Vault: read own secrets' generations, and hash each bus account it is handed for the grants part (issue 1945, ADR 0547 clause 9) #486

2026-10-26T01:10:39Z

mesh-tools commented

2026-10-26 01:10:39 +00:00

Issue 1945; ADR 0547 milestone 1, subtask 6 (the vault hashes what it is handed, clause 9).

secret_own (read-only): every own secret (own///) with generation, sha256: fingerprint (same Fingerprint as secret_verify and secret_holders), made, changed, changed by; filters node, module, name prefix; at most 1000 rows with cut; never a value. For bus accounts also user, hashed, hashedAt, hashWhy, hashOwed.
The vault bcrypt-hashes each covered bus account handed to it (broker, provisioner-broker, and a process's broker-, ADR 0436 §2), once per generation, at bcrypt.DefaultCost as the controller's hashBusPassword, into its state bus-accounts keyed by user, and says account-hashed (no value, no hash). At start it hashes every held account missing a key of its generation. A refused write (the bucket not there yet) is kept as owed and tried again on the vault's existing minute pass, one summary log line per pass: no new timer (NATS-native: weighed, the pass exists; the bucket's creation is the event that is missing, issue 1790).
account_hash {user} hashes one account again by hand; logs its caller.
Manifest: state bus-accounts (history 2), emits account-hashed.

Not in this change, noted on issue 1945 (note 69): 'readable by the grants part alone' is not enforced (announce.State has only a Readable flag; only mesh-grants declares the read); adoption of hashes the vault holds no value for has no path yet; the bucket appears at the controller's next start (issue 1790); one bucket of hashes against ADR 0201 §13 wants a progressive insight on ADR 0547.

Tests: TestSecretOwnListsFingerprintsOfOwnSecretsOnly (six filters, no value, bus-account rows), TestAHandedBusAccountIsHashedOncePerGeneration (table of 10 steps, hash checked with bcrypt against the value, process account covered, rotation refused), TestNoBucketHoldsASecret (exactly one bucket of hashes allowed). In modules/mesh-vault: go test -race -count=1 ./... and go vet -tags integration ./... pass.

Folded in per playbook 07 (a follow-up goes into the unapproved pull request): the hashing commits 32b912cf and 1c55e5d4 on top of the reviewed e572937d. Companion: mesh-delivery fix/1945-vault-hashing (mesh-grants reads the hashes); each works without the other, so no delivery group.

Rules bent (rules-are-weighed): no mesh-controller.try, as the operator directed on 2026-10-25.

Issue: 1945

Reviewed-by: review-vault-hash@shanks at 1c55e5d44d

Issue 1945; ADR 0547 milestone 1, subtask 6 (the vault hashes what it is handed, clause 9). 1. `secret_own` (read-only): every own secret (own/<node>/<module>/<name>) with generation, `sha256:` fingerprint (same Fingerprint as secret_verify and secret_holders), made, changed, changed by; filters node, module, name prefix; at most 1000 rows with `cut`; never a value. For bus accounts also user, hashed, hashedAt, hashWhy, hashOwed. 2. The vault bcrypt-hashes each covered bus account handed to it (broker, provisioner-broker, and a process's broker-<id>, ADR 0436 §2), once per generation, at bcrypt.DefaultCost as the controller's hashBusPassword, into its state `bus-accounts` keyed by user, and says `account-hashed` (no value, no hash). At start it hashes every held account missing a key of its generation. A refused write (the bucket not there yet) is kept as owed and tried again on the vault's existing minute pass, one summary log line per pass: no new timer (NATS-native: weighed, the pass exists; the bucket's creation is the event that is missing, issue 1790). 3. `account_hash {user}` hashes one account again by hand; logs its caller. 4. Manifest: state `bus-accounts` (history 2), emits `account-hashed`. Not in this change, noted on issue 1945 (note 69): 'readable by the grants part alone' is not enforced (announce.State has only a Readable flag; only mesh-grants declares the read); adoption of hashes the vault holds no value for has no path yet; the bucket appears at the controller's next start (issue 1790); one bucket of hashes against ADR 0201 §13 wants a progressive insight on ADR 0547. Tests: TestSecretOwnListsFingerprintsOfOwnSecretsOnly (six filters, no value, bus-account rows), TestAHandedBusAccountIsHashedOncePerGeneration (table of 10 steps, hash checked with bcrypt against the value, process account covered, rotation refused), TestNoBucketHoldsASecret (exactly one bucket of hashes allowed). In modules/mesh-vault: `go test -race -count=1 ./...` and `go vet -tags integration ./...` pass. Folded in per playbook 07 (a follow-up goes into the unapproved pull request): the hashing commits 32b912cf and 1c55e5d4 on top of the reviewed e572937d. Companion: mesh-delivery fix/1945-vault-hashing (mesh-grants reads the hashes); each works without the other, so no delivery group. Rules bent (rules-are-weighed): no mesh-controller.try, as the operator directed on 2026-10-25. Issue: 1945 Reviewed-by: review-vault-hash@shanks at 1c55e5d44dbb18e3271d6ae1042b22603868e49c

