A module's own secret rotates when its definition says the module reads it at start (hq 180)

`secret rotate <node> <module> <name>` makes the secret anew the way the first mint did, seals it
to the machine and the operator, and sends the machine, so the module starts again on the new value
— said in the log with who asked and when, never the value. Only for a secret whose definition says
`"taken": "at-start"`: an own secret is now a path, or {path, taken}, and a definition that says
nothing of how a secret is taken is refused with the word to write, because a credential rotated
under software that never reads it again is worse than one left alone (issue 179). `applied` is
refused by name until the staged form ADR 0114 decided is built; a value given to the mesh is
refused as ADR 0113 says. `rotate` is a verb on the controller's seat with two shapes — a pair
credential by provision, an own secret by machine, module and name — so the console can ask.
Registered manifests keep their bytes: a path alone is written back as a path.

internal/catalogue/manifest.go

@@ -390,7 +390,16 @@ type Manifest struct {
 	// module running on three machines has three passwords and the mesh can read none of them. A
 	// manifest carrying one instead would put the same secret on every machine that ever runs the
 	// module, in a file anybody can read, for ever.
-	OwnSecrets map[string]string `json:"own-secrets,omitempty"`
+	//
+	// **And how the module takes it** (novox/hq ADR 0114, issue 180): `"admin": "<path>"` says
+	// where and nothing else; `"admin": {"path": "<path>", "taken": "at-start"}` says the module
+	// reads the file when it starts, so the mesh may rotate it by making a new value and starting
+	// the module again; `"taken": "applied"` says the module's own code applies it to a backend
+	// that takes it only once, so a rotation must be staged beside the current value — the form the
+	// mesh does not build yet, and refuses by name. A secret that says neither is not rotated by
+	// the mesh: the one fault worse than an unrotated credential is a rotated one the software
+	// never saw.
+	OwnSecrets OwnSecrets `json:"own-secrets,omitempty"`
 
 	// SecretsOwner is who the files holding this module's secrets belong to on the machine —
 	// `uid:gid`, or a name — when its process is not root.
@@ -1419,14 +1428,20 @@ func ParseManifest(raw []byte) (Manifest, error) {
 			}
 		}
 	}
-	for name, where := range m.OwnSecrets {
-		if !placedOrAbsolute(where) {
+	for name, own := range m.OwnSecrets {
+		if !placedOrAbsolute(own.Path) {
 			problems = append(problems, fmt.Sprintf(
-				"%s needs %q at %q, which is neither an absolute path nor a placed one", m.Module, name, where))
+				"%s needs %q at %q, which is neither an absolute path nor a placed one", m.Module, name, own.Path))
 		}
 		if name == "" {
 			problems = append(problems, m.Module+" needs a secret with no name")
 		}
+		if own.Taken != "" && own.Taken != TakenAtStart && own.Taken != TakenApplied {
+			problems = append(problems, fmt.Sprintf(
+				"%s says its secret %q is taken %q; a secret is taken %q (read when the module starts) "+
+					"or %q (applied by the module's own code to a backend that takes it once)",
+				m.Module, name, own.Taken, TakenAtStart, TakenApplied))
+		}
 	}
 	localOf := map[string]string{}
 	for _, to := range m.SecretRequirements() {
@@ -1690,8 +1705,8 @@ func (m Manifest) undeclaredMounts() []string {
 			claim(fmt.Sprint(r["path"]))
 		}
 	}
-	for _, where := range m.OwnSecrets {
-		claim(where)
+	for _, own := range m.OwnSecrets {
+		claim(own.Path)
 	}
 	for _, to := range m.SecretRequirements() {
 		for _, f := range m.SecretFiles(to) {
@@ -1826,3 +1841,69 @@ func invokeProblems(m Manifest) []string {
 	}
 	return problems
 }
+
+// How a module takes one of its own secrets (ADR 0114): read from the file when it starts, or
+// applied by its own code to a backend that takes it once.
+const (
+	TakenAtStart = "at-start"
+	TakenApplied = "applied"
+)
+
+// OwnSecret is where one of a module's own secrets lands, and how the module takes it.
+type OwnSecret struct {
+	Path  string
+	Taken string
+}
+
+// OwnSecrets is a module's own secrets by name. On the wire each is a path, or an object naming
+// the path and how it is taken; written back the way it was read, so a manifest the mesh holds
+// keeps its bytes.
+type OwnSecrets map[string]OwnSecret
+
+func (o *OwnSecrets) UnmarshalJSON(raw []byte) error {
+	var entries map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &entries); err != nil {
+		return err
+	}
+	out := make(OwnSecrets, len(entries))
+	for name, body := range entries {
+		var path string
+		if err := json.Unmarshal(body, &path); err == nil {
+			out[name] = OwnSecret{Path: path}
+			continue
+		}
+		var long struct {
+			Path  string `json:"path"`
+			Taken string `json:"taken,omitempty"`
+		}
+		dec := json.NewDecoder(bytes.NewReader(body))
+		dec.DisallowUnknownFields()
+		if err := dec.Decode(&long); err != nil {
+			return fmt.Errorf("own-secrets.%s: a path, or {\"path\", \"taken\"}: %w", name, err)
+		}
+		out[name] = OwnSecret{Path: long.Path, Taken: long.Taken}
+	}
+	*o = out
+	return nil
+}
+
+func (o OwnSecrets) MarshalJSON() ([]byte, error) {
+	entries := make(map[string]any, len(o))
+	for name, s := range o {
+		if s.Taken == "" {
+			entries[name] = s.Path
+			continue
+		}
+		entries[name] = map[string]string{"path": s.Path, "taken": s.Taken}
+	}
+	return json.Marshal(entries)
+}
+
+// Paths is each own secret's path by name — the shape every placement and file walk reads.
+func (o OwnSecrets) Paths() map[string]string {
+	out := make(map[string]string, len(o))
+	for name, s := range o {
+		out[name] = s.Path
+	}
+	return out
+}