Repository navigation
P5: busbar-transport-webrtc leaves for its own repo, pinned (rows 106/107; DRAFT, stacked on #935, plugin repo on #943) - #964
Draft
MattJackson wants to merge 31 commits into
Draft
MattJackson wants to merge 31 commits into
MattJackson wants to merge 31 commits into
Conversation
…p, pulled at a pinned rev; every gate reads the pinned planes as its base layer (P5, rows 106/107) - crates/busbar-plane-mcp is deleted. GetBusbar/busbar-plane-mcp holds it, history imported with filter-repo; its logic crate is predev 00555bd's crate and its -plugin cdylib runs busbar's published conformance suite. The root pins it as one git row; the root's two edges take the workspace row; deny.toml allows the repo; plugins.yaml drops pending_crate and checks busbar out (its tests read the battery and qa/method-inventory.json at the pin). - THE BASE LAYER (ARCHITECT row 106 (A)): Ctx gains a base beneath the overlay and above the disk. Ctx::workspace lays every pinned package of the plane kind at crates/<package>, read from the checkout cargo metadata resolves for the rev Cargo.lock pins (kind_isolation::plane_base), never written into the tree. with_overlay keeps it, so a plant still wins. Generic over the kind, no plane named. Fails closed: a pinned plane cargo cannot resolve is an Err naming it and its rev. kind-isolation's own mount is unchanged. No ledger row moves. - RED arms: xtask/tests/pinned_planes_base.rs (the base is laid from the checkout and nothing of it is on disk; a plant wins over it; structure-lint, config-schema, no-float-money, plane-purity and reachability each lose a passing row without it); declared_classes reads the pinned planes and none without the base. - The tests that read the filesystem resolve a pinned plane through the same rule (crates/busbar/tests/common/pinned_planes.rs): capability-equality's proven mcp-server cells and its five-plane floor (with a RED arm that the evidence is not on disk and is read from the checkout); the kernel trust and core-admin plane-key ratchets take the pinned planes' keys; proto-deletion-gate.sh reads the door crate from its checkout. - plugin-ci.yml: a plane repo runs plane-purity, structure-lint and config-schema at its busbar pin over its own change (scripts/fleet/plane-gates.sh, BUSBAR_PLANE_SOURCE): no row that passes over busbar's pinned plane may fail over the change.
… take the pinned planes too (tests/common/pinned.rs, fail-closed), and the sibling set is every plane the roster registers, with its five-plane floor (ARCHITECT row 106 (A))
…a door home; the plane step is an xtask plugin-gate; the pin moves to the merged plugin head - Ctx::exists and Ctx::is_dir answer a directory the base layer lays (a pinned plane's crate and every directory in it), and Ctx::base_children lists what it lays under a directory: qa-names, plane-purity:roots, plane-pricing-blindness and structure-lint's scope rows read the pinned plane where it lived. construction's glob_dirs lists the laid crate beside the disk's, so the census's plane glob still matches its five crates. - workspace-deps: a manifest the base lays is a pinned git dependency, never a crate on disk. - PlaneRoots::over(cx): a door crate the base lays is its plane's door home (settings-leak, response-header, blocking-ffi). - plugin-ci's plane step is `xtask plugin-gates plane` (the busbar gates over busbar's pinned plane and over the change, a row that stops passing is a finding), with selftest cases; the shell script is gone (script-allowlist: product checks are cargo xtask). - busbar-plane-mcp pinned at a5e2ae355c, the head GetBusbar/busbar-plane-mcp#10 merged.
