A module may hold several secrets from one provider, each a pair of its own

secrets: maps a requirement to several files under local names. Each local name is
its own need, its own pair credential (the pair is keyed on it: migration 0027),
its own file on the consumer, its own holder at the provider (the identity with the
local name after it) and rotates apart from the others. The plain shape is
unchanged and every existing row is the credential it was (novox/hq 04-ISSUES/069,
ADR 0094).

internal/catalogue/declaration.go

@@ -60,6 +60,9 @@ type Grant struct {
 	// Values are what that module contributed — the name it wants, and anything else the
 	// provision's own vocabulary defines.
 	Values map[string]any
+	// Local is the name the credential goes by inside the consumer where it keeps several for one
+	// provision (ADR 0094); empty for the ordinary one. The provider sees it as a holder of its own.
+	Local string
 	// Slug is the consumer module's identity slug, if it declared one — carried on the grant so the
 	// provider side derives the same login the consumer does, even across nodes where the consumer's
 	// manifest is not in view (novox/hq ADR 0049). Empty means "use the module name".
@@ -285,45 +288,48 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 				"id": AccessID(a.Path), "type": "access", "path": a.Path, "mode": a.At(),
 			})
 		}
-		for _, to := range sortedKeys(m.Secrets) {
-			var found *Needed
-			for i, n := range r.Needs {
-				// **This module's need, not the provision's** (novox/hq 04-ISSUES/022). Matching
-				// on the name alone, every consumer of a provision took whichever credential
-				// happened to be last in the list — so on a node with two of them, one module
-				// would be given the other's password and fail to authenticate with a valid
-				// credential belonging to somebody else.
-				if n.Name == to && n.For == m.Module {
-					found = &r.Needs[i]
+		for _, to := range m.SecretRequirements() {
+			for _, file := range m.SecretFiles(to) {
+				var found *Needed
+				for i, n := range r.Needs {
+					// **This module's need, not the provision's** (novox/hq 04-ISSUES/022). Matching
+					// on the name alone, every consumer of a provision took whichever credential
+					// happened to be last in the list — so on a node with two of them, one module
+					// would be given the other's password and fail to authenticate with a valid
+					// credential belonging to somebody else. And this file's local name, where the
+					// module keeps several (ADR 0094).
+					if n.Name == to && n.For == m.Module && n.Local == file.Local {
+						found = &r.Needs[i]
+					}
 				}
+				if found != nil && found.ByRecord && found.Sealed == "" && !found.Manager {
+					// Answered by a record whose key has not been supplied since this consumer was
+					// put on it. **Refused, not skipped.** The mesh discarded the plaintext when the
+					// key was accepted and cannot seal another, so a machine that resolved cleanly
+					// would receive no file at all and fail at whatever tried to read it — which is
+					// the outcome ADR 0024 exists to avoid, arrived at politely.
+					//
+					// The manager holder is the one exception (novox/hq ADR 0050): an empty refresh token
+					// is a licence whose manager has not adopted one yet, a real waiting state rather than
+					// a lost key. It falls through to the skip below — its bound facts (carrying the
+					// manager's public key) are still delivered, which is what adoption needs to seal the
+					// first refresh token.
+					return nil, fmt.Errorf(
+						"%s on this machine uses the licence %q and no key has been sealed to it. "+
+							"The mesh cannot make one; supply it again with `licence key %s`",
+						m.Module, found.From, found.From)
+				}
+				if found == nil || found.Sealed == "" {
+					// Answered on this machine, or answered by a node the mesh could not seal to.
+					// Nothing to write either way, and writing an empty credential file would be
+					// worse than none: something would read it and fail authenticating.
+					continue
+				}
+				first = append(first, ownedBy(m.SecretsOwner, map[string]any{
+					"id": SecretID(SecretLocal(to, file.Local)), "type": "file", "path": file.Path,
+					"sealed": found.Sealed,
+				}))
 			}
-			if found != nil && found.ByRecord && found.Sealed == "" && !found.Manager {
-				// Answered by a record whose key has not been supplied since this consumer was
-				// put on it. **Refused, not skipped.** The mesh discarded the plaintext when the
-				// key was accepted and cannot seal another, so a machine that resolved cleanly
-				// would receive no file at all and fail at whatever tried to read it — which is
-				// the outcome ADR 0024 exists to avoid, arrived at politely.
-				//
-				// The manager holder is the one exception (novox/hq ADR 0050): an empty refresh token
-				// is a licence whose manager has not adopted one yet, a real waiting state rather than
-				// a lost key. It falls through to the skip below — its bound facts (carrying the
-				// manager's public key) are still delivered, which is what adoption needs to seal the
-				// first refresh token.
-				return nil, fmt.Errorf(
-					"%s on this machine uses the licence %q and no key has been sealed to it. "+
-						"The mesh cannot make one; supply it again with `licence key %s`",
-					m.Module, found.From, found.From)
-			}
-			if found == nil || found.Sealed == "" {
-				// Answered on this machine, or answered by a node the mesh could not seal to.
-				// Nothing to write either way, and writing an empty credential file would be
-				// worse than none: something would read it and fail authenticating.
-				continue
-			}
-			first = append(first, ownedBy(m.SecretsOwner, map[string]any{
-				"id": SecretID(to), "type": "file", "path": m.Secrets[to],
-				"sealed": found.Sealed,
-			}))
 		}
 		for _, to := range sortedKeys(m.Grants) {
 			for _, g := range with.Grants {
@@ -613,6 +619,15 @@ func grantPath(directory, consumer, module string) string {
 	return strings.TrimRight(directory, "/") + "/" + consumer + "." + module + ".secret"
 }
 
