Archived
#195 refused two modules beside a consumer that both answer a bound provision — in every pass. The first pass exists only to answer what a node offers, and a refusal there makes the machine vanish from every other node's world (resolve.go says so for its sibling case): with novox refused for its own acme-ca, ace's plan lost the vault and the identity provider and read "nothing in this mesh provides secret". Seen live within minutes of the rollout. The second pass refuses it, where it is asked, as before.