jschoubben 565f144a20 A pair credential is sealed to the operator key too ...

The secret the vault provides a module is the credential of the consumer↔vault
pair, and so is every credential a provider grants; sealing only own secrets
to the operator left exactly those unrecoverable. Same column, same call; the
export and `secret recover` address a pair by consumer node, module and the
provision's name, and say which kind each entry is.

2026-09-21 00:36:16 +02:00

..

0001-nodes.sql

The control plane, as far as identity

2026-08-29 02:44:09 +02:00

0002-enrolment-tokens.sql

Node records, and the right to join once

2026-08-29 14:46:03 +02:00

0003-what-a-node-owns.sql

The mesh keeps a copy of what each node owns

2026-08-29 16:51:54 +02:00

0004-the-overlay.sql

The mesh computes a private network it cannot impersonate

2026-08-29 16:58:56 +02:00

0005-modules-and-assignments.sql

The mesh decides what a node runs

2026-08-29 22:00:06 +02:00

0006-where-a-module-came-from.sql

The mesh knows where a module came from, and whether it is behind

2026-08-29 22:32:16 +02:00

0007-settings.sql

Settings: changing a module's config without editing its file

2026-08-29 23:01:09 +02:00

0008-which-provider.sql

Where the answer to a requirement is allowed to live

2026-08-29 23:51:50 +02:00

0009-secrets.sql

Credentials the mesh delivers and cannot read

2026-08-30 00:21:18 +02:00

0010-builds.sql

Builds have a history, and failures are rows like any other

2026-08-30 10:18:23 +02:00

0011-what-a-node-did.sql

Keep what each machine did, so status can say what is wrong

2026-08-30 18:08:59 +02:00

0012-a-modules-own-secret.sql

A module may need a secret of its own, and the provisioner watches

2026-08-30 18:22:05 +02:00

0013-a-secret-the-mesh-cannot-reinvent.sql

A secret the mesh was given is not one the mesh can reinvent

2026-08-31 00:32:11 +02:00

0014-what-a-machine-was-last-sent.sql

"Behind" means not running what the mesh would send

2026-08-31 05:17:21 +02:00

0015-a-consumer-is-a-module-on-a-machine.sql

A consumer is a module on a machine, not a machine

2026-09-01 02:40:09 +02:00

0016-the-mesh-assigns-the-port.sql

The mesh assigns the port, and a module says it once

2026-09-01 17:52:53 +02:00

0017-what-a-machine-already-holds.sql

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

0018-a-report-names-its-declaration.sql

Caught up is an equality, not an ordering

2026-09-02 00:02:44 +02:00

0019-a-nodes-public-domain.sql

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

0020-a-module-is-a-repository-and-a-path.sql

Build a module from a repository and a path within it

2026-09-12 16:45:50 +02:00

0021-what-to-do-when-a-module-is-upgraded.sql

The mesh acts on what the catalogue decided a build meant

2026-09-13 01:55:07 +02:00

0022-a-build-keeps-what-it-was-told.sql

A build keeps what it was told

2026-09-15 01:22:34 +02:00

0023-an-operator-key-and-a-second-seal.sql

An operator key, a second seal on every own secret, and the vault keeps the export

2026-09-20 23:56:49 +02:00

0024-a-pair-credential-is-sealed-to-the-operator-too.sql

A pair credential is sealed to the operator key too

2026-09-21 00:36:16 +02:00