fix: a ${secret:} placeholder must fill from the file-owner's credential (provider-seal-key gate) #10

2026-09-06T11:47:08Z

jschoubben commented

2026-09-06 11:47:08 +00:00

The provider-seal-key gate, closed. On a node with two modules requiring the same provision (baserow + letta both consuming postgres), sealedFor matched a need by provision name alone, so a file's ${secret:X} placeholder took whichever consumer's sealed credential came last in r.Needs — the other module's password. baserow was handed letta's password and failed authentication. The secrets:-map path already guards this (For == m.Module, 04-ISSUES/022); the ${secret:…} placeholder path did not. Added the guard.

Also dedups the contributions file (co-located provider+consumer emitted a consumer twice — once full, once partial); the m.Contributes loop now skips a (provision, module) the grants loop already carried, while non-grant contributions (routes) still emit.

Regression test added (two consumers of one provision each get their own credential). Proven end-to-end on a new two-node lab install (mesh-lab assigned-two-node-db, SUITE_EXIT=0): baserow + letta on one node, substrate on another, each authenticates with its own minted password and reaches its own database.

https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

**The provider-seal-key gate, closed.** On a node with two modules requiring the same provision (baserow + letta both consuming postgres), `sealedFor` matched a need by provision **name alone**, so a file's `${secret:X}` placeholder took whichever consumer's sealed credential came **last** in `r.Needs` — the other module's password. baserow was handed letta's password and failed authentication. The `secrets:`-map path already guards this (`For == m.Module`, 04-ISSUES/022); the `${secret:…}` placeholder path did not. Added the guard. Also dedups the contributions file (co-located provider+consumer emitted a consumer twice — once full, once partial); the `m.Contributes` loop now skips a `(provision, module)` the grants loop already carried, while non-grant contributions (routes) still emit. Regression test added (two consumers of one provision each get their own credential). **Proven end-to-end** on a new two-node lab install (mesh-lab `assigned-two-node-db`, SUITE_EXIT=0): baserow + letta on one node, substrate on another, each authenticates with its own minted password and reaches its own database. https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

jschoubben added 1 commit 2026-09-06 11:47:08 +00:00

fix: fill a ptr-secret placeholder from the file-owner's credential, not the last consumer's 99a753994e

The provider-seal-key gate: on a node with two modules requiring the same provision (baserow
and letta both consuming postgres), sealedFor matched a need by provision NAME alone, so a
file's ${secret:X} placeholder took whichever consumer's sealed credential came last in
r.Needs -- the OTHER module's password. baserow was handed letta's password and could not
authenticate. The secrets:-map delivery path already guards this (For == m.Module, novox/hq
04-ISSUES/022); the ${secret:...} placeholder path did not. Added the same guard.

Also dedups the contributions file: when provider and consumer are co-located, grantsFor
enumerates the same-node consumer, so a consumer was emitted twice into the provider's
receives file (once full with its grant, once partial). The m.Contributes loop now skips a
(provision, module) the grants loop already carried; non-grant contributions (routes) still emit.

Regression test added: two consumers of one provision each get their own credential. Proven
end-to-end on a two-node lab install (mesh-lab assigned-two-node-db): baserow and letta on one
node, substrate on another, each authenticates with its own minted password.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

jschoubben merged commit dc65440e31 into main

2026-09-06 11:47:23 +00:00

jschoubben deleted branch fix/secret-per-consumer

2026-09-06 11:47:23 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#10