Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/broker/agreement_test.go

@@ -4,8 +4,8 @@ import (
 	"regexp"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/broker"
-	"github.com/novox/mesh-control/internal/link"
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/link"
 )
 
 // The names are written twice, so a test keeps them agreeing.

internal/broker/management.go

@@ -68,7 +68,7 @@ const ExchangeName = "mesh"
 const BuildQueueName = "builds"
 
 // The events bus (novox/hq ADR 0042): one topic exchange every event rides, a second for tool
-// RPC kept apart, and a dead-letter home for a poison event. The substrate owns these — a module's
+// RPC kept apart, and a dead-letter home for a poison event. The foundation owns these — a module's
 // account cannot declare them, only bind its own queue to the events one.
 const (
 	EventsExchangeName = "mesh.events"
@@ -151,7 +151,7 @@ func (m *Management) CreateModuleAccount(ctx context.Context, node, module, pass
 }
 
 // EnsureModuleQueue declares a consuming module's queue with its dead-letter exchange, idempotently.
-// The substrate declares it because a scoped module account may not: the broker refuses a queue with
+// The foundation declares it because a scoped module account may not: the broker refuses a queue with
 // a dead-letter exchange to a non-administrator (novox/hq ADR 0043), so a consumer passively checks
 // the queue the mesh made rather than declaring its own.
 func (m *Management) EnsureModuleQueue(ctx context.Context, node, module string) error {
@@ -166,7 +166,7 @@ func (m *Management) EnsureModuleQueue(ctx context.Context, node, module string)
 }
 
 // EnsureEventExchanges declares the bus's exchanges and the dead-letter home, idempotently. The
-// substrate owns them (a module's account may not declare an exchange), and a dead-letter exchange
+// foundation owns them (a module's account may not declare an exchange), and a dead-letter exchange
 // with no queue behind it drops what it receives — so a durable queue bound to `#` retains a poison
 // event for inspection, which is the whole reason the trail exists.
 func (m *Management) EnsureEventExchanges(ctx context.Context) error {

internal/broker/module_account_test.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/broker"
+	"github.com/novox/mesh-controller/internal/broker"
 )
 
 // The audit logger consumes everything and emits nothing. Its account must let it declare and read

internal/builder/builder.go

@@ -17,7 +17,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-control/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // Turning a repository into artifacts the mesh can pin.

internal/builder/builder_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-control/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // A repository becoming artifacts the mesh can pin.

internal/builder/standing_on_test.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // A module naming a base the mesh has not built is refused, and the refusal names what is missing.

internal/catalogue/bootstrap_cycle_test.go

@@ -51,7 +51,7 @@ func TestAModuleThatDoesNotProvideTheStoreStillBuilds(t *testing.T) {
 
 // A mapping that names an address still names the port, and the machine side is still the middle.
 //
-// The substrate bundle writes "127.0.0.1:5432:5432" today, so the shape is not hypothetical.
+// The foundation bundle writes "127.0.0.1:5432:5432" today, so the shape is not hypothetical.
 // Found in review: the first cut split on the first colon, read "127.0.0.1" as the machine port,
 // failed to parse it, and silently skipped the mapping — which put the filter back on the
 // declared port, the exact fault MachineSide was written to end.

internal/catalogue/co_located_test.go

@@ -62,7 +62,7 @@ func routeProxy() Manifest {
 // A co-located provider's served VALUES reach its consumer, not just its served keys.
 //
 // The mesh walks a provider on ANOTHER machine and settles what it serves with that node's settings
-// layers before offering it (cmd/mesh-control plan.go, theRestOfTheMesh). A provider on the
+// layers before offering it (cmd/mesh-controller plan.go, theRestOfTheMesh). A provider on the
 // consumer's own machine was never settled at all: resolve.go's servedHere and declaration.go's
 // here() both read the manifest and stop there. So a served value the operator supplied — the one
 // kind of value a manifest cannot carry, because it is different on every mesh — arrived as the

internal/catalogue/declaration.go

@@ -89,11 +89,11 @@ type Rendering struct {
 	// a fact about the mesh, and resolution answers questions about one machine.
 	Mesh []string
 
