A module's own secret is asked for by a verb and typed at the desk, bounded, the prompt naming who asked (hq ADR 0277)

The give verb opened the desk's hidden prompt for a module's own secret, with the desk named. Now the
secret-ask verb (secret ask <node> <module> <name> [--at <desk>]) opens the same prompt from anywhere on
the mesh, with the desk the module's machine unless named, and give composes the same line. Every ask
is recorded in the store before the prompt opens (migration 0091): one open ask per secret, three an
hour, so an agent cannot keep a prompt in front of the operator. The prompt names who asked, from the
bus's word on the caller cut to a name's characters, never an argument of the call. The value stays
typed at the desk, sealed to the one call and then to the module's machine, never in an argument, a
log or an event; a secret the mesh makes itself and a trusted party's secret are refused as before.

cmd/mesh-controller/desk_secret.go

@@ -15,16 +15,23 @@ import (
 	"github.com/novox/mesh-controller/internal/secrets"
 )
 
-// A module's own secret given at the operator's desk (novox/hq ADR 0259 §10).
+// A module's own secret given at the operator's desk (novox/hq ADR 0259 §10, ADR 0277).
+//
+//	mesh-controller secret ask <node> <module> <name> [--at <desk>]
 //
 // **The value never passes through whoever asked for it.** An agent, or the operator at the mesh MCP
-// server, calls `give` with the machine, the module, the secret's name and the desk — never a value. The
-// controller makes a sealing keypair for this one call, asks the desk's `node-launcher.secret` to prompt the
-// operator without showing what is typed, and is answered with what was typed **sealed to that key**: no
-// plaintext on the bus, in a runtime's log or in any call's record. It opens it here, seals it to the
+// server, calls `secret-ask` (or `give`) with the machine, the module, the secret's name and the desk — never
+// a value. The controller makes a sealing keypair for this one call, asks the desk's `node-launcher.secret` to
+// prompt the operator without showing what is typed, and is answered with what was typed **sealed to that
+// key**: no plaintext on the bus, in a runtime's log or in any call's record. It opens it here, seals it to the
 // module's machine exactly as `secret accept` does, and forgets it. What it answers says only that the
 // value was taken, or why not.
 //
+// **Bounded, and the prompt says who asked** (ADR 0277): one open prompt per secret and few an hour, read from
+// the store before the prompt opens (inventory.OpenSecretAsk), so an agent cannot keep a prompt in front of the
+// operator until they type. The prompt names the module, the secret, the machine and who asked — the caller as
+// the bus named it, never a word the caller chose — written by the desk's launcher from those names alone.
+//
 // **What remains** (ADR 0234's accepted residual risk): on an X11 desk any program of the operator's
 // account can read the keys as they are typed. And a program that calls the desk's prompt itself, with a
 // key of its own, is answered with what the operator typed into a prompt they did not ask for — as it could
@@ -54,6 +61,37 @@ type deskGive struct {
 	// announce raises the condition that says a module's own secret was given (secretGivenObservation), on
 	// every channel; nil announces nothing (a test that does not look).
 	announce func(node, module, name, how string) error
+	// askedBy is who asked, as the bus named the caller: said in the prompt and recorded.
+	askedBy string
+	// open records the ask and holds the bounds (one open per secret, few an hour), answering the record's id;
+	// nil keeps no record (a test that does not look). end closes it with how it ended.
+	open func(node, module, name, desk string) (int64, error)
+	end  func(id int64, outcome string) error
+}
+
+// askedByName is the caller as the prompt names it: the first clause of what the bus said, in the characters
+// a name has, at most 80 of them. The desk's launcher refuses anything else, so no words of the caller's own
+// reach the prompt.
+func askedByName(caller string) string {
+	first, _, _ := strings.Cut(caller, ",")
+	var b strings.Builder
+	for _, r := range strings.TrimSpace(first) {
+		switch {
+		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9', r == '.', r == '_', r == '/', r == '@',
+			r == '-', r == ' ':
+			b.WriteRune(r)
+		default:
+			b.WriteRune('-')
+		}
+		if b.Len() >= 80 {
+			break
+		}
+	}
+	name := strings.TrimSpace(b.String())
+	if name == "" || strings.HasPrefix(name, "-") {
+		return "an unnamed caller"
+	}
+	return name
 }
 
