disk.append: the host's bounded disk lane for the file export sink; the declares gate reads kind-constant arms - #482
Open
MattJackson wants to merge 13 commits into
Open
MattJackson wants to merge 13 commits into
MattJackson wants to merge 13 commits into
Conversation
…hrough the memory-ABI door The JSON lane's store, secret and auth-verify paths are deleted: DynStore, DynSecret, load_store*/load_secret*, the legacy 1.5.5 store wire (legacy_usage), the in-process store open (LinkedEntry::Store keeps only the store v3 door), the cold secret fallback (a no-door secret module is refused naming the rebuild, PluginRegistry::secret_refusal), ColdAuth and open_auth (a no-door auth row is refused on the auth axis, auth_axis::JSON_AUTH_REFUSED). The kernel's in-process auth test stand-ins move to auth::stand_in (test-support only). Contract: abi/cold keeps only the two paths not yet moved — the hosted login's auth wire (p4-oidc-repin moves it to the auth door) and the request-log file/webhook export wire (their door re-pins need the host disk lane and the EXP2 export fixes, not on predev). The kind words move to abi::mechanism::kind, the #85 envelope to abi::mechanism::observe, the served-route pair to abi::mechanism::endpoint, and the HOT lane's two-symbol handshake to abi::handshake. The SDK's store/secret JSON exports (export_store_plugin!, export_secret_plugin!, dispatch, dispatch_secret) are gone. The 1.5.5 refusal-at-boot proof gains its secret arm (abi_version 1, admitted until now).
…tays whole until the auth-oidc door re-pin The chain-verify suites (busbar-kernel auth/tests/plugin_chain_tests.rs, busbar tests/mcp_stdio_serve.rs' governed session) run the pinned auth-oidc cdylib, still on the JSON lane, as a chain verifier; its verify and its hosted login leave the lane together with that plugin's door re-pin (the p4-oidc-repin lane). The kernel's in-process test stand-ins stay on auth::stand_in.
… kind store 3, secret 2, auth 3, hook 2, export 3, plane 1, transport 1 (THE DESIGN §11.2, A.9): no JSON-lane versions (store 4, secret 1), no ranges (plane [1, ABI_MINOR], transport [TRANSPORT_DECL_MINOR, ABI_MINOR]). A HOT-lane plane or transport image states its kind's one version in its manifest; its decl's airlock is checked at load, apart. The HOT and door test manifests that stated the airlock minor state the kind version.
abi-freeze: abi/cold 3702 -> 2164. one-memory-abi: 10 cold-lane rows drained (65 -> 55). abi-location: the two legacy_usage.rs version-const rows struck with the file; no-float-money's persisted-record homes lose it too. design-bindings: PB-37 and PB-93 drop the deleted JSON-store fallback tests (PB-93 keeps the adapter's published-schema shim sweep). The C header re-rendered (the mechanism's kind words). The store adapter's shim suites bind the build's store fixture rather than the deleted fake-call JSON store.
…ue (no new C-unwind site)
# Conflicts: # crates/busbar-kernel/src/preflight.rs # crates/busbar/src/root/tests/linked.rs # crates/plugin-loader/src/tests/store_conformance_tests.rs # crates/store-memory/src/lib.rs
… export lookup (registry 4 -> 1) The contract's doc comments name the plugin ABI's sections in words (feature_invariance), and say what the JSON lane's residue serves (the auth plugin still on it, verify and login, and the two request-log sinks). The export row's kind word is read from the mechanism's kind list.
… (THE DESIGN §11.11 R4, §11.12; ARCHITECT ruling Q-C1-FILE 2026-10-03)
The request-log file sink is door-only, and it asked the host for a disk lane that did not exist, so
every line was dropped with BUSBAR-7074, a break from 1.5.5. The host now serves the lane.
