Merge pull request 'Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)' (#298 ) from fix/164-an-accepted-credential-is-never-minted into main

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)
A Servarr app's API key, an indexer's key and a downloader's password are values the provider's software holds; the pair path made a random value for every consumer of them, sealed it to both ends and reported success, and the provider refused it. An offer may now say `"credential": {"issued-by": "outside"}`: SecretFor never makes a value for it, the plan reads such a pair as given or not given and sends the consumer no credential file until a person gives it, without refusing its machine; remakeShared and SharedSecretFor never make a provider's own secret issued outside either. `secret accept <provider's node> <provider module> <provision>` seals one value to every consumer that binds the provision from that provider, the provider and the operator, under one generation; the per-pair form is refused for such a provision, and rotate names the accept. A consumer may wait for a provision's credential: the controller excuses the wait only when the store bears it out, and its needs-operator condition names the one accept line. Adds the replay of issue 164 (TestReplay164), written with only what the controller had before.
2026-10-13 09:52:07 +00:00 · 2026-10-13 11:37:31 +02:00 · 2026-10-13 09:35:26 +00:00 · 2026-10-13 11:08:17 +02:00
33 changed files with 1432 additions and 670 deletions
@@ -0,0 +1,145 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// A provision whose credential only a person outside the mesh can give (novox/hq ADR 0337, issue 164, issue 165):
+// given once for its provider, at the controller's terminal, and sealed in one act to every consumer that binds the
+// provision from that provider now. The value is never read back, printed or kept.
+
+// outsideOffer is the provider module's own name when `secret accept <node> <module> <name>` names a provision that
+// module offers with a credential issued outside the mesh, and "" when it names anything else (an own secret, or a
+// pair with --provider).
+func outsideOffer(ctx context.Context, module, name, provider string) (string, error) {
+	if provider != "" {
+		return "", nil
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return "", err
+	}
+	defer open.Close()
+	shelf, err := open.inventory.Catalogue(ctx)
+	if err != nil {
+		return "", err
+	}
+	if m, known := shelf[module]; known && m.IssuedOutsideOf(name) {
+		return module, nil
+	}
+	return "", nil
+}
+
+// offeredOutsideBy is a module that offers the provision with a credential issued outside the mesh, or "".
+func offeredOutsideBy(ctx context.Context, provision string) (string, error) {
+	open, err := openStores(ctx)
+	if err != nil {
+		return "", err
+	}
+	defer open.Close()
+	shelf, err := open.inventory.Catalogue(ctx)
+	if err != nil {
+		return "", err
+	}
+	module, _ := catalogue.OffersIssuedOutside(shelf, provision)
+	return module, nil
+}
+
+// consumersFrom is every consumer that binds a provision from one provider now, found by resolving every machine as
+// its next send would, and the machines that could not be resolved, with why.
+func consumersFrom(ctx context.Context, open *stores, provider, providerModule, provision string) (
+	[]inventory.PairEnd, []string, error) {
+	nodes, err := open.inventory.Nodes(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	var out []inventory.PairEnd
+	var unresolved []string
+	for _, n := range nodes {
+		plan, _, err := planFor(ctx, open, n.Name)
+		if err != nil {
+			unresolved = append(unresolved, fmt.Sprintf("%s: %s", n.Name, oneLine(err.Error())))
+			continue
+		}
+		out = append(out, bindsFrom(plan, n.Name, provider, providerModule, provision)...)
+	}
+	return out, unresolved, nil
+}
+
+// bindsFrom is every consumer on one machine whose resolution answers the provision from that provider. Pure.
+func bindsFrom(plan catalogue.Resolution, machine, provider, providerModule, provision string) []inventory.PairEnd {
+	var out []inventory.PairEnd
+	for _, need := range plan.Needs {
+		if need.ByRecord || need.Name != provision || need.From != provider {
+			continue
+		}
+		if need.Module != "" && need.Module != providerModule {
+			continue
+		}
+		out = append(out, inventory.PairEnd{Consumer: machine, ConsumerModule: need.For, Local: need.Local})
+	}
+	sort.Slice(out, func(i, j int) bool {
+		return out[i].ConsumerModule+"\x00"+out[i].Local < out[j].ConsumerModule+"\x00"+out[j].Local
+	})
+	return out
+}
+
+// acceptForProvision gives a provision's credential issued outside the mesh, once for its provider (ADR 0337 §3).
+func acceptForProvision(ctx context.Context, provider, providerModule, provision, value string) error {
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	consumers, unresolved, err := consumersFrom(ctx, open, provider, providerModule, provision)
+	if err != nil {
+		return err
+	}
+	accepted, err := open.inventory.AcceptSecretForProvision(ctx, provision, provider, providerModule, value, consumers)
+	value = ""
+	if err != nil {
+		return err
+	}
+	fmt.Print(acceptedSaid(provider, providerModule, provision, accepted, unresolved))
+	if len(accepted.Sealed) == 0 {
+		return nil
+	}
+	if err := sendTo(ctx, open, accepted.Machines); err != nil {
+		return fmt.Errorf("%s is sealed and could not be sent: %w; `push %s` sends it", provision, err,
+			strings.Join(accepted.Machines, "`, `push "))
+	}
+	fmt.Printf("  sent %s; each consumer starts again on it\n", strings.Join(accepted.Machines, ", "))
+	return nil
+}
+
+// acceptedSaid is what one accept for a provider did, in words that never carry the value. Pure.
+func acceptedSaid(provider, providerModule, provision string, a inventory.ProvisionAccepted, unresolved []string) string {
+	var b strings.Builder
+	if len(a.Sealed) == 0 {
+		fmt.Fprintf(&b, "%s from %s on %s: no consumer binds it now, so nothing was sealed; a consumer that binds "+
+			"later waits for it, and this line given again seals it to every consumer then\n", provision,
+			providerModule, provider)
+	} else {
+		var names []string
+		for _, c := range a.Sealed {
+			names = append(names, fmt.Sprintf("%s on %s%s", c.ConsumerModule, c.Consumer, asLocal(c.Local)))
+		}
+		fmt.Fprintf(&b, "%s from %s on %s is given, sealed to %s and to %s\n", provision, providerModule, provider,
+			strings.Join(names, ", "), provider)
+		fmt.Fprintf(&b, "  the mesh cannot read it back, never makes one of its own for it, and will not rotate it\n")
+	}
+	for _, c := range a.Unsealable {
+		fmt.Fprintf(&b, "  not sealed to %s on %s: no sealing key on that machine; give it again once it has one\n",
+			c.ConsumerModule, c.Consumer)
+	}
+	for _, u := range unresolved {
+		fmt.Fprintf(&b, "  not known whether a consumer on %s binds it, which did not resolve; give it again once it does\n", u)
+	}
+	return b.String()
+}
@@ -722,7 +722,7 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 		return "", err
 	}
 	derived := derivedFilter{rules: rules, foundation: with.Foundation, mesh: with.Mesh,
-		outward: plan.PublicDomain != "", outwardLinks: with.OutwardLinks, local: with.LocalNetworks}
+		outward: plan.PublicDomain != "", outwardLinks: with.OutwardLinks}
 	filtering, err := inv.FilteringOf(ctx, node)
 	if err != nil {
 		return "", err
@@ -930,9 +930,6 @@ type derivedFilter struct {
 	// The filter constrains what arrives on them; everything arriving elsewhere is this machine's
 	// own guest and is not filtered.
 	outwardLinks []string
-	// local is the machine's local networks, which a port from `local-network` stays open to (novox/hq
-	// ADR 0340).
