Repository navigation
plane/approvals: delete the kernel's dead copy of the plane's ask-state seal (Q128 K2-H3) - #674
Merged
Merged
Conversation
…te seal (K2-H3) The caller-facing ask-state seal is the plane's own: its crate seals the payload over the host's `sign` (ARCHITECT Q-L3B-ASK). The kernel still carried a dead copy, with AskState, Sealer, Rejected, digest_arguments and the two MAC domains, spelled with the plane token escaped. Nothing called it. Core keeps the spent-approval ledger, DEFAULT_TTL_SECS and nonce. The copy's tests (askstate_tests.rs) go with it, and the signing_secret docs no longer name the deleted sealer. RED: approvals_tests the_kernel_holds_no_plane_named_seal_domain scans the kernel's sources for the escaped plane token and the seal's domain segment.
MattJackson
enabled auto-merge
October 8, 2026 02:44
promote into
|
| gate | row | detail |
|---|---|---|
| construction | one-pick-site |
3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:358; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8 |
| kind-isolation | kind-isolation:deps |
3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w |
| kind-isolation-ship | kind-isolation:deps |
9 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the ar |
| kind-isolation-ship | kind-isolation:test-deps |
5 finding(s) over 31 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship c |
| kind-isolation-ship | kind-isolation:faces |
2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is |
| kind-isolation-ship | kind-isolation:legacy-drain |
3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier) |
| ship-ready | ship-ready:ship-twin |
'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is |
| structure-lint | structure-lint:plane-dup:unledgered |
22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger |
tests passed: 16801, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38343694664 . Artifact verdict-cce32ac2f9f68d5cbb52db2af773a7b4b9324606 (failures.json, junit.xml, raw.log; 90 days).
… 117 -> 116 Deleting the kernel's dead ask-state seal (K2-H3) drained one secret-instance hit from busbar-kernel, leaving a law0-slack finding that raised the kind-isolation:law0 figure 18 -> 19 on both kind-isolation and kind-isolation-ship. Lower the ceiling in the commit that drained it. Proved with busbar-release dev cargo xtask gate kind-isolation and kind-isolation-ship: law0 back to 18 (base figure).
MattJackson
added this pull request to the merge queue
Oct 10, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Oct 10, 2026
Deleting the kernel's dead ask-state seal (K2-H3) drains four plane hits from busbar-kernel: the two crate::mcp::roots doc links and the two \x6dcp seal domains (the decoded scanner reads them as mcp). The re-armed ledger (#725) pinned the row at predev's 1175, so the drain read as 4 hits of law0 slack (figure 29 -> 33 on kind-isolation and kind-isolation-ship). Not proved on Latchkey: the run budget is spent (RUN_CAP); reasoned from the CI verdict and the deleted source, and the PR's CI is the proof.
MattJackson
added this pull request to the merge queue
Oct 10, 2026
MattJackson
removed this pull request from the merge queue due to a manual request
Oct 10, 2026
MattJackson
enabled auto-merge
October 11, 2026 00:05
The kind-isolation:law0 row this branch arms reported law0-slack busbar-kernel × plane 1169 hit(s) under a ceiling of 1171; the ledger row now sits at the measured value (Law 9). Not proved on Latchkey: the run budget is spent (RUN_CAP), so the PR's CI is the proof.
MattJackson
disabled auto-merge
October 11, 2026 01:19
Collaborator
Author
|
Claim released by busbar-release: the |
Collaborator
Author
|
Re-run by busbar-release: the engine pin ENGINE_REF 937eae641 now contains busbar-release 7ab2191, 5a1380d, 55c488f, which the owner question this PR was held on names; the failed jobs of ca12c6d are re-run and the hold is lifted. |
qa/kind-isolation.toml: two busbar-kernel [[law0]] rows conflicted. - instance:secret: predev lowered it 117 -> 115 (R-FIX3); this branch lowered it by the dead ask-state seal. Merged tree measures 114. - plane: predev lowered it 1175 -> 1173 (#570); this branch lowered it by the seal's two crate::mcp::roots doc links and two \x6dcp domains. Merged tree measures 1169. Both rows are pinned at the merged measure, both reasons kept in the cite (Law 9: the ceiling ratchets down to today's number).
MattJackson
added this pull request to the merge queue
Oct 12, 2026
…ernel plane ceiling 1172 -> 1168 (this PR's dead ask-state seal deletion, on predev's 1172)
… 1141 + this PR's -4 = 1137
… 1132 + this PR's -4 = 1128
…ft with the engine (predev), and the root's door_steps spent_ledger proves the spend
MattJackson
added a commit
that referenced
this pull request
Oct 13, 2026
qa/kind-isolation.toml busbar-kernel x plane: base 1132, ours 1128 (E5a's proxy-tunnel drain: two `llm engine` prose mentions, the `decision:` doc key, the `installed decision` assert message), theirs 1128 (#674: the ask-state seal's `crate::mcp::roots` links and `\x6dcp` domains). O == T, but these are two different drains of equal size, not one change carried twice, so theirs + ours - base = 1124, predev's cite kept with E5a's clause renumbered 1128 -> 1124.
MattJackson
added a commit
that referenced
this pull request
Oct 13, 2026
… into lane-egress-e2-net-guard qa/kind-isolation.toml: predev's rows, plus this branch's own E2 drain. busbar x transport and busbar-kernel x transport: this branch carries the same E1 +17/-17 move #741 landed on predev, so theirs (224, 266) is taken, count and cite. busbar-kernel x plane: predev 1128 (row 156 and #674 drains since this branch's last predev, 1141) minus E2's own six (net_guard.rs and its two suites deleted: 1141 -> 1135 here) = 1122, predev's cite kept with E2's clause renumbered 1128 -> 1122. Every other row is predev's.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Q128 audit K2-H3. The caller-facing ask-state seal is the plane's own: its crate seals the payload over the host's
sign(ARCHITECT Q-L3B-ASK). The kernel still carried a dead copy inplane/approvals.rs:AskState,Sealer,Rejected,digest_argumentsand the two MAC domains, spelled with the plane token escaped (busbar/\x6dcp/askstate/...). Nothing called it.plane/tests/askstate_tests.rs, which tested only the copy).DEFAULT_TTL_SECSandnonce, which are in use.signing_secretdocs no longer name the deleted sealer.RED:
approvals_tests::the_kernel_holds_no_plane_named_seal_domainscans the kernel's sources for the escaped plane token and the seal's domain segment. It fails on predev'sapprovals.rs.Proof (Latchkey cli-aa01a9cc-fece-400b-8ffa-5a56e2694ee4; fmt cli-648f4ce4-7c1c-40e0-9de2-a022dd137cc6; construction cli-a5ed1af8-1692-4895-a64c-58fc2adcc166): fmt, clippy
-p busbar-kernel-D warnings, RED,cargo xtask gate construction(the same FAIL rows as predev in a history-less checkout: no new row),cargo test -p busbar-kernel.