T

jschoubben 89370b6f5c mesh-enrolment: redeem, the joining machine's one call

redeem answers only enrol.<node> as the runtime proves it, checks the proof against the identity key presented, spends the
token once by compare-and-set (the keys lose their expiry), asks the vault for the node's account and certificate, writes
the node into placement on the issue's warrant, answers once the bus node loaded node.<node>, signed by the vault; the
same keys called again finish what is not done and answer the same (ADR 0587 §5-§7). The proof is mesh-host's EnrolProof
with the node's name in the token's place, since the seat never holds the secret. Tests added: two table-style tests.

(issue 774, 774/S56)

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

2026-11-02 01:44:46 +01:00

modules

mesh-enrolment: redeem, the joining machine's one call

2026-11-02 01:44:46 +01:00

.gitignore

Nodes compose: placement from the catalogue, node records, self wants, own and pair credentials, core boxes and the authority from the vault (issue 1126)

2026-10-26 19:30:18 +01:00

README.md

Begin mesh-delivery with its README and its own check (ADR 0428)

2026-10-18 16:07:25 +00:00

README.md

mesh-delivery

Novox Mesh — delivery: the parts that build, check and deliver a change by watching and writing keys on the bus (ADR 0429).

Made by the mesh from the gitea module's config value repositories (novox/hq ADR 0428). Main takes no push: a change reaches it by a pull request whose mesh/repo-check (this repository's merge-check.sh) and mesh/merge-gate passed.