57/V1: mesh-vault in Go, holding secrets sealed and answering get sealed to the asker (issue 674) #286

Merged

mesh-admin merged 17 commits from pkg/57-v1-vault-in-go into feat/57-config-and-provisioning

2026-10-14 18:27:50 +00:00

Author	SHA1	Message	Date
mesh-adminandClaude Opus 5.5	c0d55ee27d	mesh-vault: ADR 0230's rules pinned one at a time, and the words held to the controller's types (review 255) mesh/merge-gate head c0d55ee27dae merged into trunk b807b1d21102 — pass: [release feat/57-config-and-provisioning, judged by its controller fcdecb436117] t… Details mesh/repo-check head c0d55ee27dae merged into trunk b807b1d21102 — pass: [release feat/57-config-and-provisioning, judged by its controller fcdecb436117] i… Details mesh/delivery delivered Details mesh/delivery-group group pkg/57-v1-vault-in-go delivered: every member is delivered Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 01:41:01 +00:00
mesh-adminandClaude Opus 5.5	dadf824c3e	mesh-vault: tests of the bound, the retry's real path and a hand-out without its record; the README corrected (review 255) mesh/delivery superseded: a newer head of the same pull request Details mesh/merge-gate head dadf824c3e33 merged into trunk 8aa37e8b835d — pass: the change touches no module of the mesh's graph Details mesh/repo-check head dadf824c3e33 merged into trunk 8aa37e8b835d — fail: its merge-check.sh failed: files asking for a setting without saying whether it is… Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 01:39:49 +00:00
mesh-adminandClaude Opus 5.5	8c5d70a186	mesh-vault: the retirement tools take the controller's consumers, confirm, by and via; vault_status; the export's fingerprint (review 255) mesh/merge-gate head 8c5d70a18677 merged into trunk 8aa37e8b835d — pass: the change touches no module of the mesh's graph Details mesh/repo-check head 8c5d70a18677 merged into trunk 8aa37e8b835d — fail: its merge-check.sh failed: files asking for a setting without saying whether it is… Details mesh/delivery superseded: a newer head of the same pull request Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 01:39:15 +00:00
mesh-adminandClaude Opus 5.5	958018e696	mesh-vault: the ledger keeps the ledger; retirement moves to retirement.go (review 255) mesh/merge-gate head 958018e696e4 merged into trunk 8aa37e8b835d — pass: the change touches no module of the mesh's graph Details mesh/repo-check head 958018e696e4 merged into trunk 8aa37e8b835d — fail: its merge-check.sh failed: files asking for a setting without saying whether it is… Details mesh/delivery superseded: a newer head of the same pull request Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 01:38:27 +00:00
mesh-adminandClaude Opus 5.5	b71e696993	mesh-vault: retirement in the controller's words, held to its types by golden files (review 255) mesh/merge-gate head b71e696993b3 merged into trunk 8aa37e8b835d — pass: the change touches no module of the mesh's graph Details mesh/repo-check head b71e696993b3 merged into trunk 8aa37e8b835d — fail: its merge-check.sh failed: files asking for a setting without saying whether it is… Details mesh/delivery superseded: a newer head of the same pull request Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 01:37:27 +00:00
mesh-adminandClaude Opus 5.5	6ab38066c9	mesh-vault: bound the record of hand-outs and record only a well-formed ask (review 255) mesh/merge-gate head 6ab38066c910 merged into trunk 8aa37e8b835d — pass: the change touches no module of the mesh's graph Details mesh/repo-check head 6ab38066c910 merged into trunk 8aa37e8b835d — fail: its merge-check.sh failed: files asking for a setting without saying whether it is… Details mesh/delivery superseded: a newer head of the same pull request Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 01:36:11 +00:00
mesh-adminandClaude Opus 5.5	c63f7d6e5c	mesh-vault: the ledger's tests say ADR 0230's rules, not a withdrawal on the first pass (review 250) mesh/merge-gate head c63f7d6e5cea merged into trunk 8aa37e8b835d — pass: the change touches no module of the mesh's graph Details mesh/repo-check head c63f7d6e5cea merged into trunk 8aa37e8b835d — fail: its merge-check.sh failed: files asking for a setting without saying whether it is… Details mesh/delivery superseded: a newer head of the same pull request Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 01:22:30 +00:00