-	// Substrate is the ports the mesh itself needs reachable on every machine, which no module
-	// declares because the substrate is not a module (novox/hq 04-ISSUES/051 and 052). The broker
+	// Foundation is the ports the mesh itself needs reachable on every machine, which no module
+	// declares because the foundation is not a module (novox/hq 04-ISSUES/051 and 052). The broker
 	// is the one that matters: a machine dials it to enrol, and a firewall derived only from
 	// modules closes it.
-	Substrate []int
+	Foundation []int
 
 	// Names is every machine's internal name and its address, for containers to be given.
 	//
@@ -213,7 +213,7 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 	if err != nil {
 		return nil, err
 	}
-	filtering := AsNftables(rules, with.Mesh, r.PublicDomain != "", with.Substrate)
+	filtering := AsNftables(rules, with.Mesh, r.PublicDomain != "", with.Foundation)
 
 	var out []map[string]any
 	for _, m := range r.Modules {
@@ -821,7 +821,7 @@ func here(r Resolution, requirement string, with Rendering) (*Needed, error) {
 //
 // **The one derivation, so the two arrangements cannot disagree.** For a provider elsewhere the
 // control plane walks that node, reads its manifest with that machine's port assignments, and
-// settles the result with that node's settings layers before offering it (cmd/mesh-control plan.go,
+// settles the result with that node's settings layers before offering it (cmd/mesh-controller plan.go,
 // theRestOfTheMesh). A provider on the consumer's own machine never passes through that walk, so
 // every step of it has to be repeated here — and each step that was not repeated was a promise the
 // co-located arrangement quietly broke: first the port (novox/hq 04-ISSUES/038), then the settled

internal/catalogue/filtering.go

@@ -217,10 +217,10 @@ const SSHPort = 22
 // `outward` says this machine is reachable from outside the mesh, which is the only thing that
 // decides whether ssh is answered there as well as on the private network.
 //
-// `substrate` is the ports the MESH ITSELF needs reachable, which no module declares.
+// `foundation` is the ports the MESH ITSELF needs reachable, which no module declares.
 //
 // **Everything else in this file is derived from what modules say they listen on, and the
-// substrate is not a module** (novox/hq 04-ISSUES/051). So the broker — the port every machine
+// foundation is not a module** (novox/hq 04-ISSUES/051). So the broker — the port every machine
 // dials to enrol and to receive every declaration it is ever sent — was absent from the ruleset,
 // and nothing noticed: a mesh of one never dials its own broker across the network. The first
 // machine to join a firewalled anchor is refused by the packet filter during enrolment, before
@@ -229,7 +229,7 @@ const SSHPort = 22
 // It is a floor for the same reason ssh is. A machine nobody can reach is a machine nobody can
 // repair; a machine the mesh cannot reach is a machine the mesh cannot manage. Neither is a thing
 // any module asks for, and neither may be derived away.
-func AsNftables(rules []Rule, mesh []string, outward bool, substrate []int) string {
+func AsNftables(rules []Rule, mesh []string, outward bool, foundation []int) string {
 	var b strings.Builder
 	b.WriteString("# Computed by the mesh from what is assigned to this node.\n")
 	b.WriteString("# Edits are lost on the next declaration; change a module's listens instead.\n\n")
@@ -297,9 +297,9 @@ func AsNftables(rules []Rule, mesh []string, outward bool, substrate []int) stri
 	// Not narrowed to the private network, because the machines that need this most are the ones
 	// not on it yet: a node enrols BEFORE it has an address here, over the ordinary network, and a
 	// rule allowing only the private network would close the door being knocked on.
-	if len(substrate) > 0 {
+	if len(foundation) > 0 {
 		b.WriteString("\n\t\t# the mesh's own — never derived, never closed\n")
-		for _, port := range substrate {
+		for _, port := range foundation {
 			b.WriteString(fmt.Sprintf("\t\ttcp dport %d accept\n", port))
 		}
 	}

internal/catalogue/filtering_foundation_test.go

@@ -7,7 +7,7 @@ import (
 
 // The mesh's own ports survive a ruleset derived from modules that do not mention them.
 //
-// **The firewall is computed from what modules declare they listen on, and the substrate is not a
+// **The firewall is computed from what modules declare they listen on, and the foundation is not a
 // module** (novox/hq 04-ISSUES/052). So the broker's port — the one every machine dials to enrol
 // and to receive every declaration it is ever sent — was absent from every ruleset the mesh ever
 // generated, and nothing caught it: a mesh of one never dials its own broker across the network,
@@ -37,12 +37,12 @@ func TestTheBrokersPortIsOpenedThoughNoModuleDeclaresIt(t *testing.T) {
 
