Providers create the credential the mesh minted, sealing nothing (ADR 0053)

redis, postgres and minio adapters drop generatePassword + the returned credential:
each creates the resource under the login the mesh derived (`as`) with the password
the mesh minted (`p.password`). minio's client gains a secret-key argument so it sets
the mesh's secret rather than generating one. umami (analytics) is re-pointed at the
new contract too; its siteId return is a data-provision concern ADR 0053 scopes out.

Proven: mesh-lab provider-uses-mesh-credential green — redis creates the consumer's
login with the mesh's password, the consumer authenticates (PONG), no seal key set.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/redis/provisioner/index.ts

@@ -1,27 +1,23 @@
 // redis's provisioner — the adapter that makes redis a provider of the mesh `redis-cache`
-// interface. The watching, sealing and grant-file handling are the sdk harness's; this writes only
-// the per-service half: how redis creates and removes a per-consumer cache (novox/hq ADR 0044/0045).
+// interface. The reconcile loop, the contributions file, and reading the mesh's minted password are
+// the sdk harness's; this writes only the per-service half: how redis creates and removes a
+// per-consumer cache (novox/hq ADR 0044/0045/0053).
 //
-// The `redis-cache` interface: a consumer receives `{ host, port, username, password,
-// keyspacePrefix }` and stores its keys under `<keyspacePrefix>:*`, isolated from every other
-// consumer by an ACL user scoped to exactly that prefix.
+// The `redis-cache` interface: a consumer connects as `as` with the password the mesh minted, and
+// stores its keys under `<as>:*`, isolated from every other consumer by an ACL user scoped to
+// exactly that prefix.
 //
-// Identity (the ACL username and keyspace) is derived from `grant.consumer` alone — never from
-// `grant.values` — because on removal the harness hands the adapter a grant carrying only the
-// consumer. Deriving from the consumer keeps create and remove naming the same resource.
+// **The login and password are the mesh's, not the provisioner's (ADR 0053).** The mesh derives the
+// login and hands it to both ends so they agree, and mints the password and delivers a copy to each.
+// redis creates exactly that login with exactly that password — a name or password the provisioner
+// invented is one the consumer could never present.
 
-import { runProvisioner, type Grant, type Credential } from "@novox/mesh-sdk/provisioner";
+import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
 import { emit } from "@novox/mesh-sdk/events";
-import { RedisClient, generatePassword } from "../client.js";
+import { RedisClient } from "../client.js";
 
 const redis = RedisClient.fromEnv();
 
-/** A stable, ACL-safe identity for a consumer: only [A-Za-z0-9_.-], never empty. */
-function identity(consumer: string): string {
-  const safe = consumer.replace(/[^A-Za-z0-9_.-]/g, "_").replace(/^_+|_+$/g, "");
-  return safe || "consumer";
-}
-
 /** Emit a lifecycle event without letting a broker hiccup fail the provisioning itself. */
 async function announce(type: string, body: Record<string, string>): Promise<void> {
   try {
@@ -32,26 +28,19 @@ async function announce(type: string, body: Record<string, string>): Promise<voi
 }
 
 runProvisioner("redis-cache", {
-  async create(grant: Grant): Promise<Credential> {
-    const username = identity(grant.consumer);
-    const keyspacePrefix = username;
-    const password = generatePassword();
-    await redis.createAclUser(username, password, keyspacePrefix);
-    await announce("module.redis.cache.provisioned", { consumer: grant.consumer, username, keyspacePrefix });
-    return {
-      fields: {
-        host: redis.host,
-        port: String(redis.port),
-        username,
-        password,
-        keyspacePrefix,
-      },
-    };
+  async create(p: Provision): Promise<void> {
+    // The keyspace is scoped to the consumer's own login, so one cannot read another's keys.
+    const keyspacePrefix = p.as;
+    await redis.createAclUser(p.as, p.password, keyspacePrefix);
+    await announce("module.redis.cache.provisioned", {
+      consumer: p.consumer ?? "",
+      username: p.as,
+      keyspacePrefix,
+    });
   },
 
-  async remove(grant: Grant): Promise<void> {
-    const username = identity(grant.consumer);
-    await redis.deleteAclUser(username);
-    await announce("module.redis.cache.deprovisioned", { consumer: grant.consumer, username });
+  async remove(p: { as: string }): Promise<void> {
+    await redis.deleteAclUser(p.as);
+    await announce("module.redis.cache.deprovisioned", { username: p.as });
   },
 });