mesh-adminandClaude Opus 5.5	39c38f3745	mesh-vault: tests for the review's fixes, and the README saying what at-rest encryption protects (review 250) mesh/merge-gate head 39c38f37459a merged into trunk 8aa37e8b835d — pass: the change touches no module of the mesh's graph Details mesh/repo-check head 39c38f37459a merged into trunk 8aa37e8b835d — fail: its merge-check.sh failed: files asking for a setting without saying whether it is… Details mesh/delivery superseded: a newer head of the same pull request Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 01:21:30 +00:00
mesh-adminandClaude Opus 5.5	da889d421d	mesh-vault: finish a new operator key after a failure partway, record every hand-out, reach the vault's copies from secret recover (review 250) mesh/merge-gate head da889d421d71 merged into trunk 8aa37e8b835d — pass: the change touches no module of the mesh's graph Details mesh/delivery superseded: a newer head of the same pull request Details mesh/repo-check head da889d421d71 merged into trunk 8aa37e8b835d — fail: its merge-check.sh failed: files asking for a setting without saying whether it is… Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 01:20:25 +00:00
mesh-adminandClaude Opus 5.5	b67fe1ffb1	mesh-vault: sync before rename, record hand-outs, refuse a new key beside secrets, take the operator key as PEM only (review 250) mesh/delivery-group group pkg/57-v1-vault-in-go delivering: 1 of 2 delivered Details mesh/delivery superseded: a newer head of the same pull request Details mesh/merge-gate head b67fe1ffb16e merged into trunk 8aa37e8b835d — pass: the change touches no module of the mesh's graph Details mesh/repo-check head b67fe1ffb16e merged into trunk 8aa37e8b835d — fail: its merge-check.sh failed: files asking for a setting without saying whether it is… Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 01:19:36 +00:00
mesh-adminandClaude Opus 5.5	2000c02559	mesh-vault: retire a holder by ADR 0230, never delete it on a pass; refuse a contributions file that says nothing (review 250) mesh/delivery superseded: a newer head of the same pull request Details mesh/delivery-group group pkg/57-v1-vault-in-go checking: 1 of 2 member(s) ready Details mesh/merge-gate head 2000c02559d8 merged into trunk 8aa37e8b835d — pass: the change touches no module of the mesh's graph Details mesh/repo-check head 2000c02559d8 merged into trunk 8aa37e8b835d — fail: its merge-check.sh failed: files asking for a setting without saying whether it is… Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 01:18:51 +00:00
mesh-adminandClaude Opus 5.5	84d8198f15	mesh-vault: ADR 0349's vault tests (issue 674) mesh/merge-gate head 84d8198f1540 merged into trunk 8aa37e8b835d — pass: the change touches no module of the mesh's graph Details mesh/repo-check head 84d8198f1540 merged into trunk 8aa37e8b835d — fail: its merge-check.sh failed: files asking for a setting without saying whether it is… Details mesh/delivery-group group pkg/57-v1-vault-in-go rejected: a member's own check failed Details mesh/delivery superseded: a newer head of the same pull request Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 00:57:54 +00:00
mesh-adminandClaude Opus 5.5	329fc420c9	mesh-vault: the ledger's and the tools' tests, and the README settling the key formats (issue 674) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 00:56:44 +00:00
mesh-adminandClaude Opus 5.5	da04ad62ae	mesh-vault: the tools the TypeScript vault offered, in Go (issue 674) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 00:55:34 +00:00
mesh-adminandClaude Opus 5.5	11fc3258b4	mesh-vault: get, secret-changed and the custody ledger (issue 674) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 00:54:22 +00:00
mesh-adminandClaude Opus 5.5	44d6a18e43	mesh-vault: its store, its keys and its rules (issue 674) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 00:53:38 +00:00
mesh-adminandClaude Opus 5.5	71c611b768	Rewrite mesh-vault in Go, holding secrets sealed and handing them out on request (issue 674) The vault was read-only TypeScript and held no secret the mesh uses (hq ADR 0349 §7, §11; ADR 0113 §1, §2, §22). It now keeps each secret in its own store, sealed to its own key and to the operator key, answers the seat's verb get sealed to the asker's key and only to an allowed asker (nobody yet: V4 and P3 bring the rule), raises secret-changed without a value, and takes no private key. The custody ledger and its three tools carry over unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 00:52:59 +00:00