…oml keeps predev's store-memory row (no fixture-store: the kernel links an in-crate store double) beside this lane's busbar-plane-mcp pin
…s; the root pins it (/status rows 106/107) BUSBAR-1.6.0.md l.2220 (#39): "plugin SOURCE never re-enters busbar". l.3962: extract each plugin crate to its repo, pinned back as a git dependency in the root manifest's linked rows. This takes the same shape as #838 for mcp and stacks on its base layer (ARCHITECT row 106 (A)). Crates go 23 -> 22. - crates/busbar-plane-decisions is deleted. GetBusbar/busbar-plane-decisions#13 carries predev 5c99bef's crate byte for byte, with tests/conformance.{rs,json} in its -plugin twin, at busbar pin 5c99bef. The root pins that PR's head d78c070da4 with one git row. The `plane-decisions` edge in crates/busbar takes the workspace row. - deny.toml allow-git gains the repo. plugins.yaml drops pending_crate. The decisions tests read none of busbar's files, so it needs no busbar_checkout. - Cargo.lock: busbar-plane-decisions resolves from git. busbar-contract stays patched to the path crate, and the plugin-loader dev edge leaves with tests/conformance.rs. - Every gate, test and script that reads crates/busbar-plane-decisions reads it through #838's base layer and pinned_planes resolver: Ctx::workspace lays every pinned plane at crates/<package> from its checkout, and nothing in it names a plane. So no reference in xtask, the tests or the ledgers changes. Ledgers: none touched (#838's ruling condition 6). The pinned plane is measured at the path it had, from the same bytes. - .ci/default.yaml already builds the pinned busbar-plane-decisions-plugin cdylib ("plugin busbar-plane-decisions busbar-plane-decisions-plugin optional").
…its feature, not by git rm crates/busbar-<P> BUSBAR-1.6.0.md l.2220 (#39): plugin source never re-enters busbar, so a plane that left for its own repo (P5: mcp #838, decisions #888) has no crates/busbar-<P> directory and no workspace member. Its strong-form removal is the root's `busbar-<P> = { git = …, rev = … }` pin row plus the bin's `busbar-<P> = { workspace = true, … }` rows and the feature that names it. - pinned_in / plane_present: a plane is PINNED when the root pins it as a git row and nothing of it is on disk. A plane on disk is never read as pinned. - drop_member also drops the pin row. The key is matched exactly, so a -plugin twin row stays. neutralise_bin's dependency pattern takes the workspace row as well as the path row. - remove_and_assert: PINNED is a removable state, as PRESENT is. ABSENT is still refused. After the removal it asserts zero pin rows and zero bin rows, a rewritten root, and a pinned plane that the bin named in at least one row. - Selftest (6b) and the roster check accept a one-crate plane that is pinned. The decisions roster line passes again, for mcp and decisions alike. Checked without cargo build: remove_and_assert over llm, a2a, voice, plane-mcp and plane-decisions on a scratch copy (all asserted; the renamed-crate control is still refused), and `cargo metadata` loads the scratch after each pinned removal.
…o; the root pins it (/status row 158) BUSBAR-1.6.0.md l.2220 (#39): "plugin SOURCE never re-enters busbar". l.3962: each plugin crate is pinned back as a git dependency in the root manifest's linked rows. This uses the tcp/http/ws/ store-memory pattern. Crates go 24 -> 23. - crates/busbar-transport-stdio is deleted. GetBusbar/busbar-transport-stdio#14 carries it, byte for byte except the twin layout of lib.rs (the cdylib export is in transport-stdio-plugin), at busbar pin 5c99bef. The root pins that PR's head 604a5caf13 with one git row. The root's edge takes the workspace row, and its `transport-stdio` linked row is unchanged. - deny.toml allow-git gains the repo; plugins.yaml drops pending_crate. Cargo.lock: the package resolves from git, and busbar-contract stays patched to the path crate. - Selftests that planted into the in-tree stdio crate: - linked-dropped-features and plugin-closure-deps scan workspace members only, so their plants move to busbar-transport-webrtc, the one transport still in crates/. - kind-isolation's plants keep their paths: the gate lays every pinned plugin-kind checkout at crates/<package> beneath its overlay (kind_isolation/pinned.rs), as for tcp, http and ws. - Ledgers: - qa/construction.toml drops the manifest-allowlist row for a manifest no longer in crates/, as the ws extraction did. - The census floor `transport = 1` holds: webrtc. - Kept rows, each still measured from the pinned checkout: kind-isolation's stdio cell and root edge, the dep-wall carrier exemption (the crate still resolves) and the audit-ledger scopes (#589 reads pinned plugin scopes from the checkout). - crates/busbar-kernel/Cargo.toml: a comment's example of a self-naming crate is now webrtc. The hit count is unchanged.
