Repository navigation
P5 rulings: base layer lays pinned transports; linked-dropped-features and plugin-closure-deps read pinned plugins (stacked on #894, #901) - #935
Merged
Conversation
…p, pulled at a pinned rev; every gate reads the pinned planes as its base layer (P5, rows 106/107) - crates/busbar-plane-mcp is deleted. GetBusbar/busbar-plane-mcp holds it, history imported with filter-repo; its logic crate is predev 00555bd's crate and its -plugin cdylib runs busbar's published conformance suite. The root pins it as one git row; the root's two edges take the workspace row; deny.toml allows the repo; plugins.yaml drops pending_crate and checks busbar out (its tests read the battery and qa/method-inventory.json at the pin). - THE BASE LAYER (ARCHITECT row 106 (A)): Ctx gains a base beneath the overlay and above the disk. Ctx::workspace lays every pinned package of the plane kind at crates/<package>, read from the checkout cargo metadata resolves for the rev Cargo.lock pins (kind_isolation::plane_base), never written into the tree. with_overlay keeps it, so a plant still wins. Generic over the kind, no plane named. Fails closed: a pinned plane cargo cannot resolve is an Err naming it and its rev. kind-isolation's own mount is unchanged. No ledger row moves. - RED arms: xtask/tests/pinned_planes_base.rs (the base is laid from the checkout and nothing of it is on disk; a plant wins over it; structure-lint, config-schema, no-float-money, plane-purity and reachability each lose a passing row without it); declared_classes reads the pinned planes and none without the base. - The tests that read the filesystem resolve a pinned plane through the same rule (crates/busbar/tests/common/pinned_planes.rs): capability-equality's proven mcp-server cells and its five-plane floor (with a RED arm that the evidence is not on disk and is read from the checkout); the kernel trust and core-admin plane-key ratchets take the pinned planes' keys; proto-deletion-gate.sh reads the door crate from its checkout. - plugin-ci.yml: a plane repo runs plane-purity, structure-lint and config-schema at its busbar pin over its own change (scripts/fleet/plane-gates.sh, BUSBAR_PLANE_SOURCE): no row that passes over busbar's pinned plane may fail over the change.
… take the pinned planes too (tests/common/pinned.rs, fail-closed), and the sibling set is every plane the roster registers, with its five-plane floor (ARCHITECT row 106 (A))
…a door home; the plane step is an xtask plugin-gate; the pin moves to the merged plugin head - Ctx::exists and Ctx::is_dir answer a directory the base layer lays (a pinned plane's crate and every directory in it), and Ctx::base_children lists what it lays under a directory: qa-names, plane-purity:roots, plane-pricing-blindness and structure-lint's scope rows read the pinned plane where it lived. construction's glob_dirs lists the laid crate beside the disk's, so the census's plane glob still matches its five crates. - workspace-deps: a manifest the base lays is a pinned git dependency, never a crate on disk. - PlaneRoots::over(cx): a door crate the base lays is its plane's door home (settings-leak, response-header, blocking-ffi). - plugin-ci's plane step is `xtask plugin-gates plane` (the busbar gates over busbar's pinned plane and over the change, a row that stops passing is a finding), with selftest cases; the shell script is gone (script-allowlist: product checks are cargo xtask). - busbar-plane-mcp pinned at a5e2ae355c, the head GetBusbar/busbar-plane-mcp#10 merged.
…oml keeps predev's store-memory row (no fixture-store: the kernel links an in-crate store double) beside this lane's busbar-plane-mcp pin
…s; the root pins it (/status rows 106/107) BUSBAR-1.6.0.md l.2220 (#39): "plugin SOURCE never re-enters busbar". l.3962: extract each plugin crate to its repo, pinned back as a git dependency in the root manifest's linked rows. This takes the same shape as #838 for mcp and stacks on its base layer (ARCHITECT row 106 (A)). Crates go 23 -> 22. - crates/busbar-plane-decisions is deleted. GetBusbar/busbar-plane-decisions#13 carries predev 5c99bef's crate byte for byte, with tests/conformance.{rs,json} in its -plugin twin, at busbar pin 5c99bef. The root pins that PR's head d78c070da4 with one git row. The `plane-decisions` edge in crates/busbar takes the workspace row. - deny.toml allow-git gains the repo. plugins.yaml drops pending_crate. The decisions tests read none of busbar's files, so it needs no busbar_checkout. - Cargo.lock: busbar-plane-decisions resolves from git. busbar-contract stays patched to the path crate, and the plugin-loader dev edge leaves with tests/conformance.rs. - Every gate, test and script that reads crates/busbar-plane-decisions reads it through #838's base layer and pinned_planes resolver: Ctx::workspace lays every pinned plane at crates/<package> from its checkout, and nothing in it names a plane. So no reference in xtask, the tests or the ledgers changes. Ledgers: none touched (#838's ruling condition 6). The pinned plane is measured at the path it had, from the same bytes. - .ci/default.yaml already builds the pinned busbar-plane-decisions-plugin cdylib ("plugin busbar-plane-decisions busbar-plane-decisions-plugin optional").
