jschoubben 09824b4839 Vault: answer the enrolment verbs in mesh-sdk's wire shapes, certify the serving key presented, record each rotation's hand act ...

Review round 1 found that redeem could never succeed: the vault's answers were not the shapes mesh-enrolment decodes.
- enrolment-token reads `sealed` (not `show`), so asking for the sealed token no longer mints a new one; it answers
  delivery.EnrolmentTokenAnswer: at issue the bus address, its certificate fingerprint and the vault's signing key.
- Issue takes the machine's first tunnel (`tunnel`), keeps it beside the token and refuses a token whose Missing() is
  not empty, so the sealed token is one a machine can use (ADR 0587 §3, insight 2026-11-02).
- node-account answers delivery.NodeAccountAnswer: the login, and the password sealed anonymously to the presented
  raw X25519 key in base64, as the node-engine's SealingKey.Open reads it.
- A joining node's certificate is signed for the serving key presented at the redeem, only when the four presented keys
  have the digest node-account recorded; the name comes from placement (ADR 0587 §6).
- rotate-node refuses a hand act that is not rotate-node of this node, keeps the act id in the node's node-logins key
  (`acts`, beside mesh-sdk's fields) and refuses an id used before (ADR 0583 §2).

The enrolment test now calls the real tool handlers and decodes every answer into mesh-sdk's types, failing on an
empty field; it replaces the earlier enrolment test, so mesh-vault stays at 134 unit tests.

(issue 774, 774/S43, 774/S44, 774/S45, 774/S46, review round 1)
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

2026-11-02 01:42:19 +01:00

..

adwaita

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

artifact-store-tools

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

asus-zephyrus-g14

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

audit-logger

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

avahi

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

baserow

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

blueman

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

bluetooth

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

brother

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

buildah

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

ca-trust

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

claude-code

Keep three timeout tests' upper bounds well under the production timeouts, so a timeout that falls back to production still fails (issue 1814, review round 3)

2026-11-01 17:26:58 +01:00

claude-licence-manager

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

clipmenu

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

confluence

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

cups

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

dbus

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

desk-channel

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

dev-tools

Take the build agent and the toolchain images out of the catalogue's prose, and refuse the word where it comes back outside the one module still naming it (issue 1295, E6)

2026-10-23 15:34:11 +02:00

disk-load

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

distribution

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

dmenu

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

dnsmasq

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

docker

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

docker-compose

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

dunst

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

fail2ban

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

feh

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

flatpak

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

fonts

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

forticlient

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

gitea

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

gitlab

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

gnome-keyring

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

go

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

grafana

Say grafana's refused admin password once with its cause, and ask again hourly, not every 30 s (issue 774)

2026-10-30 18:18:16 +01:00

hello-web

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

home-assistant

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

hostname

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

i3

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

i3status-rust

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

icecast

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

influxdb

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

invoicing

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

jira

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

kernel

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

keycloak

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

lab

Take the build agent and the toolchain images out of the catalogue's prose, and refuse the word where it comes back outside the one module still naming it (issue 1295, E6)

2026-10-23 15:34:11 +02:00

lemurs

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

letta

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

local-model-consumer

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

localization

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

logrotate

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mailu

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

marrytts

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

matrix

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

memory-pressure

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-build-go

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-build-image

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-build-node

Pin the Go and TypeScript build modules to mesh-sdk 67354f8: a check ask for another toolchain is declined too (ADR 0584, issue 1578)

2026-11-01 15:38:27 +01:00

mesh-catalog

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

mesh-cli

mesh-cli: nox enrol open opens a sealed enrolment token locally with the operator's private key

2026-11-02 01:42:19 +01:00

mesh-conditions

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

mesh-config

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

mesh-delivery-gate

Say a failed check first in the merge ask's headline, since a merge is not gated on the check and the headline is the phone's only warning (issue 1166)

2026-11-01 18:06:27 +01:00

mesh-files

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-hand-acts

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

mesh-healers

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

mesh-issues

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-knowledge

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-mail

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-mail-notifier

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-mail-reader

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-mail-web

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-provisioner

Pin pacman and mesh-provisioner to the group's mesh-sdk head b2a27ed5 (issues 1953, 1876, 1954)

2026-11-01 16:24:04 +01:00

mesh-provisioner-client

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-reads

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-self-check

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-vault

Vault: answer the enrolment verbs in mesh-sdk's wire shapes, certify the serving key presented, record each rotation's hand act

2026-11-02 01:42:19 +01:00

mesh-watcher

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

messenger

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

minio

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

model-usage

Commit the lock files of mssql, mongodb, model-usage and mesh-catalog, and refuse a Node module without one (issue 1868, ADR 0469 §5)

2026-10-22 18:12:32 +02:00

mongodb

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

mosquitto

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

mounts

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mssql

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

n8n

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

nats

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

netcheck

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

networkmanager

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

nextcloud

nextcloud: repair the account only on a 401, never reset the throttle (issue 1253, review 2)

2026-10-25 16:57:46 +01:00

nextcloud-client

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

nfs-server

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

nftables

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

nm-applet

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

node-env

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

nodejs

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

nodered

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

ollama

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

only-office

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

openai-consumer

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

openrazer

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

pacman

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

photos-eef

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

photos-filip

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

picom

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

polychromatic

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

postgres

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

power

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

powerlevel10k

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

records

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

redis

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

restic

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

rofi

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

route-adapter

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

screen-lock

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

searxng

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

sensors

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

showcase

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

slack

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

snapd

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

ssh-client

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

sshd

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

step-ca

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

sudo

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

supabase

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

systemd

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

systemd-networkd

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

systemd-resolved

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

telegram

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

time-sync

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

triggerhappy

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

umami

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

unifi

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

website

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

xclip

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

xdg

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

xorg

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

xterm

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

zfs

Keep three timeout tests' upper bounds well under the production timeouts, so a timeout that falls back to production still fails (issue 1814, review round 3)

2026-11-01 17:26:58 +01:00

zsh

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

zsh-autosuggestions

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

zsh-syntax-highlighting

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00