… pinned-plane helper by reference (root is a PathBuf; E0308 at :1233)
…-p5-extract-plane-decisions
… fix 7b30159) into lane-plane-delete-pinned
…ut (dirs_for_globs filters with Ctx::is_dir, disk then base layer); RED: a plane present only in the base layer is counted
… fix ccc0eff) into lane-plane-delete-pinned
…dirs_for_globs counts a pinned plane from the base layer) into lane-p5-extract-plane-decisions
…er the scan roots (a pinned plane's crate), so rules that read lines read a pinned plane; RED: forbid-unsafe finds the attribute in a base-laid plane's lib and reports its absence MISSING
… scan carries pinned-plane sources; forbid-unsafe MISSING fix) into lane-p5-extract-plane-decisions
…nsport-webrtc: the webrtc extraction stacks on the stdio extraction and the pinned-plane stack
…d-features and plugin-closure-deps read the pinned plugin crates ARCHITECT P5 rulings 2026-10-14. The gates keep READING extracted code (BUSBAR-1.6.0.md l.2220, #39: plugin source never re-enters busbar, so it is read from the pinned checkout). 1. The base layer is widened from planes to every kind the census floors above zero: plane and transport (kind_isolation/pinned.rs BASE_KINDS). The pinned tcp, http, grpc, ws and stdio crates are laid at crates/<package> as the planes are, so the `transport` census counts them and the construction rules read their lines. Pinned packages resolve from `cargo metadata --all-features` (Ctx::cargo_metadata_all_features, honouring the same planted key). A plugin linked only behind a default-off feature (transport-webrtc, once pinned) is no package of the default answer, and the base would refuse it as unresolved. RED: xtask/tests/pinned_planes_base.rs the_base_lays_a_pinned_transport_the_census_counts_and_the_rules_read. The pinned stdio carrier is laid, the transport glob counts it only with the base, and `forbid-unsafe:busbar-transport-stdio` passes over it and is not emitted without the base. 2. linked-dropped-features and plugin-closure-deps read the workspace members AND every pinned plugin crate (one_abi::members_with_pinned): a `git+` plugin package of cargo metadata, at crates/<package>, its manifest read through the context (a plant or the base wins), else from the checkout. Their "gone blind" floors (3 linked, 5 plugins) count both. RED: each gate's selftest now plants into the PINNED stdio carrier (its manifest at crates/busbar-transport-stdio). A gate reading workspace members only never sees the plant. 3. What reading them again measures, restored at the pinned manifests: - qa/linked-dropped-features.toml: the four tokio rows of busbar-transport-http (io-std, process, rt-multi-thread, signal), exactly the rows 871a978 struck when http left and the gate stopped seeing it. - qa/construction.toml manifest-allowlist reviewed_extra: http, grpc and ws, each its own direct third-party deps at the pinned rev (the PLUGIN LIBRARIES ruling's rows; tcp and stdio name busbar-contract alone).
…rtc; the root pins it (/status rows 106/107) BUSBAR-1.6.0.md l.2220 (#39): plugin source never re-enters busbar. Crates go 22 -> 21 on the stack. - crates/busbar-transport-webrtc is deleted. GetBusbar/busbar-transport-webrtc#2 carries it in the twin layout: the logic crate's src byte for byte except the export, which moves to the -plugin cdylib, so lib.rs is `forbid(unsafe_code)`. It runs the published suite's DATAGRAM script (busbar #943) and keeps its own both-ways witness. The root pins that PR's head dda9bb39c4 with one git row. The root's optional edge takes the workspace row, and its `transport-webrtc` feature, linked and linked-axes rows are unchanged. - deny.toml allow-git gains the repo; plugins.yaml drops pending_crate. Cargo.lock: the package resolves from git, and its plugin-loader dev edge and self edge leave with the crate. - The gates keep reading it (ARCHITECT P5 ruling, #935): the base layer lays the pinned framer at crates/busbar-transport-webrtc. It is resolved from `cargo metadata --all-features`, since `transport-webrtc` is off by default. So the transport census, forbid-unsafe, manifest-allowlist (its row stays) and kind-isolation (its cell and root edge stay) read the same source. - crates/busbar-kernel/Cargo.toml: the self-naming example says "did in this tree" (same hit count).
