Replace a value given by hand like one the mesh made (hq ADR 0228) #82

2026-10-06T10:15:56Z

mesh-admin commented

2026-10-06 10:15:56 +00:00

Implements novox/hq ADR 0228 (hq PR #131).

Manifest: an own secret may say "issued-by": "outside" (anything else refused). OwnSecret.MeshMayMake() = taken: at-start and not outside-issued.
secret rotate of a given (accepted) at-start value now works like a made one (origin → made). Refused, with reason: outside-issued (names the issuer and the given value's age), applied, untaken. Optional --why/--cause, recorded in the hand-act log; the seat verb rotate gains why and cause (own-secret shape only; beside a provision it is refused as passed over).
Automatic replacement: secret accept of an own secret the mesh may make marks it (module_secret.replace_after_start, migration 0067). The serving controller, on a machine's clean report (all applied, nothing failed or refused) of the declaration it was last sent, sent after the value was given (and, on an adopted machine, with the module taken), remakes the value, sends the machine(s), logs it and states the seat fact secret-replaced (added to the seat's emits and the grant). Happens once: the mark is claimed by clearing it, and put back if the remake fails. Values the mesh's own code accepts (bus accounts, bus URL) go through AcceptSecretForModule and are never marked; values given before this change are not marked.
secret accept says the given value lives until the first good start, and on a converged machine that a fresh install needs none (accepted, not refused).
No secret mint verb: plain rotate covers it.

Kept localized: new files internal/inventory/given.go, cmd/mesh-controller/given.go; small edits to secrets.go, secret.go, seatverbs.go, verbs.go, status_summary.go (listener hook), push.go (2 lines), seats.go/streams.go (emits/grant), golden updated. Migration 0067 — renumber if Phase 2 lands one first.

Tests: catalogue (issued-by parse/round-trip/refusal, MeshMayMake), inventory (given at-start rotates; replaced once after the first good start and never again; not on older/earlier declarations; outside/applied/mesh-accepted never touched; outside rotate refused with age; adopted waits for take; unassigned never; definition changed to outside keeps value), cmd (seat rotate carries why; good-start predicate), broker grant/emits agreement. Full suite green with -p 1 against throwaway postgres:17 + nats:2.11; vet and gofmt clean. (Run in parallel packages, two NATS tests flaked against the shared server and pass alone — pre-existing contention.)

Ship before novox/mesh-catalog's PR of the same branch.

Implements novox/hq ADR 0228 (hq PR #131). - **Manifest**: an own secret may say `"issued-by": "outside"` (anything else refused). `OwnSecret.MeshMayMake()` = `taken: at-start` and not outside-issued. - **`secret rotate`** of a given (accepted) at-start value now works like a made one (origin → made). Refused, with reason: outside-issued (names the issuer and the given value's age), `applied`, untaken. Optional `--why/--cause`, recorded in the hand-act log; the seat verb `rotate` gains `why` and `cause` (own-secret shape only; beside a provision it is refused as passed over). - **Automatic replacement**: `secret accept` of an own secret the mesh may make marks it (`module_secret.replace_after_start`, migration 0067). The serving controller, on a machine's clean report (all applied, nothing failed or refused) of the declaration it was last sent, sent after the value was given (and, on an adopted machine, with the module taken), remakes the value, sends the machine(s), logs it and states the seat fact `secret-replaced` (added to the seat's emits and the grant). Happens once: the mark is claimed by clearing it, and put back if the remake fails. Values the mesh's own code accepts (bus accounts, bus URL) go through `AcceptSecretForModule` and are never marked; values given before this change are not marked. - `secret accept` says the given value lives until the first good start, and on a converged machine that a fresh install needs none (accepted, not refused). - No `secret mint` verb: plain `rotate` covers it. Kept localized: new files `internal/inventory/given.go`, `cmd/mesh-controller/given.go`; small edits to `secrets.go`, `secret.go`, `seatverbs.go`, `verbs.go`, `status_summary.go` (listener hook), `push.go` (2 lines), `seats.go`/`streams.go` (emits/grant), golden updated. **Migration 0067** — renumber if Phase 2 lands one first. Tests: catalogue (issued-by parse/round-trip/refusal, MeshMayMake), inventory (given at-start rotates; replaced once after the first good start and never again; not on older/earlier declarations; outside/applied/mesh-accepted never touched; outside rotate refused with age; adopted waits for take; unassigned never; definition changed to outside keeps value), cmd (seat rotate carries why; good-start predicate), broker grant/emits agreement. Full suite green with `-p 1` against throwaway postgres:17 + nats:2.11; vet and gofmt clean. (Run in parallel packages, two NATS tests flaked against the shared server and pass alone — pre-existing contention.) Ship before novox/mesh-catalog's PR of the same branch.

mesh-admin added 1 commit 2026-10-06 10:15:56 +00:00

Replace a value given by hand like one the mesh made (hq ADR 0228) e51c6a2cb9

A given own secret the module reads at start is held by nobody but that
module, so the mesh need not read it to replace it: secret rotate now
works on it, and a value given through secret accept is replaced on its
own after the module's first good start under the mesh. Only a value an
outside party issues (own-secrets "issued-by": "outside") or one the
module applies stays as given, refused with the reason.

mesh-admin merged commit 070ecafc07 into main

2026-10-06 10:16:30 +00:00

mesh-admin deleted branch feat/a-given-secret-lives-until-the-first-good-start

2026-10-06 10:16:30 +00:00

mesh-admin commented

2026-10-06 23:09:29 +00:00

Delivery novox/mesh-controller@070ecafc07bd — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

tier 0: mesh-controller
tier 1: build-agent
tier 2: route-proxy
ace: receives build-agent, route-proxy
g14: receives build-agent
novox: receives mesh-controller, build-agent, route-proxy
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#82 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@070ecafc07bd` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#82 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin referenced this pull request

2026-10-11 09:30:49 +00:00

A declaration says the assignment generation it came from, and every send is recorded (issue 234) #227

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#82