Leave the own secret ledgers out of node-tools' manifest until the vault holds it on every machine, reading a missing file as no ledger credentials; grant the test's ledger account as the grants part does (issue 1966 T6)

2026-11-03 15:29:47 +01:00
parent 961ec0ef96
commit df929b48b5
3 changed files with 11 additions and 9 deletions
@@ -19,7 +19,9 @@ import (
 // that module's own ledger connection**; everything else stays on the runner's own.

 // LedgersFile is where the runner reads its own secret `ledgers`: MESH_LEDGERS_FILE when set, else beside its broker
-// credential, both in its directory mesh-state (node-tools' manifest: `${dir:mesh-state}/ledgers`).
+// credential, both in its directory mesh-state (`${dir:mesh-state}/ledgers`). Its manifest declares the secret only once
+// the vault holds it on every machine (B3 of issue 1966): until then a file not there means no ledger credentials, and
+// every ledger write is refused naming the missing one.
 const LedgersFile = "MESH_LEDGERS_FILE"

 // LedgersFileOf is the path of the secret `ledgers` for a runtime whose broker credential is at broker.