From 393bac573dd4c72b41a8db51540093327aca55fa Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 12 Oct 2026 01:06:06 +0200 Subject: [PATCH 1/3] Give ADR 0305 its place in to-be 24: a provider hands on the credential its software issued (issue 526) A token a media server got from its vendor could only be typed in per consumer; the vault now takes it from the provider, sealed to one call, and keeps it as the provision's one credential. --- 03-DESIGN/01-to-be/24-the-secrets-vault.md | 23 +++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/03-DESIGN/01-to-be/24-the-secrets-vault.md b/03-DESIGN/01-to-be/24-the-secrets-vault.md index dc3182b8..4a27fec6 100644 --- a/03-DESIGN/01-to-be/24-the-secrets-vault.md +++ b/03-DESIGN/01-to-be/24-the-secrets-vault.md @@ -2,8 +2,9 @@ layer: to-be status: implemented code: [mesh-catalog, mesh-controller, mesh-host] -updated: 2026-10-01 +updated: 2026-10-12 decisions: + - "ADR 0305" - "ADR 0158" - "ADR 0094" - "ADR 0092" @@ -144,6 +145,26 @@ says it takes its own secret (`taken`, issue 180); consumers read it at start. A sealed to the consumers of the moment and not remade; a consumer that binds later waits for the next acceptance. *How it is checked:* the rows of ADR 0158's table; the controller's rows pass, the live row waits for the first provider. +### A credential the provider's software issued + +*Decided 2026-10-12 (ADR 0305, issue 526), waiting for the operator's approval; built on branches in the +controller and the media catalogue.* + +Some software is given its one credential rather than told it: a media server signs in to its vendor and +keeps the token the vendor issued. The mesh can neither make nor rotate such a value, and a copy typed for +each consumer goes stale whenever the software changes it. An offer may therefore say +`"credential": {"issued-by": "software", "tool": ""}` and name no own secret. The controller takes the +value from the provider rather than from whoever asks: its `issued` verb carries no value, and asks the +provider's named tool on the provider's own machine, in the controller's own name on the subject that names +its caller, for the value sealed to a key made for that one call. The tool answers the controller alone. The +controller opens the value, seals it to every consumer pair that does not hold it yet, under one stamp of its +fingerprint, and to the operator, and forgets it; a pair that already holds it is left as it is, so asking +again restarts nothing. The provider asks when it starts, when the software's value changes, and hourly; a +consumer that binds in between holds a value the mesh made until the next ask. A change is recorded in the +hand-act log as a decision, not a repair, and `rotate` of such a provision is refused. *How it is checked:* +the tests ADR 0305 §12 names, in both repositories; the live row is `hand-acts` showing `secret issued` for +the media server's provision once both walks are done. + ## Beyond generate and hold Owning a secret means owning more than its creation. The mesh being migrated onto has a working From 540f82768e96506babbc9ae392c3e6b63d9a4fb7 Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 12 Oct 2026 01:09:13 +0200 Subject: [PATCH 2/3] Name ADR 0305's check clause and the late binder's hour in to-be 24 (issue 526) --- 03-DESIGN/01-to-be/24-the-secrets-vault.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/03-DESIGN/01-to-be/24-the-secrets-vault.md b/03-DESIGN/01-to-be/24-the-secrets-vault.md index 4a27fec6..2fe68ef3 100644 --- a/03-DESIGN/01-to-be/24-the-secrets-vault.md +++ b/03-DESIGN/01-to-be/24-the-secrets-vault.md @@ -160,9 +160,9 @@ its caller, for the value sealed to a key made for that one call. The tool answe controller opens the value, seals it to every consumer pair that does not hold it yet, under one stamp of its fingerprint, and to the operator, and forgets it; a pair that already holds it is left as it is, so asking again restarts nothing. The provider asks when it starts, when the software's value changes, and hourly; a -consumer that binds in between holds a value the mesh made until the next ask. A change is recorded in the +consumer that binds in between holds a value the mesh made, which the software refuses, for at most the hour until the next ask. A change is recorded in the hand-act log as a decision, not a repair, and `rotate` of such a provision is refused. *How it is checked:* -the tests ADR 0305 §12 names, in both repositories; the live row is `hand-acts` showing `secret issued` for +the tests ADR 0305 §13 names, in both repositories; the live row is `hand-acts` showing `secret issued` for the media server's provision once both walks are done. ## Beyond generate and hold From a0291235a2e06f2ae35482f71084819d3f95448f Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 12 Oct 2026 01:20:24 +0200 Subject: [PATCH 3/3] Say ADR 0305 is accepted in to-be 24, and name the media catalogue among its code (issue 526) --- 03-DESIGN/01-to-be/24-the-secrets-vault.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/03-DESIGN/01-to-be/24-the-secrets-vault.md b/03-DESIGN/01-to-be/24-the-secrets-vault.md index 2fe68ef3..9475e36e 100644 --- a/03-DESIGN/01-to-be/24-the-secrets-vault.md +++ b/03-DESIGN/01-to-be/24-the-secrets-vault.md @@ -1,7 +1,7 @@ --- layer: to-be status: implemented -code: [mesh-catalog, mesh-controller, mesh-host] +code: [mesh-catalog, mesh-controller, mesh-host, mesh-media-catalog] updated: 2026-10-12 decisions: - "ADR 0305" @@ -147,8 +147,8 @@ acceptance. *How it is checked:* the rows of ADR 0158's table; the controller's ### A credential the provider's software issued -*Decided 2026-10-12 (ADR 0305, issue 526), waiting for the operator's approval; built on branches in the -controller and the media catalogue.* +*Decided 2026-10-12 (ADR 0305, issue 526), accepted on the operator's approval the same day; built on +branches in the controller and the media catalogue.* Some software is given its one credential rather than told it: a media server signs in to its vendor and keeps the token the vendor issued. The mesh can neither make nor rotate such a value, and a copy typed for