 // And a mesh that was never told about a broker still gets a ruleset, rather than an empty one or
 // a panic. A control plane in that state cannot issue tokens either, which is where it surfaces.
-func TestNoBrokerMeansNoSubstrateRuleRatherThanNoRuleset(t *testing.T) {
+func TestNoBrokerMeansNoFoundationRuleRatherThanNoRuleset(t *testing.T) {
 	out := AsNftables(nil, []string{"10.42.0.1"}, false, nil)
 	if !strings.Contains(out, "table inet mesh") {
 		t.Fatalf("no ruleset at all:\n%s", out)
 	}
 	if strings.Contains(out, "never derived, never closed\n\t\ttcp dport") {
-		t.Fatalf("a substrate rule was written for a mesh with no broker:\n%s", out)
+		t.Fatalf("a foundation rule was written for a mesh with no broker:\n%s", out)
 	}
 }

internal/catalogue/manifest.go

@@ -706,7 +706,7 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	// that provides the store and also builds something asks the mesh to put an artifact into the
 	// thing that artifact is needed to create.
 	//
-	// It is the question the substrate record asks of every candidate — can it grant itself the
+	// It is the question the foundation record asks of every candidate — can it grant itself the
 	// thing it provides? The store cannot create its own database, the broker cannot create its
 	// own virtual host, and a registry cannot grant itself a repository. Such a module names its
 	// image, exactly as the bundle names the three a first node starts from.

internal/catalogue/provided_test.go

@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/catalogue"
-	"github.com/novox/mesh-control/internal/overlay"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // The manifests the control plane actually ships, resolved.

internal/identity/identity.go

@@ -19,7 +19,7 @@ import (
 	"time"
 
 	"github.com/jackc/pgx/v5"
-	"github.com/novox/mesh-control/internal/store"
+	"github.com/novox/mesh-controller/internal/store"
 )
 
 // Name is what this context is called: its database and its credential are named after it.

internal/identity/identity_test.go

@@ -13,7 +13,7 @@ import (
 	"time"
 
 	"github.com/jackc/pgx/v5"
-	"github.com/novox/mesh-control/internal/store"
+	"github.com/novox/mesh-controller/internal/store"
 )
 
 func fresh(t *testing.T) *Identity {

internal/inventory/buildinput_test.go

@@ -3,7 +3,7 @@ package inventory
 import (
 	"testing"
 
-	"github.com/novox/mesh-control/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // The image every module is compiled on top of is built and never run.

internal/inventory/catalogue.go

@@ -8,7 +8,7 @@ import (
 	"strings"
 
 	"github.com/jackc/pgx/v5"
-	"github.com/novox/mesh-control/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // ErrNoSuchModule is what the mesh says about a module it has never been told about.

internal/inventory/catalogue_test.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 func manifest(name string, provides, requires []string) catalogue.Manifest {

internal/inventory/forget_test.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // What removing a module takes with it, and what re-registering one does not.

internal/inventory/fortest.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 
-	"github.com/novox/mesh-control/internal/store"
+	"github.com/novox/mesh-controller/internal/store"
 )
 
 // ForTest is a fresh inventory in a database of its own, dropped when the test ends.

internal/inventory/inventory.go

@@ -10,7 +10,7 @@ package inventory
 import (
 	"embed"
 
-	"github.com/novox/mesh-control/internal/store"
+	"github.com/novox/mesh-controller/internal/store"
 )
 
 // Name is what this context is called: its database, and the environment variable holding the

internal/inventory/migrations/0017-what-a-machine-already-holds.sql

@@ -1,6 +1,6 @@
 -- Ports a machine holds that the mesh did not assign.
 --
--- novox/hq ADR 0038. The substrate is not a module: a node raises it from the bundle it carries
+-- novox/hq ADR 0038. The foundation is not a module: a node raises it from the bundle it carries
 -- before any mesh exists, so the control plane has never heard of the store or the broker. Told
 -- what they hold, it can put a module somewhere else; not told, it hands out a port one of them
 -- has and finds out from a container runtime three layers down.

internal/inventory/nodes.go

@@ -13,7 +13,7 @@ import (
 	"time"
 
 	"github.com/jackc/pgx/v5"
-	"github.com/novox/mesh-control/internal/store"
+	"github.com/novox/mesh-controller/internal/store"
 )
 
