Design 28: the move needs a credential and a membership for machines already enrolled #154

2026-09-27T21:48:07Z

jschoubben commented

2026-09-27 21:48:07 +00:00

What the first live attempt at the bus move found tonight, written into task 5.2 as the mechanism to build before anything moves.

With the seat handed over on record and the new bus's module assigned beside the old one, push refused the control node: not one user has a credential for the new bus. The check is right. A credential is minted only at enrolment, at module issue and for a person — nothing mints one for a machine already enrolled or for the control plane itself — and on the host the membership (address, fingerprint, password, transport) is written once at enrolment and never rewritten. So "move each machine and confirm it reports" had no mechanism under it on either side.

The mechanism: the control plane mints what is missing and delivers each plaintext where its owner reads it — a machine's as a sealed membership in its declaration, a module's as its broker secret, its own as its module secret — and the host saves a delivered membership and re-dials on it through the reconnect path it already has. The switch is then MESH_BUS_NATS plus the seat handover, in one push.

Also ticks 5.3 as built (with what its first live use taught) and marks 5.4's catalogue half done, its live half waiting on 5.2.

What the first live attempt at the bus move found tonight, written into task 5.2 as the mechanism to build before anything moves. With the seat handed over on record and the new bus's module assigned beside the old one, `push` refused the control node: not one user has a credential for the new bus. The check is right. A credential is minted only at enrolment, at `module issue` and for a person — nothing mints one for a machine already enrolled or for the control plane itself — and on the host the membership (address, fingerprint, password, transport) is written once at enrolment and never rewritten. So "move each machine and confirm it reports" had no mechanism under it on either side. The mechanism: the control plane mints what is missing and delivers each plaintext where its owner reads it — a machine's as a sealed membership in its declaration, a module's as its broker secret, its own as its module secret — and the host saves a delivered membership and re-dials on it through the reconnect path it already has. The switch is then `MESH_BUS_NATS` plus the seat handover, in one push. Also ticks 5.3 as built (with what its first live use taught) and marks 5.4's catalogue half done, its live half waiting on 5.2.

jschoubben added 1 commit 2026-09-27 21:48:08 +00:00

Design 28: the move needs a credential and a membership for machines already enrolled d7d6f2eda0

The first live attempt at 5.2 found the half nobody had built. With the seat
handed over on record and the new bus's module assigned beside the old one, the
push was refused: not one user has a credential for the new bus. The check is
right. A credential is minted only at enrolment, at `module issue` and for a
person; nothing mints one for a machine already enrolled or for the control plane
itself, and on the host the membership is written once at enrolment and never
rewritten. So "move each machine" had no mechanism under it on either side.

Written into 5.2 as the mechanism to build before anything moves: the control
plane mints what is missing and delivers each plaintext where its owner reads it —
a machine's as a sealed membership in its declaration, a module's as its broker
secret, its own as its module secret — and the host saves a delivered membership
and re-dials on it through the reconnect path it already has. 5.3 is ticked as
built; 5.4's catalogue half is done and its live half waits on 5.2.

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin design/28-the-move-needs-a-membership-for-enrolled-nodes:design/28-the-move-needs-a-membership-for-enrolled-nodes

git checkout design/28-the-move-needs-a-membership-for-enrolled-nodes

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#154