jschoubben d7a00e1f26 Add the vault's enrolment verbs to its seat, so mesh-enrolment asks the vault to mint and sign and holds nothing ...

ADR 0587 §3 and §5 (changing ADR 0561 §5) have the vault make the token and its hash (enrolment-token), answer it
sealed to the operator key for tokens to relay (sealed, §8), drop both at every end (drop), and mint, answer again
and retire a joining node's account (node-account), with mesh-enrolment their only caller; sign names mesh-enrolment
for a joining node's certificate (with the serving key it presented, since the node has no record yet) and for a
redeem answer. Both verbs optional until the vault that runs serves them. Their answers' shapes are in go/delivery.
Tested as rows of TestTheVaultsSeatPromisesItsIntakeVerbs, no new test function.

(issue 774, 774/S37)

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

2026-11-02 01:41:03 +01:00

..

buildrun

Decline a build ask for another toolchain instead of failing it (ADR 0584 clause 2, issue 1578)

2026-11-01 15:24:13 +01:00

testdata

Give a composition its value, its canonical digest and its files by digest; key a dotted module escaped (issue 1943, S2; issue 1150)

2026-10-24 16:26:32 +02:00

answer_paths.go

Only a file's secrets are split entry by entry when masked and named: a vault box under vault-sealed is one masked word and one path, judged whole by what it opens to (issue 1126, C1; review of seed-same-3, round 1)

2026-10-28 12:22:37 +01:00

assigner_test.go

Refuse a want's rule past the eighth in the refusals table, now that the eighth rule exists (issue 1954 D1)

2026-10-29 22:37:41 +01:00

assigner.go

Add the assigner's eighth rule, every provision the build requires provided, so a want waits on its provisions as ADR 0570 §4 decides (issue 1954 D1)

2026-10-29 22:37:11 +01:00

builder_reference_test.go

Name the error of a fetch whose lock waits for an unpublished package (issue 1587, ADR 0500 §6)

2026-10-22 18:00:02 +02:00

builder_test.go

Let a module that builds no artifact have a done key that can be delivered (issue 1613, the lead's request for the builder lane)

2026-10-22 17:59:55 +02:00

builder.go

Key a building key's asks by build seat language, so a builder taking it over knows whose steps to watch (issue 1887 A4b)

2026-10-23 15:44:57 +02:00

buildrecord_test.go

Give delivery.Module a path and BuildRecord the artifacts a build made, so the builder can find a module and compare digests (issue 1588)

2026-10-21 09:04:43 +00:00

buildrecord.go

Cite ADR 0478's accepted clause numbers

2026-10-21 12:45:04 +02:00

candidate_paths_test.go

Carry a candidate module's named paths, so the builder's fetch for a candidate names them (issue 1758, ADR 0499 §2, the builder lane's request)

2026-10-22 18:06:49 +02:00

checker_test.go

delivery: a verdict names the siblings it read and the commits it was carried from, and a composition its fingerprint set, so a trunk or sibling move is carried, not judged again (ADR 0548 §5, §6; issue 568 S2)

2026-10-26 11:25:07 +01:00

checker.go

delivery: a verdict names the siblings it read and the commits it was carried from, and a composition its fingerprint set, so a trunk or sibling move is carried, not judged again (ADR 0548 §5, §6; issue 568 S2)

2026-10-26 11:25:07 +01:00

composed_compare.go

Only a file's secrets are split entry by entry when masked and named: a vault box under vault-sealed is one masked word and one path, judged whole by what it opens to (issue 1126, C1; review of seed-same-3, round 1)

2026-10-28 12:22:37 +01:00

composed_keys_test.go

Let the judgement beside a composition say unchanged: equal to the declaration the node last applied (issue 1943; ADR 0540 clause 9)

2026-10-24 21:17:14 +02:00

composed_seals.go

A file's secrets are sealed values entry by entry: each a slot of its own, kept where it opens to the value that runs, masked and named per secret (issue 1126, C1; the seed-7 probe: about 45 files on ace and novox differed by their secrets' bytes alone)

2026-10-28 12:02:39 +01:00

composed_signature_test.go

Bundle the mesh's authorities by certificate, and check a node's certificate against every one a bundle holds (issue 774, ADR 0550 §2)

