Module control_plane 

gunnar-grpc’s ControlPlane seam, over gunnar-core and gunnar-store: the adapter its module docs asked for.

gunnar-grpc was written before gunnar-core existed and defined a local trait describing what the seven services need. Its own docs say the trait must become “a thin adapter, one impl in this crate” and must never be a second source of truth for what a Repo is. This is that adapter, living one level up because it is the binary that knows both halves.

What is real here, and what is not

surface	status
namespaces, repos	real, [RepoCatalog]
principals, keys, grants	real, [AuthTable]
Refs.List / Get / ReadObject / Log	real, the repository’s own stores
Admin.Stats / StorageInfo	real, measured off the fs backend
Refs.Diff	Unimplemented: no diff engine on the server side
Policy.*	Unimplemented: gunnar-core has no protection store
Mirror.*	Unimplemented: mirroring needs gunnar-client, which an S crate must never link

Every one of those is an explicit ControlError::Unimplemented and never an empty success. An empty ref list is indistinguishable from a working server with no refs (measured, not asserted), and the same is true of “0 mirrors synced”.

Three model mismatches, recorded rather than papered over

1. RepoPath cannot express a nested namespace. gunnar-proto’s RepoPath::validate rejects a / inside namespace, but nesting makes team/sub/repo.git legal over SSH. Such a repository is reachable by git and invisible to gRPC. That is a gunnar-proto change, not one to make here.
2. Scope::Server has no RepoPath. A server-wide grant is carried as an empty namespace and an empty repo, which MemoryControlPlane refuses on the way in. The test double is the one that is wrong: without a server-scoped grant the bootstrap admin cannot create the first namespace (the secret-store seam).
3. Namespace in gunnar-core carries only a name — no description, no creation time — so those two proto fields come back empty rather than invented.

Structs

CoreControlPlane

The control plane, backed by the real catalog and identity table.

RepoBytes

One repository’s bytes, attributed per file. The one walk both Admin.StorageInfo and Usage.Read are summed from (one implementation), so the two cannot disagree about what a directory weighs.

Functions

repo_bytes

See RepoBytes.