rotate: narrow a pair credential to one consuming module (hq issue 268) #75

2026-10-06T00:15:14Z

mesh-admin commented

2026-10-06 00:15:14 +00:00

hq issue 268: letta leaked its postgres-database credential on the home server. Before this change, rotate postgres-database --consumer <machine> was the narrowest form, and it rotated (and restarted) every module on that machine that consumes the provision.

rotate <provision> [--consumer <m>] [--module <module>]: only that consuming module's credentials (every local of it).
The seat verb passes module beside provision through as --module. node/secret beside provision are still refused as passed over.
If the named module holds nothing, the error says so instead of rotating nothing silently.

Tests: seatverbs argv for the new shape, and ofModule narrowing. go vet ./... and go test ./... pass.

hq issue 268: letta leaked its postgres-database credential on the home server. Before this change, `rotate postgres-database --consumer <machine>` was the narrowest form, and it rotated (and restarted) every module on that machine that consumes the provision. - `rotate <provision> [--consumer <m>] [--module <module>]`: only that consuming module's credentials (every `local` of it). - The seat verb passes `module` beside `provision` through as `--module`. `node`/`secret` beside `provision` are still refused as passed over. - If the named module holds nothing, the error says so instead of rotating nothing silently. Tests: seatverbs argv for the new shape, and `ofModule` narrowing. `go vet ./...` and `go test ./...` pass.

mesh-admin added 1 commit 2026-10-06 00:15:14 +00:00

rotate: narrow a pair credential to one consuming module (hq issue 268) f8286c063d

A machine runs many consumers of one provision, each with its own
credential. When one module leaks its credential, `rotate <provision>
--consumer <machine>` was the narrowest act and replaced every module's
on that machine, restarting all of them. --module (and the verb's
module argument beside provision) rotates only that module's.

mesh-admin merged commit 1f3abd3e0e into main

2026-10-06 00:25:31 +00:00

mesh-admin deleted branch feat/rotate-one-consuming-module

2026-10-06 00:25:32 +00:00

mesh-admin commented

2026-10-06 23:09:35 +00:00

Delivery novox/mesh-controller@1f3abd3e0e0a — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

tier 0: mesh-controller
tier 1: build-agent
tier 2: route-proxy
ace: receives build-agent, route-proxy
g14: receives build-agent
novox: receives mesh-controller, build-agent, route-proxy
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#75 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@1f3abd3e0e0a` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#75 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin referenced this pull request

2026-10-09 23:01:48 +00:00

Keep quiet for the setuid search the engine now runs to completion (hq issue 361) #190

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#75