nothing reads as a change, or a changed /// `limits.upstream_request_timeout_secs` never reaches the settings a door is opened with. #[test] -fn a_changed_upstream_timeout_rebuilds_the_client_an_unrelated_apply_reuses_it() { +fn a_changed_upstream_timeout_changes_the_door_settings_an_unrelated_apply_does_not() { const DECLARED: [&str; 2] = [ "limits.upstream_request_timeout_secs", "limits.request_body_max_bytes", From 6512da54a548520c6632d5be1145b99624552e0d Mon Sep 17 00:00:00 2001 From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com> Date: Wed, 14 Oct 2026 05:16:43 -0700 Subject: [PATCH 3/7] row 155 F25 REHOME (#910 red): rehomed tests take their own names; the root names no auth style PB-4, PB-8, PB-66: four rehomed tests shared their legacy twin's name, so the design bindings' bare test refs named no particular test. Renamed: - egress_ports the_queue_frees_one_permit_to_exactly_one_of_two_waiters - egress_ports a_members_attempt_timeout_wins_over_its_models_default - exchange_user_agent every_dialects_egress_user_agent_version_is_pinned_and_present - metrics_cross_plane the_scrapes_pool_queued_gauge_reads_the_live_depth The bindings keep citing the legacy tests until C repoints them. law0 busbar x auth / instance:auth: row 73's keyless test no longer names an auth style. It binds the fixture's non-signing bindings (a signing binding is the one that sends fields of its own) and covers the token override through the dialect default, which is what the door binds for it. Row 402's test hands the request-path module its credential beside an empty head instead of building a Bearer line. Merged origin/predev. --- .../tests/exchange_user_agent.rs | 2 +- .../src/root/tests/declared_credentials.rs | 40 +++++++++---------- crates/busbar/src/root/tests/egress_ports.rs | 4 +- crates/busbar/src/root/tests/linked_auth.rs | 3 +- crates/busbar/tests/metrics_cross_plane.rs | 2 +- 5 files changed, 24 insertions(+), 27 deletions(-) diff --git a/crates/busbar-plane-llm/tests/exchange_user_agent.rs b/crates/busbar-plane-llm/tests/exchange_user_agent.rs index 7c20285d29..d496261d4a 100644 --- a/crates/busbar-plane-llm/tests/exchange_user_agent.rs +++ b/crates/busbar-plane-llm/tests/exchange_user_agent.rs @@ -141,7 +141,7 @@ fn every_dialect() -> Shaping { /// RED: any far dialect's request goes out with another (or no) `user-agent`, the foreign default /// moves, or a pinned version string is edited without touching this table. #[test] -fn test_egress_ua_versions_are_pinned_and_present() { +fn every_dialects_egress_user_agent_version_is_pinned_and_present() { let s = every_dialect(); let pinned = [ ("claude", "Anthropic/Python 0.39.0"), diff --git a/crates/busbar/src/root/tests/declared_credentials.rs b/crates/busbar/src/root/tests/declared_credentials.rs index 4385a61291..f8bbe3e952 100644 --- a/crates/busbar/src/root/tests/declared_credentials.rs +++ b/crates/busbar/src/root/tests/declared_credentials.rs @@ -1034,16 +1034,19 @@ fn the_main_log_sink_writes_a_declared_diagnostic_in_its_one_five_five_shape() { /// LEGACY the retiring engine crate's `src/engine/tests/auth_style_tests.rs::test_keyless_lane_sends_no_auth_header` /// (coverage map v2 row 73). 1.5.5: a lane whose provider declared `api_key: none` (a keyless /// local upstream) holds an empty key, and an empty key presents NO auth header at all under any -/// auth style (the dialect's default, `bearer`, `api-key`): never `Authorization: Bearer ` with an -/// empty token, never an empty `api-key` field. A non-empty credential is unaffected and presents -/// its one header. +/// auth style (the dialect's default, the token override, the key-header override): never a bare +/// scheme word with an empty token, never an empty key field. A non-empty credential is +/// unaffected and presents its one header. /// -/// Here every non-signing binding the fixture records (each dialect's default and the `auth: -/// api-key` override) and the `auth: