Repository navigation
#65: the kernel seal reaches the kernel and nothing else; acquire_for_kernel is test-only - #941
Open
MattJackson wants to merge 1 commit into
Open
MattJackson wants to merge 1 commit into
MattJackson wants to merge 1 commit into
Conversation
…_kernel is test-only KernelSeal::acquire_for_kernel() was a #[doc(hidden)] pub fn any crate naming busbar-contract could call (caps/token.rs:106-109; SPEC #65 l.2260: "no public/forgeable KernelSeal constructor"). ARCHITECT ruling 2026-10-14 (mechanism approved): - contract: KernelSeal::deliver() (#[inline]) builds a seal and hands it to the extern "Rust" symbol __busbar_kernel_root, which the contract declares and only busbar-kernel defines. - kernel (new src/seal.rs): the #[no_mangle] definition wraps the seal in Held, a type private to the module, and returns it as Box<dyn Any> (zero-sized, no allocation); seal::acquire() (#[inline(never)], beside the definition so the definition is always linked) downcasts it back. A caller outside the kernel gets a box it cannot open; a second definer is a duplicate symbol. - acquire_for_kernel survives only under cfg(test) / the dev-only test-seal feature; the kernel's production sites (teller.rs Kernel::new, host_services.rs idempotency key) and test_support take seal::acquire(); the kernel's own tests reach the test seal through a dev edge. - gates: one-memory-abi excuses __busbar_kernel_root at exactly crates/busbar-kernel/src/seal.rs (planted elsewhere = RED, selftest added); structure-lint's no_mangle ban lists seal.rs. RED: tests/members/seal_tests.rs builds the mechanism with rustc and proves the honest program links and opens its seal while a program defining the root symbol fails to link as a duplicate symbol; the release-path test proves deliver() hands a non-kernel caller no seal. The contract doc carries a compile_fail fixture for acquire_for_kernel outside test-seal.
This was referenced Oct 14, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CONTRACT-ABI lane, item 3 (#65, SPEC l.2260; TODO caps/token.rs:106-109). ARCHITECT ruling 2026-10-14 approved this mechanism.
Before:
KernelSeal::acquire_for_kernel()was a#[doc(hidden)] pub fn— any crate naming busbar-contract (every linked plugin) could mint everyPass/Grant; only a CI text scan stood in the way.After:
KernelSeal::deliver()(#[inline], so only a caller's image references the symbol) hands a fresh seal toextern "Rust" __busbar_kernel_root, declared by the contract, defined only by busbar-kernel.src/seal.rs: the#[no_mangle]definition wraps the seal in a module-privateHeldand returnsBox<dyn Any>(ZST, no alloc);seal::acquire()(#[inline(never)], same object as the definition, so the definition is always linked) downcasts it back. Non-kernel callers get a box they cannot open; a second definer is a duplicate-symbol link error.acquire_for_kernelexists only undercfg(test)/ dev-onlytest-seal; kernel production sites (teller.rsKernel::new, host_services.rs idempotency key) andtest_support::tokens::sealuseseal::acquire(). Kernel gains a dev edgebusbar-contract features=["test-seal"]so its tests mint as before (test_seal_is_dev_onlykeeps the feature off non-dev edges).#[allow(unsafe_code)]items (contractdeliver, kernel definition), each with a SAFETY note.__busbar_kernel_rootat exactlycrates/busbar-kernel/src/seal.rs(planted anywhere else = RED, new selftest); structure-lint'sno_mangleban lists seal.rs.RED:
busbar-kernel/src/tests/members/seal_tests.rs— (1) builds the mechanism with rustc: the honest program links and opens its seal, a program defining the root symbol to catch the seal fails to link as a duplicate symbol; (2)deliver()hands a non-kernel caller no seal. Contract doc:compile_failfixture onacquire_for_kernelwithout test-seal (rendered only when the feature is off).Shared files (disjoint hunks, ruling 20): kernel Cargo.toml (#901 #897 #893 #571 #503), host_services.rs (#864), structure_lint/choke_points.rs (#904).
No customer-visible behaviour; no third-party dependency change.