From fc7717f6b1b918699182b0ffbddb2d456fd6a02a Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 1 Sep 2026 15:04:36 +0200 Subject: [PATCH] =?UTF-8?q?021=20closed=20=E2=80=94=20the=20record=20was?= =?UTF-8?q?=20left=20open=20after=20the=20fix=20landed?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The code and its tests went in hours before the record was touched, so an issue that read `located` had been fixed all along. That is the exact failure the frontmatter exists to prevent: status is meant to be answerable from the record rather than by reading the code. Closed with the commit that did it, and cross-referenced to 022 and 023, which came out of the same mistaken instinct — treating the machine as a boundary, then as an identity, then finding a consumer had a password and no name to present with it. --- .../00-report.md | 23 +++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/04-ISSUES/021-a-consumer-on-the-providers-machine-is-given-no-credential/00-report.md b/04-ISSUES/021-a-consumer-on-the-providers-machine-is-given-no-credential/00-report.md index 8df93be..a08c6fa 100644 --- a/04-ISSUES/021-a-consumer-on-the-providers-machine-is-given-no-credential/00-report.md +++ b/04-ISSUES/021-a-consumer-on-the-providers-machine-is-given-no-credential/00-report.md @@ -1,8 +1,8 @@ --- -status: located +status: fixed opened: 2026-09-01 located-in: [mesh-control] -fixed-by: +fixed-by: mesh-control df62bb5 amended-design: --- @@ -69,3 +69,22 @@ them as consumers. readable secret for local consumers would be a hole opened for convenience. - **Refusing must stay refusing.** A requirement nothing answers is still refused; this is about a requirement that *was* answered. + +## Fixed + +A requirement answered on this machine is still a requirement. Resolution now records a need for +it, so a credential is made, the provider is told who asked, and the consumer's file is written — +the same as if the two were on different machines. + +The reasoning that made it a gap is now written where it was assumed: the machine is not a trust +boundary once both ends are containers, and treating it as one gave the commonest arrangement of +all — a service and its database on one node — the weakest handling. + +Two later issues came out of the same mistaken instinct and are worth reading together: +[`022`](../022-one-credential-per-node-per-provision-not-per-module/00-report.md), where the +machine was treated as an *identity* rather than a boundary, and +[`023`](../023-a-consumer-cannot-build-a-connection-string/00-report.md), where the consumer was +given a password and never told the name to present with it. + +*Closed 2026-09-01. The fix landed the same day and this record was left open by oversight — the +code and the tests were in place for hours while the record still said `located`.*