The vault answers a module's own secrets unless its plan hands it, not whenever a plan exists (issue 774) #573

2026-10-30T22:51:17Z

mesh-tools commented

2026-10-30 22:51:17 +00:00

Issue 774 (L3). Blocking fault after the 23:33 provisions group: 22 modules on ace and novox failed to compose with " needs a secret called X and none was made for it". Cause: mesh-sdk 125bb917 (catalogue.Keyed) makes the provisioner write a provisions-only plan (a route) for a module it does not hand; mesh-vault's own answer skipped every module with any plan (handed() = Provisioning != nil), so the node-engine got no own secrets for them although the vault holds them.

Fix: handed() is true only when the plan names something the provisioner client fills (template source, files, secrets or items), the same line the client draws since mesh-catalog #570. New test TestOwnLeavesOutOnlyAModuleWhosePlanHandsIt fails on main, passes here. go vet (both tags) and go test ./... pass in modules/mesh-vault; 132 tests, 1 integration.

Quick vs thorough: quick = this vault-only rule (blocking fault, recovery now). Thorough = one shared catalogue rule "this plan hands the module" in mesh-sdk, used by the vault and the provisioner client, with a test; started in the same turn on branch fix/plan-hands (the second part this week to disagree about what a plan means).

Reviewed-by: rev-vault@shanks at d5c4f8aaa9

Issue 774 (L3). Blocking fault after the 23:33 provisions group: 22 modules on ace and novox failed to compose with "<module> needs a secret called X and none was made for it". Cause: mesh-sdk 125bb917 (catalogue.Keyed) makes the provisioner write a provisions-only plan (a route) for a module it does not hand; mesh-vault's own answer skipped every module with any plan (handed() = Provisioning != nil), so the node-engine got no own secrets for them although the vault holds them. Fix: handed() is true only when the plan names something the provisioner client fills (template source, files, secrets or items), the same line the client draws since mesh-catalog #570. New test TestOwnLeavesOutOnlyAModuleWhosePlanHandsIt fails on main, passes here. go vet (both tags) and go test ./... pass in modules/mesh-vault; 132 tests, 1 integration. Quick vs thorough: quick = this vault-only rule (blocking fault, recovery now). Thorough = one shared catalogue rule "this plan hands the module" in mesh-sdk, used by the vault and the provisioner client, with a test; started in the same turn on branch fix/plan-hands (the second part this week to disagree about what a plan means). Reviewed-by: rev-vault@shanks at d5c4f8aaa968f69e185ce765623a4bc346d5507b

mesh-tools added 1 commit 2026-10-30 22:51:17 +00:00

Answer a module's own secrets to its node-engine when its plan only keys a provision, so twenty modules whose route the provisioner now keys compose again (issue 774)

mesh/delivery merged: source.main moved to novox/mesh-catalog@ca48943b925a

Details

mesh/check being carried to d5c4f8aaa968 on ca48943b925a | from 5be46a80cb35

d5c4f8aaa9

mesh-tools commented

2026-10-30 22:51:21 +00:00

Delivery novox/mesh-catalog@d5c4f8aaa968 — merged since 2026-10-30T23:00:19Z

Source — source.main moved to novox/mesh-catalog@ca48943b92. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-10-30 22:51 (new) → proposed (announced): novox/mesh-catalog#573's head announced
2026-10-30 22:51 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-30 23:00 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@d5c4f8aaa968` — **merged** since 2026-10-30T23:00:19Z **Source** — source.main moved to novox/mesh-catalog@ca48943b925a. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-10-30 22:51 (new) → proposed (announced): novox/mesh-catalog#573's head announced - 2026-10-30 22:51 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-30 23:00 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit ca48943b92 into main

2026-10-30 23:00:17 +00:00

mesh-tools deleted branch fix/secret-made-keyed-plan

2026-10-30 23:00:17 +00:00

mesh-tools referenced this pull request

2026-10-30 23:02:30 +00:00

One rule for whether a plan hands its module, so no part reads a provisions-only plan as handed (issue 774) #574

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#573