-	local []string
 }

 // closesOutside is what a narrowing from everywhere to the private network is called: it closes.
@@ -980,17 +977,6 @@ func (d derivedFilter) fate(r inventory.Reach) string {
 			if !onMesh {
 				return fmt.Sprintf("%s — declared by %s from the mesh only", closesOutside, by)
 			}
-		case catalogue.FromLocalNetwork:
-			// The private network and this machine's local networks (novox/hq ADR 0340): it closes to
-			// everything else outside, and says which local networks stay.
-			if !onMesh {
-				if len(d.local) == 0 {
-					return fmt.Sprintf("%s — declared by %s from the local network, and this machine "+
-						"reported none", closesOutside, by)
-				}
-				return fmt.Sprintf("WILL CLOSE to everything outside the private network and %s — declared "+
-					"by %s from the local network", strings.Join(d.local, ", "), by)
-			}
 		}
 		return fmt.Sprintf("declared by %s (from %s)", by, rule.From)
 	}
@@ -1,67 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/overlay"
-)
-
-// localNetworksOf is a machine's attached networks judged (novox/hq ADR 0340): which count as its local
-// network, from what it last said of itself and the links it said face outside it. A machine that has
-// said none judges to nothing, and a port reached from `local-network` is then admitted from the private
-// network only, and said so.
-func localNetworksOf(ctx context.Context, inv *inventory.Inventory, node string) ([]catalogue.LocalNetwork, error) {
-	account, had, err := inv.MachineOf(ctx, node)
-	if err != nil {
-		return nil, err
-	}
-	outward, err := inv.OutwardLinksOf(ctx, node)
-	if err != nil {
-		return nil, err
-	}
-	return judgedNetworks(account, had, outward, overlay.Interface), nil
-}
-
-// judgedNetworks is the judging alone, from what was read.
-func judgedNetworks(account inventory.MachineAccount, had bool, outward []string, tunnel string) []catalogue.LocalNetwork {
-	if !had || account.Machine == nil {
-		return nil
-	}
-	attached := make([]catalogue.AttachedNetwork, 0, len(account.Machine.Networks))
-	for _, n := range account.Machine.Networks {
-		attached = append(attached, catalogue.AttachedNetwork{Link: n.Link, Network: n.Network})
-	}
-	return catalogue.JudgeLocalNetworks(attached, outward, tunnel)
-}
-
-// localNetworkLines is what `node` shows of a machine's attached networks (ADR 0340 §8): each one, with
-// whether it counts as the local network and why, or why none is shown.
-func localNetworkLines(account inventory.MachineAccount, had bool, judged []catalogue.LocalNetwork) []string {
-	out := []string{"  its local network (what a port reached from local-network is admitted from):"}
-	switch {
-	case !had || account.Machine == nil:
-		return append(out, "    not said — this machine has not reported what it is attached to")
-	case len(account.Machine.Networks) == 0:
-		why := account.Machine.Unknown["networks"]
-		if why == "" {
-			why = "its node-engine is older than the one that says it"
-		}
-		return append(out, "    not said — "+why)
-	}
-	counted := 0
-	for _, j := range judged {
-		verdict := "not counted"
-		if j.Counts {
-			verdict = "counts"
-			counted++
-		}
-		out = append(out, fmt.Sprintf("    %-22s on %-10s %s: %s", j.Network, j.Link, verdict, j.Why))
-	}
-	if counted == 0 {
-		out = append(out, "    none counts: a port reached from local-network is admitted from the private network only")
-	}
-	return out
-}
@@ -1,65 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/inventory"
-)
-
-// **node shows what the local network resolved to** (novox/hq ADR 0340 §8): every attached network,
-// whether it counts, and why the others do not — the public subnet named as never counted.
-func TestNodeShowsWhichAttachedNetworksCountAndWhy(t *testing.T) {
-	account := inventory.MachineAccount{Architecture: "amd64", Kernel: "linux", Machine: &inventory.MadeOf{
-		Networks: []inventory.AttachedNetwork{
-			{Link: "eth0", Network: "192.168.1.10/24"},
-			{Link: "eth1", Network: "203.0.113.7/24"},
-			{Link: "wg-mesh", Network: "10.10.0.4/24"},
-		}}}
-	judged := judgedNetworks(account, true, []string{"eth0", "eth1"}, "wg-mesh")
-	text := strings.Join(localNetworkLines(account, true, judged), "\n")
-	for _, want := range []string{
-		"192.168.1.0/24", "counts: in a private range (RFC 1918, 192.168.0.0/16)",
-		"203.0.113.0/24", "not counted: public, never counted",
-		"10.10.0.0/24", "the private network's own link",
-	} {
-		if !strings.Contains(text, want) {
-			t.Errorf("node does not say %q:\n%s", want, text)
-		}
-	}
-}
-
-// A machine that said none, or whose node-engine is older, is said as that — never as an empty list
-// that reads like a machine on no network.
-func TestNodeSaysWhenNoNetworkWasSaid(t *testing.T) {
-	older := inventory.MachineAccount{Machine: &inventory.MadeOf{}}
-	if text := strings.Join(localNetworkLines(older, true, nil), "\n"); !strings.Contains(text, "older than the one that says it") {
-		t.Errorf("an older node-engine is not said:\n%s", text)
-	}
-	public := inventory.MachineAccount{Machine: &inventory.MadeOf{
-		Networks: []inventory.AttachedNetwork{{Link: "eth0", Network: "198.51.100.9/24"}}}}
-	judged := judgedNetworks(public, true, []string{"eth0"}, "wg-mesh")
-	if text := strings.Join(localNetworkLines(public, true, judged), "\n"); !strings.Contains(text, "none counts") {
-		t.Errorf("a machine on a public network only is not said to have no local network:\n%s", text)
-	}
-	if text := strings.Join(localNetworkLines(inventory.MachineAccount{}, false, nil), "\n"); !strings.Contains(text, "not said") {
-		t.Errorf("a machine that never reported is not said:\n%s", text)
-	}
-}
-
-// The preview of a flip says what a port from the local network keeps: the local networks it stays
-// open to, or that the machine reported none (ADR 0340 §6).
