Let an own secret name its owner (issue 1170)

internal/catalogue/declaration.go

@@ -680,7 +680,13 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			if !ok || family == "" || with.Needed[m.Module][name] == "" {
 				continue
 			}
-			first = append(first, ownedBy(m.SecretsOwner, map[string]any{
+			// A per-secret owner (novox/hq ADR 0436 §1) stands in for the module's secrets-owner, when
+			// the manifest named one for this secret (or the family it belongs to).
+			owner := m.SecretsOwner
+			if own.Owner != "" {
+				owner = own.Owner
+			}
+			first = append(first, ownedBy(owner, map[string]any{
 				"id": NeedID(name), "type": "file", "path": own.Path, "sealed": with.Needed[m.Module][name],
 			}))
 		}
@@ -694,6 +700,9 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				if m.Module == RuntimeModule && r.Account != "" {
 					owner = r.Account
 				}
+				if o := m.OwnSecrets[name].Owner; o != "" {
+					owner = o
+				}
 				first = append(first, ownedBy(owner, map[string]any{
 					"id": NeedID(name), "type": "file", "path": m.OwnSecrets[name].Path, HandedSecretField: name,
 				}))
@@ -709,6 +718,9 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				if m.Module == RuntimeModule && r.Account != "" {
 					owner = r.Account
 				}
+				if o := m.OwnSecrets[name].Owner; o != "" {
+					owner = o
+				}
 				first = append(first, ownedBy(owner, map[string]any{
 					"id": NeedID(name), "type": "file", "path": m.OwnSecrets[name].Path, VaultSealedField: box,
 				}))
@@ -742,6 +754,9 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			if m.Module == RuntimeModule && r.Account != "" {
 				owner = r.Account
 			}
+			if o := m.OwnSecrets[name].Owner; o != "" {
+				owner = o
+			}
 			first = append(first, ownedBy(owner, map[string]any{
 				"id": NeedID(name), "type": "file", "path": m.OwnSecrets[name].Path, "sealed": sealed,
 			}))