jschoubben 049bd176c3 Vault: enrolment token and node account, signing for enrolment, a node's two logins and their rotation, own hand-out of a login ...

The vault serves the verbs enrolment-token, node-account, rotate-node, node-account-confirm and abandon, keeps the state
node-logins, and says rotation-begun, node-account-ready and rotation-done (ADR 0587 §3, §5, §8; ADR 0583 §1-§7 and
insights; ADR 0561 §4, §5). Only mesh-enrolment asks the first two and sign for an enrolment; a rotation needs a hand act
read back from mesh-hand-acts by its id, runs one at a time with the bus node last, and is ready only when the loaded list
holds the new login and done when it lacks the old one. A node's login is handed to that node's engine alone, sealed to
the key it stated. The key of a node that leaves the placement is deleted. Accounts kept for an enrolment or a node are
marked and never retired as unwanted.

Subtasks 774/S43 to S50 in one commit: they share enrolment.go, noderotation.go, tools.go and the manifest, and could not
be cut apart without a commit that does not build. New tests: 3 unit functions (table-style flows) and the one
integration test of S50; mesh-vault stays at 134 unit and 2 integration tests, within the module budget of 500 and 50, so
none was merged or deleted. The integration test's player gained a mesh/ask answer.

(issue 774, 774/S43, 774/S44, 774/S45, 774/S46, 774/S47, 774/S48, 774/S49, 774/S50)
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

2026-11-02 01:42:19 +01:00

..

adwaita

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

artifact-store-tools

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

asus-zephyrus-g14

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

audit-logger

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

avahi

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

baserow

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

blueman

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

bluetooth

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

brother

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

buildah

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

ca-trust

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

claude-code

Keep three timeout tests' upper bounds well under the production timeouts, so a timeout that falls back to production still fails (issue 1814, review round 3)

2026-11-01 17:26:58 +01:00

claude-licence-manager

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

clipmenu

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

confluence

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

cups

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

dbus

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

desk-channel

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

dev-tools

Take the build agent and the toolchain images out of the catalogue's prose, and refuse the word where it comes back outside the one module still naming it (issue 1295, E6)

2026-10-23 15:34:11 +02:00

disk-load

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

distribution

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

dmenu

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

dnsmasq

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

docker

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

docker-compose

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

dunst

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

fail2ban

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

feh

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

flatpak

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

fonts

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

forticlient

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

gitea

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

gitlab

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

gnome-keyring

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

go

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

grafana

Say grafana's refused admin password once with its cause, and ask again hourly, not every 30 s (issue 774)

2026-10-30 18:18:16 +01:00

hello-web

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

home-assistant

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

hostname

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

i3

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

i3status-rust

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

icecast

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

influxdb

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

invoicing

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

jira

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

kernel

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

keycloak

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

lab

Take the build agent and the toolchain images out of the catalogue's prose, and refuse the word where it comes back outside the one module still naming it (issue 1295, E6)

2026-10-23 15:34:11 +02:00

lemurs

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

letta

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

local-model-consumer

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

localization

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

logrotate

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mailu

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

marrytts

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

matrix

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

memory-pressure

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-build-go

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-build-image

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-build-node

Pin the Go and TypeScript build modules to mesh-sdk 67354f8: a check ask for another toolchain is declined too (ADR 0584, issue 1578)

2026-11-01 15:38:27 +01:00

mesh-catalog

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

mesh-cli

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-conditions

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

mesh-config

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

mesh-delivery-gate

Say a failed check first in the merge ask's headline, since a merge is not gated on the check and the headline is the phone's only warning (issue 1166)

2026-11-01 18:06:27 +01:00

mesh-files

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-hand-acts

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

mesh-healers

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

mesh-issues

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-knowledge

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-mail

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-mail-notifier

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-mail-reader

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-mail-web

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-provisioner

Pin pacman and mesh-provisioner to the group's mesh-sdk head b2a27ed5 (issues 1953, 1876, 1954)

2026-11-01 16:24:04 +01:00

mesh-provisioner-client

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-reads

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-self-check

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-vault

Vault: enrolment token and node account, signing for enrolment, a node's two logins and their rotation, own hand-out of a login

2026-11-02 01:42:19 +01:00

mesh-watcher

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

messenger

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

minio

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

model-usage

Commit the lock files of mssql, mongodb, model-usage and mesh-catalog, and refuse a Node module without one (issue 1868, ADR 0469 §5)

2026-10-22 18:12:32 +02:00

mongodb

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

mosquitto

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

mounts

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mssql

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

n8n

Keep n8n on its own Dockerfile: since ADR 0487 a module may ship one, and the move to the upstream image only added a config value and a uuid mount (the operator, 2026-10-22)

2026-10-22 11:47:44 +02:00

nats

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

netcheck

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

networkmanager

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

nextcloud

nextcloud: repair the account only on a 401, never reset the throttle (issue 1253, review 2)

2026-10-25 16:57:46 +01:00

nextcloud-client

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

nfs-server

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

nftables

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

nm-applet

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

node-env

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

nodejs

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

nodered

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

ollama

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

only-office

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

openai-consumer

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

openrazer

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

pacman

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

photos-eef

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

photos-filip

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

picom

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

polychromatic

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

postgres

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

power

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

powerlevel10k

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

records

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

redis

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

restic

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

rofi

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

route-adapter

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

screen-lock

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

searxng

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

sensors

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

showcase

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

slack

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

snapd

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

ssh-client

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

sshd

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

step-ca

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

sudo

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

supabase

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

systemd

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

systemd-networkd

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

systemd-resolved

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

telegram

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

time-sync

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

triggerhappy

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

umami

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

unifi

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

website

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

xclip

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

xdg

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

xorg

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

xterm

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

zfs

Keep three timeout tests' upper bounds well under the production timeouts, so a timeout that falls back to production still fails (issue 1814, review round 3)

2026-11-01 17:26:58 +01:00

zsh

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

zsh-autosuggestions

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

zsh-syntax-highlighting

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00