 // errNothingGiven is a prompt dismissed, or not answered in time: nothing changes.
@@ -95,20 +133,37 @@ func (d deskGive) give(node, module, name, desk string) (string, error) {
 				"bus, where an agent may answer first (novox/hq ADR 0259 §10)", module, name, node, module, name)
 		}
 	}
+	// The bounds, read and kept before anybody is asked to type (novox/hq ADR 0277): one open prompt per secret,
+	// few an hour. How the ask ends is recorded whatever happens below.
+	outcome := "failed"
+	if d.open != nil {
+		id, err := d.open(node, module, name, desk)
+		if err != nil {
+			return "", fmt.Errorf("nobody was asked to type anything: %w", err)
+		}
+		defer func() {
+			if d.end != nil {
+				_ = d.end(id, outcome)
+			}
+		}()
+	}
 	public, private, err := secrets.Keypair()
 	if err != nil {
 		return "", fmt.Errorf("no key could be made to take the value: %w", err)
 	}
 	// By name, never by words: the holder writes the prompt from these, and says the controller asks, which
-	// the bus alone makes true (broker.ControllerOnly).
+	// the bus alone makes true (broker.ControllerOnly). Who asked is the bus's word on the caller, cut to a
+	// name's characters — never an argument of the call.
 	raw, err := d.ask(desk, map[string]any{
 		"module":          module,
 		"secret":          name,
 		"node":            node,
+		"asked_by":        askedByName(d.askedBy),
 		"seal_to":         public,
 		"timeout_seconds": deskPromptWithin,
 	})
 	if err != nil {
+		outcome = "refused"
 		return "", fmt.Errorf("the desk on %s could not be asked: %w", desk, err)
 	}
 	var answer struct {
@@ -121,8 +176,10 @@ func (d deskGive) give(node, module, name, desk string) (string, error) {
 	}
 	switch {
 	case answer.TimedOut:
+		outcome = "timed-out"
 		return "", fmt.Errorf("%w: the prompt on %s was not answered within %d seconds", errNothingGiven, desk, deskPromptWithin)
 	case answer.Cancelled:
+		outcome = "dismissed"
 		return "", fmt.Errorf("%w: the prompt on %s was dismissed", errNothingGiven, desk)
 	case answer.Sealed == "":
 		return "", fmt.Errorf("the desk on %s answered no sealed value", desk)
@@ -137,6 +194,7 @@ func (d deskGive) give(node, module, name, desk string) (string, error) {
 		opened[i] = 0
 	}
 	if strings.TrimSpace(value) == "" {
+		outcome = "empty"
 		return "", fmt.Errorf("%w: the prompt on %s was answered empty", errNothingGiven, desk)
 	}
 	untilStart, err := d.accept(value)
@@ -144,8 +202,10 @@ func (d deskGive) give(node, module, name, desk string) (string, error) {
 	if err != nil {
 		return "", err
 	}
+	outcome = "given"
 	act := link.HandAct{Verb: "secret accept", Args: []string{node, module, name, "--at-desk", desk},
-		Why:   fmt.Sprintf("the operator gave %s for %s on %s at the desk on %s", name, module, node, desk),
+		Why: fmt.Sprintf("the operator gave %s for %s on %s at the desk on %s, asked by %s", name, module, node, desk,
+			askedByName(d.askedBy)),
 		Cause: "given-at-the-desk"}
 	recorded := ""
 	if err := d.record(act); err != nil {
@@ -165,15 +225,23 @@ func (d deskGive) give(node, module, name, desk string) (string, error) {
 	return words + recorded, nil
 }
 