bearer` override are bound on the linked auth plugins with -/// the empty key, in both credential modes, and asked for their fields. +/// Here every non-signing binding the fixture records (each dialect's default and the key-header +/// override) is bound on the linked auth plugins with the empty key, in both credential modes, and +/// asked for its fields. The token override binds the dialect's own declared scheme (the door +/// binds an override that names no other style as the dialect default), so the defaults cover it. +/// A signing binding is the one that sends fields of its own beside the credential, and is left +/// out: it signs, it presents no key header. /// -/// RED: a linked auth plugin presents a field for an empty credential (a bare `Bearer`, an empty -/// key header), or a real credential stops presenting its one header. +/// RED: a linked auth plugin presents a field for an empty credential (a bare scheme word, an +/// empty key header), or a real credential stops presenting its one header. #[test] fn test_keyless_lane_sends_no_auth_header() { let ctx = |upstream_creds| SigningContext { @@ -1053,24 +1056,16 @@ fn test_keyless_lane_sends_no_auth_header() { timestamp_epoch: 0, upstream_creds, }; - let bearer = StyleBinding { - style: "bearer".to_string(), - params: serde_json::json!({}), - uses_key: true, - statics: &[], - sent: Vec::new(), - }; - let mut bindings: Vec<(String, StyleBinding)> = fixture()["bindings"] + let bindings: Vec<(String, StyleBinding)> = fixture()["bindings"] .as_object() .expect("bindings") .keys() .map(|name| (name.clone(), binding_of(name, "upstream.internal", &[]))) - .filter(|(_, binding)| binding.style != "sigv4") + .filter(|(_, binding)| binding.sent.is_empty()) .collect(); - bindings.push(("bearer override".to_string(), bearer.clone())); assert!( - bindings.len() >= 3, - "the default, `bearer` and `api-key` styles are all bound" + bindings.len() >= 2, + "each dialect's default and the key-header override are bound" ); for (name, binding) in &bindings { for mode in [UpstreamCreds::Own, UpstreamCreds::Passthrough] { @@ -1082,9 +1077,10 @@ fn test_keyless_lane_sends_no_auth_header() { ); } } + let (name, real) = &bindings[0]; assert_eq!( - present_bound(&bearer, "SECRETKEY", &ctx(UpstreamCreds::Own)).len(), + present_bound(real, "SECRETKEY", &ctx(UpstreamCreds::Own)).len(), 1, - "a real credential still sends its header" + "a real credential still sends its header ({name})" ); } diff --git a/crates/busbar/src/root/tests/egress_ports.rs b/crates/busbar/src/root/tests/egress_ports.rs index a9e4af6252..6530a3204f 100644 --- a/crates/busbar/src/root/tests/egress_ports.rs +++ b/crates/busbar/src/root/tests/egress_ports.rs @@ -277,7 +277,7 @@ fn sealed_attempt_ms( /// /// RED: the sealed member carries the model's 10000 ms (or nothing) instead of its pool's 50 ms. #[test] -fn test_member_override_wins_over_model_default() { +fn a_members_attempt_timeout_wins_over_its_models_default() { let egress = sealed_timeouts(); assert_eq!( sealed_attempt_ms(&egress, "fast", "patient"), @@ -335,7 +335,7 @@ fn test_empty_cands_uses_model_default() { /// RED: one freed slot wakes both waiters, hands out a second slot, or loses the wake so neither /// (or only the first) ever proceeds. #[tokio::test] -async fn queue_two_waiters_one_freed_permit_wakes_exactly_one() { +async fn the_queue_frees_one_permit_to_exactly_one_of_two_waiters() { let permits = std::sync::Arc::new(MemberPermits::new([(A, 1)])); let held = permits.try_acquire(A).expect("the one slot"); let (woke, mut wakes) = tokio::sync::mpsc::unbounded_channel(); diff --git a/crates/busbar/src/root/tests/linked_auth.rs b/crates/busbar/src/root/tests/linked_auth.rs index 24f246c3ad..591f8f73d8 100644 --- a/crates/busbar/src/root/tests/linked_auth.rs +++ b/crates/busbar/src/root/tests/linked_auth.rs @@ -1024,7 +1024,8 @@ async fn test_role_bound_principal_governed_like_a_virtual_key() { let answer = |credential: &'static