Merge pull request 'To-be 24 names ADR 0305: a provider hands on the credential its software issued (issue 526)' (#320) from feat/526-a-provider-delivers-what-its-software-issued into main

03-DESIGN/01-to-be/24-the-secrets-vault.md

@@ -1,9 +1,10 @@
 ---
 layer: to-be
 status: implemented
-code: [mesh-catalog, mesh-controller, mesh-host]
-updated: 2026-10-01
+code: [mesh-catalog, mesh-controller, mesh-host, mesh-media-catalog]
+updated: 2026-10-12
 decisions:
+  - "ADR 0305"
   - "ADR 0158"
   - "ADR 0094"
   - "ADR 0092"
@@ -144,6 +145,26 @@ says it takes its own secret (`taken`, issue 180); consumers read it at start. A
 sealed to the consumers of the moment and not remade; a consumer that binds later waits for the next
 acceptance. *How it is checked:* the rows of ADR 0158's table; the controller's rows pass, the live row waits for the first provider.
 
+### A credential the provider's software issued
+
+*Decided 2026-10-12 (ADR 0305, issue 526), accepted on the operator's approval the same day; built on
+branches in the controller and the media catalogue.*
+
+Some software is given its one credential rather than told it: a media server signs in to its vendor and
+keeps the token the vendor issued. The mesh can neither make nor rotate such a value, and a copy typed for
+each consumer goes stale whenever the software changes it. An offer may therefore say
+`"credential": {"issued-by": "software", "tool": "<tool>"}` and name no own secret. The controller takes the
+value from the provider rather than from whoever asks: its `issued` verb carries no value, and asks the
+provider's named tool on the provider's own machine, in the controller's own name on the subject that names
+its caller, for the value sealed to a key made for that one call. The tool answers the controller alone. The
+controller opens the value, seals it to every consumer pair that does not hold it yet, under one stamp of its
+fingerprint, and to the operator, and forgets it; a pair that already holds it is left as it is, so asking
+again restarts nothing. The provider asks when it starts, when the software's value changes, and hourly; a
+consumer that binds in between holds a value the mesh made, which the software refuses, for at most the hour until the next ask. A change is recorded in the
+hand-act log as a decision, not a repair, and `rotate` of such a provision is refused. *How it is checked:*
+the tests ADR 0305 §13 names, in both repositories; the live row is `hand-acts` showing `secret issued` for
+the media server's provision once both walks are done.
+
 ## Beyond generate and hold
 
 Owning a secret means owning more than its creation. The mesh being migrated onto has a working