+// holderAs is a consumer's name at the provider with a local name after it, where it keeps several
+// credentials for one provision (ADR 0094); the name alone otherwise.
+func holderAs(as, local string) string {
+	if local == "" {
+		return as
+	}
+	return as + "_" + local
+}
+
 // contributions collects what every module in this set contributes, by requirement.
 //
 // Ordered by contributing module, because the result becomes a file on a machine and a file whose
@@ -649,8 +664,11 @@ func (r Resolution) contributions(settings SettingsBy, grants []Grant,
 		}
 		out[g.Provision] = append(out[g.Provision], Contribution{
 			From: g.From, Node: g.Consumer, At: g.At, Values: g.Values,
-			As:     ConsumerIdentity(g.Consumer, IdentitySource(g.Slug, g.From)),
-			Secret: grantPath(directories[g.Provision], g.Consumer, g.From),
+			// One holder per local name: the identity the consumer is known by, and the local name
+			// after it where the module keeps several (ADR 0094). Not a login any backend checks —
+			// a secret is not a login — so the identity limit does not apply to the suffix.
+			As:     holderAs(ConsumerIdentity(g.Consumer, IdentitySource(g.Slug, g.From)), g.Local),
+			Secret: grantPath(directories[g.Provision], g.Consumer, holderAs(g.From, g.Local)),
 		})
 		if granted[g.Provision] == nil {
 			granted[g.Provision] = map[string]bool{}

internal/catalogue/manifest.go

@@ -278,6 +278,14 @@ type Manifest struct {
 	// makes `restart-on` precise.
 	Secrets map[string]string `json:"secrets,omitempty"`
 