-// giveAtDesk is `secret accept <node> <module> <name> --at-desk <machine>`: the desk path, on this
-// controller's stores and bus.
-func giveAtDesk(ctx context.Context, node, module, name, desk string) error {
+// askAtDesk is `secret ask <node> <module> <name> [--at <machine>]`, and the terminal's `secret accept … --at-desk
+// <machine>`: the desk path, on this controller's stores and bus. The desk is the module's machine unless named.
+func askAtDesk(ctx context.Context, node, module, name, desk string) error {
+	if desk == "" {
+		desk = node
+	}
 	open, err := openStores(ctx)
 	if err != nil {
 		return err
 	}
 	defer open.Close()
 	d := deskGive{
+		askedBy: link.Caller(),
+		open: func(node, module, name, desk string) (int64, error) {
+			return open.inventory.OpenSecretAsk(ctx, node, module, name, askedByName(link.Caller()), desk)
+		},
+		end:      func(id int64, outcome string) error { return open.inventory.EndSecretAsk(ctx, id, outcome) },
 		declares: func(module, name string) error { return open.inventory.DeclaresOwnSecret(ctx, module, name) },
 		known: func(machine string) error {
 			_, err := open.inventory.NodeByName(ctx, machine)

cmd/mesh-controller/desk_secret_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"strings"
 	"testing"
 	"time"
@@ -124,12 +125,21 @@ func TestADismissedEmptyLateOrForeignAnswerTakesNothing(t *testing.T) {
 
 func TestTheGiveVerbRunsTheDeskPathAndTheControllerMayAskTheDesk(t *testing.T) {
 	argv, err := argvFor("give", map[string]any{"node": "anchor", "module": "telegram", "secret": "telegram-token", "at": "laptop"})
-	if err != nil || strings.Join(argv, " ") != "secret accept anchor telegram telegram-token --at-desk laptop" {
+	if err != nil || strings.Join(argv, " ") != "secret ask anchor telegram telegram-token --at laptop" {
 		t.Fatalf("%v %v", argv, err)
 	}
 	if _, err := argvFor("give", map[string]any{"node": "anchor", "module": "telegram", "secret": "telegram-token"}); err == nil {
 		t.Error("give without a desk was taken")
 	}
+	// secret-ask is the same line, with the desk the module's machine unless named (novox/hq ADR 0277).
+	argv, err = argvFor("secret-ask", map[string]any{"node": "anchor", "module": "telegram", "secret": "telegram-token"})
+	if err != nil || strings.Join(argv, " ") != "secret ask anchor telegram telegram-token" {
+		t.Fatalf("%v %v", argv, err)
+	}
+	argv, err = argvFor("secret-ask", map[string]any{"node": "anchor", "module": "telegram", "secret": "telegram-token", "at": "laptop"})
+	if err != nil || strings.Join(argv, " ") != "secret ask anchor telegram telegram-token --at laptop" {
+		t.Fatalf("%v %v", argv, err)
+	}
 	perms, err := broker.PermissionsFor(broker.Principal{Kind: broker.KindController})
 	if err != nil {
 		t.Fatal(err)
@@ -266,13 +276,22 @@ func TestASecretValueIsNeverAcceptedThroughAVerb(t *testing.T) {
 	}
 }
 
