The control plane authenticates nobody, so identity is a module

Closes the last open question about what the substrate contains. 0006
left an identity provider conditional — substrate only if the control
plane delegated authentication — and said the decision had not been
taken. It is now: it delegates to nothing.

The conditional was never about machines. A node proves itself with a
keypair it generated over a broker account issued at enrolment, and
declarations are verified by signature; none of that involves an
identity provider. It was only ever about whether a person signing in to
a mesh surface would be authenticated by something else.

So the substrate is three — a relational store, a message bus, an image
registry — and with 0028 having removed the object store, no member is
conditional and every one is there for the same reason.

It does not settle how a person signs in to a surface, deliberately.
What is settled is that whatever answers that is not something which
must exist before the mesh does, so it can be decided late or replaced —
which being substrate would have prevented.

03-DESIGN/01-to-be/07-the-substrate.md

@@ -38,7 +38,7 @@ The test, applied:
 | a message bus — **LavinMQ** | it reaches nodes over it ([ADR 0002](../../02-DECISIONS/0002-nodes-communicate-over-a-broker.md)) | no — it cannot grant itself a virtual host | **substrate** |
 | ~~an object store~~ | ~~artifacts and blobs it delivers~~ | — | **not substrate** — [ADR 0028](../../02-DECISIONS/0028-the-substrate-supplies-the-control-plane-and-nothing-else.md) |
 | an image registry — **the OCI registry** | images it delivers to nodes | no — it needs a repository | **substrate** |
-| an identity provider | only if it delegates authentication | — | **conditional, below** |
+| ~~an identity provider~~ | ~~only if it delegates authentication~~ | — | **not substrate** — it delegates to nothing ([ADR 0031](../../02-DECISIONS/0031-the-control-plane-authenticates-nobody.md)) |
 | ingress — **Traefik** | not to start; only to be reached by name | — it grants itself one afterwards | **not substrate** ([ADR 0007](../../02-DECISIONS/0007-connectivity.md)) |
 | anything else the mesh hosts | no | — | not substrate |
 
@@ -206,7 +206,11 @@ host's vocabulary grows by one shape rather than by one resource type per substr
 
 ## Open
 
-- **Whether identity is the fifth.** Above; it follows from a decision not yet taken.
+- ~~**Whether identity is the fifth.**~~ **Closed 2026-08-31** by
+  [ADR 0031](../../02-DECISIONS/0031-the-control-plane-authenticates-nobody.md): the control
+  plane delegates authentication to nothing, so identity is an ordinary module. With the object
+  store gone ([ADR 0028](../../02-DECISIONS/0028-the-substrate-supplies-the-control-plane-and-nothing-else.md))
+  the substrate is three, and no member is conditional.
 - ~~**Whether the bus must precede the control plane.**~~ **Resolved** by
   [ADR 0006](../../02-DECISIONS/0006-the-substrate-and-the-control-plane.md) — it must, and the question as
   posed here could not have answered it. This asked whether the control plane's contexts talk to