Vault: name a hash record's secret in a field called of, so the runtime keeps it (issue 1945) #487

2026-10-26T08:26:06Z

mesh-tools commented

2026-10-26 08:26:06 +00:00

Issue 1945 (note 72): since #486's delivery the vault writes no bus-account hash: the tool runtime refuses the state record 'bus-accounts. carries a field "secret", which names a credential' (mesh-tools node-tools/internal/bus/state.go:391-395 credentialField: a stored field name ending in password, secret, token and the like). My fault in #486: its tests used a store that did not apply that check.

AccountHash's field secret (the name of the vault's secret the hash is of) becomes of; Hashed and the account-hashed event follow, for one name. Nothing reads the old field: mesh-grants' HeldHash reads hash, generation, at and adopted only; no record was ever written under it (every write was refused).

Tests: the test store now applies the runtime's rule to every record it is handed (a copy in credential_field_test.go, since the rule is unexported in mesh-tools: its home belongs in mesh-sdk so every module's tests use the real one; noted on issue 1945); TestStateRecordsPassTheRuntimesCredentialFieldCheck (3 rows: a hash record passes, an adopted one passes, a record with a 'secret' field is refused). go test -race -count=1 ./... and go vet -tags integration ./... in modules/mesh-vault pass. A .gitignore keeps the locally built binary out.

Rules bent: no mesh-controller.try (operator, 2026-10-25).

Issue: 1945

Reviewed-by: review-hashfield@shanks at e7aaa8420e

Issue 1945 (note 72): since #486's delivery the vault writes no bus-account hash: the tool runtime refuses the state record 'bus-accounts.<user> carries a field "secret", which names a credential' (mesh-tools node-tools/internal/bus/state.go:391-395 credentialField: a stored field name ending in password, secret, token and the like). My fault in #486: its tests used a store that did not apply that check. AccountHash's field `secret` (the name of the vault's secret the hash is of) becomes `of`; Hashed and the account-hashed event follow, for one name. Nothing reads the old field: mesh-grants' HeldHash reads hash, generation, at and adopted only; no record was ever written under it (every write was refused). Tests: the test store now applies the runtime's rule to every record it is handed (a copy in credential_field_test.go, since the rule is unexported in mesh-tools: its home belongs in mesh-sdk so every module's tests use the real one; noted on issue 1945); TestStateRecordsPassTheRuntimesCredentialFieldCheck (3 rows: a hash record passes, an adopted one passes, a record with a 'secret' field is refused). `go test -race -count=1 ./...` and `go vet -tags integration ./...` in modules/mesh-vault pass. A .gitignore keeps the locally built binary out. Rules bent: no mesh-controller.try (operator, 2026-10-25). Issue: 1945 Reviewed-by: review-hashfield@shanks at e7aaa8420eacaa9b5c4f32504339dea895c81bbd

mesh-tools added 1 commit 2026-10-26 08:26:07 +00:00

Vault: name a hash record's secret in a field called of, so the runtime accepts it

mesh/check pass e7aaa8420eac on 3ded9e780043 | unit 2018 run, 2325 kept, 5 skipped | integration 2040 run, 2344 kept, 9 skipped | over bound: unit, in…

mesh/delivery merged: source.main moved to novox/mesh-catalog@3ded9e780043

Details

e7aaa8420e

The runtime refuses a state field whose name ends in secret, so no bus-account hash could be written on novox. The test state now applies the same check.

Issue: 1945

mesh-tools commented

2026-10-26 08:26:12 +00:00

Delivery novox/mesh-catalog@e7aaa8420eac — merged since 2026-10-26T09:00:54Z

Source — source.main moved to novox/mesh-catalog@3ded9e7800. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-10-26 08:26 (new) → proposed (announced): novox/mesh-catalog#487's head announced
2026-10-26 08:26 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-26 09:00 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@e7aaa8420eac` — **merged** since 2026-10-26T09:00:54Z **Source** — source.main moved to novox/mesh-catalog@3ded9e780043. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-10-26 08:26 (new) → proposed (announced): novox/mesh-catalog#487's head announced - 2026-10-26 08:26 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-26 09:00 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit 3ded9e7800 into main

2026-10-26 09:00:52 +00:00

mesh-tools deleted branch fix/1945-vault-hash-field

2026-10-26 09:00:52 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#487