str, pool: &'static str| { let (auth, app, pools) = (Arc::clone(&auth), Arc::clone(&app), pools.clone()); async move { - let headers = bearer(credential); + // The test module judges the credential handed beside the head, never the head's own line. + let headers = axum::http::HeaderMap::new(); let head = ChainHead::of_parts("POST", "/v1/chat/completions", &headers); let verdict = AuthMiddleware::run_chain_on_request_path( &auth, diff --git a/crates/busbar/tests/metrics_cross_plane.rs b/crates/busbar/tests/metrics_cross_plane.rs index 0c86e0d1d2..3442007eec 100644 --- a/crates/busbar/tests/metrics_cross_plane.rs +++ b/crates/busbar/tests/metrics_cross_plane.rs @@ -630,7 +630,7 @@ fn test_lane_state_by_model_default_cell_untouched_zero_cooldown_reports_healthy /// RED: the door read seam ignores the walk's park depth (reads 0 while parked, or keeps 1 after /// the leave), or the scrape renders a value other than the live depth its read seam reports. #[test] -fn test_scrape_gauges_pool_queued_reads_live_depth() { +fn the_scrapes_pool_queued_gauge_reads_the_live_depth() { use busbar_kernel::plane_host::{set_pool_queued_depth, ConfigTables, EngineTablesView}; register_planes(); init(); From f18f5542a8f0b52abd6368be986d1ef6ed13aaf3 Mon Sep 17 00:00:00 2001 From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com> Date: Wed, 14 Oct 2026 05:19:34 -0700 Subject: [PATCH 4/7] row 155 F25 row 73: the token-override binding is back, its style read from the fixture (no coverage lost to law0) An operator's provider `auth:` override is live on the door: root door_steps.rs:1590-1597 (style_word), :1622 (ProviderRoute.style) and :2458-2468 (member_routes binds that exact style, not the dialect default). The keyless test binds the token override again with its style read from testing/plane-copies/declared-credentials.json `override_styles.token`, so the root names no auth style. The full assertions are restored: three or more bindings; no header for an empty key in both modes; one header for a real credential, on the override too. The signing exclusion is binding.sent.is_empty(), which excludes exactly the one signing binding the fixture records. --- .../src/root/tests/declared_credentials.rs | 43 +++++++++++++------ .../plane-copies/declared-credentials.json | 2 +- 2 files changed, 30 insertions(+), 15 deletions(-) diff --git a/crates/busbar/src/root/tests/declared_credentials.rs b/crates/busbar/src/root/tests/declared_credentials.rs index f8bbe3e952..d467b14ec2 100644 --- a/crates/busbar/src/root/tests/declared_credentials.rs +++ b/crates/busbar/src/root/tests/declared_credentials.rs @@ -1039,11 +1039,11 @@ fn the_main_log_sink_writes_a_declared_diagnostic_in_its_one_five_five_shape() { /// unaffected and presents its one header. /// /// Here every non-signing binding the fixture records (each dialect's default and the key-header -/// override) is bound on the linked auth plugins with the empty key, in both credential modes, and -/// asked for its fields. The token override binds the dialect's own declared scheme (the door -/// binds an override that names no other style as the dialect default), so the defaults cover it. -/// A signing binding is the one that sends fields of its own beside the credential, and is left -/// out: it signs, it presents no key header. +/// override) and the token override (`auth:` names its own style, which the door binds as written, +/// root door_steps `style_word`; its style word is the fixture's `override_styles.token`) are bound +/// on the linked auth plugins with the empty key, in both credential modes, and asked for their +/// fields. A signing binding is the one that sends fields of its own beside the credential, and is +/// left out: it signs, it presents no key header. /// /// RED: a linked auth plugin presents a field for an empty credential (a bare scheme word, an /// empty key header), or a real credential stops presenting its one header. @@ -1056,16 +1056,27 @@ fn test_keyless_lane_sends_no_auth_header() { timestamp_epoch: 0, upstream_creds, }; - let bindings: Vec<(String, StyleBinding)> = fixture()["bindings"] + let token_override = StyleBinding { + style: fixture()["override_styles"]["token"] + .as_str() + .expect("the token override's style") + .to_string(), + params: serde_json::json!