mesh-vault: sync before rename, record hand-outs, refuse a new key beside secrets, take the operator key as PEM only (review 250)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-14 01:19:36 +00:00
parent 2000c02559
commit b67fe1ffb1
3 changed files with 168 additions and 17 deletions
@@ -13,7 +13,6 @@
  "emits": [
    "provisioned",
    "rotated",
-    "deprovisioned",
    "secret-changed"
  ],
  "receives": {
@@ -111,7 +110,13 @@
  "tools": [
    "secret_export",
    "secret_holders",
-    "secret_verify"
+    "secret_verify",
+    "secret_handed",
+    "secret_vault_export",
+    "provisioner_retirement",
+    "provisioner_retire_approve",
+    "provisioner_retire_reject",
+    "provisioner_delete"
  ],
  "claims": [
    {