2026-10-28 21:54:04 +01:00

composed_signature.go

Merge main (the R4g finish: the composer command) into feat/r6 (issue 1943)

2026-10-24 23:01:18 +02:00

composed_value_test.go

Let the node's own composition carry its files' filled paths, and refuse a composition that would have a provisioner's file written empty (issue 1945)

2026-10-25 01:46:36 +02:00

composed_value.go

Let the node's own composition carry its files' filled paths, and refuse a composition that would have a provisioner's file written empty (issue 1945)

2026-10-25 01:46:36 +02:00

composed.go

Merge main (the R4g finish: the composer command) into feat/r6 (issue 1943)

2026-10-24 23:01:18 +02:00

control_records_test.go

Work out a node's declared packages and their difference with the mirror in the SDK, so each engine writes its own key (ADR 0565 clause 6, issue 1953)

2026-11-01 16:02:06 +01:00

control_records.go

Name a provision's credential as the vault's own names it, read each node's provisions by its engine, and give mesh-config's held values their layout in the sdk, so the vault, the engine and the composition checks read one form (issue 1954, issue 1953 D7)

2026-10-29 22:39:29 +01:00

delivery_test.go

Let the lease key name its ask and time, and the user-list key say the lease is handed

2026-11-02 00:15:20 +01:00

delivery.go

Name the seat's states, candidates by proposal and the proposal itself, so readers and the holder share one contract (ADR 0567 §1-§6, issue 1126)

2026-10-28 18:09:38 +01:00

enginedata.go

Name the node-engine's data items state, so mesh-host writes and disk-load reads one shape (ADR 0577)

2026-11-01 00:05:38 +01:00

enginepackages.go

Work out a node's declared packages and their difference with the mirror in the SDK, so each engine writes its own key (ADR 0565 clause 6, issue 1953)

2026-11-01 16:02:06 +01:00

enrolment.go

Add the vault's enrolment verbs to its seat, so mesh-enrolment asks the vault to mint and sign and holds nothing

2026-11-02 01:41:03 +01:00

fingerprint2_test.go

Carry mesh package versions in build asks and fingerprints

2026-11-01 02:40:12 +01:00

fingerprint2.go

Carry mesh package versions in build asks and fingerprints

2026-11-01 02:40:12 +01:00

fingerprint_test.go

Prove the source fingerprint against three builds the live builder recorded (issue 1203)

2026-10-19 11:03:46 +02:00

fingerprint.go

Prove the source fingerprint against three builds the live builder recorded (issue 1203)

2026-10-19 11:03:46 +02:00

forge_inputs_test.go

Carry mesh package versions in build asks and fingerprints

2026-11-01 02:40:12 +01:00

gate_test.go

Move the joining token's shape into mesh-sdk, so the vault that makes it, mesh-cli and the engine read one type

2026-11-02 01:41:03 +01:00

gate.go

A settle ask's group begins with a colon, which no branch name holds, so a branch named settle/... still merges on its Approve (review of issue 1280)

2026-10-26 21:12:31 +01:00

grants.go

delivery: the grants part's grant keys and the source the assigner reads (a1; issue 774)

2026-10-28 21:54:04 +01:00

handed.go

delivery: the bus node hands the loaded list's hashes to the vault, sealed, in the bus module's have (ADR 0547 clause 9, issue 1945)

2026-10-26 11:28:38 +01:00

held_test.go

Give the controller seat the verb held and the event artifacts-gone, so the builder rebuilds a done key whose blob the artifact store no longer holds (issue 1937)

2026-10-24 04:07:22 +02:00

held.go

Give the controller seat the verb held and the event artifacts-gone, so the builder rebuilds a done key whose blob the artifact store no longer holds (issue 1937)

2026-10-24 04:07:22 +02:00

history_records.go

Keep the seat mesh-placement's state as one key per module and node, so a node watches its own keys and a change writes only the modules it moves (issue 774, research 072 row 37)

2026-10-31 09:21:04 +01:00

indexer2_test.go

Test the indexer's manifests, the new fields of modules and candidates, and the fpset (issue 1357)

2026-10-20 01:44:22 +00:00

judge_test.go

Add the node-engine verb composition to the seat's contract, and the resources two compositions differ in (issue 774)

2026-10-31 00:23:42 +01:00

judge.go

Add the node-engine verb composition to the seat's contract, and the resources two compositions differ in (issue 774)

