A module may hold several secrets from one provider, each a pair of its own

secrets: maps a requirement to several files under local names. Each local name is
its own need, its own pair credential (the pair is keyed on it: migration 0027),
its own file on the consumer, its own holder at the provider (the identity with the
local name after it) and rotates apart from the others. The plain shape is
unchanged and every existing row is the credential it was (novox/hq 04-ISSUES/069,
ADR 0094).

cmd/mesh-controller/rotate.go

@@ -83,11 +83,11 @@ func rotateCommand(ctx context.Context, args []string) error {
 	for _, h := range holders {
 		// The module, because a machine may hold several credentials for one provision and
 		// rotating "anchor's database password" now means rotating three of them.
-		fmt.Printf("  %s on %s, from %s\n", h.ConsumerModule, h.Consumer, h.Provider)
+		fmt.Printf("  %s on %s, from %s%s\n", h.ConsumerModule, h.Consumer, h.Provider, asLocal(h.Local))
 	}
 
 	for _, h := range holders {
-		if err := inv.RotateSecret(ctx, h.Provision, h.Consumer, h.ConsumerModule, h.Provider); err != nil {
+		if err := inv.RotateSecret(ctx, h.Provision, h.Consumer, h.ConsumerModule, h.Provider, h.Local); err != nil {
 			// Partly rotated, and said so plainly. What is gone is remade on the next push, so
 			// the remedy is to run this again rather than to repair anything — but a machine
 			// whose secret was discarded and not resent is holding a credential the provider is
@@ -115,3 +115,11 @@ func rotateCommand(ctx context.Context, args []string) error {
 		"changed cannot authenticate — `status` says who is still behind\n", len(machines))
 	return nil
 }
+
+// asLocal names the credential inside the consumer where it holds several (ADR 0094).
+func asLocal(local string) string {
+	if local == "" {
+		return ""
+	}
+	return " (as " + local + ")"
+}