-// The `give` verb's own line passes the terminal-only rule of ADR 0266, and no other `secret accept` does: a
-// value, a file, a provider or an extra word is still the terminal's alone.
+// The `give` and `secret-ask` verbs' own line passes the terminal-only rule of ADR 0266, and no `secret accept`
+// does: a value, a file, a provider or an extra word is still the terminal's alone (novox/hq ADR 0277).
 func TestOnlyTheGiveLinePassesTheTerminalRuleForSecrets(t *testing.T) {
-	if err := terminalOnly([]string{"secret", "accept", "anchor", "telegram", "telegram-token", "--at-desk", "laptop"}); err != nil {
-		t.Errorf("give's line refused: %v", err)
+	for _, argv := range [][]string{
+		{"secret", "ask", "anchor", "telegram", "telegram-token", "--at", "laptop"},
+		{"secret", "ask", "anchor", "telegram", "telegram-token"},
+	} {
+		if err := terminalOnly(argv); err != nil {
+			t.Errorf("%v refused: %v", argv, err)
+		}
 	}
 	for _, argv := range [][]string{
+		{"secret", "accept", "anchor", "telegram", "telegram-token", "--at-desk", "laptop"},
+		{"secret", "ask", "anchor", "telegram", "telegram-token", "--from", "/tmp/x"},
+		{"secret", "ask", "anchor", "telegram", "telegram-token", "--at", "laptop", "--local"},
+		{"secret", "ask", "anchor", "telegram", "--at", "laptop"},
 		{"secret", "accept", "anchor", "telegram", "telegram-token"},
 		{"secret", "accept", "anchor", "telegram", "telegram-token", "--from", "/tmp/x"},
 		{"secret", "accept", "anchor", "telegram", "telegram-token", "--at-desk", "laptop", "--local"},
@@ -398,3 +417,96 @@ func TestAGiveNamingAMachineTheMeshDoesNotKnowAsksNobody(t *testing.T) {
 		}
 	}
 }
+
+// novox/hq ADR 0277: the prompt names who asked — the controller's word on the bus's caller, cut to a name's
+// characters — and never a word the caller chose: there is no argument for it.
+func TestThePromptNamesWhoAskedFromTheBussWordAlone(t *testing.T) {
+	d, _, acts, asked := aDesk(t, sealedTo(t, typed))
+	d.askedBy = "g14/claude-code, through the mesh-controller seat"
+	if _, err := d.give("anchor", "telegram", "telegram-token", "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	if got := (*asked)[0]["asked_by"]; got != "g14/claude-code" {
+		t.Errorf("asked_by %q", got)
+	}
+	if len(*acts) != 1 || !strings.Contains((*acts)[0].Why, "asked by g14/claude-code") {
+		t.Errorf("the record: %+v", *acts)
+	}
+	for in, want := range map[string]string{
+		"jochen at a shell on novox":         "jochen at a shell on novox",
+		"laptop/agent":                       "laptop/agent",
+		"Your bank asks\nType your PIN, now": "Your bank asks-Type your PIN",
+		"":                                   "an unnamed caller",
+		"<b>x</b>":                           "an unnamed caller",
+		strings.Repeat("a", 100):             strings.Repeat("a", 80),
+		"--prompt, something else":           "an unnamed caller",
+	} {
+		if got := askedByName(in); got != want {
+			t.Errorf("askedByName(%q) = %q, want %q", in, got, want)
+		}
+	}
+	// The verb's schema has no argument that reaches the prompt's words.
+	for _, verb := range []string{"give", "secret-ask"} {
+		for _, free := range []string{"asked_by", "prompt", "message", "value", "from"} {
+			if _, err := argvFor(verb, map[string]any{"node": "anchor", "module": "telegram", "secret": "telegram-token",
+				"at": "laptop", free: "x"}); err == nil {
+				t.Errorf("%s takes %s", verb, free)
+			}
+		}
+	}
+}
+
+// An ask for a secret is bounded before anybody is asked to type (ADR 0277): the record refuses it, nothing is
+// asked; and how every ask ends is recorded.
+func TestASecretAskIsBoundedAndItsEndRecorded(t *testing.T) {
+	d, accepted, _, asked := aDesk(t, sealedTo(t, typed))
+	var ended []string
+	d.open = func(node, module, name, desk string) (int64, error) { return 7, nil }
+	d.end = func(id int64, outcome string) error {
+		ended = append(ended, fmt.Sprintf("%d %s", id, outcome))
+		return nil
+	}
+	if _, err := d.give("anchor", "telegram", "telegram-token", "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	d.open = func(node, module, name, desk string) (int64, error) {
+		return 0, errors.New("an ask for telegram-token of telegram on anchor is still open")
+	}
+	_, err := d.give("anchor", "telegram", "telegram-token", "laptop")
+	if err == nil || !strings.Contains(err.Error(), "nobody was asked to type anything") || !strings.Contains(err.Error(), "still open") {
+		t.Errorf("a second ask: %v", err)
+	}
+	if len(*asked) != 1 || len(*accepted) != 1 {
+		t.Errorf("asked %d, accepted %d", len(*asked), len(*accepted))
+	}
+	d.open = func(node, module, name, desk string) (int64, error) { return 8, nil }
+	d.ask = func(string, map[string]any) (json.RawMessage, error) {
+		return json.RawMessage(`{"cancelled":true}`), nil
+	}
+	if _, err := d.give("anchor", "telegram", "telegram-token", "laptop"); !errors.Is(err, errNothingGiven) {
+		t.Errorf("a dismissed prompt: %v", err)
+	}
+	if strings.Join(ended, "; ") != "7 given; 8 dismissed" {
+		t.Errorf("ended: %v", ended)
+	}
+}
+
+// A secret ask cannot be turned into a secret read: the line carries no value, the answer carries none, and every
+// other `secret` line is the terminal's.
+func TestASecretAskIsNeverASecretRead(t *testing.T) {
+	t.Setenv(verbVar, "mesh-controller.secret-ask")
+	for _, args := range [][]string{
+		{"ask", "anchor", "telegram", "telegram-token", "the-value"},
+		{"ask", "anchor", "telegram"},
+		{"ask", "anchor", "telegram", "telegram-token", "--from", "/dev/null"},
+	} {
+		if err := secretCommand(context.Background(), args); err == nil {
+			t.Errorf("secret %v was taken", args)
+		}
+	}
+	for _, args := range [][]string{{"recover", "anchor", "telegram", "telegram-token"}, {"export"}} {
+		if err := terminalOnly(append([]string{"secret"}, args...)); err == nil {
+			t.Errorf("secret %v passed the terminal rule", args)
+		}
+	}
+}

