2026-09-05 10:27:11 +00:00
1 changed files with 8 additions and 4 deletions
@@ -151,10 +151,14 @@ and proven — a credential moving at both ends with the old one ceasing to work
 the sort of thing to do deliberately on a quiet afternoon rather than as a side effect of moving a
 service between systems.

-**So there is a step before any of this: read the current environment out of the old system while
-it can still be read.** Once a value is accepted, the mesh cannot show it back — *a mesh that can
-reveal a secret is a mesh that holds it* — and once the old system is gone, neither can that. A
-password nobody wrote down is a service nobody can adopt.
+**So there is a step before any of this: read the current environment out of the old system**, because
+adoption means supplying those values and they live in its files today.
+
+*Corrected 2026-08-31 — an earlier version of this paragraph made that sound more dangerous than it
+is.* A sealed secret is not unreadable; it is sealed **to the node**, which holds the private half
+and writes the plaintext into the module's own file. The value is there, on the machine, as an
+ordinary file. What does not exist is a way to ask *the mesh* what a secret is, and there is no
+reveal command, because a mesh that can reveal a secret is a mesh that holds one.

 ## Where it starts, and what that costs