mesh-vault: secret_holders lists every record of the vault's store by name and fingerprint (issue 1409) #670

2026-11-12T16:44:17Z

mesh-tools commented

2026-11-12 16:44:17 +00:00

Issue 1409, design 39 parts D1's gap: secret_holders listed only issued secrets, so the licence secrets the vault keeps were seen nowhere.

Builds design 39 bus-and-switch §20 and §15, parts §12, design 24 and as-is 06, with the lead's answers V1-V10 and V-thorough (issue 1409 notes 11-12). secret_holders answers records (every record of the store: name, generation, since, changed, changedBy, changedVia, origin, length, the vault's own fingerprint of the whole value; key and part for a licence. record), recordsCount, and recordsError only when the store cannot be listed. A record the vault cannot open or read is listed by name with its error and the listing goes on. No value is ever answered (principle 6). No new tool, no manifest change.

Quick fix: a list of licence.* records. Thorough fix (chosen): every store record, so no kind of secret is invisible again (principle 4), for about the same code.

Acceptance 1409/AC1-AC5 (issue 1409's latest note); AC5 live after the delivery.

Tests: TestSecretHoldersListsEveryStoreRecordByNameAndFingerprintNeverTheValue (fails without the change); 142 of 500 unit, 2 of 50 integration; checks/* pass.

Reviewed-by: mesh-code-reviewer@shanks at 45b0779b68

Issue 1409, design 39 parts D1's gap: `secret_holders` listed only issued secrets, so the licence secrets the vault keeps were seen nowhere. Builds design 39 bus-and-switch §20 and §15, parts §12, design 24 and as-is 06, with the lead's answers V1-V10 and V-thorough (issue 1409 notes 11-12). `secret_holders` answers `records` (every record of the store: name, generation, since, changed, changedBy, changedVia, origin, length, the vault's own fingerprint of the whole value; key and part for a `licence.` record), `recordsCount`, and `recordsError` only when the store cannot be listed. A record the vault cannot open or read is listed by name with its error and the listing goes on. No value is ever answered (principle 6). No new tool, no manifest change. Quick fix: a list of `licence.*` records. Thorough fix (chosen): every store record, so no kind of secret is invisible again (principle 4), for about the same code. Acceptance 1409/AC1-AC5 (issue 1409's latest note); AC5 live after the delivery. Tests: `TestSecretHoldersListsEveryStoreRecordByNameAndFingerprintNeverTheValue` (fails without the change); 142 of 500 unit, 2 of 50 integration; checks/* pass. Reviewed-by: mesh-code-reviewer@shanks at 45b0779b6801ecbc6997e4ebb50f1e3bb4196988

mesh-tools added 2 commits 2026-11-12 16:44:18 +00:00

mesh-vault: secret_holders lists every record of the vault's store by name and fingerprint (issue 1409) 52572698cb

S1 vault-licence-secrets-listed. secret_holders answers `records` and
`recordsCount` beside holders, count and enrolments: each store record's name,
generation, since, changed, changedBy/changedVia, origin, length and the vault's
own fingerprint of the whole value, plus key and part for licence.<key>.<part>.
A record the vault cannot open stays listed with an error. Never a value.

Builds: design 39 bus-and-switch §20, §15; design 39 parts §12 (D1); design 24 Every secret lives in the vault, Beyond generate and hold; as-is 06 The vault, as it runs.
Lead answers (issue 1409 note 11): V1, V-thorough, V2-V8. V3 drops the map's
tokenFingerprint and AC5; V-thorough widens the licence.-prefix list to every record.

mesh-vault: a store file that is not a record is listed by name with its error (issue 1409, V10)

mesh/delivery merged: source.main moved to novox/mesh-catalog@792a79720b30

Details

mesh/check checking 45b0779b6801 on 792a79720b30

45b0779b68

Store.ListReadable lists every record and, beside them, each file it cannot read
by name with its error; RecordsHeld lists those as rows with an error and goes
on. recordsError stays for a store that cannot be listed at all. Store.List and
ListPrefix keep their behaviour for their other callers.

Builds: design 39 bus-and-switch §20; design 39 parts §12. Lead answers (issue 1409): V9 (keep recordsCount and recordsError), V10.

mesh-tools commented

2026-11-12 16:44:22 +00:00

Delivery novox/mesh-catalog@45b0779b6801 — merged since 2026-11-12T17:51:20Z

Source — source.main moved to novox/mesh-catalog@792a79720b. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-11-12 16:44 (new) → proposed (announced): novox/mesh-catalog#670's head announced
2026-11-12 16:44 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-11-12 17:51 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@45b0779b6801` — **merged** since 2026-11-12T17:51:20Z **Source** — source.main moved to novox/mesh-catalog@792a79720b30. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-11-12 16:44 (new) → proposed (announced): novox/mesh-catalog#670's head announced - 2026-11-12 16:44 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-11-12 17:51 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit 792a79720b into main

2026-11-12 17:51:18 +00:00

mesh-tools deleted branch fix/1409-store-records-listed

2026-11-12 17:51:19 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#670