-func TestTheFlipPreviewSaysWhatALocalNetworkPortKeeps(t *testing.T) {
-	rules := []catalogue.Rule{{Port: 1883, Protocol: "tcp", From: catalogue.FromLocalNetwork, Because: []string{"mosquitto"}}}
-	at := inventory.Reach{Protocol: "tcp", Address: "0.0.0.0", Port: 1883}
-	with := derivedFilter{rules: rules, mesh: []string{"10.10.0.1"}, outwardLinks: []string{"eth0"},
-		local: []string{"192.168.1.0/24"}}
-	if fate := with.fate(at); !strings.Contains(fate, "192.168.1.0/24") {
-		t.Errorf("the preview says %q, without the local network it stays open to", fate)
-	}
-	with.local = nil
-	if fate := with.fate(at); !strings.Contains(fate, "reported none") {
-		t.Errorf("the preview says %q, without saying no local network was reported", fate)
-	}
-}
@@ -75,7 +75,7 @@ func stateHealth(ctx context.Context, inv *inventory.Inventory, k *conditions.Ke
 			State: r.State, Reason: r.Reason, Since: r.Since, Streak: r.Streak, Restarts: r.Restarts,
 			Check: r.Check, Needs: r.Needs, Account: r.Account, Root: r.Root}
 		for _, w := range r.Waits {
-			kept.Waits = append(kept.Waits, inventory.Wait{Part: w.Part, Secret: w.Secret, Setting: w.Setting, What: w.What})
+			kept.Waits = append(kept.Waits, inventory.Wait{Part: w.Part, Secret: w.Secret, Setting: w.Setting, Provision: w.Provision, What: w.What})
 		}
 		resources = append(resources, kept)
 	}
@@ -19,7 +19,6 @@ import (
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/overlay"
 	"github.com/novox/mesh-controller/internal/token"
 )

@@ -885,16 +884,6 @@ func showNode(ctx context.Context, stored *stores, name string) error {
 		for _, line := range machineLines(account, had, time.Now()) {
 			fmt.Println(line)
 		}
-		// And which of the networks it is attached to count as its local network, and why the others
-		// do not (novox/hq ADR 0340 §8).
-		outward, err := inv.OutwardLinksOf(ctx, name)
-		if err != nil {
-			fmt.Printf("  its local network could NOT be judged: %v\n", err)
-		} else {
-			for _, line := range localNetworkLines(account, had, judgedNetworks(account, had, outward, overlay.Interface)) {
-				fmt.Println(line)
-			}
-		}
 	}

 	held, err := inv.Profile(ctx, name)
@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -44,6 +45,28 @@ func needsOperatorKey(module, node string) string {
 type operatorWaitFacts struct {
 	manifests map[string]catalogue.Manifest
 	given     map[string]map[string]time.Time
+	// outside is, per provision some module offers with a credential issued outside the mesh, that provider module
+	// and the machines it is assigned to (novox/hq ADR 0337); pairsGiven, per "<module>@<machine>", the provisions
+	// it holds a value a person gave for, sealed to the keys both ends have now. Absent is not known: no wait for a
+	// provision of it is excused.
+	outside    map[string]outsideProvider
+	pairsGiven map[string]map[string]bool
+}
+
+// outsideProvider is the module offering a provision whose credential only a person gives, and where it runs.
+type outsideProvider struct {
+	Module   string
+	Machines []string
+}
+
+// acceptLine is the one line that gives an outside provision's credential for every consumer of its provider: on
+// the provider's machine when it runs on one, named as <machine> when on several or none.
+func (p outsideProvider) acceptLine(provision string) string {
+	machine := "<its machine>"
+	if len(p.Machines) == 1 {
+		machine = p.Machines[0]
+	}
+	return inventory.AcceptLine(machine, p.Module, provision)
 }

 // checkWait is nil when a wait is excused, and otherwise why not, in words. Pure.
@@ -52,9 +75,18 @@ func checkWait(module, machine string, w inventory.Wait, f operatorWaitFacts) er
 	if !known {
 		return fmt.Errorf("says it waits for %s, and the mesh holds no manifest of %s to check it against", waitNames(w), module)
 	}
+	named := 0
+	for _, n := range []string{w.Secret, w.Setting, w.Provision} {
+		if n != "" {
+			named++
+		}
+	}
 	switch {
-	case w.Secret != "" && w.Setting != "", w.Secret == "" && w.Setting == "":
-		return fmt.Errorf("says it waits, naming %s, where a wait names one secret or one setting", waitNames(w))
+	case named != 1:
+		return fmt.Errorf("says it waits, naming %s, where a wait names one secret, one setting or one provision",
+			waitNames(w))
+	case w.Provision != "":
+		return checkProvisionWait(module, machine, w, m, f)
 	case w.Setting != "":
 		if _, declared := m.Settings[w.Setting]; !declared {
 			return fmt.Errorf("says it waits for the setting %s, which %s does not declare", w.Setting, module)
@@ -80,20 +112,46 @@ func checkWait(module, machine string, w inventory.Wait, f operatorWaitFacts) er
 	return nil
 }

+// checkProvisionWait excuses a wait for a provision's credential only when the store bears it out (novox/hq ADR 0337
+// §6): the module requires the provision, a provider offers it with a credential issued outside the mesh, and the
+// module on this machine holds no value a person gave for it under the keys both ends have now.
