jev rig: the decision plane's seven gating Teller-step checks; owed_gaps {} (teller-steps budget re-measured, Q12(a)) by MattJackson · Pull Request #676 · GetBusbar/busbar

MattJackson · 2026-10-08T02:46:33Z

The decision plane's seven gating Teller-step cells are now proven by named jev rig checks, and owed_gaps goes to {}.

xtask/src/conformance_record/jev.rs: the jev rig gains 7 served checks, each judged over deltas the rig reads on the same boot: h2-authenticate-refusal, h2-verify-refusal, h2-admit-refusal, h2-route-terminal, h2-meter-row, h2-audit-record, h2-exit-terminal. They use pure judges with green and red tests (xtask/tests/jev_gating.rs).
The teller-steps gate resolves jev.rig|<check> to the rig file while that file declares the check. There is a RED plant for this, and the owed-gap plant is rewritten.
qa/teller-steps.json: matrix.decision's seven gating cells name the checks, and the seven owed_gaps entries are struck (owed_gaps: {}). The decision admit and audit root cells cite the root leg's budget and audit-chain tests.
Ruling Q12(a): MEASURED_TELLER_STEPS rises to the measured 21 803 serial units (22 cases; it was 12 382 at 15 cases) and the case stays. Its taken is recorded separately (TAKEN_TELLER_STEPS).

This branch carries #628 (teller-steps derived roster, head 3cfc21c), merged in rather than rebased (no force-push). Until #628 lands, this diff includes it. The one conflict was the teller-steps budget: this branch's 22-case measure is kept over #628's 21-case 19 850.

Proof (origin/predev and #628 merged in):

cli-506cb9a8-f36e-481a-a4c7-c2d1ca5d9c16 (large):
- fmt and clippy -p xtask -D warnings passed.
- The tests jev_gating, conformance_rigs and readers passed, and gate teller-steps passed.
- Selftest: GREEN, and all 21 RED plants are red. It ran 36 020 contended units, re-taken serially at 22 366, against a budget of 34 885.
- jev rig, served leg on a booted busbar: status: pass.
cli-6e5dbc00-3a69-462e-815f-30d24c81ad36 (medium), after the final predev merge (kind-isolation:law0: the DoD's Law 0 class gets its own gating row, armed at today's number (Q128) #597): the same checks passed again, with the selftest at 26 624 units, under budget.
- xtask lib: 626 passed and 1 failed. The failure is qa_names::the_pre_fix_config_of_the_day_is_named_in_full, which needs git history that the job's one-commit tree lacks (environmental).

…each a named served check judged over deltas the rig reads on the same boot (h2-authenticate-refusal, h2-verify-refusal, h2-admit-refusal, h2-route-terminal, h2-meter-row, h2-audit-record, h2-exit-terminal); the teller-steps gate resolves `jev.rig|<check>` to xtask/src/conformance_record/jev.rs while the file declares the check; matrix.decision's seven gating cells name them and the seven owed_gaps entries are struck; decision admit/audit root cells cite the root leg's budget and audit-chain tests Each judge is a pure function over the observation (xtask/tests/jev_gating.rs pins its green and every red arm). The served leg mints a key granted only another pool (verify) and a key in a one-request-a-day group (admit), and runs the down-lane check last because a 503 benches the sole member. The owed-gap plant re-adds the struck entry beside the closed cell; a new plant holds a jev.rig cell whose check the rig no longer declares red.

…g cells (ARCHITECT Q12(a)): 21 803 serial units, 22 cases

…ig; the teller-steps budget keeps this branch's 22-case measure

github-actions · 2026-10-08T03:44:02Z

promote into `predev`: all green @421cc743a

Already red on predev, not this PR's: 10

gate	row	detail
construction	`one-pick-site`	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	`kind-isolation:deps`	3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	`kind-isolation:law0`	5 hit(s) off the [[law0]] ceilings, 3 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabulary
kind-isolation-ship	`kind-isolation:deps`	10 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	`kind-isolation:test-deps`	8 finding(s) over 32 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship c
kind-isolation-ship	`kind-isolation:law0`	5 hit(s) off the [[law0]] ceilings, 3 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabulary
kind-isolation-ship	`kind-isolation:faces`	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	`kind-isolation:legacy-drain`	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	`ship-ready:ship-twin`	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	`structure-lint:plane-dup:unledgered`	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

tests passed: 16603, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38261257921 . Artifact verdict-421cc743a120d601cc3eadfd46dcc060cb702e02 (failures.json, junit.xml, raw.log; 90 days).

