14 lines
920 B
Markdown
14 lines
920 B
Markdown
# Diagnosis — 2026-09-21
|
|
|
|
1. The three open questions, answered. It is `secret accept` growing a provider end, not a new
|
|
verb: the verb already means a value a person supplied, sealed on the way in. An accepted pair
|
|
refuses `rotate` — the mesh cannot make the replacement — and accepting a new value is the
|
|
rotation. The origin becomes a fact of every pair credential, `made` or `accepted`, so the
|
|
vault's ledger can say which a person supplied.
|
|
2. One consequence the report did not name: a pair credential is remade whenever either end's
|
|
sealing key changes, and an accepted one cannot be — the mesh does not hold the value. The
|
|
read is refused aloud with the remedy rather than quietly replaced by a minted one.
|
|
|
|
**Located in:** the controller's pair-credential store and the `secret accept` command. Decided
|
|
in [ADR 0092](../../02-DECISIONS/0092-an-operator-delivers-a-pair-credential.md).
|