+func checkProvisionWait(module, machine string, w inventory.Wait, m catalogue.Manifest, f operatorWaitFacts) error {
+	if !slices.Contains(m.Requires, w.Provision) {
+		return fmt.Errorf("says it waits for the provision %s, which %s does not require", w.Provision, module)
+	}
+	if _, outside := f.outside[w.Provision]; !outside {
+		return fmt.Errorf("says it waits for the provision %s, whose credential the mesh gives itself: only a "+
+			"credential issued outside the mesh waits for the operator", w.Provision)
+	}
+	given, readable := f.pairsGiven[module+"@"+machine]
+	if !readable {
+		return fmt.Errorf("says it waits for the provision %s, and what was given on %s could not be read", w.Provision, machine)
+	}
+	if given[w.Provision] {
+		return fmt.Errorf("says it waits for the provision %s, whose credential was given", w.Provision)
+	}
+	return nil
+}
+
 // waitRefusedPrefix opens every reason checkWait gives, so the words of a refused wait are told from a check's own.
 const waitRefusedPrefix = "says it waits"

 // waitNames is what a wait names, as "the secret x" or "the setting y".
 func waitNames(w inventory.Wait) string {
-	switch {
-	case w.Secret != "" && w.Setting != "":
-		return "the secret " + w.Secret + " and the setting " + w.Setting
-	case w.Secret != "":
-		return "the secret " + w.Secret
-	case w.Setting != "":
-		return "the setting " + w.Setting
+	var names []string
+	if w.Secret != "" {
+		names = append(names, "the secret "+w.Secret)
 	}
-	return "nothing"
+	if w.Setting != "" {
+		names = append(names, "the setting "+w.Setting)
+	}
+	if w.Provision != "" {
+		names = append(names, "the provision "+w.Provision)
+	}
+	if len(names) == 0 {
+		return "nothing"
+	}
+	return strings.Join(names, " and ")
 }

 // checkWaiting reads one machine's resources against the facts: every waiting resource whose waits all check out is
@@ -107,11 +165,17 @@ func checkWaiting(machine string, rs []inventory.ResourceHealth, f operatorWaitF
 			if len(r.Waits) == 0 {
 				why = fmt.Errorf("says it waits, and names nothing it waits for")
 			}
+			waits := make([]inventory.Wait, 0, len(r.Waits))
 			for _, w := range r.Waits {
 				if why == nil {
 					why = checkWait(r.Module, machine, w, f)
 				}
+				if p, outside := f.outside[w.Provision]; outside && w.Provision != "" {
+					w.Act = p.acceptLine(w.Provision)
+				}
+				waits = append(waits, w)
 			}
+			r.Waits = waits
 			if why != nil {
 				r.State, r.Reason = link.StateUnhealthy, why.Error()
 			}
@@ -150,6 +214,10 @@ func operatorWaitSaid(module, machine string, waits []inventory.Wait) string {
 		if w.Secret != "" {
 			part += fmt.Sprintf(", given with `nox secret ask %s %s %s`", machine, module, w.Secret)
 		}
+		if w.Provision != "" && w.Act != "" {
+			// One line for the provider, which seals it to every consumer of it (ADR 0337 §3, §7).
+			part += fmt.Sprintf(", given for every consumer with `%s`", w.Act)
+		}
 		parts = append(parts, part+")")
 	}
 	return fmt.Sprintf("%s on %s waits for the operator: %s", module, machine, strings.Join(parts, "; "))
@@ -172,7 +240,7 @@ func needsOperatorObservation(module, node string, waits []inventory.Wait, rs []
 func needsOperatorWords(module, node string, waits []inventory.Wait) words {
 	var acts []string
 	seen := map[string]bool{}
-	secret := false
+	secret, provision := false, false
 	for _, w := range waits {
 		var act string
 		switch {
@@ -180,6 +248,9 @@ func needsOperatorWords(module, node string, waits []inventory.Wait) words {
 			act, secret = fmt.Sprintf("type %s at %s's desk prompt", w.What, node), true
 		case w.Setting != "":
 			act = fmt.Sprintf("approve %s of %s on %s when it is proposed to you", w.Setting, module, node)
+		case w.Provision != "":
+			// ADR 0337 §7: "give <what> of <provider> on <machine>"; the line is in the summary.
+			act, provision = "give "+w.What, true
 		}
 		if act != "" && !seen[act] {
 			seen[act] = true
@@ -197,6 +268,10 @@ func needsOperatorWords(module, node string, waits []inventory.Wait) words {
 		explanation += " A hidden prompt opens at the desk when the secret is asked for, and what you type there " +
 			"is sealed to the machine."
 	}
+	if provision {
+		explanation += " A key only you can give is given once for the app that issued it, and reaches every " +
+			"module that uses it."
+	}
 	explanation += " Its update is in place and nothing was undone; it carries on by itself once it is given."
 	return words{
 		Headline:    fmt.Sprintf("%s waits for you on %s", module, node),
@@ -217,6 +292,12 @@ func readWaitFacts(ctx context.Context, inv *inventory.Inventory, machine string
 	if f.given == nil {
 		f.given = map[string]map[string]time.Time{}
 	}
+	if f.outside == nil {
+		f.outside = map[string]outsideProvider{}
+	}
+	if f.pairsGiven == nil {
+		f.pairsGiven = map[string]map[string]bool{}
+	}
 	if inv == nil {
 		return
 	}
@@ -238,15 +319,59 @@ func readWaitFacts(ctx context.Context, inv *inventory.Inventory, machine string
 				}
 			}
 		}
-		if _, read := f.given[module+"@"+machine]; read {
+		if _, read := f.given[module+"@"+machine]; !read {
+			if given, err := inv.GivenOwnSecrets(ctx, machine, module); err == nil {
+				f.given[module+"@"+machine] = given
+			}
+		}
+		if _, read := f.pairsGiven[module+"@"+machine]; !read {
+			if given, err := inv.GivenPairsOf(ctx, machine, module); err == nil {
+				f.pairsGiven[module+"@"+machine] = given
+			}
+		}
+		// The provisions it requires whose credential only a person gives, and where their provider runs (ADR 0337).
+		m, known := f.manifests[module]
+		if !known {
 			continue
 		}
-		if given, err := inv.GivenOwnSecrets(ctx, machine, module); err == nil {
-			f.given[module+"@"+machine] = given
+		for _, provision := range m.Requires {
+			if _, read := f.outside[provision]; read {
+				continue
+			}
+			if shelf == nil {
+				var err error
+				if shelf, err = inv.Catalogue(ctx); err != nil {
+					shelf = map[string]catalogue.Manifest{}
+				}
+			}
+			provider, outside := catalogue.OffersIssuedOutside(shelf, provision)
+			if !outside {
+				continue
+			}
+			f.outside[provision] = outsideProvider{Module: provider, Machines: machinesRunning(ctx, inv, provider)}
 		}
 	}
 }

+// machinesRunning is every machine a module is assigned to, by name; a read that fails is left out.
+func machinesRunning(ctx context.Context, inv *inventory.Inventory, module string) []string {
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		// Only the summary's accept line reads it, which then names the provider's machine "<its machine>".