cmd/mesh-controller/seatverbs.go

@@ -768,10 +768,22 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		}
 		return append(argv, "--json"), nil
 	case "give":
+		// The same line as secret-ask with the desk named (novox/hq ADR 0277): one path, one set of bounds.
 		if err := need("node", "module", "secret", "at"); err != nil {
 			return nil, err
 		}
-		return []string{"secret", "accept", str("node"), str("module"), str("secret"), "--at-desk", str("at")}, nil
+		return []string{"secret", "ask", str("node"), str("module"), str("secret"), "--at", str("at")}, nil
+	case "secret-ask":
+		// A module's own secret asked for, typed by the operator at the desk (novox/hq ADR 0277): never a value
+		// in the arguments. The desk is the module's machine unless at names another.
+		if err := need("node", "module", "secret"); err != nil {
+			return nil, err
+		}
+		argv := []string{"secret", "ask", str("node"), str("module"), str("secret")}
+		if at := str("at"); at != "" {
+			argv = append(argv, "--at", at)
+		}
+		return argv, nil
 	case "rotate":
 		if p := str("provision"); p != "" {
 			argv := []string{"rotate", p}
@@ -1538,10 +1550,11 @@ var terminalOnlyCommands = map[string]string{
 	"licence":  "the licences' secrets",
 }
 
