novox/mesh-catalog
9
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

57/V2: accept, secret-ask, issued and rotate are the vault's verbs (issue 675) #302

Closed
mesh-admin wants to merge 5 commits from pkg/57-v2-vault-verbs into feat/57-config-and-provisioning
pull from: pkg/57-v2-vault-verbs
merge into: :feat/57-config-and-provisioning
Conversation 4 Commits 5 Files Changed 8
+1455 -8
5 Commits
Author SHA1 Message Date
mesh-adminandClaude Opus 5.5 eb958f668e Prove the vault's secret-ask test and the issuing provider's test with a stand-in provider (issue 675)
mesh/merge-gate head eb958f668ecd merged into trunk 1a2c917abfdb — pass: [release feat/57-config-and-provisioning, judged by its controller fcdecb436117] t…
Details
mesh/repo-check head eb958f668ecd merged into trunk 1a2c917abfdb — fail: [release feat/57-config-and-provisioning, judged by its controller fcdecb436117] i…
Details
mesh/delivery-group group pkg/57-v2-vault-verbs rejected: a member's own check failed
Details
mesh/delivery stopped: the pull request closed unmerged
Details 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 19:14:34 +00:00
mesh-adminandClaude Opus 5.5 63b7aec065 Prove V1's review follow-ups (issue 675) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 19:13:09 +00:00
mesh-adminandClaude Opus 5.5 efddb634e5 Open a value only in the vault, sealed to a key made for its call (issue 675) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 19:12:21 +00:00
mesh-adminandClaude Opus 5.5 eba300794f Serve the vault's intake verbs and say how they work (issue 675) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 19:10:55 +00:00
mesh-adminandClaude Opus 5.5 2abe1f95e8 Take accept, secret-ask, issued and rotate into the vault (issue 675) 
ADR 0349 clauses 8 to 10: a value given at the controller's terminal, typed
at a desk or issued by a provider's software enters the vault and opens
there alone, and rotation is the vault's. Each comes in two steps from the
controller, which reaches the desk and the provider: the vault makes a key
for the one call and opens what was sealed to it. An ask is recorded in the
vault's store before the prompt opens and bounded to one open per secret
and three an hour.

Also V1's review follow-ups: the tool layer passes an act through, a
rolled record is said, the export's fingerprint and vault_status are
tested, and an unproven by is kept beside the proven caller.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 19:10:03 +00:00