jschoubben ecc7621274 Privilege no caller named controller in the vault; match a hand act's verb exactly ...

The controller is not placed (ADR 0590), yet the vault still answered a
caller named controller alone (accept), took its relay of who asked
(secret-ask, rotate's by) and sealed it the core's credentials. Those
branches and accept go with their tests; a node's account alone is never
minted or rotated here. The sensitive-verb judge now needs the act's verb to
be the vault's own, mesh-vault.<verb>, not any verb ending so (issue 1126
review 1).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

2026-11-02 12:29:56 +01:00

..

testdata

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

.gitignore

Vault: name a hash record's secret in a field called of, so the runtime accepts it

2026-10-26 09:25:35 +01:00

accounts.go

Vault: enrolment token and node account, signing for enrolment, a node's two logins and their rotation, own hand-out of a login

2026-11-02 01:42:19 +01:00

adopt.go

Vault: enrolment token and node account, signing for enrolment, a node's two logins and their rotation, own hand-out of a login

2026-11-02 01:42:19 +01:00

askers.go

Ask mesh-sdk's Plan.Hands wherever the vault and the provisioner client judge a module handed, and refuse in the catalogue check any line that takes a plan existing for it, so a plan of provisions alone never again withholds a module's secrets (issue 774)

2026-10-31 00:00:46 +01:00

core_test.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00

core.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00

credential_field_test.go

Vault: name a hash record's secret in a field called of, so the runtime accepts it

2026-10-26 09:25:35 +01:00

ended_test.go

mesh-vault reads an ended assignment as a removed key (issue 1098)

2026-10-18 02:37:28 +02:00

enrolment_test.go

mesh-vault: retire and rotate without the controller's lease

2026-11-02 10:35:59 +01:00

enrolment_tools.go

Vault: answer the enrolment verbs in mesh-sdk's wire shapes, certify the serving key presented, record each rotation's hand act

2026-11-02 01:42:19 +01:00

enrolment.go

Vault: answer the enrolment verbs in mesh-sdk's wire shapes, certify the serving key presented, record each rotation's hand act

2026-11-02 01:42:19 +01:00

followups_test.go

Make each sensitive vault verb judge its own caller

2026-11-02 12:29:56 +01:00

form_test.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

intake_test.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00

intake.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00

issued_account_test.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00

keys.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

ledger_test.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

ledger.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

main.go

mesh-vault: retire and rotate without the controller's lease

2026-11-02 10:35:59 +01:00

mint_integration_test.go

mesh-vault: retire and rotate without the controller's lease

2026-11-02 10:35:59 +01:00

mint_test.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00

mint.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00

move_test.go

Stop serving the vault's move-asks, which only the controller called

2026-11-02 12:29:56 +01:00

move.go

Stop serving the vault's move-asks, which only the controller called

2026-11-02 12:29:56 +01:00

named_pair_test.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

nodekey_test.go

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

noderotation.go

mesh-vault: retire and rotate without the controller's lease

2026-11-02 10:35:59 +01:00

notyet_test.go

Answer an unreadable assignment as not yet, never a refusal (issue 928)

2026-10-16 19:30:15 +02:00

outcomes_test.go

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

outcomes.go

Ask mesh-sdk's Plan.Hands wherever the vault and the provisioner client judge a module handed, and refuse in the catalogue check any line that takes a plan existing for it, so a plan of provisions alone never again withholds a module's secrets (issue 774)

2026-10-31 00:00:46 +01:00

own_issue_test.go

Make the vault ask a software-issuing provider's tool itself for holders that hold nothing (issue 928)

2026-10-16 19:34:11 +02:00

owncalls_test.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00

ownissue.go

Make the vault ask a software-issuing provider's tool itself for holders that hold nothing (issue 928)

2026-10-16 19:34:11 +02:00

ownnode_test.go

Let the vault mint every wanted bus account whoever holds the controller's lease, keep its mint over a controller's issued value, and tell a node which modules it judged handed, so no account waits on a node reporting to the controller (issue 774)

2026-10-31 09:49:15 +01:00

ownnode.go

Let the vault mint every wanted bus account whoever holds the controller's lease, keep its mint over a controller's issued value, and tell a node which modules it judged handed, so no account waits on a node reporting to the controller (issue 774)

2026-10-31 09:49:15 +01:00

owntake.go

The vault takes what runs through move-in's replace_running, not a verb of its own, so no seat promises anything new (issue 1126, cause C4)

2026-10-28 09:48:14 +01:00

pair_test.go

Make the vault ask a software-issuing provider's tool itself for holders that hold nothing (issue 928)

2026-10-16 19:34:11 +02:00

pair.go

Read every module whole for the plan-hands check, so its verdict follows their source, and judge a shared value's consumer by whether its plan hands it; leave mesh-provisioner out of the group (review round 1, issue 774)

2026-10-31 00:00:46 +01:00

perholder_bus_test.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

perholder_test.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00

perholder.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

placed_test.go

Read the seat mesh-placement's state through the sdk's PlacementKeys in mesh-conditions, mesh-config, mesh-provisioner, mesh-vault and mesh-self-check, so they read its keys per module and node and the form before alike while it is delivered (issue 774, research 072 row 37)

2026-10-31 09:27:15 +01:00

placed.go

Read the seat mesh-placement's state through the sdk's PlacementKeys in mesh-conditions, mesh-config, mesh-provisioner, mesh-vault and mesh-self-check, so they read its keys per module and node and the form before alike while it is delivered (issue 774, research 072 row 37)

2026-10-31 09:27:15 +01:00

providers_test.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

pulled_in_test.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

reseal_health_test.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

reseal_health.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

retire_test.go

mesh-vault: retire and rotate without the controller's lease

2026-11-02 10:35:59 +01:00

retire.go

mesh-vault: retire and rotate without the controller's lease

2026-11-02 10:35:59 +01:00

retirement_test.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

retirement.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

rotate_one_test.go

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

rotation_integration_test.go

mesh-vault: retire and rotate without the controller's lease

2026-11-02 10:35:59 +01:00

rotation.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00

sensitive_test.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00

sensitive.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00

signing_test.go

Read the seat mesh-placement's state through the sdk's PlacementKeys in mesh-conditions, mesh-config, mesh-provisioner, mesh-vault and mesh-self-check, so they read its keys per module and node and the form before alike while it is delivered (issue 774, research 072 row 37)

2026-10-31 09:27:15 +01:00

signing.go

Vault: answer the enrolment verbs in mesh-sdk's wire shapes, certify the serving key presented, record each rotation's hand act

2026-11-02 01:42:19 +01:00

store.go

Vault: enrolment token and node account, signing for enrolment, a node's two logins and their rotation, own hand-out of a login

2026-11-02 01:42:19 +01:00

tools_test.go

Make each sensitive vault verb judge its own caller

2026-11-02 12:29:56 +01:00

tools.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00

vault_test.go

Make each sensitive vault verb judge its own caller

2026-11-02 12:29:56 +01:00

vault.go

Privilege no caller named controller in the vault; match a hand act's verb exactly

2026-11-02 12:29:56 +01:00