+		// empty-on-error: no wait is excused or refused by it
+		return nil
+	}
+	var out []string
+	for _, n := range nodes {
+		assigned, err := inv.Assigned(ctx, n.Name)
+		if err == nil && slices.Contains(assigned, module) {
+			out = append(out, n.Name)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
 // waitingModules is every module with a waiting resource in a statement.
 func waitingModules(rs []inventory.ResourceHealth) []string {
 	seen := map[string]bool{}
@@ -55,8 +55,8 @@ func TestAWaitIsExcusedOnlyWhenItChecksOut(t *testing.T) {
 		{"a secret the mesh makes", inventory.Wait{Part: "p", Secret: "made", What: "w"}, factsGiven(nil), "mesh makes itself"},
 		{"the bus account", inventory.Wait{Part: "p", Secret: "broker", What: "w"}, factsGiven(nil), "mesh makes itself"},
 		{"a setting not declared", inventory.Wait{Part: "p", Setting: "logins", What: "w"}, factsGiven(nil), "does not declare"},
-		{"both", inventory.Wait{Part: "p", Secret: "licence", Setting: "smb-users", What: "w"}, factsGiven(nil), "one secret or one setting"},
-		{"neither", inventory.Wait{Part: "p", What: "w"}, factsGiven(nil), "one secret or one setting"},
+		{"both", inventory.Wait{Part: "p", Secret: "licence", Setting: "smb-users", What: "w"}, factsGiven(nil), "one secret, one setting or one provision"},
+		{"neither", inventory.Wait{Part: "p", What: "w"}, factsGiven(nil), "one secret, one setting or one provision"},
 		{"no manifest known", passwordWait, operatorWaitFacts{}, "no manifest"},
 		{"what was given cannot be read", passwordWait,
 			operatorWaitFacts{manifests: map[string]catalogue.Manifest{"mounts": mountsManifest}}, "could not be read"},
@@ -0,0 +1,83 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// One accept for a provider reaches every consumer that binds the provision from it, and each consumer's send
+// places it; the per-pair form naming a consumer is refused for such a provision, naming the provider's form; a
+// value the mesh made before the rule is not placed (novox/hq ADR 0337 §2, §3, §4, issue 164, issue 165). Needs the
+// store (MESH_TEST_POSTGRES), and is named in testdata/store-tests.
+func TestOneAcceptForAProviderIsPlacedForEveryConsumer(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	// Before the rule: tv's offer said nothing of its credential, and the send made one per pair.
+	register(t, open, catalogue.Manifest{Module: "tv", Version: "1",
+		Provides: []catalogue.Offer{{Name: "tv-api", Scope: catalogue.ScopeMesh}}})
+	for _, m := range []string{"requests", "indexer"} {
+		register(t, open, catalogue.Manifest{Module: m, Version: "1", Requires: []string{"tv-api"},
+			Secrets: map[string]string{"tv-api": "/var/lib/mesh/" + m + "/tv-api.secret"}})
+	}
+	for _, a := range [][2]string{{"anchor", "tv"}, {"laptop", "requests"}, {"laptop", "indexer"}} {
+		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+			t.Fatal(err)
+		}
+	}
+	placed := func(module string) bool {
+		t.Helper()
+		plan, settings, err := planFor(ctx, open, "laptop")
+		if err != nil {
+			t.Fatalf("laptop was refused: %v", err)
+		}
+		declared, err := declarationFor(ctx, open, "laptop", plan, settings)
+		if err != nil {
+			t.Fatalf("laptop did not compose: %v", err)
+		}
+		for _, r := range declared.Resources {
+			if r["path"] == "/var/lib/mesh/"+module+"/tv-api.secret" && r["sealed"] != nil {
+				return true
+			}
+		}
+		return false
+	}
+
+	if !placed("requests") || !placed("indexer") {
+		t.Fatal("before the rule, the send made and placed a credential per pair")
+	}
+	// The offer now says only a person gives it: the values the mesh made are not placed.
+	register(t, open, catalogue.Manifest{Module: "tv", Version: "2",
+		Provides: []catalogue.Offer{{Name: "tv-api", Scope: catalogue.ScopeMesh,
+			Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}}})
+	if placed("requests") || placed("indexer") {
+		t.Fatal("a credential nobody gave was placed")
+	}
+
+	// The per-pair form is refused, naming the provider's form, and reads nothing.
+	file := filepath.Join(t.TempDir(), "key")
+	if err := os.WriteFile(file, []byte("the app's key\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	err := secretCommand(ctx, []string{"accept", "laptop", "requests", "tv-api", "--provider", "anchor", "--from", file})
+	if err == nil || !strings.Contains(err.Error(), "secret accept anchor tv tv-api") {
+		t.Fatalf("the per-pair form was not refused naming the provider's: %v", err)
+	}
+
+	consumers, unresolved, err := consumersFrom(ctx, open, "anchor", "tv", "tv-api")
+	if err != nil || len(unresolved) != 0 {
+		t.Fatalf("the consumers of tv on anchor could not be found: %v %v", err, unresolved)
+	}
+	if len(consumers) != 2 {
+		t.Fatalf("the consumers of tv on anchor are %+v; want requests and indexer on laptop", consumers)
+	}
+	if _, err := open.inventory.AcceptSecretForProvision(ctx, "tv-api", "anchor", "tv", "the app's key", consumers); err != nil {
+		t.Fatal(err)
+	}
+	if !placed("requests") || !placed("indexer") {
+		t.Fatal("the value given once for the provider was not placed for every consumer")
+	}
+}
@@ -0,0 +1,113 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A consumer may wait for a provision's credential only a person gives (novox/hq ADR 0337 §5–§7, issue 164).
+
+var requestsManifest = catalogue.Manifest{Module: "requests", Version: "1", Requires: []string{"tv-api", "db"},
+	Secrets: map[string]string{"tv-api": "/s/tv-api", "db": "/s/db"}}
+
+var tvKeyWait = inventory.Wait{Part: "the tv library", Provision: "tv-api", What: "the API key of tv"}
+
+func outsideFacts(given map[string]bool) operatorWaitFacts {
+	return operatorWaitFacts{manifests: map[string]catalogue.Manifest{"requests": requestsManifest},
+		outside:    map[string]outsideProvider{"tv-api": {Module: "tv", Machines: []string{"media"}}},
+		pairsGiven: map[string]map[string]bool{"requests@laptop": given}}
+}
+
+// §6: excused only when the module requires the provision, its provider says it is issued outside, and no value a
+// person gave is held for the pair under the keys both ends have now.