…its feature, not by git rm crates/busbar-<P> BUSBAR-1.6.0.md l.2220 (#39): plugin source never re-enters busbar, so a plane that left for its own repo (P5: mcp #838, decisions #888) has no crates/busbar-<P> directory and no workspace member. Its strong-form removal is the root's `busbar-<P> = { git = …, rev = … }` pin row plus the bin's `busbar-<P> = { workspace = true, … }` rows and the feature that names it. - pinned_in / plane_present: a plane is PINNED when the root pins it as a git row and nothing of it is on disk. A plane on disk is never read as pinned. - drop_member also drops the pin row. The key is matched exactly, so a -plugin twin row stays. neutralise_bin's dependency pattern takes the workspace row as well as the path row. - remove_and_assert: PINNED is a removable state, as PRESENT is. ABSENT is still refused. After the removal it asserts zero pin rows and zero bin rows, a rewritten root, and a pinned plane that the bin named in at least one row. - Selftest (6b) and the roster check accept a one-crate plane that is pinned. The decisions roster line passes again, for mcp and decisions alike. Checked without cargo build: remove_and_assert over llm, a2a, voice, plane-mcp and plane-decisions on a scratch copy (all asserted; the renamed-crate control is still refused), and `cargo metadata` loads the scratch after each pinned removal.
…o; the root pins it (/status row 158) BUSBAR-1.6.0.md l.2220 (#39): "plugin SOURCE never re-enters busbar". l.3962: each plugin crate is pinned back as a git dependency in the root manifest's linked rows. This uses the tcp/http/ws/ store-memory pattern. Crates go 24 -> 23. - crates/busbar-transport-stdio is deleted. GetBusbar/busbar-transport-stdio#14 carries it, byte for byte except the twin layout of lib.rs (the cdylib export is in transport-stdio-plugin), at busbar pin 5c99bef. The root pins that PR's head 604a5caf13 with one git row. The root's edge takes the workspace row, and its `transport-stdio` linked row is unchanged. - deny.toml allow-git gains the repo; plugins.yaml drops pending_crate. Cargo.lock: the package resolves from git, and busbar-contract stays patched to the path crate. - Selftests that planted into the in-tree stdio crate: - linked-dropped-features and plugin-closure-deps scan workspace members only, so their plants move to busbar-transport-webrtc, the one transport still in crates/. - kind-isolation's plants keep their paths: the gate lays every pinned plugin-kind checkout at crates/<package> beneath its overlay (kind_isolation/pinned.rs), as for tcp, http and ws. - Ledgers: - qa/construction.toml drops the manifest-allowlist row for a manifest no longer in crates/, as the ws extraction did. - The census floor `transport = 1` holds: webrtc. - Kept rows, each still measured from the pinned checkout: kind-isolation's stdio cell and root edge, the dep-wall carrier exemption (the crate still resolves) and the audit-ledger scopes (#589 reads pinned plugin scopes from the checkout). - crates/busbar-kernel/Cargo.toml: a comment's example of a self-naming crate is now webrtc. The hit count is unchanged.
