A provider with one credential shares it with every consumer, remade for all at once (hq ADR 0158)

An offer may say `"credential": {"own": "<secret>"}`: the provider's own secret is the credential
every consumer of that provision receives, in the shape of a pair credential. The vault keeps one
value, sealed to the provider, to every consumer that holds the provision and to the operator, all
under one generation stamp; a consumer binding later, or `secret rotate` on the provider's secret,
makes a fresh value and seals it to every holder in one act, and the rotate command sends every
holding machine together. An accepted value is sealed to the consumers of the moment and never
remade: a consumer binding after it is refused with the way out (ADR 0113). The named own secret
must say how it is taken (issue 180), so the provider's start applies the file.

A need carries the shared secret's name from either side of the machine boundary; the plan mints a
consumer's copy from the provider's value. Registered manifests keep their bytes.

cmd/mesh-controller/plan.go

@@ -163,7 +163,14 @@ func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Reso
 			}
 			continue
 		}
-		secret, err := inv.SecretFor(ctx, n.Name, nodeName, n.For, n.From, n.Local)
+		var secret inventory.Secret
+		var err error
+		if n.SharedOwn != "" {
+			// The provider's one credential, sealed to this consumer too (novox/hq ADR 0158).
+			secret, err = inv.SharedSecretFor(ctx, n.Name, nodeName, n.For, n.From, providerModuleOf(resolved, open, ctx, n), n.Local, n.SharedOwn)
+		} else {
+			secret, err = inv.SecretFor(ctx, n.Name, nodeName, n.For, n.From, n.Local)
+		}
 		if err != nil {
 			// Said rather than skipped. A machine that resolves cleanly and receives no
 			// credential is one that will fail to authenticate at some later, less obvious
@@ -1338,3 +1345,23 @@ func foundationPortsFor(brokerPort int, modules []catalogue.Manifest) []int {
 	}
 	return nil
 }
+
+// providerModuleOf is which module answers a need on the providing node: the one in this node's
+// own set when the provider is here, else the one the catalogue says offers it.
+func providerModuleOf(resolved catalogue.Resolution, open *stores, ctx context.Context, n catalogue.Needed) string {
+	for _, m := range resolved.Modules {
+		if _, shared := m.SharedCredentialOf(n.Name); shared {
+			return m.Module
+		}
+	}
+	shelf, err := open.inventory.Catalogue(ctx)
+	if err != nil {
+		return ""
+	}
+	for name, m := range shelf {
+		if _, shared := m.SharedCredentialOf(n.Name); shared {
+			return name
+		}
+	}
+	return ""
+}

cmd/mesh-controller/secret.go

@@ -387,10 +387,23 @@ func secretRotate(ctx context.Context, args []string) error {
 	}
 	fmt.Printf("rotated %q of %s on %s at %s, asked by %s; the value is sealed and not shown\n",
 		name, module, node, time.Now().UTC().Format(time.RFC3339), whoAsked())
-	fmt.Printf("sending %s, so %s starts again on the new value:\n", node, module)
-	if err := sendTo(ctx, open, []string{node}); err != nil {
+	// A shared credential (ADR 0158) has as many holders as the provision has consumers, and all
+	// of them are sent in one act, so no machine is left reading a value the provider no longer takes.
+	machines, err := open.inventory.SharedHolders(ctx, node, module, name)
+	if err != nil {
+		return err
+	}
+	if len(machines) == 0 {
+		machines = []string{node}
+	}
+	if len(machines) == 1 {
+		fmt.Printf("sending %s, so %s starts again on the new value:\n", node, module)
+	} else {
+		fmt.Printf("shared with every consumer; sending %s together:\n", strings.Join(machines, ", "))
+	}
+	if err := sendTo(ctx, open, machines); err != nil {
 		return fmt.Errorf("%w\n\nThe new value is sealed and not yet delivered; what runs keeps the old "+
-			"one until the machine next applies. Fix the cause and run `push %s`", err, node)
+			"one until the machines next apply. Fix the cause and run `push --behind`", err)
 	}
 	return nil
 }