+func TestAWaitForAProvisionIsExcusedOnlyWhenTheStoreBearsItOut(t *testing.T) {
+	for _, c := range []struct {
+		name string
+		w    inventory.Wait
+		f    operatorWaitFacts
+		says string
+	}{
+		{"required, issued outside, not given", tvKeyWait, outsideFacts(nil), ""},
+		{"given", tvKeyWait, outsideFacts(map[string]bool{"tv-api": true}), "was given"},
+		{"not required", inventory.Wait{Part: "p", Provision: "music-api", What: "w"}, outsideFacts(nil), "does not require"},
+		{"a credential the mesh gives itself", inventory.Wait{Part: "p", Provision: "db", What: "w"}, outsideFacts(nil),
+			"mesh gives itself"},
+		{"what was given cannot be read", tvKeyWait, operatorWaitFacts{
+			manifests: map[string]catalogue.Manifest{"requests": requestsManifest},
+			outside:   map[string]outsideProvider{"tv-api": {Module: "tv"}}}, "could not be read"},
+		{"a provision and a secret", inventory.Wait{Part: "p", Provision: "tv-api", Secret: "x", What: "w"},
+			outsideFacts(nil), "one secret, one setting or one provision"},
+	} {
+		err := checkWait("requests", "laptop", c.w, c.f)
+		switch {
+		case c.says == "" && err != nil:
+			t.Errorf("%s: refused: %v", c.name, err)
+		case c.says != "" && (err == nil || !strings.Contains(err.Error(), c.says)):
+			t.Errorf("%s: %v; want a refusal saying %q", c.name, err, c.says)
+		}
+	}
+}
+
+// §7: an excused wait is the consumer's needs-operator condition, in plain words, its summary naming the one line
+// that gives the credential for every consumer of the provider; the wait as kept is not changed.
+func TestAWaitForAProvisionNamesTheOneAcceptForItsProvider(t *testing.T) {
+	r := inventory.ResourceHealth{Module: "requests", Resource: "requests.app", Kind: "container", Target: "requests",
+		State: link.StateWaiting, Check: "tool", Waits: []inventory.Wait{tvKeyWait}}
+	kept := []inventory.ResourceHealth{r}
+	got := checkWaiting("laptop", kept, outsideFacts(nil))
+	if got[0].State != link.StateWaiting {
+		t.Fatalf("an excused wait for a provision was judged: %+v", got[0])
+	}
+	if kept[0].Waits[0].Act != "" {
+		t.Fatal("checking the wait changed the statement as kept")
+	}
+	waits, waiting := operatorWait("requests", got)
+	if !waiting {
+		t.Fatal("the module does not read as waiting for the operator")
+	}
+	o := needsOperatorObservation("requests", "laptop", waits, got)
+	if !strings.Contains(o.Summary, "secret accept media tv tv-api") {
+		t.Fatalf("the summary does not name the accept for the provider: %q", o.Summary)
+	}
+	if !strings.HasPrefix(o.Needs, "give the API key of tv") {
+		t.Fatalf("the needs do not name the act: %q", o.Needs)
+	}
+	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
+		Resolved: o.Resolved, Needs: o.Needs, Actions: o.Actions}, "laptop"); !ok {
+		t.Fatalf("the condition is not in plain words: %s", why)
+	}
+	// A provider on several machines, or none: the line names its machine as a place to fill.
+	if line := (outsideProvider{Module: "tv", Machines: []string{"a", "b"}}).acceptLine("tv-api"); line !=
+		"secret accept <its machine> tv tv-api" {
+		t.Fatalf("a provider on two machines reads %q", line)
+	}
+}
+
+// §3: the consumers one accept reaches are those whose resolution answers the provision from that provider.
+func TestTheConsumersOfAProviderAreThoseItAnswers(t *testing.T) {
+	plan := catalogue.Resolution{Needs: []catalogue.Needed{
+		{Name: "tv-api", From: "media", Module: "tv", For: "requests"},
+		{Name: "tv-api", From: "media", Module: "tv", For: "indexer", Local: "main"},
+		{Name: "tv-api", From: "other", Module: "tv", For: "elsewhere"},
+		{Name: "tv-api", From: "media", Module: "another-tv", For: "not-this-module"},
+		{Name: "db", From: "media", Module: "tv", For: "requests"},
+		{Name: "tv-api", ByRecord: true, For: "by-record"},
+	}}
+	got := bindsFrom(plan, "laptop", "media", "tv", "tv-api")
+	if len(got) != 2 || got[0].ConsumerModule != "indexer" || got[0].Local != "main" || got[1].ConsumerModule != "requests" {
+		t.Fatalf("the consumers from tv on media are %+v", got)
+	}
+	said := acceptedSaid("media", "tv", "tv-api", inventory.ProvisionAccepted{
+		Sealed:     []inventory.PairEnd{{Consumer: "laptop", ConsumerModule: "requests"}},
+		Unsealable: []inventory.PairEnd{{Consumer: "new", ConsumerModule: "indexer"}}}, []string{"down: refused"})
+	for _, want := range []string{"sealed to requests on laptop", "no sealing key", "down: refused"} {
+		if !strings.Contains(said, want) {
+			t.Errorf("what the accept says lacks %q:\n%s", want, said)
+		}
+	}
+}
@@ -182,12 +182,21 @@ func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Reso
 		}
 		var secret inventory.Secret
 		var err error
-		if n.SharedOwn != "" {
+		if outsideModule, outside := issuedOutsideBy(shelf, n); outside {
+			// Only a person can give it (novox/hq ADR 0337, issue 164): read as given, never made.
+			secret, err = inv.GivenPairSecret(ctx, n.Name, nodeName, n.For, n.From, outsideModule, n.Local)
+		} else if n.SharedOwn != "" {
 			// The provider's one credential, sealed to this consumer too (novox/hq ADR 0158).
 			secret, err = inv.SharedSecretFor(ctx, n.Name, nodeName, n.For, n.From, providerModuleOf(resolved, open, ctx, n), n.Local, n.SharedOwn)
 		} else {
 			secret, err = inv.SecretFor(ctx, n.Name, nodeName, n.For, n.From, n.Local)
 		}
+		if inventory.IsNotGiven(err) {
+			// **Not given, and the rest of the consumer runs** (ADR 0337 §4): no credential file, so the module can
+			// tell it was not given and says it waits for it; the machine is not refused for what only a person can
+			// give, and nothing the mesh made stands in for it.
+			continue
+		}
 		if err != nil {
 			// Said rather than skipped. A machine that resolves cleanly and receives no
 			// credential is one that will fail to authenticate at some later, less obvious
@@ -442,12 +451,6 @@ func declarationWith(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return sendable{}, err
 	}
-	// Which ports the filter admits from the local network, and from which networks, for plan to say
-	// (novox/hq ADR 0340 §8). The same rules the composition rendered, never sent.