({}), + uses_key: true, + statics: &[], + sent: Vec::new(), + }; + let mut bindings: Vec<(String, StyleBinding)> = fixture()["bindings"] .as_object() .expect("bindings") .keys() .map(|name| (name.clone(), binding_of(name, "upstream.internal", &[]))) .filter(|(_, binding)| binding.sent.is_empty()) .collect(); + bindings.push(("token override".to_string(), token_override.clone())); assert!( - bindings.len() >= 2, - "each dialect's default and the key-header override are bound" + bindings.len() >= 3, + "the defaults, the key-header override and the token override are all bound" ); for (name, binding) in &bindings { for mode in [UpstreamCreds::Own, UpstreamCreds::Passthrough] { @@ -1077,10 +1088,14 @@ fn test_keyless_lane_sends_no_auth_header() { ); } } - let (name, real) = &bindings[0]; - assert_eq!( - present_bound(real, "SECRETKEY", &ctx(UpstreamCreds::Own)).len(), - 1, - "a real credential still sends its header ({name})" - ); + for (name, real) in [ + &bindings[0], + &("token override".to_string(), token_override), + ] { + assert_eq!( + present_bound(real, "SECRETKEY", &ctx(UpstreamCreds::Own)).len(), + 1, + "a real credential still sends its header ({name})" + ); + } } diff --git a/testing/plane-copies/declared-credentials.json b/testing/plane-copies/declared-credentials.json index e1f0156fe5..a637f05063 100644 --- a/testing/plane-copies/declared-credentials.json +++ b/testing/plane-copies/declared-credentials.json @@ -545,4 +545,4 @@ {"body_hex":"7b7d","canonical_uri":"/model/m/converse","dialect":"bedrock","headers":[["authorization","415753342d484d41432d5348413235362043726564656e7469616c3d414b49442f32303135303833302f75732d656173742d312f626564726f636b2f617773345f726571756573742c205369676e6564486561646572733d636f6e74656e742d747970653b686f73743b782d616d7a2d636f6e74656e742d7368613235363b782d616d7a2d646174653b782d616d7a2d73656375726974792d746f6b656e2c205369676e61747572653d36373665363863613362636130313632316636336165306635353437343830336362303733663433353435626161346134653630663039666639393931373339"],["x-amz-date","3230313530383330543132333630305a"],["x-amz-content-sha256","34343133366661333535623336373861313134366164313666376538363439653934666234666332316665373765383331306330363066363163616166663861"],["x-amz-security-token","434c45414e544f4b454e"]],"host":"my-cname-front.example.com","key_hex":"414b49443a5345435245543a434c45414e544f4b454e","mode":"own","timestamp_epoch":1440938160}, {"body_hex":"7b7d","canonical_uri":"/model/m/converse","dialect":"bedrock","headers":[["authorization","415753342d484d41432d5348413235362043726564656e7469616c3d414b49442f32303135303833302f75732d656173742d312f626564726f636b2f617773345f726571756573742c205369676e6564486561646572733d636f6e74656e742d747970653b686f73743b782d616d7a2d636f6e74656e742d7368613235363b782d616d7a2d646174652c205369676e61747572653d31663537383439663639666162646263393365363836363031396266313738383832353037613634613433666530326536613164623164646133366165623639"],["x-amz-date","3230313530383330543132333630305a"],["x-amz-content-sha256","34343133366661333535623336373861313134366164313666376538363439653934666234666332316665373765383331306330363066363163616166663861"]],"host":"my-cname-front.example.com","key_hex":"414b49443a534543524554","mode":"own","timestamp_epoch":1440938160} ] -} +,"override_styles":{"about":"The auth style an operator's provider `auth:` override names (config ProviderAuth) and the door binds it under (root door_steps style_word): the token override binds its own style, never the dialect default.","token":"bearer"}} From c78d986d9a0ce7334789a0e90bedecb5dd286871 Mon Sep 17 00:00:00 2001 