-// givenAtTheDesk is exactly the line the `give` verb composes, and nothing beside it: `secret accept <node>
-// <module> <secret> --at-desk <machine>`, with no other word — no value, no file, no provider.
+// givenAtTheDesk is exactly the line the `give` and `secret-ask` verbs compose, and nothing beside it: `secret ask
+// <node> <module> <secret>`, with `--at <machine>` or no other word — no value, no file, no provider (novox/hq
+// ADR 0277). The terminal's own `secret accept … --at-desk` is the terminal's.
 func givenAtTheDesk(argv []string) bool {
-	if len(argv) != 7 || argv[0] != "secret" || argv[1] != "accept" || argv[5] != "--at-desk" {
+	if (len(argv) != 5 && len(argv) != 7) || argv[0] != "secret" || argv[1] != "ask" {
 		return false
 	}
 	for _, w := range argv[2:5] {
@@ -1549,7 +1562,10 @@ func givenAtTheDesk(argv []string) bool {
 			return false
 		}
 	}
-	return argv[6] != "" && !strings.HasPrefix(argv[6], "-")
+	if len(argv) == 5 {
+		return true
+	}
+	return argv[5] == "--at" && argv[6] != "" && !strings.HasPrefix(argv[6], "-")
 }
 
 // terminalOnly refuses, through any verb, a command that is the operator's at the controller's terminal

cmd/mesh-controller/seatverbs_schema_test.go

@@ -276,12 +276,6 @@ var accountedFlags = map[string]map[string]string{
 		"all":  "withheld: every measurement of a fortnight is more than a call should carry; `command` reaches it",
 	},
 	// The desk path of `secret accept` (novox/hq ADR 0259 §10): a value is never an argument of a call.
-	"secret accept": {
-		"at-desk":  "=at",
-		"from":     "withheld: a file of the control node's is read at a shell, never named by a call",
-		"provider": "withheld: a pair credential's value is given at a shell; give takes a module's own secret",
-		"local":    "withheld: it goes with --provider",
-	},
 	"hand-acts":          {"json": "set by the verb: the answer is data"},
 	"conditions":         {"json": "set by the verb: the answer is data"},
 	"retire":             {"json": "set by the verb: the answer is data"},

cmd/mesh-controller/secret.go

@@ -39,6 +39,8 @@ func secretCommand(ctx context.Context, args []string) error {
 	}
 	switch args[0] {
 	case "accept":
+	case "ask":
+		return secretAsk(ctx, args[1:])
 	case "rotate":
 		return secretRotate(ctx, args[1:])
 	case "recover":
@@ -78,7 +80,7 @@ func secretCommand(ctx context.Context, args []string) error {
 		if *from != "" || *provider != "" {
 			return errors.New("--at-desk gives a module's own secret, and takes neither --from nor --provider")
 		}
-		return giveAtDesk(ctx, node, module, name, *desk)
+		return askAtDesk(ctx, node, module, name, *desk)
 	}
 
 	value, err := valueFor(node, module, name, *from)
@@ -148,7 +150,24 @@ func secretCommand(ctx context.Context, args []string) error {
 	return nil
 }
 
+// secretAsk is `secret ask <node> <module> <name> [--at <machine>]` (novox/hq ADR 0277): the operator is asked
+// for a module's own secret in a prompt at the desk, which only they answer. The one `secret` line a verb may
+// run beside rotate (givenAtTheDesk): it carries no value and answers none.
+func secretAsk(ctx context.Context, args []string) error {
+	rest, flags := split(args)
+	set := flag.NewFlagSet("secret ask", flag.ContinueOnError)
+	at := set.String("at", "", "the machine the operator sits at, where the prompt opens; the module's machine when absent")
+	if err := set.Parse(flags); err != nil {
+		return err
+	}
+	if len(rest) != 3 {
+		return errors.New("secret ask <node> <module> <name> [--at <machine>]")
+	}
+	return askAtDesk(ctx, rest[0], rest[1], rest[2], *at)
+}
+
 const secretUsage = "secret rotate <node> <module> <name> [--why <text> [--cause <word>]]\n" +
+	"secret ask <node> <module> <name> [--at <machine>]\n" +
 	"secret accept <node> <module> <name> [--from <file> | --at-desk <machine>] [--provider <node> [--local <name>]]\n" +
 	"secret recover <node> <module> <name> --key <operator-key> [--out <file>] [--from-export <file>] [--provider <node>]\n" +
 	"secret export [--out <file>]"