2026-10-31 00:23:42 +01:00

manifests_mailu_test.go

Test a 21 KB manifest round trip byte for byte, on mailu's manifest copied from mesh-catalog (issue 1357)

2026-10-20 06:02:43 +00:00

manifests.go

Add the layout of the indexer's manifests bucket: the key by digest and its value (issue 1357)

2026-10-20 01:43:17 +00:00

module_newform_test.go

Accept a modules value with the new fingerprint alone, and say mesh/check is the required status (issue 1851, S7 and S16, ADR 0453 §6, ADR 0503 §3 §5)

2026-10-22 17:46:56 +02:00

module_paths_test.go

Keep each artifact's named paths in the modules value, so the checker needs no manifest to see a change touch them (issue 1758, ADR 0499, lead decision L8)

2026-10-22 18:00:24 +02:00

motion_test.go

Read whether a module is being delivered on a node in one place, so the view and the condition keeper judge a delivery alike (issue 1952 S7, ADR 0564 clause 13)

2026-10-29 21:37:59 +01:00

motion.go

Read whether a module is being delivered on a node in one place, so the view and the condition keeper judge a delivery alike (issue 1952 S7, ADR 0564 clause 13)

2026-10-29 21:37:59 +01:00

namedtree_layouts_test.go

Carry each named path's git object beside a module's other inputs (issue 1758, S3, ADR 0499 §2-§3)

2026-10-22 17:27:58 +02:00

namedtree_test.go

Compute a module's narrowed tree in one function, so every caller gives the merge's value (issue 1758, S2, ADR 0499 §2)

2026-10-22 17:27:02 +02:00

namedtree.go

Compute a module's narrowed tree in one function, so every caller gives the merge's value (issue 1758, S2, ADR 0499 §2)

2026-10-22 17:27:02 +02:00

nodehealth.go

Carry the engine's verdict on each account declared never to become root, and its contract, in the node's health report, so the self-check's DA and D-root judge on the machine's own word (issue 1952, ADR 0266)

2026-10-29 23:48:08 +01:00

noderecord_test.go

Add the contract of the enrolment state and of redeem, so the holder, the grants part and the engine read one shape

2026-11-02 01:41:03 +01:00

noderecord.go

The vault signs: the contract of its state signers, its verb sign and its event signed, a node's grants to ask it and to read what it trusts, and the authority composed as a bundle (issue 774, ADR 0550 §2)

2026-10-28 21:54:04 +01:00

own_drift.go

A drifted own secret is read from a resource id as a node runs it, its module's name first (only-office.needs-jwt), so the node agent finds what to hand the vault (issue 1126, cause C4; review round 2)

2026-10-28 10:00:29 +01:00

packages.go

Carry mesh package versions in build asks and fingerprints

2026-11-01 02:40:12 +01:00

placed.go

Keep the seat mesh-placement's state as one key per module and node, so a node watches its own keys and a change writes only the modules it moves (issue 774, research 072 row 37)

2026-10-31 09:21:04 +01:00

placement_candidate.go

Keep as today what a node keeps today and what is held only behind it, saying how; a stub hands and collects nothing of its own (issue 1126)

2026-10-28 23:49:22 +01:00

placement_keys.go

Say which machines are inside the private network from placement, for route-proxy, whose membership read goes with the assignments stream (issue 774, research 072 rows 33 and 34)

2026-10-31 09:28:15 +01:00

placement_proposal.go

Delete PlacementProposalChange.BeforeLease: the assigner no longer keeps the controller's assignments in step

2026-11-02 00:32:13 +01:00

placement_test.go

Delete PlacementProposalChange.BeforeLease: the assigner no longer keeps the controller's assignments in step

2026-11-02 00:32:13 +01:00

placement.go

Keep the seat mesh-placement's state as one key per module and node, so a node watches its own keys and a change writes only the modules it moves (issue 774, research 072 row 37)

2026-10-31 09:21:04 +01:00

preview.go

Carry mesh package versions in build asks and fingerprints

2026-11-01 02:40:12 +01:00

provided.go

Let the merge preview and the provided manifest decode instead of judging (ADR 0578 §3)

2026-11-01 02:18:56 +01:00

put.go

Say the put's tools, not a seat's verbs, in the put's words (ADR 0546)

