A file's secrets are sealed values entry by entry, masked and named per secret (issue 1126; group fix/1126-seed-same-3) #115

2026-10-28T11:28:23Z

mesh-tools commented

2026-10-28 11:28:23 +00:00

Delivery group fix/1126-seed-same-3 (mesh-sdk, mesh-host), design 47 L2, from the seed-7 probe (issue 1126 notes 64-67).

The probe found about 45 files on ace and novox differing only by their secrets' bytes: a file's secrets map was not covered by C1's slot rule (SealedFields named only sealed and vault-sealed).

Each secrets.<name> entry is its own slot (SealSlot with SecretSlotField) in Seals, SealsIn, KeepSeals; KeepSeals swaps only that entry's bytes.
Masking and paths split only the secrets field per entry ("the same on both sides", "another seal of the same value", "another value", with the secret's name); a vault-sealed box and every other object under a secret key stay one masked word and one path (review round 1).

Quick vs thorough: thorough (the one slot rule covers every sealed field the composer writes).
Tests: rows in TestPlacement from intoFile's own output, each failing first; gofmt, vet, -tags integration and go test pass.

Reviewed-by: rev-seed-same-3@shanks at 8520a4c099

Delivery group fix/1126-seed-same-3 (mesh-sdk, mesh-host), design 47 L2, from the seed-7 probe (issue 1126 notes 64-67). The probe found about 45 files on ace and novox differing only by their secrets' bytes: a file's `secrets` map was not covered by C1's slot rule (SealedFields named only sealed and vault-sealed). - Each `secrets.<name>` entry is its own slot (SealSlot with SecretSlotField) in Seals, SealsIn, KeepSeals; KeepSeals swaps only that entry's bytes. - Masking and paths split only the `secrets` field per entry ("the same on both sides", "another seal of the same value", "another value", with the secret's name); a vault-sealed box and every other object under a secret key stay one masked word and one path (review round 1). Quick vs thorough: thorough (the one slot rule covers every sealed field the composer writes). Tests: rows in TestPlacement from intoFile's own output, each failing first; gofmt, vet, -tags integration and go test pass. Reviewed-by: rev-seed-same-3@shanks at 8520a4c09960a03b6f8b3dd16b7d4138d4be5ae4

mesh-tools added 2 commits 2026-10-28 11:28:24 +00:00

A file's secrets are sealed values entry by entry: each a slot of its own, kept where it opens to the value that runs, masked and named per secret (issue 1126, C1; the seed-7 probe: about 45 files on ace and novox differed by their secrets' bytes alone) 70de9429e5

Only a file's secrets are split entry by entry when masked and named: a vault box under vault-sealed is one masked word and one path, judged whole by what it opens to (issue 1126, C1; review of seed-same-3, round 1)

mesh/delivery merged: source.main moved to novox/mesh-sdk@6097e4f3e040

Details

mesh/delivery-group group fix/1126-seed-same-3 merged: every member is merged

Details

mesh/check pass 8520a4c09960 on 79eb58efe4b0 | carried from mesh-catalog 774fcdfa93ad | unit 2188 run, 1064 kept, 36 skipped | integration 2197 run, 1…

8520a4c099

mesh-tools commented

2026-10-28 11:28:27 +00:00

Delivery novox/mesh-sdk@8520a4c09960 — merged since 2026-10-28T11:40:37Z

Source — source.main moved to novox/mesh-sdk@6097e4f3e0. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group fix/1126-seed-same-3: novox/mesh-host@1e01868d92, novox/mesh-sdk@8520a4c099

composed together: pass — the checker's verdict at the members' heads (8ad62a745898)

Transitions

2026-10-28 11:28 (new) → proposed (announced): novox/mesh-sdk#115's head announced
2026-10-28 11:28 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-28 11:40 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-sdk@8520a4c09960` — **merged** since 2026-10-28T11:40:37Z **Source** — source.main moved to novox/mesh-sdk@6097e4f3e040. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `fix/1126-seed-same-3`: novox/mesh-host@1e01868d92c3, novox/mesh-sdk@8520a4c09960 - composed together: pass — the checker's verdict at the members' heads (8ad62a745898) **Transitions** - 2026-10-28 11:28 (new) → proposed (announced): novox/mesh-sdk#115's head announced - 2026-10-28 11:28 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-28 11:40 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit 6097e4f3e0 into main

2026-10-28 11:40:35 +00:00

mesh-tools deleted branch fix/1126-seed-same-3

2026-10-28 11:40:36 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-sdk#115