[BenCodez]

Summary

• add an enroll-verifier owner command for VotingPlugin-hosted automation
• let a node generate and retain its own 256-bit credential while Control receives only its lowercase SHA-256 verifier
• preserve node-ID validation, enrollment limits, durable locking, and verifier-only storage
• add command and credential-store regression coverage
• document that the command is intended for the trusted proxy/backend enrollment handshake

This is the Control-side prerequisite for command-free automatic proxy and backend enrollment in VotingPlugin.

Validation

• unit coverage added for verifier installation, authentication, invalid digest rejection, and raw-secret non-persistence

AI disclosure: This pull request was created with assistance from OpenAI Codex and reviewed by BenCodez.

[BenCodez]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T18:27:13.167553Z	2d5c16c	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: bcccab113f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

Added a bounded mvn -U retry loop to the release workflow as well. This addresses the transient Maven Central 429/cached-resolution failure seen during the last release; retries remain capped at four attempts. The workflow already creates the tag and its own recoverable draft, so a manual GitHub release is not required.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 2d5c16c233

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".