+	// SecretsMany is the same key, `secrets`, where a requirement maps to SEVERAL files under local
+	// names — `"secret": {"admin": "/…/admin", "token": "/…/token"}` — because a module may need
+	// more than one value from a provider that gives one per pair (novox/hq 04-ISSUES/069, ADR
+	// 0094). Each local name is a pair credential of its own, keyed on that name, delivered as its
+	// own file, served to the provider as its own holder, and rotated with the others. Filled from
+	// the manifest's `secrets` object by UnmarshalJSON; never written by hand.
+	SecretsMany map[string]map[string]string `json:"-"`
+
 	// OwnSecrets are secrets this module needs in order to be itself, and where to put them.
 	//
 	// **Named for whose they are, not how secret they are.** `secrets` above is a credential for
@@ -619,6 +627,134 @@ func ReceivedID(requirement string) string { return "received-" + requirement }
 //
 // Every problem is reported rather than the first, because somebody writing a manifest fixes
 // them in one pass or in four.
+// manifestFields is Manifest without its methods, so the JSON methods below can use the ordinary
+// field decoding for everything but `secrets`.
+type manifestFields Manifest
+
+// UnmarshalJSON reads `secrets` in both of its shapes — a path, or an object of local names to
+// paths (ADR 0094) — and everything else exactly as the fields declare, unknown keys refused.
+func (m *Manifest) UnmarshalJSON(raw []byte) error {
+	var keys map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &keys); err != nil {
+		return err
+	}
+	plain := map[string]string{}
+	many := map[string]map[string]string{}
+	if secrets, ok := keys["secrets"]; ok && string(secrets) != "null" {
+		var byName map[string]json.RawMessage
+		if err := json.Unmarshal(secrets, &byName); err != nil {
+			return fmt.Errorf("secrets: an object of requirement to path, or to {local name: path}: %w", err)
+		}
+		for to, v := range byName {
+			switch {
+			case len(v) > 0 && v[0] == '"':
+				var path string
+				if err := json.Unmarshal(v, &path); err != nil {
+					return err
+				}
+				plain[to] = path
+			case len(v) > 0 && v[0] == '{':
+				var paths map[string]string
+				if err := json.Unmarshal(v, &paths); err != nil {
+					return fmt.Errorf("secrets.%s: an object of local name to path: %w", to, err)
+				}
+				many[to] = paths
+			default:
+				return fmt.Errorf("secrets.%s: a path, or an object of local name to path, not %s", to, v)
+			}
+		}
+		delete(keys, "secrets")
+	}
+	rest, err := json.Marshal(keys)
+	if err != nil {
+		return err
+	}
+	decoder := json.NewDecoder(bytes.NewReader(rest))
+	decoder.DisallowUnknownFields()
+	var fields manifestFields
+	if err := decoder.Decode(&fields); err != nil {
+		return err
+	}
+	*m = Manifest(fields)
+	if len(plain) > 0 {
+		m.Secrets = plain
+	}
+	if len(many) > 0 {
+		m.SecretsMany = many
+	}
+	return nil
+}
+
+// MarshalJSON writes `secrets` back in the shape it was read: paths, and objects of local names.
+func (m Manifest) MarshalJSON() ([]byte, error) {
+	raw, err := json.Marshal(manifestFields(m))
+	if err != nil {
+		return nil, err
+	}
+	if len(m.SecretsMany) == 0 {
+		return raw, nil
+	}
+	var keys map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &keys); err != nil {
+		return nil, err
+	}
+	merged := map[string]any{}
+	for to, path := range m.Secrets {
+		merged[to] = path
+	}
+	for to, paths := range m.SecretsMany {
+		merged[to] = paths
+	}
+	secrets, err := json.Marshal(merged)
+	if err != nil {
+		return nil, err
+	}
+	keys["secrets"] = secrets
+	return json.Marshal(keys)
+}
+
+// SecretFile is one file a module is given a credential in: the local name it goes by inside
+// the module (empty for the ordinary one-file case, where the requirement's name serves) and where.
+type SecretFile struct {
+	Local string
+	Path  string
+}
+
+// SecretFiles is every file a module wants the credential for one requirement in, in a stable
+// order: the plain path as one entry with no local name, or one entry per local name.
+func (m Manifest) SecretFiles(to string) []SecretFile {
+	if path, ok := m.Secrets[to]; ok {
+		return []SecretFile{{Path: path}}
+	}
+	paths := m.SecretsMany[to]
+	out := make([]SecretFile, 0, len(paths))
+	for _, local := range sortedKeys(paths) {
+		out = append(out, SecretFile{Local: local, Path: paths[local]})
+	}
+	return out
+}
+
+// SecretRequirements is every requirement this module wants a credential file for, sorted.
+func (m Manifest) SecretRequirements() []string {
+	seen := map[string]bool{}
+	for to := range m.Secrets {
+		seen[to] = true
+	}
+	for to := range m.SecretsMany {
+		seen[to] = true
+	}
+	return sortedKeys(seen)
+}
+
+// SecretLocal is the name a credential goes by inside the module: the local name where the
+// requirement maps to several, else the requirement itself. It is what `${secret:<name>}` says.
+func SecretLocal(to, local string) string {
+	if local == "" {
+		return to
+	}
+	return local
+}
+
 func ParseManifest(raw []byte) (Manifest, error) {
 	var m Manifest
 	// Strictly. **An unknown key is refused**, which is the discipline the host's declaration
@@ -908,11 +1044,47 @@ func ParseManifest(raw []byte) (Manifest, error) {
 			problems = append(problems, m.Module+" needs a secret with no name")
 		}
 	}
-	for to, where := range m.Secrets {
-		if !strings.HasPrefix(where, "/") {
-			problems = append(problems, fmt.Sprintf(
-				"%s keeps the credential for %q at %q, which is not an absolute path",
-				m.Module, to, where))
+	for _, to := range m.SecretRequirements() {
+		if _, plain := m.Secrets[to]; plain {
+			if _, also := m.SecretsMany[to]; also {
+				problems = append(problems, fmt.Sprintf(
+					"%s keeps the credential for %q both as one file and as several", m.Module, to))
+			}
+		}
+		for _, f := range m.SecretFiles(to) {
+			if !strings.HasPrefix(f.Path, "/") {
+				problems = append(problems, fmt.Sprintf(
+					"%s keeps the credential for %q at %q, which is not an absolute path",
+					m.Module, SecretLocal(to, f.Local), f.Path))
+			}
+			if f.Local != "" && !name.MatchString(f.Local) {
+				problems = append(problems, fmt.Sprintf(
+					"%s keeps a credential for %q under %q, which is not a usable name",
+					m.Module, to, f.Local))
+			}
+			// A local name is what `${secret:<name>}` says, so it may not be another requirement's
+			// name or one of the module's own secrets — the file would hold the wrong credential
+			// while every check passed.
+			if f.Local != "" {
+				if _, own := m.OwnSecrets[f.Local]; own {
+					problems = append(problems, fmt.Sprintf(
+						"%s keeps a credential for %q under %q, which is also one of its own secrets",
+						m.Module, to, f.Local))
+				}
+				for _, w := range m.Wants() {
+					if w == f.Local {
+						problems = append(problems, fmt.Sprintf(
+							"%s keeps a credential for %q under %q, which is also something it requires",
+							m.Module, to, f.Local))
+					}
+				}
+			}
+		}
+		if len(m.SecretsMany[to]) == 0 && m.Secrets[to] == "" {
+			if _, many := m.SecretsMany[to]; many {
+				problems = append(problems, fmt.Sprintf(
+					"%s keeps the credential for %q as several files and names none", m.Module, to))
+			}
 		}
 		var wanted bool
 		for _, w := range m.Wants() {
@@ -1119,8 +1291,10 @@ func (m Manifest) undeclaredMounts() []string {
 	for _, where := range m.OwnSecrets {
 		claim(where)
 	}
-	for _, where := range m.Secrets {
-		claim(where)
+	for _, to := range m.SecretRequirements() {
+		for _, f := range m.SecretFiles(to) {
+			claim(f.Path)
+		}
 	}
 	for _, where := range m.Receives {
 		claim(where)

