From f00077f376a351a928c03baefa57033d5579ffc3 Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 7 Sep 2026 02:17:54 +0200 Subject: [PATCH] secrets: regenerate the module sealed-box cross-check fixture The manager module's seal now runs over the audited tweetnacl-sealedbox-js (mesh-catalog anthropic-manager) rather than a hand-transcribed NaCl. Regenerate the fixture's sealed value from that new seal() over the same node key pair and plaintext, so the fixture is the new library's output. crypto_box_seal is randomised, so the blob differs; the wire format does not. TestModuleSealedBoxOpensInGo still opens it under box.OpenAnonymous and recovers the plaintext, proving TS(tweetnacl-sealedbox-js) to Go interop. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF --- internal/secrets/testdata/module-sealedbox-fixture.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/secrets/testdata/module-sealedbox-fixture.json b/internal/secrets/testdata/module-sealedbox-fixture.json index fdcae72..bd50c37 100644 --- a/internal/secrets/testdata/module-sealedbox-fixture.json +++ b/internal/secrets/testdata/module-sealedbox-fixture.json @@ -3,5 +3,5 @@ "managerPublicKey": "rJZ9OSnuCcU5MNi8iV0EK8c5nYN+Cx5A+q+miIIIoUc=", "managerPrivateKey": "wGHx9hpbO1pyvLiw8oGwi31LBce3HscDiGhXpNU+wl4=", "plaintext": "rt-a-refresh-token-only-the-manager-may-read", - "sealed": "yKcpcuBD68n84vFEUufVd1lFCng72BbtyT9/40NCVgjyldBa68pQSpiym0qRVthasb/K21u+HywAgk4saJDAABTpm6E3MeyATSdDoLTz/mNR2p0lcDKE2sSDEI8=" + "sealed": "/fI4OGzdLLQnhwv1IagCiS8DNhsjiaPdJTaLjZYBayxHa5xLZ5T74+00yxKHToAoMGimQ0pCrz5ykQPp6YPsSFUSO8Oujz48f1tl/xRyRtkbulVBBC6ylS0KAAM=" }