From f2eb54820469bfa7f799d4b87fd21db573de56f1 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 21:28:29 +0100
Subject: [PATCH] Take core-credentials out of the bus's, the provisioner's and
 its client's manifests until the judge that knows it runs

The running indexer's judge refuses the word, a refused manifest holds the bus's user list, and so the indexer build
that knows the word is never granted. The node-engine on main still finds these modules by its name list, and the
vault keeps no list, so no credential is lost; the word comes back once the new judge runs (issue 774).

Claude-Session: https://claude.ai/code/session_01JG73KG7AfSdh6FP8VrBqCn
---
 modules/mesh-provisioner-client/module.json                  | 1 -
 .../cmd/mesh-provisioner/provisioner_test.go                 | 5 +++++
 modules/mesh-provisioner/module.json                         | 1 -
 modules/nats/cmd/nats-tools/manifest_test.go                 | 5 +++++
 modules/nats/module.json                                     | 1 -
 5 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/modules/mesh-provisioner-client/module.json b/modules/mesh-provisioner-client/module.json
index 8fca6444..095128a8 100644
--- a/modules/mesh-provisioner-client/module.json
+++ b/modules/mesh-provisioner-client/module.json
@@ -7,7 +7,6 @@
       "scope": "node"
     }
   ],
-  "core-credentials": true,
   "own-secrets": {
     "provisioner-broker": "${dir:state}/broker"
   },
diff --git a/modules/mesh-provisioner/cmd/mesh-provisioner/provisioner_test.go b/modules/mesh-provisioner/cmd/mesh-provisioner/provisioner_test.go
index c856a63b..1328bde9 100644
--- a/modules/mesh-provisioner/cmd/mesh-provisioner/provisioner_test.go
+++ b/modules/mesh-provisioner/cmd/mesh-provisioner/provisioner_test.go
@@ -295,6 +295,11 @@ func TestTheManifestDeclaresWhatTheCodeKeeps(t *testing.T) {
 	if err := json.Unmarshal(raw, &m); err != nil {
 		t.Fatal(err)
 	}
+	// No "core-credentials" until the indexer whose judge knows the word runs (issue 774): the running judge refuses it,
+	// and a refused manifest holds the bus's user list, so the indexer that knows it is never granted. It comes back then.
+	if strings.Contains(string(raw), `"core-credentials"`) {
+		t.Error("the manifest says \"core-credentials\" before the judge that reads it runs")
+	}
 	if m.Module != "mesh-provisioner" || m.RunsAs != "mesh-provisioner" || m.OwnSecrets["broker"] == "" {
 		t.Errorf("an account of its own: module %q, runs-as %q, own secrets %v", m.Module, m.RunsAs, m.OwnSecrets)
 	}
diff --git a/modules/mesh-provisioner/module.json b/modules/mesh-provisioner/module.json
index 7b512a6f..12d4c27c 100644
--- a/modules/mesh-provisioner/module.json
+++ b/modules/mesh-provisioner/module.json
@@ -46,7 +46,6 @@
     "plans",
     "refused"
   ],
-  "core-credentials": true,
   "own-secrets": {
     "broker": "${dir:state}/broker"
   },
diff --git a/modules/nats/cmd/nats-tools/manifest_test.go b/modules/nats/cmd/nats-tools/manifest_test.go
index 57b4a3fc..9ac143ba 100644
--- a/modules/nats/cmd/nats-tools/manifest_test.go
+++ b/modules/nats/cmd/nats-tools/manifest_test.go
@@ -43,6 +43,11 @@ func TestTheBussManifestMountsItsProgramsIntoTheUpstreamImage(t *testing.T) {
 	if err := json.Unmarshal(raw, &m); err != nil {
 		t.Fatal(err)
 	}
+	// No "core-credentials" until the indexer whose judge knows the word runs (issue 774): the running judge refuses it,
+	// and a refused manifest holds the bus's user list, so the indexer that knows it is never granted. It comes back then.
+	if strings.Contains(string(raw), `"core-credentials"`) {
+		t.Error("the manifest says \"core-credentials\" before the judge that reads it runs")
+	}
 	if m.Build.On != nil {
 		t.Error("build.on is declared: nothing is built on a base image any more")
 	}
diff --git a/modules/nats/module.json b/modules/nats/module.json
index 93f518d7..f9083c93 100644
--- a/modules/nats/module.json
+++ b/modules/nats/module.json
@@ -21,7 +21,6 @@
     }
   ],
   "bus-users": "/var/lib/nats-module/conf/accounts.conf",
-  "core-credentials": true,
   "own-secrets": {
     "broker": "${dir:mesh-state}/broker",
     "broker-nats-tools": "${dir:tools-secret}/broker-nats-tools"