mesh-provisioner-client: a module that leaves or is placed again asks the vault afresh (issue 1945) #484

2026-10-25T23:07:02Z

mesh-tools commented

2026-10-25 23:07:02 +00:00

Issue 1945, notes 57-58. Live on ace 2026-10-25: mesh-build-go was unassigned at 22:49 and assigned again at 23:49 under a newly minted bus password. The provisioner client wrote the generation-4 password it still held in memory at 23:51:26 without a vault get (mesh-vault.secret_handed shows none after 22:27:58), and the bus refused the account. The vault's secret-changed event was not raised or was lost in the bus reload at 23:50:05.

The change:

leave() drops the module's held secrets (own, provision, pair) and clears providing and leftOut.
The assignments watch drops held secrets when an assignment is gone, or when a module is placed after being absent, so a delete then put inside one batch also asks the vault again.
A consumer's ended assignment drops the pair credentials a provider here held for it.
A module that stays placed keeps its held values until secret-changed, as before.

Tests, run locally (the check does not gate, operator 2026-10-25 22:56):

unit with -race: pass
go vet -tags integration: clean
integration with -race: pass

One table test of four rows was added; without the fix, three of them fail (the reviewer checked). The package has 73 tests.

Notes for issue 1945, none of them blocking:

A provider leaving drops the consumer credentials of every provider on the machine, which costs one vault get each.
The provider branch and forgetBound have no test row yet.

Acceptance after delivery to ace: mesh-build-go assigned to ace once more connects to the bus (no 'the bus refused this account'), and mesh-vault.secret_handed shows a get by provisioner.ace of own/ace/mesh-build-go/broker at a new generation.

Reviewed-by: review-heldsecret@shanks at 363a3d3f7e

Issue 1945, notes 57-58. Live on ace 2026-10-25: mesh-build-go was unassigned at 22:49 and assigned again at 23:49 under a newly minted bus password. The provisioner client wrote the generation-4 password it still held in memory at 23:51:26 without a vault get (mesh-vault.secret_handed shows none after 22:27:58), and the bus refused the account. The vault's secret-changed event was not raised or was lost in the bus reload at 23:50:05. The change: - `leave()` drops the module's held secrets (own, provision, pair) and clears `providing` and `leftOut`. - The assignments watch drops held secrets when an assignment is gone, or when a module is placed after being absent, so a delete then put inside one batch also asks the vault again. - A consumer's ended assignment drops the pair credentials a provider here held for it. - A module that stays placed keeps its held values until secret-changed, as before. Tests, run locally (the check does not gate, operator 2026-10-25 22:56): - unit with -race: pass - go vet -tags integration: clean - integration with -race: pass One table test of four rows was added; without the fix, three of them fail (the reviewer checked). The package has 73 tests. Notes for issue 1945, none of them blocking: - A provider leaving drops the consumer credentials of every provider on the machine, which costs one vault get each. - The provider branch and forgetBound have no test row yet. Acceptance after delivery to ace: mesh-build-go assigned to ace once more connects to the bus (no 'the bus refused this account'), and mesh-vault.secret_handed shows a get by provisioner.ace of own/ace/mesh-build-go/broker at a new generation. Reviewed-by: review-heldsecret@shanks at 363a3d3f7e8f7554507b8cbfd87c825cc4a5fa23

mesh-tools added 1 commit 2026-10-25 23:07:02 +00:00

Provisioner client: drop a module's held vault secrets when it leaves or is placed again, so it asks afresh (issue 1945)

mesh/delivery merged: source.main moved to novox/mesh-catalog@82e7e3e32675

Details

mesh/check pass 363a3d3f7e8f on 82e7e3e32675 | unit 2015 run, 2322 kept, 5 skipped | integration 2037 run, 2341 kept, 9 skipped | over bound: unit, in…

363a3d3f7e

A re-assigned module was filled with the generation it held before the vault minted a new one; the bus refused the account.

mesh-tools commented

2026-10-25 23:07:05 +00:00

Delivery novox/mesh-catalog@363a3d3f7e8f — merged since 2026-10-25T23:21:47Z

Source — source.main moved to novox/mesh-catalog@82e7e3e326. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-10-25 23:07 (new) → proposed (announced): novox/mesh-catalog#484's head announced
2026-10-25 23:07 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-25 23:21 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@363a3d3f7e8f` — **merged** since 2026-10-25T23:21:47Z **Source** — source.main moved to novox/mesh-catalog@82e7e3e32675. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-10-25 23:07 (new) → proposed (announced): novox/mesh-catalog#484's head announced - 2026-10-25 23:07 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-25 23:21 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit 82e7e3e326 into main

2026-10-25 23:21:44 +00:00

mesh-tools deleted branch fix/1945-held-secret-on-leave

2026-10-25 23:21:44 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#484