From 393bac573dd4c72b41a8db51540093327aca55fa Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 12 Oct 2026 01:06:06 +0200 Subject: [PATCH] Give ADR 0305 its place in to-be 24: a provider hands on the credential its software issued (issue 526) A token a media server got from its vendor could only be typed in per consumer; the vault now takes it from the provider, sealed to one call, and keeps it as the provision's one credential. --- 03-DESIGN/01-to-be/24-the-secrets-vault.md | 23 +++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/03-DESIGN/01-to-be/24-the-secrets-vault.md b/03-DESIGN/01-to-be/24-the-secrets-vault.md index dc3182b8..4a27fec6 100644 --- a/03-DESIGN/01-to-be/24-the-secrets-vault.md +++ b/03-DESIGN/01-to-be/24-the-secrets-vault.md @@ -2,8 +2,9 @@ layer: to-be status: implemented code: [mesh-catalog, mesh-controller, mesh-host] -updated: 2026-10-01 +updated: 2026-10-12 decisions: + - "ADR 0305" - "ADR 0158" - "ADR 0094" - "ADR 0092" @@ -144,6 +145,26 @@ says it takes its own secret (`taken`, issue 180); consumers read it at start. A sealed to the consumers of the moment and not remade; a consumer that binds later waits for the next acceptance. *How it is checked:* the rows of ADR 0158's table; the controller's rows pass, the live row waits for the first provider. +### A credential the provider's software issued + +*Decided 2026-10-12 (ADR 0305, issue 526), waiting for the operator's approval; built on branches in the +controller and the media catalogue.* + +Some software is given its one credential rather than told it: a media server signs in to its vendor and +keeps the token the vendor issued. The mesh can neither make nor rotate such a value, and a copy typed for +each consumer goes stale whenever the software changes it. An offer may therefore say +`"credential": {"issued-by": "software", "tool": ""}` and name no own secret. The controller takes the +value from the provider rather than from whoever asks: its `issued` verb carries no value, and asks the +provider's named tool on the provider's own machine, in the controller's own name on the subject that names +its caller, for the value sealed to a key made for that one call. The tool answers the controller alone. The +controller opens the value, seals it to every consumer pair that does not hold it yet, under one stamp of its +fingerprint, and to the operator, and forgets it; a pair that already holds it is left as it is, so asking +again restarts nothing. The provider asks when it starts, when the software's value changes, and hourly; a +consumer that binds in between holds a value the mesh made until the next ask. A change is recorded in the +hand-act log as a decision, not a repair, and `rotate` of such a provision is refused. *How it is checked:* +the tests ADR 0305 ยง12 names, in both repositories; the live row is `hand-acts` showing `secret issued` for +the media server's provision once both walks are done. + ## Beyond generate and hold Owning a secret means owning more than its creation. The mesh being migrated onto has a working