- contract: abi::host::service gains op DISK_APPEND = 22 (SERVICES 22 -> 23, may pend), with DiskAppendIn
{head, dest_key, bytes, result} -> DiskWritten {size, rotated, faults, written}. A FAILED answer names
its step in value (DISK_OPEN_FAILED / DISK_APPEND_FAILED) and still reports the rotation.
check_disk_append_in (host side) and check_disk_append (caller side), one RED per arm.
HostSlots.disk_append is appended (184 -> 192); the abi-layout golden gains the appended rows and the
new table size. SDK: Connector::disk_append, on the op's handle count. services: HostServices::disk_append,
DiskDest, DiskReport, DISK_KEEP (9), DISK_ROTATE_KEY ("rotate_mb", the host's rotation key).
- loader: an opener grants an instance the destinations its manifest declares (ExportRows::open,
Plugin::grant_destinations); open and refresh bind each one to the path the settings give it. The
disk_append slot maps the key through that binding (NO_DESTINATION otherwise) and writes the lane's report.
- kernel: host_disk::DiskLane: one thread, appends in submission order, bounded (LANE_BOUND). It writes
as 1.5.5 did (open for append, create if absent, write the bytes whole), after a rename rotation when one is due.
- root: LateServices and CredentialServices forward the call.
A delivery's host-service results and connections are stored under (ticket, n), with n counting from 0.
The flusher used ONE ticket for every batch, so the second batch picked up the first batch's stored
results: otlp got the first batch's establish ("the far end took no bytes": one export, then nothing),
and the file sink got the first batch's disk.append (only the first batch was written). Minting a
ticket per batch and recycling it afterwards forgets those results (worker recycle_now: completions,
services, conns).
…of 265), the design cited in words in the contract, every HostServices double answers disk_append
…nt (kind::EXPORT => &[...]) reads as one keyed by its word
…RABLE-BYPASS row's ledgered rename exemption, and its error-text intern a reviewed hold-escapes site (bounded by MAX_WORDS)
MattJackson
enabled auto-merge
October 5, 2026 14:37
promote into
|
| crate | test | step | first panic |
|---|---|---|---|
| `` | nextest xtask::cli::selftest_runs_every_registered_gates_red_proof |
test:workspace | |
transport_dropped_in_serves |
a_dropped_in_transport_registers_through_the_one_fold_and_serves |
test:dropped-in-tcp-transport | crates/busbar/tests/transport_dropped_in_serves.rs:168:13: busbar exited (ExitStatus(unix_wait_status(512))) before serving; log: |
-p busbar --test transport_dropped_in_serves |
test target failed |
test:dropped-in-tcp-transport | |
busbar |
root::connector::h2_tests::a_request_whose_bytes_left_is_not_redialled |
test:root-test-harness | crates/busbar/src/root/tests/connector_h2.rs:754:5: nothing answered the request the close cut |
-p busbar --bin busbar |
test target failed |
test:root-test-harness | |
busbar |
root::connector::h2_tests::a_request_whose_bytes_left_is_not_redialled |
test:single-plane-voice | crates/busbar/src/root/tests/connector_h2.rs:754:5: nothing answered the request the close cut |
-p busbar --bin busbar |
test target failed |
test:single-plane-voice |
DENY rows (14)
| gate | row | detail |
|---|---|---|
| construction | one-pick-site |
3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8 |
| reachability | reachability:unit-path:decision |
NO LIVE UNIT PATH: roster plane 'decision' has no kernel-loop runner registered for its capability key, no 'Units' impl its linked entry exports and no served door, so nothing 'fn main()' reaches driv |
| reachability | reachability:root-reach:decision |
NO UNIT PATH REACHED: no module a chain from crates/busbar/src/main.rs arrives at routes plane 'decision''s capability key onto a kernel-loop runner, its linked entry exports no 'Units' impl, and no s |
| kind-isolation | kind-isolation:deps |
