The secrets vault: handoff, the amended decision, issues 069–071, and the reconciliation of open issues #58

2026-09-21T07:30:03Z

jschoubben commented

2026-09-21 07:30:03 +00:00

Merge last of five, after the code repositories.

ADR 0085 amended on the record, dated: the vault is a foundation module, one per mesh, holding the root secrets under an operator-held key.
Design 24 says how; 07 closes its open item; 21 says what the installer now does and what it still cannot check.
Issues 069 (one value per pair) and 070 (no operator-delivered pair credential) opened; 071 (fixed genesis credentials) opened and resolved.
Playbook 07: a feature worktree needs the siblings the lab reads.
Open issues reconciled against main: 11 resolved with evidence, 3 partly, 9 still open (041 recorded as widened).

Checks (cycle, records, index) green.

Merge last of five, after the code repositories. - ADR 0085 amended on the record, dated: the vault is a foundation module, one per mesh, holding the root secrets under an operator-held key. - Design 24 says how; 07 closes its open item; 21 says what the installer now does and what it still cannot check. - Issues 069 (one value per pair) and 070 (no operator-delivered pair credential) opened; 071 (fixed genesis credentials) opened and resolved. - Playbook 07: a feature worktree needs the siblings the lab reads. - Open issues reconciled against main: 11 resolved with evidence, 3 partly, 9 still open (041 recorded as widened). Checks (cycle, records, index) green.

jschoubben added 7 commits 2026-09-21 07:30:04 +00:00

Hand off the secrets vault to mesh-catalog; open issues 069 and 070 187389b7d1

Design 24 flips to in-progress with mesh-catalog as its owner (playbook 04).
Starting the build surfaced two gaps the decision did not settle: a module
requiring `secret` receives exactly one value (069), and no command can
accept an operator's value into a consumer↔vault pair (070). Both opened as
issues rather than improvised around.

Also fills fixed-by on 067 and 068, which the cycle check refused as resolved
with no reference.

Amend ADR 0085: the vault is a foundation module and holds the root secrets baa3351552

Recorded on the record, dated, before anything shipped against the sentences
that change. The vault is installed at genesis like the store and broker, one
per mesh, and holds every secret a module has for itself sealed a second time
to an operator key whose private half never enters the mesh — the break-glass
path the first version left open, without a key one place holds.

Design 24 says how; 07 and 21 say what genesis does not yet do; issue 071
names the fixed credentials the foundation is raised with today.

Playbook 07: a feature worktree needs the siblings the lab reads 050a2d08e8

A bed run from .work/<slug>/mesh-lab derives mesh-tools and mesh-sdk by
sibling path and fails at once when the directory holds only the touched
repos. Detached worktrees on main, never symlinks.

Design 24: pair credentials are sealed to the operator too 8607d21110

Designs 07 and 21 and issue 071: genesis now makes the root secrets 1bce3f33a8

The installer half of the amended ADR 0085 is built and proven by the
genesis bed's root-secrets step; the foundation design closes its open item
and the installation design says what the installer does and what it still
cannot check.

Design 24: the export says what an earlier key opens ffd7592687

Reconcile the open issues against main 61f61b5d06

An audit of the six code repositories found eleven open issues fixed on main
with commits and beds to show (025, 027, 033, 036, 037, 040, 045, 047, 050,
052, 053), three partly (007, 026, 035), nine not (020, 031, 041, 046, 049,
054, 064, 065, 066) and one whose fix would live outside those repos (006).
Resolved ones name their evidence; partly ones say what remains; 041 records
that the exposure has widened since it was reported.

jschoubben merged commit aa9b5b99e4 into main

2026-09-21 08:03:28 +00:00

jschoubben deleted branch feat/secrets-vault

2026-09-21 08:03:28 +00:00

jschoubben referenced this issue from a commit

2026-09-25 12:25:29 +00:00

Issue 116: resolved by mesh-controller PR #58

jschoubben referenced this pull request

2026-09-25 12:27:57 +00:00

Issue 116: route-proxy has no authentication or IP-restriction mechanism #109

jschoubben referenced this issue from a commit

2026-09-25 14:52:43 +00:00