-	rules, err := plan.Rules(with)
-	if err != nil {
-		return sendable{}, err
-	}
 	// And what was taken on it, said in every declaration it is sent from this one place.
 	adoption, err := adoptionOf(ctx, open.inventory, record, plan, composed)
 	if err != nil {
@@ -457,8 +460,7 @@ func declarationWith(ctx context.Context, open *stores, node string,
 		Received: composed.Received, Mesh: with.Mesh, BusUsers: with.BusUsers,
 		LeftOut: sortedKeysOf(composed.LeftOut), leftOutWhy: composed.LeftOut, withheld: with.Withheld,
 		unbound: with.Unbound, foreseen: composed.Foreseen, unplaced: composed.Unplaced,
-		modules:      namedModules(plan, composed.LeftOut),
-		localNetwork: catalogue.LocalNetworkPorts(rules, with.LocalNetworks)}
+		modules: namedModules(plan, composed.LeftOut)}
 	// And which build of each module it carries, for the send to record (novox/hq issue 259, ADR
 	// 0221). Read only on the send path: a question about what would be sent records nothing.
 	if choosing == Allocating {
@@ -967,12 +969,6 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
-	// And which of the networks it is attached to count as its local network (novox/hq ADR 0340):
-	// private ranges only, on a link facing outside it. Reported by the machine, never set.
-	local, err := localNetworksOf(ctx, inv, node)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
 	// Where this machine reaches each mesh seat's holder, for ${seat:<seat>:reach} (novox/hq ADR
 	// 0222): the artifact store as this network reaches it, which the container runtime is told to
 	// trust (ADR 0082). The same address composed into every reference the mesh built.
@@ -997,8 +993,7 @@ func renderingFor(ctx context.Context, open *stores, node string,
 		Machines: machines, Zones: zones, Holders: replicas,
 		Suffix: overlay.Suffix(), MeshRange: meshRange, TunnelInterface: overlay.Interface, Accounts: accounts, Foundation: foundation,
 		Kept: kept, Adopted: record.Adopted, OutwardLinks: outwardLinks,
-		LocalNetworks: catalogue.CountedLocalNetworks(local),
-		Given:         given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, SeatReach: reach, Built: built,
+		Given: given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, SeatReach: reach, Built: built,
 		BusUsers: busUsers, Withheld: withheld, Unbound: unbound,
 	}, record, nil
 }
@@ -1431,11 +1426,6 @@ func planCommand(ctx context.Context, args []string) error {
 			fmt.Printf("  %-20s settings from %s\n", module, layer.From)
 		}
 	}
-	// What each port reached from the local network resolved to on this machine (novox/hq ADR 0340 §8),
-	// or that it resolved to none.
-	for _, p := range declared.localNetwork {
-		fmt.Println("  " + p.Said())
-	}
 	fmt.Printf("\n%d resource(s)\n", len(resources))

 	if *show {
@@ -1761,6 +1751,17 @@ func busUserList(ctx context.Context, inv *inventory.Inventory,

 // providerModuleOf is which module answers a need on the providing node: the one in this node's
 // own set when the provider is here, else the one the catalogue says offers it.
+// issuedOutsideBy is whether a need's provision is offered by its provider with a credential issued outside the
+// mesh (novox/hq ADR 0337), and that provider module: the one answering it when known, else any that offers it so.
+func issuedOutsideBy(shelf map[string]catalogue.Manifest, n catalogue.Needed) (string, bool) {
+	if n.Module != "" {
+		if m, known := shelf[n.Module]; known {
+			return n.Module, m.IssuedOutsideOf(n.Name)
+		}
+	}
+	return catalogue.OffersIssuedOutside(shelf, n.Name)
+}
+
 func providerModuleOf(resolved catalogue.Resolution, open *stores, ctx context.Context, n catalogue.Needed) string {
 	for _, m := range resolved.Modules {
 		if _, shared := m.SharedCredentialOf(n.Name); shared {
@@ -0,0 +1,74 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// TestReplay164 replays novox/hq issue 164 (found provisioning the media machine's modules, re-checked
+// 2026-10-08): a Servarr app's API key, an indexer's key and a downloader's password are values the provider's
+// software holds and only a person can give, and for a consumer of such a provision the send made a random pair
+// credential, sealed it to both ends and placed it; the provider refused it, and a consumer retrying it could be
+// banned by the provider. The outcome asserted (ADR 0337): for a provision whose offer says its credential is
+// issued outside the mesh, the send makes no value and places none, the consumer's machine still composes, and a
+// value a person gave for the pair is placed. Written with only what the controller had before its fix —
+// register, assign, planFor, declarationFor, AcceptSecretForPair and the inventory's secret reads — so it is laid
+// over the commit before. Needs the store (MESH_TEST_POSTGRES), and is named in testdata/store-tests.
+func TestReplay164(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	const secretFile = "/var/lib/mesh/requests/tv-api.secret"
+	register(t, open, catalogue.Manifest{Module: "tv", Version: "1",
+		Provides: []catalogue.Offer{{Name: "tv-api", Scope: catalogue.ScopeMesh,
+			Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}},
+		Serves: map[string]map[string]any{"tv-api": {"port": 8989}}})
+	register(t, open, catalogue.Manifest{Module: "requests", Version: "1", Requires: []string{"tv-api"},
+		Secrets: map[string]string{"tv-api": secretFile}})
+	for _, a := range [][2]string{{"anchor", "tv"}, {"laptop", "requests"}} {
+		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+			t.Fatal(err)
+		}
+	}
+	sent := func() []map[string]any {
+		t.Helper()
+		plan, settings, err := planFor(ctx, open, "laptop")
+		if err != nil {
+			t.Fatalf("the consumer's machine was refused for a credential only a person gives: %v", err)
+		}
+		declared, err := declarationFor(ctx, open, "laptop", plan, settings)
+		if err != nil {
+			t.Fatalf("the send to laptop did not compose: %v", err)
+		}
+		return declared.Resources
+	}
+	placed := func(resources []map[string]any) map[string]any {
+		for _, r := range resources {
+			if r["path"] == secretFile && r["sealed"] != nil {
+				return r
+			}
+		}
+		return nil
+	}
+
+	if got := placed(sent()); got != nil {
+		t.Errorf("the send placed a credential for tv-api (%v), which only a person can give and nobody gave", got["id"])
+	}
+	held, err := open.inventory.SecretsOf(ctx, "laptop", "requests")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, s := range held {
+		if s.Name == "tv-api" {
+			t.Fatalf("the mesh holds a value for tv-api that nobody gave (origin %q)", s.Origin)
+		}
+	}
+
+	// Given by a person for the pair, it is placed, as given.
