A manifest may say its own secrets are the core's credentials (core-credentials), so a reader asks the module rather than a list here (issue 774, the operator 2026-11-03)

go/catalogue/invokes_test.go

@@ -1,6 +1,8 @@
 package catalogue
 
 import (
+	"encoding/json"
+	"strings"
 	"testing"
 )
 
@@ -15,4 +17,15 @@ func TestAManifestMaySayWhatItInvokes(t *testing.T) {
 	if len(m.Invokes) != 2 || m.Invokes[1] != "*" {
 		t.Fatalf("invokes not read: %v", m.Invokes)
 	}
+	// And that its own secrets are the core's credentials (issue 774): read, and written back as said.
+	for raw, core := range map[string]bool{`{"module":"bus","version":"1","core-credentials":true}`: true, `{"module":"app","version":"1"}`: false} {
+		m, err := decodeForTest([]byte(raw))
+		if err != nil || m.CoreCredentials != core || m.UnknownField() != "" {
+			t.Errorf("%s: core credentials %v, %v, %q", raw, m.CoreCredentials, err, m.UnknownField())
+		}
+		back, _ := json.Marshal(m)
+		if strings.Contains(string(back), "core-credentials") != core {
+			t.Errorf("%s written back as %s", raw, back)
+		}
+	}
 }

go/catalogue/manifest.go

@@ -801,6 +801,12 @@ type Manifest struct {
 	// start, and is then replaced.
 	OwnSecrets OwnSecrets `json:"own-secrets,omitempty"`
 
+	// CoreCredentials says this module's own secrets are the core's credentials (novox/hq ADR 0349 §16, issue 755): the
+	// vault seals each to the machine, and the node-engine writes the vault's box into its file, never a value of its
+	// own (Rendering.VaultSealed). Said by the module, never by a list in mesh-sdk (the operator, 2026-11-03: mesh-sdk names
+	// no module): the bus and the provisioner and its client say it.
+	CoreCredentials bool `json:"core-credentials,omitempty"`
+
 	// SecretsOwner is who the files holding this module's secrets belong to on the machine —
 	// `uid:gid`, or a name — when its process is not root.
 	//