 // Inventory is this context, holding the store it exclusively owns.

internal/inventory/ports.go

@@ -120,7 +120,7 @@ func (i *Inventory) assignPort(
 	if err != nil {
 		return Assigned{}, err
 	}
-	// And what the machine itself says it already holds — the substrate it raised before there
+	// And what the machine itself says it already holds — the foundation it raised before there
 	// was a mesh to ask (novox/hq ADR 0038). Not assignments: nothing here chose them, and
 	// nothing here can move them.
 	carried, err := i.carriedOn(ctx, nodeID)

internal/inventory/ports_test.go

@@ -4,7 +4,7 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 func aNodeWithModules(t *testing.T, modules ...string) (*Inventory, string) {

internal/inventory/secrets.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 
-	"github.com/novox/mesh-control/internal/secrets"
+	"github.com/novox/mesh-controller/internal/secrets"
 )
 
 // Where sealed secrets live.

internal/inventory/secrets_test.go

@@ -5,7 +5,7 @@ import (
 	"crypto/ecdh"
 	"crypto/rand"
 	"encoding/base64"
-	"github.com/novox/mesh-control/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"strings"
 	"testing"
 

internal/licences/adapters/adapters.go

@@ -23,7 +23,7 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/novox/mesh-control/internal/secrets"
+	"github.com/novox/mesh-controller/internal/secrets"
 )
 
 // Shape is how a vendor's credential behaves, and the switch the ADR 0050 carve-out turns on.

internal/licences/fortest.go

@@ -13,7 +13,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 
-	"github.com/novox/mesh-control/internal/store"
+	"github.com/novox/mesh-controller/internal/store"
 )
 
 // ForTest is a fresh licence store in a database of its own, dropped when the test ends.

internal/licences/licences.go

@@ -20,9 +20,9 @@ import (
 	"time"
 
 	"github.com/jackc/pgx/v5"
-	"github.com/novox/mesh-control/internal/licences/adapters"
-	"github.com/novox/mesh-control/internal/secrets"
-	"github.com/novox/mesh-control/internal/store"
+	"github.com/novox/mesh-controller/internal/licences/adapters"
+	"github.com/novox/mesh-controller/internal/secrets"
+	"github.com/novox/mesh-controller/internal/store"
 )
 
 // Name is what this context is called: its database and its credential are named after it.

internal/licences/refresh_test.go

@@ -10,8 +10,8 @@ import (
 
 	"golang.org/x/crypto/nacl/box"
 
-	"github.com/novox/mesh-control/internal/licences/adapters"
-	"github.com/novox/mesh-control/internal/secrets"
+	"github.com/novox/mesh-controller/internal/licences/adapters"
+	"github.com/novox/mesh-controller/internal/secrets"
 )
 
 // nodeKeyPair is a node's key as the node would hold it: the public half the mesh seals to, and an

internal/licences/submitrefresh_test.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/secrets"
+	"github.com/novox/mesh-controller/internal/secrets"
 )
 
 // SubmitRefresh is the boundary a manager NODE crosses to publish a refresh it performed: the control

internal/link/enrol_shape_test.go

@@ -11,9 +11,9 @@ import (
 
 	"golang.org/x/crypto/nacl/box"
 
-	"github.com/novox/mesh-control/internal/catalogue"
-	"github.com/novox/mesh-control/internal/inventory"
-	"github.com/novox/mesh-control/internal/link"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
 )
 
 // What a node says when it joins, as that node's own code writes it.
@@ -25,7 +25,7 @@ import (
 // Skipped unless MESH_ENROL names the file the host's suite wrote:
 //
 //	mesh-host:    MESH_ENROL_OUT=/tmp/enrol.json go test ./internal/link/
-//	mesh-control: MESH_ENROL=/tmp/enrol.json make check
+//	mesh-controller: MESH_ENROL=/tmp/enrol.json make check
 //
 // **What this does not cover**, said so nobody reads more into a pass than is there: the full
 // enrolment path also issues a broker account, and that needs a broker. What is checked here is

internal/link/enrolment.go

@@ -9,9 +9,9 @@ import (
 	"fmt"
 	"sort"
 
-	"github.com/novox/mesh-control/internal/broker"
-	"github.com/novox/mesh-control/internal/identity"
-	"github.com/novox/mesh-control/internal/inventory"
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/identity"
+	"github.com/novox/mesh-controller/internal/inventory"
 )
 