…btest_path resolver and drops the superseded path_mounted_module

The root-decisions leg ships (plane-decisions is in default), so --root-legs-gating holds it to every gating step, and decision.verify was the one gating cell left 'none' on it: the row went red with no FAIL line. serve_tests.rs gains a_decisions_unit_granted_only_another_pool_is_refused_before_admit: a key whose allowed_pools names only another pool is refused 403 through the composed door with no dial, no request counted and nothing posted on the lane (serve_granted mints the key with the grant; serve_governed delegates to it with None). The ledger's decision.verify root cell now names it as proven.

…r x plane The verify-refusal test added four 'decisions' plane hits to the composition root (a second cfg(feature) wrapper, serve_granted; the test name; a doc comment), lifting busbar x plane past its [[law0]] ceiling of 822 and the law0 figure 11 -> 13 on both kind-isolation and its ship twin. serve_granted folds into serve_governed (its callers pass None), and the test and its doc drop the plane name; qa/teller-steps.json follows the rename. The one hit left is the test's own cfg. Not proved on Latchkey: the run budget is spent (RUN_CAP), so the PR's CI is the proof. Diagnosis from the CI verdict and the gate's scan rules.

…it the verify test's cfg added The verify-refusal test's own #[cfg(feature = "plane-decisions")] is the one hit left after 9666e32: busbar x plane 823 against its [[law0]] ceiling of 822, the law0 figure 11 -> 12 on kind-isolation and its ship twin. The file's two cfg-gated std imports become one cfg-gated use, naming the plane once fewer; the cell is back at 822 exactly (no slack). Not proved on Latchkey: the run budget is spent (RUN_CAP), so the PR's CI is the proof. Diagnosis from the CI verdict, the matrix scanner's needles, and the base...head diff of crates/ (the cfg is the only plane-vocabulary line it adds).

The predev merge split serve_configured out of serve_governed but left the key mint naming allowed_pools without the parameter (E0425, and serve_governed's argument unused). serve_configured now takes the pool grant; serve_keyed passes None. Not proved on Latchkey: the run budget is spent; the PR's CI judges.

…redev's verify/admit/audit proofs Ruling: predev (#628, #622) landed the decisions root leg's verify, admit and audit cells with the corrected verify test (a_decisions_unit_from_a_key_naming_another_pool_is_refused_before_its_dial: Approve/ScopeDenied sealed before admit and dial, plus the granted-every-pool control). This branch's older duplicate (a_unit_granted_only_another_pool_is_refused_before_admit) is dropped and the three root cells cite predev's tests and notes; coverage is re-pointed, never retired (BUSBAR-1.6.0.md:3857), and the root-leg proof stays beside each cell as the teller-steps gate of Law 1 requires (BUSBAR-1.6.0.md:2176). serve_tests.rs is predev's verbatim, which also removes the duplicate `allowed_pools` field the auto-merge produced in serve_configured. The branch keeps its own intent: the seven jev rig cells and owed_gaps {}.

MattJackson added 5 commits October 7, 2026 16:17

teller-steps: the self-test budget is re-measured at the seven jev ri…

8f53b0d

…g cells (ARCHITECT Q12(a)): 21 803 serial units, 22 cases

Merge lane-gb-teller-steps-derive (#628 head 3cfc21c) into lane-dec-r…

64611f4

…ig; the teller-steps budget keeps this branch's 22-case measure

Merge origin/predev into lane-dec-rig

4cb5762

Merge origin/predev into lane-dec-rig

a188868

MattJackson enabled auto-merge October 8, 2026 02:46

MattJackson added the fixing label Oct 10, 2026

Merge origin/predev into lane-dec-rig; teller_steps takes predev's li…

5e2eda7

…btest_path resolver and drops the superseded path_mounted_module