row 155 B1c-1: the plane states its provider keys as a neutral descriptor in its Statement (dormant seam)

[MattJackson]

Row 155 B1c-1. Not a money ($) change. Dormant: customer-visible behaviour is unchanged; nothing parses a provider entry from the descriptor yet. Not run locally: only cargo fmt; ModernCI is the proof.

The seam (ARCHITECT ruling "Option A", coordinator-approved B1c-1/B1c-2 split)

A provider entry's plane-owned keys are DATA the plane declares through its Statement. They use a neutral shape vocabulary, are listed per form in frozen order, and each carries a required flag. Core holds no plane key name.

• busbar-contract provider_keys.
  • Types: ProviderKeys { catalog, deployment, entry }. Each form is a Table { deny_unknown, keys }; each Key { name, shape, required }.
  • Shape has seven words: str, one-of, int, bool, list, str-map, table (a nested struct with its keys and deny_unknown).
  • JSON encode/decode under the ONE Statement-extensions key provider_keys (EXT_PROVIDER_KEYS). decode refuses any other shape word, unstated or missing members, a key named twice, and an empty or repeated one-of.
  • abi::mechanism::extensions::{entry, entry_len} build one extensions entry at compile time, because a door's Statement is const data.
• busbar-plane-llm. meta::PROVIDER_KEYS states the three forms.
  • Each form's keys are read off ProviderDef / ProviderDeploy / ProviderCfg in field order, with the core keys left out (row 155 B1b: the resolved provider carries its plane keys as one opaque table under the neutral merge #957's base_url, path, path_base, api_key, auth, token_url, scope, subject, health, allow_metadata_hosts).
  • Plane keys: protocol, error_map, organization, project, max_output_key (one-of max_tokens|max_completion_tokens), anthropic_adaptive_thinking, native_structured_output, model_capabilities (a list of a deny-unknown table, from ModelCapabilities).
  • Required flags: catalog protocol, entry error_map, rule models.
  • Unknown keys: the catalog passes them over; deployment and entry refuse them.
  • The door's Statement carries the descriptor in extensions (octets).
• plugin-loader. ServedFacts::provider_keys is read off the Statement's extensions and judged at bind. PlaneRegistration::provider_keys is the new field; the other construction sites are updated.
• busbar-kernel. The door fold keeps the descriptor (inside its PlaneRegistration). plane::door::provider_keys() reads it. Nothing consumes it: it is unwired seam U19 in the TODO's table, wiring owner B1c-2.

Tests

• Round trip: busbar-contract provider_keys_tests::a_descriptor_round_trips_through_its_encoding (encode, decode, equal), plus the_descriptor_is_read_off_the_one_extensions_key.
• RED: a_non_neutral_shape_word_is_refused. secret, string, duration, {enum: …}, a non-neutral word inside a list and one inside a nested table are each refused, naming the word and the vocabulary. the_encoding_states_exactly_its_members covers the closed encoding.
• Drift guard (busbar-llm engine::provider_keys_drift_tests): busbar-llm is where both the frozen structs and the plane are reachable, and the guard adds no busbar_kernel:: line.
  • Each form's declared keys equal the frozen struct's serde field order with the core keys filtered out. The order is read off the derived reader itself by a field-recording deserializer.
  • It also checks each required flag (missing field), each shape (every key written in its shape parses), each one-of's words and their order (serde's unknown variant … expected …), and each table's unknown-key rule, nested tables included.
• Plane: tests/provider_keys.rs. The door's rendered Statement carries the descriptor byte for byte under the key, and the one loader's registration hands it on decoded.
• Kernel: door_tests::the_provider_keys_a_door_states_are_kept_by_the_fold.
• extensions_tests::an_entry_built_at_compile_time_is_the_encoded_entry.

Rows

No ledger row moves. The kernel and contract text names no plane package or id (kind-isolation presence unchanged). No kernel string literal is added outside tests, and the test literals are neutral words. No busbar_kernel:: line is added in a plane crate.

Queue rule 20

Hunks are disjoint from the open PRs on the same files (#959, #931 TODO; #897 plane_calls.rs; #890 plane_door.rs; drafts #957, #966, #960, #891). git merge-tree against each and origin/predev is clean.

[MattJackson]

#1028 also edits crates/busbar-llm/src/engine/mod.rs (adds CODEC_HOST to the use busbar_kernel::{..., proto::...} group) and crates/busbar-plane-llm/src/plane_door.rs (DoorHost; attempt/far_end/answer/refusal slot take the host). Disjoint hunks, test merge clean.

[MattJackson]

Rule 20 note from #1030 (row 155): disjoint hunks in crates/busbar-plane-llm/src/plane_door.rs (the abi::plane import, Answer.tap_fault, to_caller, deliver). A test merge is clean.

[MattJackson]

Rule 20 note from #1031 (row 155, draft): one more disjoint line in plane_door.rs (far_end's ReplyCtx gains translate_cap). A test merge is clean.