 // Enrolment is what actually happens when a node presents a token: the token is spent, the key is

internal/link/heard_test.go

@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/inventory"
-	"github.com/novox/mesh-control/internal/link"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
 )
 
 // Turning what a node said into what the mesh keeps.
@@ -152,7 +152,7 @@ func TestABareAliveDoesNotWipeTheDeclarationThatSaysANodeIsCurrent(t *testing.T)
 func TestAFailureDoesNotBecomeTheAccountOfWhatTheMachineHolds(t *testing.T) {
 	// A partial list is not an account of what the machine holds. Recording one as though it
 	// were would tell a rebuilding node to remove what it still has — which is the fault that
-	// destroyed a substrate once (novox/hq 04-ISSUES/010).
+	// destroyed a foundation once (novox/hq 04-ISSUES/010).
 	inv := inventory.ForTest(t)
 	ctx := context.Background()
 	node, err := inv.AddNode(ctx, "workstation")

internal/link/protocol.go

@@ -88,7 +88,7 @@ type Report struct {
 
 	// Carried are the machine's ports held by what that host raised from its own bundle.
 	//
-	// **The half the mesh cannot know** (novox/hq ADR 0038). The substrate is not a module — a
+	// **The half the mesh cannot know** (novox/hq ADR 0038). The foundation is not a module — a
 	// node raises it before any mesh exists — so without being told, the mesh assigns a module a
 	// port the store or the broker already holds, and hears about it from a container runtime.
 	//

internal/overlay/declaration.go

@@ -127,7 +127,7 @@ func config(node Node, peers []Peer, keyPath string) string {
 		b.WriteString("PostDown = sysctl -q -w net.ipv4.ip_forward=0\n")
 
 		// And past the machine's own firewall, which on any node with a container runtime is
-		// closed. Docker sets the FORWARD policy to DROP and inserts its chains, so the substrate
+		// closed. Docker sets the FORWARD policy to DROP and inserts its chains, so the foundation
 		// this mesh installs at tier 1 silently breaks the network it builds at tier 2: every
 		// spoke reaches the hub, no spoke reaches any other, and every part of it reports
 		// success. Found in the lab; nothing about it is visible from the mesh's own state.

internal/overlay/generator.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strconv"
 
-	"github.com/novox/mesh-control/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // The private network as a module rather than as code beside the module system.

internal/overlay/opens_test.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 func networkOf(t *testing.T, nodes []Node) *Generator {

internal/secrets/sealedbox_xcheck_test.go

@@ -15,7 +15,7 @@ import (
 // **Why it must hold.** The refresh token is sealed to the manager node — at adoption and after each
 // rotation — by the manager MODULE, in TypeScript (mesh-catalog anthropic-manager/sealedbox.ts). The
 // HOST then unseals it with Go's box.OpenAnonymous (mesh-host identity.SealingKey.Unseal) to mount the
-// cleartext, and mesh-control seals every other credential with box.SealAnonymous (secrets.Seal). If
+// cleartext, and mesh-controller seals every other credential with box.SealAnonymous (secrets.Seal). If
 // the TS seal and the Go box disagreed by a byte, the host would refuse the refresh token as a value
 // it cannot open — silently, as a manager that never gets its credential. So this is load-bearing, and
 // it is pinned here rather than trusted.

internal/secrets/testdata/module-sealedbox-fixture.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Produced by mesh-catalog anthropic-manager sealedbox.ts (crypto_box_seal). Proves that value the module seals to a node's public key opens under Go box.OpenAnonymous — the host's Unseal and mesh-control secrets.Seal/Open. Regenerate with the module's compiled seal().",
+  "_comment": "Produced by mesh-catalog anthropic-manager sealedbox.ts (crypto_box_seal). Proves that value the module seals to a node's public key opens under Go box.OpenAnonymous — the host's Unseal and mesh-controller secrets.Seal/Open. Regenerate with the module's compiled seal().",
   "managerPublicKey": "rJZ9OSnuCcU5MNi8iV0EK8c5nYN+Cx5A+q+miIIIoUc=",
   "managerPrivateKey": "wGHx9hpbO1pyvLiw8oGwi31LBce3HscDiGhXpNU+wl4=",
   "plaintext": "rt-a-refresh-token-only-the-manager-may-read",