The bus, the provisioner and its client say their own secrets are the core's credentials, and the vault keeps no list of modules; pinned at mesh-sdk 4f141ff (issue 774, the operator 2026-11-03)

modules/mesh-vault/cmd/mesh-vault/core.go

@@ -24,10 +24,6 @@ import (
 	"time"
 )
 
-// CoreModules are the core's modules whose own secrets the controller carries sealed by the vault: the same fixed
-// list as the controller's (ADR 0349 §16). The node-engine and the controller have no own secrets of their own here.
-var CoreModules = []string{"mesh-provisioner", "mesh-provisioner-client", "nats"}
-
 // nodeKeyFile is a machine's sealing key as its engine stated it.
 type nodeKeyFile struct {
 	Node  string    `json:"node"`

modules/mesh-vault/cmd/mesh-vault/core_test.go

@@ -14,7 +14,6 @@ import (
 	"encoding/pem"
 	"os"
 	"path/filepath"
-	"reflect"
 	"strings"
 	"sync"
 	"testing"
@@ -56,13 +55,6 @@ func clientsBroker(sealingKey string) MoveOf {
 		Generation: "g-1", SealingKey: sealingKey}
 }
 
-// The list is the controller's (mesh-controller's core list, ADR 0349 §16): named here so a change to either is seen.
-func TestTheCoreIsTheBusTheProvisionerAndItsClient(t *testing.T) {
-	if want := []string{"mesh-provisioner", "mesh-provisioner-client", "nats"}; !reflect.DeepEqual(CoreModules, want) {
-		t.Fatalf("the core's modules are %v, want %v", CoreModules, want)
-	}
-}
-
 // A node-engine states its machine's sealing key in its own name at the move, and only its own machine's.
 func TestAMoveRecordsTheSealingKeyItsNodeEngineStates(t *testing.T) {
 	v := newVault(t, nil)

modules/mesh-vault/cmd/mesh-vault/move.go

@@ -292,7 +292,10 @@ func (v *Vault) StateNodeKey(caller, key string) error {
 	}
 	for _, r := range all {
 		parts := strings.Split(r.Name, "/")
-		if len(parts) == 4 && parts[0] == "own" && parts[1] == node && slices.Contains(CoreModules, parts[2]) {
+		// Every own secret of the machine is said changed: which modules carry theirs sealed by the vault is what their
+		// manifests say (core-credentials), read by the node-engine, which composes again and reseals those alone; the vault
+		// keeps no list of modules (issue 774, the operator 2026-11-03).
+		if len(parts) == 4 && parts[0] == "own" && parts[1] == node {
 			v.announce(Changed{Name: r.Name, Generation: r.Generation, At: v.Now().UTC(), By: caller})
 		}
 	}

modules/mesh-vault/cmd/mesh-vault/nodekey_test.go

@@ -2,7 +2,7 @@ package main
 
 // Issue 786 (ADR 0372): a machine's node-engine states its own sealing key to the vault, in its own name, at start and
 // when it changes, whether or not it ever moved a secret in. The caller is the bus user the runtime proved; a changed
-// key (or a first one) raises `secret-changed` for the machine's core secrets, the same key says nothing.
+// key (or a first one) raises `secret-changed` for the machine's own secrets, the same key says nothing.
 
 import (
 	"git.novox.be/novox/mesh-sdk/go/seal"
@@ -76,7 +76,8 @@ func TestANodeEngineStatesItsOwnKeyAndAChangeRaisesItsCoreSecrets(t *testing.T)
 		t.Error("a key was recorded for g14 by ace's engine")
 	}
 	got := changedNames(v.bus)[before:]
-	want := []string{"own/ace/mesh-provisioner-client/provisioner-broker", "own/ace/nats/broker"}
+	// Every own secret of the machine: which carry the vault's box their manifests say, read by the node-engine (issue 774).
+	want := []string{"own/ace/mesh-provisioner-client/provisioner-broker", "own/ace/nats/broker", "own/ace/postgres/superuser-password"}
 	if strings.Join(got, ",") != strings.Join(want, ",") {
 		t.Errorf("secret-changed was raised for %v, want %v", got, want)
 	}
@@ -85,16 +86,16 @@ func TestANodeEngineStatesItsOwnKeyAndAChangeRaisesItsCoreSecrets(t *testing.T)
 	if _, err := tool.runAs("node.ace", map[string]any{"key": pub}); err != nil {
 		t.Fatal(err)
 	}
-	if n := len(changedNames(v.bus)); n != before+2 {
-		t.Errorf("the same key raised %d more", n-before-2)
+	if n := len(changedNames(v.bus)); n != before+3 {
+		t.Errorf("the same key raised %d more", n-before-3)
 	}
 	// A different key raises them again.
 	other, _ := aSealingKey(t)
 	if _, err := tool.runAs("node.ace", map[string]any{"key": other}); err != nil {
 		t.Fatal(err)
 	}
-	if n := len(changedNames(v.bus)); n != before+4 {
-		t.Errorf("a changed key raised %d, want 2", n-before-2)
+	if n := len(changedNames(v.bus)); n != before+6 {
+		t.Errorf("a changed key raised %d, want 3", n-before-3)
 	}
 	if got, _, _ := v.Store.NodeKey("ace"); got != other {
 		t.Error("the changed key was not recorded")