The node-engine carries a module's own secrets sealed by the vault when its manifest says they are the core's credentials, pinned at mesh-sdk 4f141ff (issue 774, the operator 2026-11-03)

internal/compose/resolution/core_credentials.go

@@ -2,14 +2,14 @@ package resolution
 
 import (
 	"encoding/json"
-	"slices"
 
 	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
-// CarriesVaultSealed says whether module's own secrets are the core's credentials.
-func CarriesVaultSealed(module string) bool {
-	return slices.Contains(mcat.CoreCredentialModules, module)
+// CarriesVaultSealed says whether a module's own secrets are the core's credentials, as its manifest says
+// (core-credentials): no list of modules is kept here.
+func CarriesVaultSealed(m mcat.Manifest) bool {
+	return mcat.CarriesCoreCredentials(m)
 }
 
 // vaultSealedOf is the vault's box for one of module's own secrets, if the rendering was given one.