mesh-tools added 1 commit 2026-10-26 01:10:40 +00:00

Vault: secret_own reads the module-own secrets it keeps, as fingerprints, so a generation can be told without the value

mesh/check pass e572937d97fa on 567736f7795a | unit 2143 run, 2198 kept, 5 skipped | integration 2165 run, 2217 kept, 9 skipped | over bound: unit, in…

mesh/delivery closed: a newer head of the same pull request

Details

e572937d97

Issue: 1945

mesh-tools commented

2026-10-26 01:10:43 +00:00

Delivery novox/mesh-catalog@1c55e5d44dbb — merged since 2026-10-26T07:48:06Z

Source — source.main moved to novox/mesh-catalog@22381d7522. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-10-26 01:37 (new) → proposed (announced): novox/mesh-catalog#486's head announced
2026-10-26 01:37 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-26 07:48 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@1c55e5d44dbb` — **merged** since 2026-10-26T07:48:06Z **Source** — source.main moved to novox/mesh-catalog@22381d75224f. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-10-26 01:37 (new) → proposed (announced): novox/mesh-catalog#486's head announced - 2026-10-26 01:37 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-26 07:48 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

jschoubben added 2 commits 2026-10-26 01:37:29 +00:00

Vault: hash each bus account it is handed into bus-accounts.<user>, once per generation, so the grants part can compose the user list without the controller 32b912cfe5

The controller still mints each covered account and hands it to the vault (ADR 0374); ADR 0547 clause 9 has the vault
write the bcrypt hash of what it holds into its own state, readable by the grants part, and say account-hashed. It
hashes on keep, at start every held account with no key of its generation, and again by hand (account_hash); a refused
write is owed and written at the next pass. secret_own says per bus account whether this generation's hash is written.

Issue: 1945

Vault: take and hash a process's own bus account (broker-<process id>) as a covered account, so take-over is not held by every process user

mesh/delivery merged: source.main moved to novox/mesh-catalog@22381d75224f

Details

mesh/check failed: integration: meshbuildnode/cmd/mesh-build-node.TestAFixtureBundleBuiltTwiceHasOneDigest: no toolchain of this lock is installed und…

1c55e5d44d

The controller hands each process account of a core or moved module with origin issued (ADR 0436 §2); the vault took
only broker and provisioner-broker, refused these and never hashed them. Owed hashes are now said once per pass, and
account_hash says who asked when it refuses too (review round 1).

Issue: 1945

mesh-tools commented

2026-10-26 01:37:32 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: its head e572937d97 is no longer the pull request's head, or the pull request closed. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: its head e572937d97fa is no longer the pull request's head, or the pull request closed. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-tools changed title from ~~Vault: secret_own reads the generation and fingerprint of every own secret it keeps, never a value (issue 1945)~~ to Vault: read own secrets' generations, and hash each bus account it is handed for the grants part (issue 1945, ADR 0547 clause 9)

2026-10-26 01:37:58 +00:00

mesh-tools merged commit 22381d7522 into main

2026-10-26 07:48:04 +00:00

mesh-tools deleted branch fix/1945-vault-own-read

2026-10-26 07:48:06 +00:00

mesh-tools referenced this pull request

2026-10-26 08:26:07 +00:00

Vault: name a hash record's secret in a field called of, so the runtime keeps it (issue 1945) #487

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#486