… pinned-plane helper by reference (root is a PathBuf; E0308 at :1233)
…-p5-extract-plane-decisions
… fix 7b30159) into lane-plane-delete-pinned
…ut (dirs_for_globs filters with Ctx::is_dir, disk then base layer); RED: a plane present only in the base layer is counted
… fix ccc0eff) into lane-plane-delete-pinned
…dirs_for_globs counts a pinned plane from the base layer) into lane-p5-extract-plane-decisions
…er the scan roots (a pinned plane's crate), so rules that read lines read a pinned plane; RED: forbid-unsafe finds the attribute in a base-laid plane's lib and reports its absence MISSING
… scan carries pinned-plane sources; forbid-unsafe MISSING fix) into lane-p5-extract-plane-decisions
…nsport-webrtc: the webrtc extraction stacks on the stdio extraction and the pinned-plane stack
…d-features and plugin-closure-deps read the pinned plugin crates ARCHITECT P5 rulings 2026-10-14. The gates keep READING extracted code (BUSBAR-1.6.0.md l.2220, #39: plugin source never re-enters busbar, so it is read from the pinned checkout). 1. The base layer is widened from planes to every kind the census floors above zero: plane and transport (kind_isolation/pinned.rs BASE_KINDS). The pinned tcp, http, grpc, ws and stdio crates are laid at crates/<package> as the planes are, so the `transport` census counts them and the construction rules read their lines. Pinned packages resolve from `cargo metadata --all-features` (Ctx::cargo_metadata_all_features, honouring the same planted key). A plugin linked only behind a default-off feature (transport-webrtc, once pinned) is no package of the default answer, and the base would refuse it as unresolved. RED: xtask/tests/pinned_planes_base.rs the_base_lays_a_pinned_transport_the_census_counts_and_the_rules_read. The pinned stdio carrier is laid, the transport glob counts it only with the base, and `forbid-unsafe:busbar-transport-stdio` passes over it and is not emitted without the base. 2. linked-dropped-features and plugin-closure-deps read the workspace members AND every pinned plugin crate (one_abi::members_with_pinned): a `git+` plugin package of cargo metadata, at crates/<package>, its manifest read through the context (a plant or the base wins), else from the checkout. Their "gone blind" floors (3 linked, 5 plugins) count both. RED: each gate's selftest now plants into the PINNED stdio carrier (its manifest at crates/busbar-transport-stdio). A gate reading workspace members only never sees the plant. 3. What reading them again measures, restored at the pinned manifests: - qa/linked-dropped-features.toml: the four tokio rows of busbar-transport-http (io-std, process, rt-multi-thread, signal), exactly the rows 871a978 struck when http left and the gate stopped seeing it. - qa/construction.toml manifest-allowlist reviewed_extra: http, grpc and ws, each its own direct third-party deps at the pinned rev (the PLUGIN LIBRARIES ruling's rows; tcp and stdio name busbar-contract alone).
…annot lose, the transports' layout comment is no debt label, and the moved-out tools type leaves the secret inventory - kind_isolation: plane_kind_src_roots unions the root manifest's pinned plane rows (pinned::pinned_plane_dirs), so a context without the base lists their roots and plane-purity:roots refuses them by name; plane_kind_crates refuses a pinned plane the census cannot read, so reachability:plane-crates is red without the base. - pinned_planes_base: the stdio carrier's construction row is forbid-unsafe-deny (transports carry deny), the row the gate emits. - Cargo.toml/Cargo.lock: grpc/http/stdio/tcp pinned to the one-line commit on top of each current pin that names the kind's layout SHAPE (no-deferral reads SKELETON as a Class B label once the base lays the pinned transports); the same commit is open against each repo's dev. - secret_refs: TokenExchangeCfg left the tree with its plane; its references are read at the door's declared paths through the DoorSection row, so the stale inventory entry is removed. - docs/architecture.md: names the in-tree plane directories and the two pinned plane repos.
…s tools type leaves the secret inventory, and the architecture page names only paths on disk - kind_isolation: plane_kind_src_roots unions the root manifest's pinned plane rows (pinned::pinned_plane_dirs), so a context without the base lists the pinned plane's root and plane-purity:roots refuses it by name; plane_kind_crates refuses a pinned plane the census cannot read, so reachability:plane-crates is red without the base (pinned_planes_base's two RED arms). - secret_refs: TokenExchangeCfg left the tree with the plane; its references are read at the door's declared paths through the DoorSection row, so the stale inventory entry is removed. - docs/architecture.md: the in-tree plane directories, and the MCP plane's own repository.
… and is pinned; the page names only the in-tree plane directories
…d pin commits repinned past busbar #1033 (rustls 0.23.46, RUSTSEC-2024-0449 accepted as the fleet does, lock at busbar's versions)
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
…lares.json in the tree #887 (row 114) wrote crates/busbar-plane-decisions/declares.json and crates/busbar-transport-stdio/declares.json while both crates lived here; #901/#894 (under #935) moved both crates to their own repos, which hold their own declares.json at the pinned revs (plane-decisions/declares.json needs http, transport-stdio/declares.json needs none; plugins.yaml points there). The two orphans left crates/<package> as directories on disk, and the pinned base mounts a pinned crate only where no directory sits, so every gate reading pinned plugins (reachability, plane-purity, plane-pricing-blindness, structure-lint plane-roots, forbid-unsafe, config-schema tracked sources) read the decisions plane and the stdio transport as absent.
