mesh-grants: the shadow user list takes each user's hash from the vault and says per user whether one is held (issue 1945, ADR 0547 clause 9) #57

2026-10-26T01:38:02Z

mesh-tools commented

2026-10-26 01:38:02 +00:00

Issue 1945; ADR 0547 milestone 1 (clause 9 with clause 5's shadow).

mesh-grants watches the vault's state bus-accounts (manifest reads mesh-vault.bus-accounts; a watch, no timer) and holds each shadow user's hash in memory only: Hash is json:"-", so it is in no digest, comparison or state of the part. grants_user_list and the part's state say per user whether a hash is held and how the user would compare with the list the bus loaded (same, adds, left out for want of a credential, loses its login), never the hash. take-over also names the users with no hash. Nothing takes effect before take-over. A missing bucket (the vault's new state appears at the controller's next start, issue 1790) is a gap said, and the watch opens again at the next wake.

Companion: mesh-catalog #486 (the vault writes the hashes); each works without the other, so no delivery group.

Tests: TestGrants, new subtest credentials. go test -race -count=1 ./... and go vet -tags integration ./... in modules/mesh-grants pass.

Rules bent (rules-are-weighed): no mesh-controller.try, as the operator directed on 2026-10-25.

Issue: 1945

Reviewed-by: review-vault-hash@shanks at 9132b6a296

Issue 1945; ADR 0547 milestone 1 (clause 9 with clause 5's shadow). mesh-grants watches the vault's state `bus-accounts` (manifest `reads` mesh-vault.bus-accounts; a watch, no timer) and holds each shadow user's hash in memory only: `Hash` is `json:"-"`, so it is in no digest, comparison or state of the part. `grants_user_list` and the part's state say per user whether a hash is held and how the user would compare with the list the bus loaded (same, adds, left out for want of a credential, loses its login), never the hash. `take-over` also names the users with no hash. Nothing takes effect before take-over. A missing bucket (the vault's new state appears at the controller's next start, issue 1790) is a gap said, and the watch opens again at the next wake. Companion: mesh-catalog #486 (the vault writes the hashes); each works without the other, so no delivery group. Tests: TestGrants, new subtest `credentials`. `go test -race -count=1 ./...` and `go vet -tags integration ./...` in modules/mesh-grants pass. Rules bent (rules-are-weighed): no mesh-controller.try, as the operator directed on 2026-10-25. Issue: 1945 Reviewed-by: review-vault-hash@shanks at 9132b6a296b9aa78daeacef732a44e972e2645bc

mesh-tools added 1 commit 2026-10-26 01:38:03 +00:00

mesh-grants: take each user's hash from the vault's bus-accounts and say per user whether one is held, so take-over waits until every user has a credential

mesh/delivery merged: source.main moved to novox/mesh-delivery@13380e3d0e52

Details

mesh/check pass 9132b6a296b9 on 13380e3d0e52 | unit 168 run, 473 kept | integration 178 run, 539 kept | composition passed in 36ms on novox

9132b6a296

ADR 0547 clause 9: the vault writes the hash of each bus account it holds into bus-accounts.<user>. The grants part
watches that state (no timer), carries the hash with each shadow user in memory only, and its user-list tool says per
user whether a hash is held and how its line would differ from the loaded one (same, adds, left out for want of a
credential, loses its login); never the hash, since bcrypt salts make two hashes incomparable. Take-over names the
users with no hash.

Issue: 1945

mesh-tools commented

2026-10-26 01:38:06 +00:00

Delivery novox/mesh-delivery@9132b6a296b9 — merged since 2026-10-26T07:48:10Z

Source — source.main moved to novox/mesh-delivery@13380e3d0e. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-10-26 01:38 (new) → proposed (announced): novox/mesh-delivery#57's head announced
2026-10-26 01:38 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-26 07:48 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-delivery@9132b6a296b9` — **merged** since 2026-10-26T07:48:10Z **Source** — source.main moved to novox/mesh-delivery@13380e3d0e52. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-10-26 01:38 (new) → proposed (announced): novox/mesh-delivery#57's head announced - 2026-10-26 01:38 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-26 07:48 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit 13380e3d0e into main

2026-10-26 07:48:08 +00:00

mesh-tools deleted branch fix/1945-vault-hashing

2026-10-26 07:48:08 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-delivery#57