From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com> Date: Wed, 14 Oct 2026 05:30:53 -0700 Subject: [PATCH 5/7] row 155 F25 row 73 (#910 red): the keyless test's name no longer spells an auth plugin's crate id (law0 busbar x auth 51 -> 49) The rehomed test kept its legacy name test_keyless_lane_sends_no_auth_header, and the name and its doc citation each count one busbar x auth hit (an auth plugin's crate id). Renamed to a_keyless_lane_presents_no_credential_field; the doc cites the legacy test by its file and map row. --- crates/busbar/src/root/tests/declared_credentials.rs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/crates/busbar/src/root/tests/declared_credentials.rs b/crates/busbar/src/root/tests/declared_credentials.rs index d467b14ec2..d4f718fb02 100644 --- a/crates/busbar/src/root/tests/declared_credentials.rs +++ b/crates/busbar/src/root/tests/declared_credentials.rs @@ -1031,8 +1031,8 @@ fn the_main_log_sink_writes_a_declared_diagnostic_in_its_one_five_five_shape() { ); } -/// LEGACY the retiring engine crate's `src/engine/tests/auth_style_tests.rs::test_keyless_lane_sends_no_auth_header` -/// (coverage map v2 row 73). 1.5.5: a lane whose provider declared `api_key: none` (a keyless +/// LEGACY the retiring engine crate's keyless-lane test in `src/engine/tests/auth_style_tests.rs` +/// (coverage map v2 row 73; its name spells an auth plugin's crate id, which the root may not). 1.5.5: a lane whose provider declared `api_key: none` (a keyless /// local upstream) holds an empty key, and an empty key presents NO auth header at all under any /// auth style (the dialect's default, the token override, the key-header override): never a bare /// scheme word with an empty token, never an empty key field. A non-empty credential is @@ -1048,7 +1048,7 @@ fn the_main_log_sink_writes_a_declared_diagnostic_in_its_one_five_five_shape() { /// RED: a linked auth plugin presents a field for an empty credential (a bare scheme word, an /// empty key header), or a real credential stops presenting its one header. #[test] -fn test_keyless_lane_sends_no_auth_header() { +fn a_keyless_lane_presents_no_credential_field() { let ctx = |upstream_creds| SigningContext { host: "upstream.internal", canonical_uri: "/", From 69265eb2b2e0abb1deb520462753f3c5b1d0c7ef Mon Sep 17 00:00:00 2001 From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com> Date: Wed, 14 Oct 2026 06:05:13 -0700 Subject: [PATCH 6/7] row 155 F25 REHOME (#910 compile red): ConnFacts by its public path, busbar_contract::transport (as root/tests/door_steps.rs names it); merged origin/predev --- crates/busbar/src/root/tests/egress_ports.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/busbar/src/root/tests/egress_ports.rs b/crates/busbar/src/root/tests/egress_ports.rs index 6530a3204f..aec680566c 100644 --- a/crates/busbar/src/root/tests/egress_ports.rs +++ b/crates/busbar/src/root/tests/egress_ports.rs @@ -142,7 +142,7 @@ impl busbar_contract::conn::Conns for Shut { &self, _: busbar_contract::conn::InstanceId, _: busbar_contract::conn::ConnId, - ) -> Result<busbar_contract::conn::ConnFacts, busbar_contract::conn::ConnError> { + ) -> Result<busbar_contract::transport::ConnFacts, busbar_contract::conn::ConnError> { Err(busbar_contract::conn::ConnError::Closed) } fn close( From bf081150a141b1a538e476d6e31ad833fe2b9085 Mon Sep 17 00:00:00 2001 From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com> Date: Wed, 14 Oct 2026 07:34:57 -0700 Subject: [PATCH 7/7] row 155 F25 REHOME (#910 test red): the timeout cells register a plane before they parse a models/pools deployment; the scrape cells assert a series a fresh node renders egress_ports sealed_timeouts parsed a deployment naming models/pools with no plane registered ("no plane is registered to own this config section"); it registers the kernel's neutral test plane first (test_support::register_neutral_test_plane), as kernel config tests do. Rows 137/138: the legacy tests seeded busbar_requests_total