ADR 0158: a provider with one credential shares it with every consumer, and the vault remakes it for all at once #246

2026-10-01T10:18:01Z

mesh-admin commented

2026-10-01 10:18:01 +00:00

The decision behind the forge's issue 243. An offer may say "credential": {"own": "<secret>"}; the vault keeps one value per provider assignment and provision, sealed to the provider, every current consumer and the operator, remade for all when the consumer set changes or a rotation is asked; the provider takes it as it says it takes its own secret, consumers read it at start; accepted values are sealed to the consumers of the moment and not remade; a vendor-issued token stays accepted. Extends ADR 0048; rests on 0113/0114 and issue 180. Designs 24 and 13 carry it as to-be-built. Checks pass. Code follows in mesh-controller.

The decision behind the forge's issue 243. An offer may say `"credential": {"own": "<secret>"}`; the vault keeps one value per provider assignment and provision, sealed to the provider, every current consumer and the operator, remade for all when the consumer set changes or a rotation is asked; the provider takes it as it says it takes its own secret, consumers read it at start; accepted values are sealed to the consumers of the moment and not remade; a vendor-issued token stays accepted. Extends ADR 0048; rests on 0113/0114 and issue 180. Designs 24 and 13 carry it as to-be-built. Checks pass. Code follows in mesh-controller.

mesh-admin added 1 commit 2026-10-01 10:18:02 +00:00

ADR 0158: a provider with one credential shares it with every consumer, and the vault remakes it for all at once; designs 24 and 13 carry it d29d3dfc23

mesh-admin merged commit c58f4d6790 into main

2026-10-01 10:18:11 +00:00

mesh-admin deleted branch decision/0158-a-provider-with-one-credential-shares-it

2026-10-01 10:18:11 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#246