An operator key, a second seal on every own secret, and the vault keeps the export

novox/hq ADR 0085, amended: the mesh's root secrets — the store's superuser,
the broker's administrator, every secret a module holds for itself — were
sealed to a node key and nothing else, so a lost node took them with it.
Now the mesh records an operator's public sealing key and seals every own
secret to it as well, minted or accepted. The private half is written once
by `operator key new` to a file the operator keeps off the mesh; the mesh
holds one more blob per secret that it cannot open.

`secret recover` opens a secret with that key, to a 0600 file, from the
store or from an export; `secret export` writes every operator-sealed copy
as ciphertext. A module that `keeps` (the vault) is handed that export as a
declared file on its own disk, so recovery survives the store.

Secrets made before the key exists have no operator copy and are said so —
the plaintext was discarded — until each is issued again.

internal/catalogue/declaration.go

@@ -14,6 +14,7 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"time"
 )
 
 // SettingsBy is the layers that apply to each module, keyed by module name.
@@ -89,6 +90,10 @@ type Rendering struct {
 	// a fact about the mesh, and resolution answers questions about one machine.
 	Mesh []string
 
+	// Kept is every operator-sealed secret in the mesh, for a module that `keeps` them. Nil when
+	// nothing on this node keeps them, or the mesh has no operator key.
+	Kept *KeptExport
+
 	// Foundation is the ports the mesh itself needs reachable on every machine, which no module
 	// declares because the foundation is not a module (novox/hq 04-ISSUES/051 and 052). The broker
 	// is the one that matters: a machine dials it to enrol, and a firewall derived only from
@@ -384,6 +389,13 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 			}
 			first = append(first, file)
 		}
+		if m.Keeps != "" && with.Kept != nil {
+			file, err := keptFile(m.Keeps, with.Kept)
+			if err != nil {
+				return nil, err
+			}
+			first = append(first, file)
+		}
 		if m.Computed != "" {
 			generator, known := with.Generators[m.Computed]
 			if !known {
@@ -725,6 +737,45 @@ func receivedFile(requirement, path string, given []Contribution) (map[string]an
 	}, nil
 }
 
+// Kept is one secret as the operator can recover it: where it belongs, and the value sealed to the
+// operator's key. Never a node's blob, and never a value.
+type Kept struct {
+	Node   string `json:"node"`
+	Module string `json:"module"`
+	Name   string `json:"name"`
+	// Origin is `made` or `accepted` — whether the mesh minted it or a person supplied it.
+	Origin string `json:"origin"`
+	// Sealed is the value, sealed to the operator key named in Key.
+	Sealed string    `json:"sealed"`
+	Key    string    `json:"key"`
+	MadeAt time.Time `json:"made-at"`
+}
+
+// KeptExport is what a person keeps beside the operator key, and what a vault keeps on its disk:
+// every operator-sealed copy, and the honest list of what has none.
+type KeptExport struct {
+	Export        int    `json:"export"`
+	OperatorKey   string `json:"operator-key"`
+	Fingerprint   string `json:"fingerprint"`
+	Kept          []Kept `json:"kept"`
+	Unrecoverable []Kept `json:"unrecoverable,omitempty"`
+}
+
+// KeptID is the resource that carries the export to a module that keeps it.
+func KeptID() string { return "kept" }
+
+// keptFile is the export, written where the module said. Ciphertext throughout — see Keeps.
+func keptFile(dir string, kept *KeptExport) (map[string]any, error) {
+	body, err := json.MarshalIndent(kept, "", "  ")
+	if err != nil {
+		return nil, err
+	}
+	return map[string]any{
+		"id": KeptID(), "type": "file", "path": strings.TrimRight(dir, "/") + "/export.json",
+		"mode": "0600", "content": string(body) + "\n",
+	}, nil
+}
+
 // sortedKeys is map iteration made repeatable, which everything written to a machine needs.
 func sortedKeys[V any](m map[string]V) []string {
 	out := make([]string, 0, len(m))