2026-10-25 21:08:10 +01:00

reach.go

A module with no floor holds no head back; a merge among its changes reads not yet on the machines (review of issue 1280, ADR 0556 clause 2)

2026-10-26 21:12:48 +01:00

signers.go

Add the vault's enrolment verbs to its seat, so mesh-enrolment asks the vault to mint and sign and holds nothing

2026-11-02 01:41:03 +01:00

source_test.go

A module's floor counts every running have, healthy or not; health stays in its words (ADR 0556 clause 2, insight)

2026-10-26 21:12:31 +01:00

source.go

Let a verdict warn of what a stricter judge found in a manifest it accepted before (ADR 0579 §1)

2026-11-01 02:43:10 +01:00

stepasks_compose_test.go

Let the Go build seat carry a compose ask and its answer, so the assigner composes a group with its mesh-sdk head (issue 1622)

2026-10-24 03:51:35 +02:00

stepasks_key_test.go

Name an ask's step key <node>.<ask id> and its watch, so the asker learns which node took it and refuses other keys (issue 1887 A1b, ADR 0525 §6)

2026-10-23 15:11:44 +02:00

stepasks_test.go

Carry mesh package versions in build asks and fingerprints

2026-11-01 02:40:12 +01:00

stepasks.go

Name the agreed toolchain in a check ask and decline it on a node off that toolchain (ADR 0584, issue 1578)

2026-11-01 15:33:43 +01:00

steps_test.go

Pack a build's output like the build agent and keep the steps state's shape (issues 1471, 1479), part 7 of 7

2026-10-20 20:06:48 +00:00

steps.go

End a step left by a previous process at once: every step names its owner (issue 1890)

2026-10-27 01:19:29 +01:00

stuck_test.go

Read whether a module is being delivered on a node in one place, so the view and the condition keeper judge a delivery alike (issue 1952 S7, ADR 0564 clause 13)

2026-10-29 21:37:59 +01:00

stuck.go

Give the watchman's stuck keys a layout the controller reads (issue 1153)

2026-10-18 20:11:04 +02:00

token_test.go

Move the joining token's shape into mesh-sdk, so the vault that makes it, mesh-cli and the engine read one type

2026-11-02 01:41:03 +01:00

token.go

Move the joining token's shape into mesh-sdk, so the vault that makes it, mesh-cli and the engine read one type

2026-11-02 01:41:03 +01:00

toolchains_test.go

Agree a toolchain by strict majority and name the nodes that sit out (ADR 0584, issue 1578)

2026-11-01 15:20:26 +01:00

toolchains.go

Agree a toolchain by strict majority and name the nodes that sit out (ADR 0584, issue 1578)

2026-11-01 15:20:26 +01:00

trunk_test.go

Say in the fixture's comment how it was made; test an answered state without inputs (issue 1281)

2026-10-19 22:47:27 +00:00

trunk.go

Count a build record without a state as the outcome it is (issue 1281): the controller never stores state built

2026-10-19 22:39:29 +00:00

turns.go

delivery: a turn never holds the check of heads that wait in it, so two approved merges in one turn never hold each other's carry (ADR 0548 §3; issue 568, review round 1)

2026-10-26 12:12:53 +01:00

userlist.go

Let the lease key name its ask and time, and the user-list key say the lease is handed

2026-11-02 00:15:20 +01:00

verdicts_test.go

Let a verdict warn of what a stricter judge found in a manifest it accepted before (ADR 0579 §1)

2026-11-01 02:43:10 +01:00

verdicts.go

Let a verdict warn of what a stricter judge found in a manifest it accepted before (ADR 0579 §1)

2026-11-01 02:43:10 +01:00

view_answers_test.go

Keep the placement ask among the assigner's asks: its Approve's level, not its kind, needs the proof (ADR 0567 §5, issue 1126)

2026-10-28 18:30:00 +01:00

view_answers.go

Keep the placement ask among the assigner's asks: its Approve's level, not its kind, needs the proof (ADR 0567 §5, issue 1126)

2026-10-28 18:30:00 +01:00

want_composed_test.go

Add the assigner's eighth rule, every provision the build requires provided, so a want waits on its provisions as ADR 0570 §4 decides (issue 1954 D1)

2026-10-29 22:37:11 +01:00