A provider is told who its consumers are, and a reference provisioner

Contributions were node-local, so a mesh-scoped provider — the one case
that most needs them — never heard from its consumers. A database was
given a password and no idea what to create it for.

Cross-node consumers now reach the provider's `receives` file, merged in
with the ones on its own machine: from the provider's side they are the
same thing, and a provider that had to read two lists would read one of
them. Each names the file its credential is in rather than carrying it,
because the mesh discarded the value and could not put it there. The
readable half therefore stays readable.

And examples/postgres-provisioner, which is the last step: it reads what
the host wrote and makes PostgreSQL accept it. Explicitly not part of the
control plane — the control plane decides and never touches a machine.
This runs on the machine and touches it, and a real one ships with the
module that ships PostgreSQL. It lives here because this is where the
contract is defined, written as something that runs so it can be read.

It reconciles rather than applying a change, because it is never told
what changed. Three things that follow, and each is a fault somebody has
shipped:

- the password is set every time, not only on creation, or a rotation
  reports success and changes nothing
- what it made and nobody asks for any more is revoked, or a departed
  consumer keeps a working login for ever
- what it did not make is left alone, or it cannot be run on a database
  that predates it

Proven in the lab against a real PostgreSQL, each assertion confirmed to
fail with the behaviour removed. The suite is in mesh-lab, which also
records the two ways the test itself was wrong first.

internal/catalogue/resolve.go

@@ -462,6 +462,12 @@ type Grant struct {
 	Provision string
 	// Consumer is the node that will use it, which is also what names the file.
 	Consumer string
+	// From is the module on that machine which asked, so the provider can name what it creates
+	// after the thing using it rather than after the machine.
+	From string
+	// Values are what that module contributed — the name it wants, and anything else the
+	// provision's own vocabulary defines.
+	Values map[string]any
 	// Sealed is the credential, closed to the providing node.
 	Sealed string
 }
@@ -482,7 +488,15 @@ type Rendering struct {
 // both call something "config", and without this the second would silently replace the first —
 // the node applying one of them and reporting success.
 func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
-	given, err := r.contributions(with.Settings)
+	// Where each provision's credentials land, so a contribution can name the file rather than
+	// carry a value the mesh does not have.
+	directories := map[string]string{}
+	for _, m := range r.Modules {
+		for provision, where := range m.Grants {
+			directories[provision] = where
+		}
+	}
+	given, err := r.contributions(with.Settings, with.Grants, directories)
 	if err != nil {
 		return nil, err
 	}
@@ -516,7 +530,7 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 				resources = append(append([]map[string]any{}, resources...), map[string]any{
 					"id":     GrantID(to, g.Consumer),
 					"type":   "file",
-					"path":   strings.TrimRight(m.Grants[to], "/") + "/" + g.Consumer,
+					"path":   grantPath(m.Grants[to], g.Consumer),
 					"sealed": g.Sealed,
 				})
 			}
@@ -596,21 +610,59 @@ type Contribution struct {
 	// From is the module that said it, so the provider and a person reading the file can tell
 	// which route belongs to what.
 	From string `json:"from"`
+	// Node is the machine it said it from, empty when that is this one.
+	//
+	// A provision answered from anywhere in the mesh has consumers on other machines, and the
+	// provider has to know who they are — a database told to create a password and not who for
+	// cannot do anything with it. Contributions were node-local until this, which meant the one
+	// case that most needed them was the one they did not reach.
+	Node string `json:"node,omitempty"`
+	// Secret is the file on this machine holding that consumer's credential, sealed to it.
+	//
+	// Named rather than carried, for the same reason the private network's key is: the mesh
+	// discarded the value and could not put it here if it wanted to. What is here is where to
+	// find it.
+	Secret string `json:"secret,omitempty"`
 	// Values are the module's own, with settings applied. What the keys mean is agreed by the
 	// requirement's name — everything providing `reverse-proxy` understands the same shape, which
 	// is what makes swapping one for another cost nothing.
 	Values map[string]any `json:"values"`
 }
 
+// grantPath is where one consumer's sealed credential lands on the providing machine.
+//
+// Suffixed, so the directory can also hold whatever the module writing it keeps there and so a
+// node named like something else in that directory cannot collide with it.
+func grantPath(directory, consumer string) string {
+	return strings.TrimRight(directory, "/") + "/" + consumer + ".secret"
+}
+
 // contributions collects what every module in this set contributes, by requirement.
 //
 // Ordered by contributing module, because the result becomes a file on a machine and a file whose
 // lines move about is a file that looks changed when nothing changed.
-func (r Resolution) contributions(settings SettingsBy) (map[string][]Contribution, error) {
+func (r Resolution) contributions(settings SettingsBy, grants []Grant,
+	directories map[string]string) (map[string][]Contribution, error) {
 	out := map[string][]Contribution{}
 	modules := append([]Manifest{}, r.Modules...)
 	sort.Slice(modules, func(i, j int) bool { return modules[i].Module < modules[j].Module })
 
+	// What consumers on other machines asked for. Merged in with this machine's own, because from
+	// the provider's side they are the same thing — somebody wanting something — and a provider
+	// that had to read two lists would be a provider that reads one of them.
+	sorted := append([]Grant{}, grants...)
+	sort.Slice(sorted, func(i, j int) bool {
+		if sorted[i].Provision != sorted[j].Provision {
+			return sorted[i].Provision < sorted[j].Provision
+		}
+		return sorted[i].Consumer < sorted[j].Consumer
+	})
+	for _, g := range sorted {
+		out[g.Provision] = append(out[g.Provision], Contribution{
+			From: g.From, Node: g.Consumer, Values: g.Values,
+			Secret: grantPath(directories[g.Provision], g.Consumer),
+		})
+	}
 	for _, m := range modules {
 		for _, to := range sortedKeys(m.Contributes) {
 			// Settings reach a contribution the same way they reach a file. A route's hostname is
@@ -712,3 +764,33 @@ func boundFile(n Needed, path string) (map[string]any, error) {
 		"content": string(body) + "\n",
 	}, nil
 }
+
+// ContributionsTo is what this node's set asked of one requirement, settled.
+//
+// Exported because a provider's grants are assembled from its consumers' resolutions, one machine
+// at a time, and the alternative was for the control plane to reimplement settling.
+func (r Resolution) ContributionsTo(requirement string, settings SettingsBy) (
+	string, map[string]any, error) {
+	all, err := r.contributions(settings, nil, nil)
+	if err != nil {
+		return "", nil, err
+	}
+	given := all[requirement]
+	if len(given) == 0 {
+		return "", nil, nil
+	}
+	if len(given) > 1 {
+		// Two modules on one machine wanting the same provision would share one credential, and
+		// the provider would be told to create one thing under two names. Refused rather than
+		// resolved by picking, which is the rule everywhere else here.
+		var who []string
+		for _, g := range given {
+			who = append(who, g.From)
+		}
+		sort.Strings(who)
+		return "", nil, fmt.Errorf(
+			"%s has %d modules asking for %q and they would share one credential: %s",
+			r.Node, len(given), requirement, strings.Join(who, ", "))
+	}
+	return given[0].From, given[0].Values, nil
+}