4 finding(s), 78 shipped edge instance(s) over 28 class(es), 78 declaration(s); 62 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> plugin-tooling busbar-core-admin -> busbar-plugin-l |
| kind-isolation | kind-isolation:test-deps |
7 finding(s), 37 test edge instance(s) over 20 class(es), 37 declaration(s); 22 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is a test edge |
| kind-isolation-ship | kind-isolation:deps |
16 finding(s) over 78 shipped edge(s): ship-edge cleanliness -> plugin-tooling busbar-core-admin -> busbar-plugin-loader is 'not-allowed': the architecture grants no cleanliness -> plugin-tooling edge |
| kind-isolation-ship | kind-isolation:test-deps |
15 finding(s) over 37 test edge(s): ship-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is 'not-allowed': the architecture grants no cleanliness -> legacy edge, and the ship criterion is t |
| kind-isolation-ship | kind-isolation:faces |
4 finding(s) over 31 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Store' 2 time(s) in shipped source — the entry face of kind 'store'. A trait implementation is a claim |
| kind-isolation-ship | kind-isolation:testkit |
2 finding(s) over 12 crate(s): battery-ignored crates/busbar-plane-decisions busbar-plane-decisions carries a tests/conformance.rs whose every entry is '#[ignore]'d (or which has none). 'cargo test' |
| kind-isolation-ship | kind-isolation:legacy-drain |
5 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier) |
| kind-isolation-ship | kind-isolation:control-path |
77 finding(s) over 3 control surface(s): upstream crates/busbar-core-admin/src/admin_codec/meta.rs:84 busbar-core-admin names 'egress' — a control surface has no upstream to reach, so the vocabulary o |
| ship-ready | ship-ready:ship-twin |
'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is |
| instance-noun-neutrality | instance-noun-neutrality:voice |
tracked known-debt census — 8: crates/busbar-plane-llm/src/codec/gemini/handler.rs×7 [cross-plugin] | crates/busbar-plane-llm/src/codec/gemini/tests/handler_tests.rs×2 [cross-plugin] | crates/busbar |
| structure-lint | structure-lint:plane-dup:unledgered |
24 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs mcp:crates/busbar-mcp/src/mcp/config.rs voice:crate |
Denied because (2)
- shard 4/4: gate:test:root-test-harness: green at base, red now (test: busbar (unittests src/main.rs)::root::connector::h2_tests::a_request_whose_bytes_left_is_not_redialled, test: target -p busbar --bin busbar)
- shard 4/4: gate:test:single-plane-voice: green at base, red now (test: busbar (unittests src/main.rs)::root::connector::h2_tests::a_request_whose_bytes_left_is_not_redialled, test: target -p busbar --bin busbar)
Judged against base 6299a1988: 2 new red, 0 worse, 9 standing (excused).
New reds: gate:test:root-test-harness: green at base, red now (test: busbar (unittests src/main.rs)::root::connector::h2_tests::a_request_whose_bytes_left_is_not_redialled, test: target -p busbar --bin busbar), gate:test:single-plane-voice: green at base, red now (test: busbar (unittests src/main.rs)::root::connector::h2_tests::a_request_whose_bytes_left_is_not_redialled, test: target -p busbar --bin busbar)
tests passed: 24346, failed: 3. Run: https://github.com/GetBusbar/busbar/actions/runs/37326243749 . Artifact verdict-a9067fcf6b25e28cea5453529e9c950aeb1fb65f (failures.json, junit.xml, raw.log; 90 days).
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Q2 step 1 (ARCHITECT ruling: take over the export door ports). Ported from lane-w3a onto the predev contract.
Base includes #480 (p2-switch-cold). Proof (Latchkey, debug): workspace clippy -D warnings clean; contract 844 + all test targets green; loader lib 580/580 with the dlopen fixtures; root 528/528; kernel host_disk green; xtask gate --all at row level is identical to f27bd58 (no new reds).
The plugin PRs pin this branch: GetBusbar/busbar-export-file#13, GetBusbar/busbar-export-webhook#12.