internal/catalogue/resolve.go

@@ -157,6 +157,10 @@ type Needed struct {
 	Sealed string
 	// For is the module that wanted it.
 	For string
+	// Local is the name this credential goes by inside that module, where the module wants several
+	// for one requirement (ADR 0094); empty for the ordinary one. Part of what identifies the pair
+	// credential, so two secrets from one provider to one module are two secrets.
+	Local string
 	// Manager is set when this holder is a refreshable-grant licence's MANAGER, delivered the refresh
 	// token rather than an access token (novox/hq ADR 0050). It changes one thing downstream: an empty
 	// Sealed is tolerated — the manager has not adopted a refresh token yet, which is a real waiting
@@ -298,7 +302,7 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 				if at == "" {
 					at = "127.0.0.1"
 				}
-				needs = append(needs, Needed{
+				needs = eachLocal(needs, catalogue, Needed{
 					Name: want, From: node.Name, At: at,
 					Serves: servedHere(catalogue, chosen, want), For: because[want]})
 			} else if served := servedHere(catalogue, chosen, want); len(served) > 0 {
@@ -319,7 +323,7 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 				if at == "" {
 					at = "127.0.0.1"
 				}
-				needs = append(needs, Needed{
+				needs = eachLocal(needs, catalogue, Needed{
 					Name: want, From: node.Name, At: at, Serves: served, For: because[want]})
 			}
 			continue
@@ -347,7 +351,7 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 						node.Name, want, p.Node, meshNetwork))
 					return
 				}
-				needs = append(needs, Needed{Name: want, From: p.Node, At: p.At,
+				needs = eachLocal(needs, catalogue, Needed{Name: want, From: p.Node, At: p.At,
 					Serves: p.Serves, For: because[want]})
 			}
 			switch {
@@ -854,3 +858,19 @@ func perConsumer(needs []Needed, order []string, catalogue map[string]Manifest)
 	}
 	return out
 }
+
+// eachLocal appends the need once per file the wanting module keeps the credential in: once, with
+// no local name, in the ordinary case; once per local name where the module wants several values
+// from one provider (ADR 0094). Each is its own pair credential downstream.
+func eachLocal(needs []Needed, catalogue map[string]Manifest, n Needed) []Needed {
+	files := catalogue[n.For].SecretFiles(n.Name)
+	if len(files) <= 1 {
+		return append(needs, n)
+	}
+	for _, f := range files {
+		one := n
+		one.Local = f.Local
+		needs = append(needs, one)
+	}
+	return needs
+}