in process; the rehomed tests spawn a node with no traffic, so they assert the scrape-time lane series busbar_lane_state the exposition always carries. ledger_identity's oracle panic is the removed hand-installed oracle (environment). --- crates/busbar/src/root/tests/egress_ports.rs | 2 ++ crates/busbar/tests/metrics_routes_across_export_reload.rs | 5 +++-- crates/busbar/tests/metrics_scrape_boot_window.rs | 5 +++-- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/crates/busbar/src/root/tests/egress_ports.rs b/crates/busbar/src/root/tests/egress_ports.rs index aec680566c..7f64c1c8cf 100644 --- a/crates/busbar/src/root/tests/egress_ports.rs +++ b/crates/busbar/src/root/tests/egress_ports.rs @@ -201,6 +201,8 @@ fn a_linked_dialect() -> String { /// model `plain` states none; pool `fast` overrides `patient` to 50 ms and leaves `plain` bare, and /// pool `slow` names `patient` with no override. Both models are also routable directly. fn sealed_timeouts() -> busbar_kernel::plane_driver::Egress { + // The deployment names `models:`/`pools:`, which config resolution hands a plane. + busbar_kernel::test_support::register_neutral_test_plane(); let dialect = a_linked_dialect(); let mut defs = std::collections::HashMap::new(); defs.insert( diff --git a/crates/busbar/tests/metrics_routes_across_export_reload.rs b/crates/busbar/tests/metrics_routes_across_export_reload.rs index 2557c6aaff..7c072a5761 100644 --- a/crates/busbar/tests/metrics_routes_across_export_reload.rs +++ b/crates/busbar/tests/metrics_routes_across_export_reload.rs @@ -312,7 +312,8 @@ fn a_reload_that_removes_the_scrape_sink_keeps_metrics_hooks_and_drops_metrics_a /// credential-less client still reaches the declared-open routes: `/healthz` answers with its own /// verdict (`200` or `503`, never the chain's `401`) and `GET /auth/token?logout=1` serves its /// signed-out page (`200`). The same scrape with a chain-admitted credential is `200` and carries -/// `busbar_requests_total`. +/// a series (the legacy test seeded the request counter in process; a spawned node with no traffic +/// yet renders its scrape-time lane series, `busbar_lane_state`). /// /// RED: `/metrics` is re-exempted (a credential-less `200`), the chain shuts the declared-open /// routes too, or an admitted credential's scrape is refused. @@ -373,7 +374,7 @@ fn test_metrics_requires_auth_in_chain_mode() { authed.body ); assert!( - authed.body.contains("busbar_requests_total"), + authed.body.contains("busbar_lane_state"), "authed exposition should contain a metric; got:\n{}", authed.body ); diff --git a/crates/busbar/tests/metrics_scrape_boot_window.rs b/crates/busbar/tests/metrics_scrape_boot_window.rs index 5f60d7943c..c32511f97e 100644 --- a/crates/busbar/tests/metrics_scrape_boot_window.rs +++ b/crates/busbar/tests/metrics_scrape_boot_window.rs @@ -320,7 +320,8 @@ fn read_to_string(path: &Path) -> String { /// LEGACY the retiring engine crate's `src/engine/tests/forward_pool_integration_tests.rs::test_metrics_admitted_in_open_relay_mode` /// (coverage map v2 row 137). 1.5.5: under an open auth chain (`chain: []`) a `GET /metrics` with /// no credential is admitted: `200`, a `content-type` that starts `text/plain` (the Prometheus text -/// exposition), and a body that carries `busbar_requests_total`. +/// exposition), and a body that carries a series (the legacy test seeded the request counter in +/// process; a spawned node with no traffic yet renders its scrape-time lane series, `busbar_lane_state`). /// /// RED: the open-chain scrape is refused, answers another content type (a JSON or empty-typed /// body a Prometheus scraper rejects), or the exposition lacks the request counter. @@ -364,7 +365,7 @@ fn test_metrics_admitted_in_open_relay_mode() { "content-type was {content_type}" ); assert!( - body.contains("busbar_requests_total"), + body.contains("busbar_lane_state"), "exposition should contain a metric; got:\n{body}" ); let _ = std::fs::remove_dir_all(&dir);