novox/mesh-controller
3
0
Fork 0
Code Issues Pull Requests 2 Releases Wiki Activity

The vault's seat, and a report that carries the machine's profile (hq ADR 0161) #192

Merged
mesh-admin merged 1 commits from feat/the-vaults-seat-and-the-machines-profile into main 2026-10-01 14:02:10 +00:00
Conversation 0 Commits 1 Files Changed 6
+88 -1
mesh-admin commented 2026-10-01 13:58:42 +00:00
Contributor
Copy Link
Copy Source

hq ADR 0161, rules 1 and 3, controller half:

  • mesh-vault joins the mesh's own set (mesh-scoped, delivers secret, seeded additively at the next start); CanHold refuses a provider of secret that does not claim it (issue 106). Seat count test moves to 15; vault_seat_test.go.
  • A report may carry the machine's profile, the same shape enrolment sends; the latest replaces the stored one, a report without one leaves it standing (profile_report_test.go, store-backed). The host sends it from mesh-host PR (same branch name there), the catalogue's uplink holders declare their capability after that (issue 138).

Order: this first (an unknown field in a report is tolerated, but the seat must exist before the vault claims it), then the host, then the catalogue. make check on the branch.

hq ADR 0161, rules 1 and 3, controller half: - `mesh-vault` joins the mesh's own set (mesh-scoped, delivers `secret`, seeded additively at the next start); `CanHold` refuses a provider of `secret` that does not claim it (issue 106). Seat count test moves to 15; `vault_seat_test.go`. - A report may carry the machine's profile, the same shape enrolment sends; the latest replaces the stored one, a report without one leaves it standing (`profile_report_test.go`, store-backed). The host sends it from mesh-host PR (same branch name there), the catalogue's uplink holders declare their capability after that (issue 138). Order: this first (an unknown field in a report is tolerated, but the seat must exist before the vault claims it), then the host, then the catalogue. `make check` on the branch.
mesh-admin added 1 commit 2026-10-01 13:58:42 +00:00
The vault's seat, and a report that carries the machine's profile (hq ADR 0161) e8e502343f 
mesh-vault joins the mesh's own set — mesh-scoped, delivering secret — because the controller seals
every minted credential with it, which is the test for a seat of the mesh's own; a second provider is
a second claimant, refused by name (issue 106). A report may carry the machine's profile, detected
again by the apply that reports, and the latest replaces the enrolled one: a machine that switched
its network manager is a machine whose uplink holder lacks a capability at its next push (issue 138).
mesh-admin merged commit 84ac840ff4 into main 2026-10-01 14:02:10 +00:00
mesh-admin deleted branch feat/the-vaults-seat-and-the-machines-profile 2026-10-01 14:02:11 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
jschoubben miel.truyen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#192