MattJackson
added a commit
that referenced
this pull request
Oct 15, 2026
… the framer repin past #1032; token-sealed's new red From ModernCI's nextest log at predev f4eb715 (8c1c308c) and its gates log (f50fb550): Two lanes meeting: - busbar config_validate_cross_plane: a present card is held to every registration the section bills, keyed <first scope kind>:<name> (DoorSection ledger lanes, d1be722); the cell's row was keyed `lane:`. Its row is now the registration's lane (BUSBAR-1.6.0.md l.2226, #42; #77(5)). - busbar Book is boot-only: the credential refresher's own `book()` (door_steps) read as a call of root::boot::book; renamed kept_book. The one boot call stays main.rs's. - busbar gauntlet_kernel: served_rider_chains_what_it_audits / _charges_the_presenting_key were cited only by the a2a and streaming root cells, which FLIP-A2A/FLIP-STREAMING re-pointed to their door legs; cited by nobody, they are dropped as U14 (686b91e) dropped mcp's two. - busbar plane_host_universal_purity: with a2a and streaming served through their doors (a plugin reaches busbar only over the ABI, BUSBAR-1.6.0.md l.2179, Part 2 #2) one in-root plane is left, so clock_now_secs has one caller: allowlisted with its reason, and the detector's multi-plane class is proved over the same counter on two planted plane sources. - busbar-contract feature_invariance: #65 made acquire_for_kernel dev-only; it is spelled #[cfg(feature = "test-seal")] and named in TEST_SEAL_ITEMS (no contract cfg(test) code calls it). - busbar-contract / busbar-plane-a2a: the design cited in words, not section signs. - xtask ledger_merge: [[shape-word]] (#787's reservation table) has its identity (word, file, holder), as duplicate-shape-word keys it. - xtask reachability selftest: #935's plane-crates row reads the root manifest's pins; the green fixture tree gains its root Cargo.toml (no pins: all five plane crates are laid). - busbar-core-connector fetch: the pre-body cap reads the head piece's declared_len (#1032); the field block never carries content-length, so the old lookup could not fire. - busbar root model_egress: pools_of registers the neutral test plane before parsing models/pools, as bf08115 did for the timeout cells (nextest: one process per test). A test wrong on its own head: - busbar-core-connector listen: the framer entry's listener rides the address carrier, so the view lays one beside it (TestDoor::identity("carrier")), as the connector's other cells do. - busbar-plane-llm conformance: an openai caller's head carries no anthropic-version, whose header claim outranks the chat-completions path claim (1.5.5's detection order). - busbar-plane-llm exchange_reply: never the far body; the far sentence is checked except where it is the caller dialect's own refusal sentence, which the envelope equality pins. - busbar-plane-streaming broker: the pre-X-2204 assertion that an expiry-less ek_ answer reads as 0 is struck; X-2204 refuses it (a_minted_answer_with_no_stated_expiry_is_refused). Gates: token-sealed's red was seal_release_path.rs minting a Pass outside crates/busbar-kernel/src; the release-path witness holds the seal and mints nothing. Not fixed here: universal_needs x8 are the pinned http framer built against a pre-#1032 contract (40-byte FramePiece against the host's 48); they go green with lane-transport-repin-1032.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These are the ARCHITECT P5 rulings of 2026-10-14 on the two extraction blockers. The gates keep READING extracted code: BUSBAR-1.6.0.md l.2220 (#39) says plugin source never re-enters busbar, so it is read from the pinned checkout. Not
$.Stacked on #894 (which carries #838 and #888) and #901 (stdio). Once those land, this is one commit.
1. The base layer lays every pinned transport (
kind_isolation/pinned.rsBASE_KINDS = ["plane", "transport"], the kinds[gate.census.plugin_kinds]floors above zero).crates/<package>the same way the planes are. Thetransportcensus counts them, and the construction rules read their lines.cargo metadata --all-features(Ctx::cargo_metadata_all_features, which honours the same planted key). Without it, a plugin linked only behind a default-off feature (transport-webrtc, once pinned) is no package of the default answer, and the base would refuse it as unresolved.xtask/tests/pinned_planes_base.rsthe_base_lays_a_pinned_transport_the_census_counts_and_the_rules_read. With the base, the pinned stdio carrier is laid, the transport glob counts it, andforbid-unsafe:busbar-transport-stdiopasses over it. Without the base, the glob does not count it and the row is not emitted.2. linked-dropped-features and plugin-closure-deps read pinned plugins (
one_abi::members_with_pinned).git+plugin package from cargo metadata. Each one sits atcrates/<package>, and its manifest is read through the context (a plant or the base wins), else from the checkout.3. What reading them again measures, restored at the pinned manifests:
qa/linked-dropped-features.toml: busbar-transport-http's four tokio rows (io-std, process, rt-multi-thread, signal). These are exactly the rows 871a978 struck when http left and the gate stopped seeing it. I measured them offline from cargo metadata: they are the only unified-deps or own-features findings across all 22 linked plugin crates.qa/construction.tomlmanifest-allowlistreviewed_extra: http, grpc and ws, each with its own direct third-party deps at the pinned rev. These are the PLUGIN LIBRARIES ruling's rows; tcp and stdio name busbar-contract alone.Expect: other gates now read five more transport crates. I can't run the gates locally. Any further measured row will come from the gates check, and I'll settle each against its pinned source.
The webrtc extraction (PR B) waits on the datagram conformance script (ARCHITECT ruling: option (1), WebRTC lane).