Archived
jschoubben
45c3853f4e
Found by testing removal, which is the half nobody tests. A grant was emitted for every secret the mesh held, whether or not the machine still asked for it. So a consumer that was unassigned kept appearing in its provider's manifest — and the provisioner's rule about removing what nobody asks for can only fire if the mesh stops asking. The login would have stayed live for ever, and nothing would have said so. Skipped where the declaration is built rather than where grants are gathered, so the rule holds whoever gathers them. No credential file is written for a withdrawn consumer either, or the provisioner would find a file its manifest does not mention and have to guess what that means. The secret itself is deliberately kept. It is sealed and unusable to the mesh, and a machine that comes back gets what it had — what withdraws the login is the manifest, which is the thing that reconciles.