The whole-mesh bed installs the vault before the modules that keep a secret from it; route-forwarding waits on issue 076

test/beds-read-the-catalogue.test.ts

@@ -57,7 +57,7 @@ const STILL_CARRIED: Record<string, { modules: string[]; why: string }> = {
   "provider-uses-mesh-credential.test.ts": { modules: ["redis"], why: "WEARING: a credential mechanism test" },
   "runtime-restart-on-config.test.ts": { modules: ["grafana"], why: "WEARING: a restart mechanism test" },
   "route-forwarding.test.ts": { modules: ["route-proxy", "hello-web"],
-    why: "WEARING: route-proxy without its certificate authority, hello-web with the route shape ADR 0066 replaced" },
+    why: "WEARING: route-proxy without its certificate authority, hello-web with the route shape ADR 0066 replaced — waits on novox/hq 04-ISSUES/076 (step-ca's root is a minted secret, so the catalogue's authority cannot be raised beside the proxy yet)" },
   "mesh.test.ts": { modules: ["postgres", "builder", "umami"],
     why: "WEARING: a postgres with no resources, a builder that builds itself, an umami that is another module of that name" },
 };

test/integration/whole-mesh-novox.test.ts

@@ -68,6 +68,9 @@ const NODE = "novox";
  */
 const MODULES: { name: string; containers: string[]; node?: boolean }[] = [
   { name: "postgres", containers: ["mesh-store", "mesh-postgres"] },
+  // The vault, before everything that keeps a secret from it: redis, gitea, umami, influxdb,
+  // mailu require one (novox/hq ADRs 0085, 0094).
+  { name: "mesh-vault", containers: ["mesh-vault"] },
   { name: "redis", containers: ["redis", "mesh-redis"] },
   { name: "minio", containers: ["minio", "mesh-minio"] },
   { name: "mongodb", containers: ["mongo", "mesh-mongodb"] },