ADR 0098: a fact a provider makes at first start is fetched from it; issue 076 resolved; design 08 amended; 074 down to one bed

2026-09-21 22:27:32 +02:00
parent bc373797c7
commit 252c6042e8
6 changed files with 88 additions and 5 deletions
@@ -0,0 +1,58 @@
+---
+topic: the tiers
+status: accepted
+date: 2026-09-21
+deciders: jochen
+reconstructed: false
+extends: 02-DECISIONS/0085-a-secret-is-a-provision.md
+---
+
+# 98. A fact a provider makes at first start is fetched from it, not carried in its manifest
+
+## Context
+
+The catalogue's certificate authority declared its root certificate, its root key and that key's
+password as its own secrets, and told the container to initialise from them. The mesh mints an
+own secret as random bytes, and random bytes are not a certificate: as written the authority
+could not start, and no bed had raised it
+([issue 076](../04-ISSUES/076-a-served-fact-made-at-first-start-cannot-be-served/00-report.md)).
+The authority can make its own root at first start. What it could not do then was tell the mesh
+what that root is: a consumer was given `${bound:acme-ca:root}` from the provider's `serves`,
+which is written in the manifest before anything runs.
+
+## Considered Options
+
+1. **A secret the module makes**, with the mesh taking custody once the file exists. Rejected
+   for now: a node would have to send a value up to the mesh, which no channel does today, and
+   a root key is the one thing the mesh has no reason to hold.
+2. **A served fact the provider contributes at run time.** Rejected for now: the same new
+   channel, for a fact that is not secret at all.
+3. **The consumer fetches it from the provider**, over the mesh network, through a gate before
+   the thing that needs it starts. Adopted.
+
+## Decision
+
+A provider's `serves` names where a fact made at first start can be fetched — the authority
+serves its root at a path beside its ACME directory — and a consumer fetches it in a `run-once`
+step declared before the resource that needs it, from the provider's bound address. The mesh
+network is where the fetch happens, which is what makes fetching without a prior trust
+acceptable: it is the network the mesh itself authenticates. The mesh mints only what it can
+make: the authority's password. The root key stays where it was made.
+
+## Consequences
+
+The catalogue's authority starts, and the proxy that requires it trusts what it fetched. What
+got harder: a consumer of such a fact carries one more resource, the gate that fetches it, and
+a fact that changes after first start is refetched only when the declaration changes.
+
+## How it is checked
+
+The route-forwarding bed installs the authority, the proxy and a consumer from the catalogue and
+asserts a routed name is served through the proxy; the proxy cannot start without the root its
+gate fetched. The catalogue-wide manifest test parses both manifests.
+
+## References
+
+- [issue 076](../04-ISSUES/076-a-served-fact-made-at-first-start-cannot-be-served/00-report.md)
+- [ADR 0053](0053-a-step-that-runs-on-a-schedule.md), [ADR 0085](0085-a-secret-is-a-provision.md)
+- [`03-DESIGN/01-to-be/08-connectivity.md`](../03-DESIGN/01-to-be/08-connectivity.md)
@@ -115,6 +115,7 @@ python3 00-META/checks/index.py            fail if stale
 - **0092** — [An operator delivers a pair credential, and the mesh never replaces it](0092-an-operator-delivers-a-pair-credential.md)
 - **0094** — [A module may hold several secrets from one provider, each a pair of its own](0094-a-module-may-hold-several-secrets-from-one-provider.md)
 - **0095** — [The control plane is the way to ask a module](0095-the-control-plane-is-the-way-to-ask-a-module.md)
+- **0098** — [A fact a provider makes at first start is fetched from it, not carried in its manifest](0098-a-fact-a-provider-makes-at-first-start-is-fetched-from-it.md)

 ### What runs on them, and how it gets there