internal/catalogue/secrets_into_files.go

@@ -61,23 +61,26 @@ func sealedFor(m Manifest, needs []Needed, with Rendering) (map[string]string, e
 			sealed[name] = value
 		}
 	}
-	for _, to := range sortedKeys(m.Secrets) {
-		if _, taken := sealed[to]; taken {
-			// A module whose own secret and whose requirement share a name. Refused rather than
-			// settled by precedence: whichever won, the manifest would read as though the other
-			// had, and the file would hold the credential for the wrong thing while every check
-			// passed.
-			return nil, fmt.Errorf(
-				"%s has a secret of its own called %q and also requires %q, so a file saying "+
-					"${secret:%s} could mean either — rename one of them", m.Module, to, to, to)
-		}
-		for i := range needs {
-			// `For == m.Module`, not name alone: on a node with two modules requiring the same
-			// provision, both appear in `needs`, and matching by name would fill ${secret:X} with
-			// whichever came last — the other module's credential (novox/hq 04-ISSUES/022). The
-			// `secrets:`-map path already guards this way; the ${secret:…} placeholder path did not.
-			if needs[i].Name == to && needs[i].For == m.Module && needs[i].Sealed != "" {
-				sealed[to] = needs[i].Sealed
+	for _, to := range m.SecretRequirements() {
+		for _, file := range m.SecretFiles(to) {
+			key := SecretLocal(to, file.Local)
+			if _, taken := sealed[key]; taken {
+				// A module whose own secret and whose requirement share a name. Refused rather than
+				// settled by precedence: whichever won, the manifest would read as though the other
+				// had, and the file would hold the credential for the wrong thing while every check
+				// passed.
+				return nil, fmt.Errorf(
+					"%s has a secret of its own called %q and also requires %q, so a file saying "+
+						"${secret:%s} could mean either — rename one of them", m.Module, key, key, key)
+			}
+			for i := range needs {
+				// `For == m.Module`, not name alone: on a node with two modules requiring the same
+				// provision, both appear in `needs`, and matching by name would fill ${secret:X} with
+				// whichever came last — the other module's credential (novox/hq 04-ISSUES/022). And
+				// the local name, where the module keeps several (ADR 0094).
+				if needs[i].Name == to && needs[i].For == m.Module && needs[i].Local == file.Local && needs[i].Sealed != "" {
+					sealed[key] = needs[i].Sealed
+				}
 			}
 		}
 	}

