Beds for the vault and for genesis's root secrets #39

2026-09-21T07:30:03Z

jschoubben commented

2026-09-21 07:30:03 +00:00

Merge fourth of five. Needs the mesh-controller, mesh-catalog and mesh-host branches to be green.

assigned-vault.test.ts + scenarios/vault-node.yml: redis's password from the vault, rotation (design 13's three logins), and operator recovery from the store and from the vault's export, own and pair credentials alike.
one-node-mesh.test.ts: V2 dials the broker with the admin password genesis made; V5 proves the root secrets (template password refused, key and export at 0600, vault keeps the export, superuser recovered off the mesh opens the store); mesh-vault in the must lists.
What the runs taught: wait for the node to settle after genesis (the packet filter restarts docker), retry No such exec instance, accept a push that already said "told".

Last run: 22/22.

Merge fourth of five. Needs the mesh-controller, mesh-catalog and mesh-host branches to be green. - `assigned-vault.test.ts` + `scenarios/vault-node.yml`: redis's password from the vault, rotation (design 13's three logins), and operator recovery from the store and from the vault's export, own and pair credentials alike. - `one-node-mesh.test.ts`: V2 dials the broker with the admin password genesis made; V5 proves the root secrets (template password refused, key and export at 0600, vault keeps the export, superuser recovered off the mesh opens the store); mesh-vault in the must lists. - What the runs taught: wait for the node to settle after genesis (the packet filter restarts docker), retry `No such exec instance`, accept a push that already said "told". Last run: 22/22.

jschoubben added 5 commits 2026-09-21 07:30:03 +00:00

A bed for the vault: redis's password as a secret it provides, rotated 639175ec4a

Design 13's three logins, for a secret that had no owner before (novox/hq
ADR 0085): the delivered password authenticates against the real redis, the
one `rotate secret` delivers authenticates, and the one rotated away is
refused. Plus the owner's half: the vault's ledger names the holder and the
fingerprint, notices the rotation, and answers over the mesh by fingerprint,
never by value. Runs the catalogue's own manifests.

The genesis bed checks the root secrets: made, sealed to the operator key, recoverable 9da2d01ca0

V5: the template's password is refused by the store, the operator key and the
export sit beside the bundle at 0600, the vault keeps the export, and a person
with the key recovers the superuser off the mesh and opens the store with it.
V2 dials the broker with the administrator password genesis made.

The genesis bed waits for the node to settle before asking it anything 960fa3607f

Applying the packet filter restarts the container runtime a few seconds
after the installer's last push returns; a command racing that window dies
with 'No such exec instance'. Wait for the node to report applied and
current, and retry that error like the recreate it is.

The vault bed recovers redis's vault-provided secret from the export fb72db73bc

A push that said 'told' is a push that sent, whatever became of the exec afterwards 7fad006e56

jschoubben merged commit 7e2e97f056 into main

2026-09-21 08:03:22 +00:00

jschoubben deleted branch feat/secrets-vault

2026-09-21 08:03:22 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-lab#39