…annot lose, the transports' layout comment is no debt label, and the moved-out tools type leaves the secret inventory - kind_isolation: plane_kind_src_roots unions the root manifest's pinned plane rows (pinned::pinned_plane_dirs), so a context without the base lists their roots and plane-purity:roots refuses them by name; plane_kind_crates refuses a pinned plane the census cannot read, so reachability:plane-crates is red without the base. - pinned_planes_base: the stdio carrier's construction row is forbid-unsafe-deny (transports carry deny), the row the gate emits. - Cargo.toml/Cargo.lock: grpc/http/stdio/tcp pinned to the one-line commit on top of each current pin that names the kind's layout SHAPE (no-deferral reads SKELETON as a Class B label once the base lays the pinned transports); the same commit is open against each repo's dev. - secret_refs: TokenExchangeCfg left the tree with its plane; its references are read at the door's declared paths through the DoorSection row, so the stale inventory entry is removed. - docs/architecture.md: names the in-tree plane directories and the two pinned plane repos.
…o lane-p5-extract-transport-webrtc # Conflicts: # Cargo.toml
…s tools type leaves the secret inventory, and the architecture page names only paths on disk - kind_isolation: plane_kind_src_roots unions the root manifest's pinned plane rows (pinned::pinned_plane_dirs), so a context without the base lists the pinned plane's root and plane-purity:roots refuses it by name; plane_kind_crates refuses a pinned plane the census cannot read, so reachability:plane-crates is red without the base (pinned_planes_base's two RED arms). - secret_refs: TokenExchangeCfg left the tree with the plane; its references are read at the door's declared paths through the DoorSection row, so the stale inventory entry is removed. - docs/architecture.md: the in-tree plane directories, and the MCP plane's own repository.
… and is pinned; the page names only the in-tree plane directories
…d pin commits repinned past busbar #1033 (rustls 0.23.46, RUSTSEC-2024-0449 accepted as the fleet does, lock at busbar's versions)
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DRAFT per rule 19. This branch is #935's branch (#894 + #901 + the pinned-plugin readers) plus one commit. The plugin repo it pins runs busbar #943's datagram script, so the coordinator undrafts this once #935 and #943 land. Not
$.BUSBAR-1.6.0.md l.2220 (#39): plugin source never re-enters busbar. Crates go 22 -> 21 on the stack.
What
crates/busbar-transport-webrtcis deleted. transport-webrtc: busbar's crate in the twin layout, pinned at busbar 41fd7c5f38 (P5) busbar-transport-webrtc#2 (draft, CI green including the published suite) carries it in the twin layout:src/is byte for byte except the export, which moves to the-plugincdylib, solib.rsisforbid(unsafe_code).tests/conformance.rsisconformance_suite!over the transport kind's DATAGRAM script (busbar conformance: the published suite drives datagram framers too (unblocks the webrtc extraction) #943, ARCHITECT: one suite, no exemption).tests/datagram_witness.rs.b0c9cdc59d(conformance: the published suite drives datagram framers too (unblocks the webrtc extraction) #943's head).dda9bb39c4with one git row. The root's optional edge takes the workspace row. Itstransport-webrtcfeature and its linked and linked-axes rows are unchanged.deny.tomlallow-git gains the repo;plugins.yamldropspending_crate.Cargo.lock: the package resolves from git, and its plugin-loader dev edge and self edge leave with the crate.The gates keep reading it (ARCHITECT P5 ruling, via #935)
crates/busbar-transport-webrtc. It resolves fromcargo metadata --all-features, becausetransport-webrtcis off by default.crates/busbar-kernel/Cargo.toml: the comment's example of a self-naming crate now says "did in this tree". The hit count is unchanged.