# mesh-provisioner

Holds the `mesh-provisioner` seat once for the mesh: the provisioner's server (novox/hq ADR 0349 clause 3, design 57
P4). Go, one binary (`cmd/mesh-provisioner`), served by a runtime of its own on its own bus account (`runs-as`), so
that its account alone writes the registry. The provisioner client on each node (`node-provisioner`, design 57 P5)
is the module `mesh-provisioner-client`.

## What it keeps

- `mesh-provisioner_registry`: which domain answers which kind of placeholder, keyed by the kind (`config`,
  `secret`, `bound` — the provider's own bucket, `<provider-module>_bound`, keyed
  `<node>.<module>.<provision>[.<local>]` (mesh-sdk `go/provider`) — `consumers` — a provider's consumers'
  credentials, asked of the vault by the provider machine's client (novox/hq ADR 0373) — `collected` — and `shell`, `environment` and `contribution`, read as collections of the same
  name (design 57 L1) — and the placement namespaces `dir`, `access`, `port`, `seat`, `machine`). Each
  answer names the owning module and where a client finds the values: a domain's bucket and its key shape
  (placement's is the controller's assignments mirror, whose value carries the provisioner's plan of a module handed
  to it), or a seat's verb asked on request and reply (a secret is never in a bucket). Compiled in
  `registry.go`, written at start and every hour, only where it differs; a kind no domain answers is deleted.
- `mesh-provisioner_needs`: what each module on each node needs, `<node>.<module>.<kind>.<name>`.
- `mesh-provisioner_applied`: what is applied where, `<node>.<module>`.
- `mesh-provisioner_collect`: the items of every collection, `<node>.<collection>.<contributor>`, the collection
  with a character a key's token cannot hold written `=<hex>` (`shell=3Azsh=3Anormal` is `shell:zsh:normal`), and
  read back by its name.

The last three are written by each node's provisioner client for its own node's keys alone: the controller grants
the client `<node>.>` of each and nothing wider (mesh-controller `internal/broker/provisioner.go`), and a provider
reads the needs without writing them. This module writes only the registry.

## The verb

`mesh-provisioner.provisioning` with `what` `registry` (the default), `needs`, `applied` or `collect`, narrowed by
`node` and `module` (for `collect`, the contributor) and, for `collect`, `collection`. Reads only. A key out of its
bucket's shape is said in the answer, never dropped quietly.