internal/catalogue/several_secrets_test.go

@@ -0,0 +1,125 @@
+package catalogue
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+// A module may need several values from one provider that gives one per pair (novox/hq
+// 04-ISSUES/069, ADR 0094): `secrets` maps a requirement to several files under local names, and
+// each local name is a pair credential of its own — its own need, its own file, its own holder.
+
+const twoSecrets = `{"module":"ca","version":"1","requires":["secret"],
+  "secrets":{"secret":{"root-key":"/var/lib/ca/root.key","root-pass":"/var/lib/ca/root.pass"}},
+  "resources":[{"id":"state","type":"directory","path":"/var/lib/ca","mode":"0700"}]}`
+
+func TestSecretsReadBothShapesAndWriteThemBack(t *testing.T) {
+	m, err := ParseManifest([]byte(twoSecrets))
+	if err != nil {
+		t.Fatal(err)
+	}
+	files := m.SecretFiles("secret")
+	if len(files) != 2 || files[0].Local != "root-key" || files[1].Path != "/var/lib/ca/root.pass" {
+		t.Fatalf("two files under local names, in order: %+v", files)
+	}
+	plain, err := ParseManifest([]byte(`{"module":"app","version":"1","requires":["secret"],"secrets":{"secret":"/var/lib/app/secret"}}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := plain.SecretFiles("secret"); len(got) != 1 || got[0].Local != "" || got[0].Path != "/var/lib/app/secret" {
+		t.Fatalf("the plain shape is one file with no local name: %+v", got)
+	}
+	// Written back in the shape it was read, so a built manifest keeps its local names.
+	raw, err := json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+	again, err := ParseManifest(raw)
+	if err != nil {
+		t.Fatalf("what was written does not read: %v\n%s", err, raw)
+	}
+	if len(again.SecretFiles("secret")) != 2 {
+		t.Fatalf("the local names did not survive a round trip:\n%s", raw)
+	}
+}
+
+func TestALocalNameMayNotCollideWithWhatTheModuleAlreadyCallsSomething(t *testing.T) {
+	for _, bad := range []string{
+		// One of the module's own secrets.
+		`{"module":"ca","version":"1","requires":["secret"],"own-secrets":{"root-key":"/var/lib/ca/own"},
+		  "secrets":{"secret":{"root-key":"/var/lib/ca/root.key"}}}`,
+		// Something it requires.
+		`{"module":"ca","version":"1","requires":["secret","postgres-database"],
+		  "secrets":{"secret":{"postgres-database":"/var/lib/ca/x"}}}`,
+		// Not a usable name.
+		`{"module":"ca","version":"1","requires":["secret"],"secrets":{"secret":{"Root Key":"/var/lib/ca/x"}}}`,
+		// A relative path.
+		`{"module":"ca","version":"1","requires":["secret"],"secrets":{"secret":{"root-key":"root.key"}}}`,
+	} {
+		if _, err := ParseManifest([]byte(bad)); err == nil {
+			t.Errorf("accepted:\n%s", bad)
+		}
+	}
+}
+
+func vaultAndCA() map[string]Manifest {
+	ca, _ := ParseManifest([]byte(twoSecrets))
+	vault := Manifest{Module: "mesh-vault", Version: "1", Provides: FromAnywhere("secret"),
+		Grants:   map[string]string{"secret": "/var/lib/vault/grants"},
+		Receives: map[string]string{"secret": "/var/lib/vault/grants/mesh.json"}}
+	return shelf(vault, ca)
+}
+
+func TestEachLocalNameIsANeedAFileAndAHolderOfItsOwn(t *testing.T) {
+	got, err := Resolve(vaultAndCA(), []string{"mesh-vault", "ca"}, workstation(), World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var locals []string
+	for _, n := range got.Needs {
+		if n.Name == "secret" && n.For == "ca" {
+			locals = append(locals, n.Local)
+		}
+	}
+	if strings.Join(locals, ",") != "root-key,root-pass" {
+		t.Fatalf("two secrets from one provider are two needs: %v", got.Needs)
+	}
+	for i := range got.Needs {
+		got.Needs[i].Sealed = "sealed-" + got.Needs[i].Local
+	}
+	out, err := got.Declaration(Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	seen := map[string]string{}
+	for _, r := range out {
+		if r["type"] == "file" && strings.HasPrefix(r["path"].(string), "/var/lib/ca/root.") {
+			seen[r["id"].(string)] = r["sealed"].(string)
+		}
+	}
+	if seen["ca."+SecretID("root-key")] != "sealed-root-key" || seen["ca."+SecretID("root-pass")] != "sealed-root-pass" {
+		t.Fatalf("each local name is its own file with its own credential: %v", seen)
+	}
+}
+
+func TestAProviderSeesEachLocalNameAsAHolderOfItsOwn(t *testing.T) {
+	r := Resolution{Modules: []Manifest{vaultAndCA()["mesh-vault"]}}
+	got, err := r.contributions(SettingsBy{}, []Grant{
+		{Provision: "secret", Consumer: "workstation", From: "ca", Local: "root-key", Sealed: "x"},
+		{Provision: "secret", Consumer: "workstation", From: "ca", Local: "root-pass", Sealed: "y"},
+	}, map[string]string{"secret": "/var/lib/vault/grants"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := got["secret"]
+	if len(given) != 2 {
+		t.Fatalf("two holders: %+v", given)
+	}
+	if given[0].As != "mesh_workstation_ca_root_key" && given[0].As != "mesh_workstation_ca_root-key" {
+		t.Fatalf("the holder is the consumer's identity with the local name after it: %q", given[0].As)
+	}
+	if given[0].Secret == given[1].Secret {
+		t.Fatalf("two holders share one file on the provider: %q", given[0].Secret)
+	}
+}