A node reads its placement per node and module and hands a module as the vault judged (issue 774) #188

2026-10-31T09:59:52Z

mesh-tools commented

2026-10-31 09:59:52 +00:00

This repository:

Hand a module exactly when the vault's own answer judged it handed, so the node never composes a secret the vault leaves to the provisioner (issue 774)
Read this node's placement from its node and module keys, or its placement. before the holder converts it, so a write of the holder's is composed only once its node key lands (issue 774, research 072 row 37)

Issue 774 (L3 of design 47: nothing is left with the controller), research 072 rows 11, 26, 33, 34 and 37.

Delivery group feat/072-moves, one check and one Approve: mesh-sdk acbf80ad, mesh-catalog 8439ec11, mesh-delivery a313c3e8, mesh-tools be2fc2e9, mesh-host 8bdfddab, mesh-control 7a169eae. Every member pins mesh-sdk acbf80ad, except the controller root, which stays on main's pin on purpose (the controller is deprecated; its change is kept minimal). route-proxy's contract is the published tag modules/route-proxy/contract/v0.1.0; these pins are set by hand one last time (ADR 0573; issue 1585 builds the automatic rebuild).

What it does: the seat mesh-placement keeps one key per node (<node>.node) and per module (<node>.<module>), the legacy placement.<node> mirrored while readers move; the ASSIGNMENTS stream is no longer declared and mesh-grants reads memberships from its own state; mesh-hand-acts copies the controller's hand acts once; route-proxy serves routes from the provisioner's plans through its own contract; the vault is the only issuer of bus accounts, the controller forwarding to it since the take-over (2026-10-27).

Quick fix vs thorough fix (review round 2): the reviewer found that the vault and the controller could both mint an account before the take-over. The take-over was recorded on 2026-10-27, and the operator ruled out a hand-back (2026-10-31), so the window cannot recur; no change. The manifest of mesh-grants claiming no seat mesh-grants (ADR 0547 §5) is noted on issue 774 for the controller's removal.

Before delivery: no membership is held back (grants_membership: 0 at pass 140611). Do not roll mesh-delivery back after the key conversion.

Tests: each repository's unit suite, go vet and go vet -tags integration are clean at these heads (review round 2, 2026-10-31 10:40).

Reviewed-by: rev-072@shanks at 8bdfddab4a

**This repository:** - Hand a module exactly when the vault's own answer judged it handed, so the node never composes a secret the vault leaves to the provisioner (issue 774) - Read this node's placement from its node and module keys, or its placement.<node> before the holder converts it, so a write of the holder's is composed only once its node key lands (issue 774, research 072 row 37) Issue 774 (L3 of design 47: nothing is left with the controller), research 072 rows 11, 26, 33, 34 and 37. **Delivery group `feat/072-moves`, one check and one Approve:** mesh-sdk acbf80ad, mesh-catalog 8439ec11, mesh-delivery a313c3e8, mesh-tools be2fc2e9, mesh-host 8bdfddab, mesh-control 7a169eae. Every member pins mesh-sdk acbf80ad, except the controller root, which stays on main's pin on purpose (the controller is deprecated; its change is kept minimal). route-proxy's contract is the published tag `modules/route-proxy/contract/v0.1.0`; these pins are set by hand one last time (ADR 0573; issue 1585 builds the automatic rebuild). **What it does:** the seat mesh-placement keeps one key per node (`<node>.node`) and per module (`<node>.<module>`), the legacy `placement.<node>` mirrored while readers move; the ASSIGNMENTS stream is no longer declared and mesh-grants reads memberships from its own state; mesh-hand-acts copies the controller's hand acts once; route-proxy serves routes from the provisioner's plans through its own contract; the vault is the only issuer of bus accounts, the controller forwarding to it since the take-over (2026-10-27). **Quick fix vs thorough fix (review round 2):** the reviewer found that the vault and the controller could both mint an account before the take-over. The take-over was recorded on 2026-10-27, and the operator ruled out a hand-back (2026-10-31), so the window cannot recur; no change. The manifest of mesh-grants claiming no seat `mesh-grants` (ADR 0547 §5) is noted on issue 774 for the controller's removal. **Before delivery:** no membership is held back (`grants_membership`: 0 at pass 140611). Do not roll mesh-delivery back after the key conversion. **Tests:** each repository's unit suite, `go vet` and `go vet -tags integration` are clean at these heads (review round 2, 2026-10-31 10:40). Reviewed-by: rev-072@shanks at 8bdfddab4aab5740b050e972b794061729c32520

mesh-tools added 2 commits 2026-10-31 09:59:52 +00:00

Read this node's placement from its node and module keys, or its placement.<node> before the holder converts it, so a write of the holder's is composed only once its node key lands (issue 774, research 072 row 37) a4c0cee251

Hand a module exactly when the vault's own answer judged it handed, so the node never composes a secret the vault leaves to the provisioner (issue 774)

mesh/delivery merged: source.main moved to novox/mesh-host@a4713e2d28d7

Details

mesh/delivery-group group feat/072-moves merged: every member is merged

Details

mesh/check failed: shanks: the check of novox/mesh-controller#487 failed: go mod download in modules/route-proxy: go: git.novox.be/novox/mesh-controll…

8bdfddab4a

mesh-tools commented

2026-10-31 09:59:58 +00:00

Delivery novox/mesh-host@8bdfddab4aab — merged since 2026-10-31T10:31:17Z

Source — source.main moved to novox/mesh-host@a4713e2d28. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group feat/072-moves: novox/mesh-catalog@8439ec117c, novox/mesh-controller@7a169eae76, novox/mesh-delivery@a313c3e843, novox/mesh-host@8bdfddab4a, novox/mesh-sdk@acbf80ad91, novox/mesh-tools@be2fc2e9b6

composed together: fail — the checker's verdict at the members' heads (10e5c18979c3): shanks

Transitions

2026-10-31 09:59 (new) → proposed (announced): novox/mesh-host#188's head announced
2026-10-31 09:59 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-31 10:31 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-host@8bdfddab4aab` — **merged** since 2026-10-31T10:31:17Z **Source** — source.main moved to novox/mesh-host@a4713e2d28d7. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `feat/072-moves`: novox/mesh-catalog@8439ec117cb9, novox/mesh-controller@7a169eae76ef, novox/mesh-delivery@a313c3e84380, novox/mesh-host@8bdfddab4aab, novox/mesh-sdk@acbf80ad910a, novox/mesh-tools@be2fc2e9b6ac - composed together: fail — the checker's verdict at the members' heads (10e5c18979c3): shanks **Transitions** - 2026-10-31 09:59 (new) → proposed (announced): novox/mesh-host#188's head announced - 2026-10-31 09:59 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-31 10:31 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit a4713e2d28 into main

2026-10-31 10:31:14 +00:00

mesh-tools deleted branch feat/072-moves

2026-10-31 10:31:15 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#188