+	if err := open.inventory.AcceptSecretForPair(ctx, "tv-api", "laptop", "requests", "anchor", "", "the app's key"); err != nil {
+		t.Fatal(err)
+	}
+	if placed(sent()) == nil {
+		t.Fatal("the value a person gave for tv-api was not placed")
+	}
+}
@@ -0,0 +1,71 @@
+package main
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// **A new SDK plans the toolchain, and then every bundle compiled in it** (novox/hq issue 614), reasoned
+// as `mesh-controller.delivery-plan` reasons it: the modules registered as a build registers them —
+// resolved, so carrying no `build` — their builds recorded with what they stood on and what they made,
+// the graph read by theGraph and the change scoped by pullScope. On 2026-10-13 mesh-sdk 0.1.14 planned
+// "builds mesh-sdk, sent nowhere": mesh-tools' `build.on` naming the SDK's package and the providers'
+// TypeScript bundles were edges only while their manifests were unbuilt.
+//
+// **The replay of issue 614** (mesh-lab R614): written only with what the controller had before its fix — a
+// store, modules registered and builds recorded, theGraph and pullScope — so it is laid over the commit before
+// and fails there with the plan of that day, [[mesh-sdk]]. Needs a store: MESH_TEST_POSTGRES.
+func TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles(t *testing.T) {
+	inv := inventory.ForTest(t)
+	ctx := t.Context()
+	asked := time.Now().Add(-time.Hour)
+	digest := func(c string) string { return "@sha256:" + strings.Repeat(c, 64) }
+	register := func(m catalogue.Manifest, repository, path string, against []string, made []inventory.Artifact) {
+		t.Helper()
+		if err := inv.RegisterModule(ctx, m, inventory.Source{Repository: repository, Seat: "git", Path: path,
+			Ref: "main", BuiltFrom: "old", Asked: asked}); err != nil {
+			t.Fatal(err)
+		}
+		if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-" + m.Module, Repository: repository, Ref: "main",
+			Module: m.Module, Commit: "old", On: "builder", Path: path, Against: against, Made: made, Asked: asked}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	bundle := func(module, language string) catalogue.Manifest {
+		return catalogue.Manifest{Module: module, Version: "1", Bundles: []catalogue.Bundle{{
+			Name: "code", Language: language, Source: catalogue.ArtifactStoreScheme + module + "/code" + digest("2"),
+			Entrypoints: []string{"tools/index.js"}}}}
+	}
+	register(catalogue.Manifest{Module: "build-agent", Version: "1",
+		Claims: []catalogue.Claim{{Name: "node-build-agent", Scope: catalogue.ScopeNode}}},
+		"novox/mesh-catalog", "modules/build-agent", nil, nil)
+	register(catalogue.Manifest{Module: "mesh-sdk", Version: "1"}, "novox/mesh-sdk", "", nil,
+		[]inventory.Artifact{{Name: "lib", Kind: "package", Reference: "@novox/mesh-sdk@0.1.13"}})
+	register(catalogue.Manifest{Module: "mesh-tools", Version: "1"}, "novox/mesh-tools", "",
+		[]string{"@novox/mesh-sdk@0.1.13", catalogue.ArtifactStoreScheme + "upstream/docker.io/library/node" + digest("0")},
+		[]inventory.Artifact{{Name: "build", Kind: "image", Reference: catalogue.ArtifactStoreScheme + "mesh-tools/build" + digest("1")}})
+	register(catalogue.Manifest{Module: "mesh-tools-go", Version: "1"}, "novox/mesh-tools", "go", nil, nil)
+	register(bundle("minio", "typescript"), "novox/mesh-catalog", "modules/minio", nil, nil)
+	register(bundle("umami", "typescript"), "novox/mesh-catalog", "modules/umami", nil, nil)
+	register(bundle("dnsmasq", "go"), "novox/mesh-catalog", "modules/dnsmasq", nil, nil)
+
+	entries, read, edges, err := theGraph(ctx, inv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	m := orderMember{ID: "novox/mesh-sdk@new", Repository: "novox/mesh-sdk", Head: "new",
+		Paths: []string{"src/provisioner/index.ts", "package.json"}}
+	s := pullScope(m.pull(), entries, read, edges)
+	want := [][]string{{"mesh-sdk"}, {"mesh-tools"}, {"minio", "umami"}}
+	if !reflect.DeepEqual(s.Reach.Plan.Tiers, want) {
+		t.Fatalf("a new SDK plans %v, want %v (edges %v)", s.Reach.Plan.Tiers, want, edges)
+	}
+	if !reflect.DeepEqual(s.Dependents, []string{"mesh-tools", "minio", "umami"}) {
+		t.Errorf("dependents %v", s.Dependents)
+	}
+}
@@ -79,6 +79,37 @@ func secretCommand(ctx context.Context, args []string) error {
 		return fmt.Errorf("a secret's value is given at the controller's terminal or at the desk (`give`), never "+
 			"through a verb (this line came through %q): nothing was read or sealed", verb)
 	}
+	// **A provision's credential issued outside the mesh is given once, for its provider** (novox/hq ADR 0337 §3,
+	// issue 165): `secret accept <provider's machine> <provider module> <provision>`, sealed to every consumer of
+	// that provider; the per-pair form naming a consumer is refused for it, naming this one.
+	outsideAt, err := outsideOffer(ctx, module, name, *provider)
+	if err != nil {
+		return err
+	}
+	if outsideAt == "" && *provider != "" {
+		if offered, err := offeredOutsideBy(ctx, name); err != nil {
+			return err
+		} else if offered != "" {
+			return fmt.Errorf("%s is issued outside the mesh and given once for its provider, which seals it to "+
+				"every consumer of it (ADR 0337): `secret accept %s %s %s`; nothing was read or sealed",
+				name, *provider, offered, name)
+		}
+	}
+	if outsideAt != "" {
+		if *desk != "" || *local != "" {
+			return errors.New("a provision's credential issued outside the mesh is given at the controller's " +
+				"terminal, for every consumer of its provider; it takes neither --at-desk nor --local")
+		}
+		value, err := valueFor(node, module, name, *from)
+		if err != nil {
+			return err
+		}
+		value = asSupplied(value)
+		if value == "" {
+			return errors.New("there is nothing to seal")
+		}
+		return acceptForProvision(ctx, node, module, name, value)
+	}
 	if *desk != "" {
 		if *from != "" || *provider != "" {
 			return errors.New("--at-desk gives a module's own secret, and takes neither --from nor --provider")
@@ -173,6 +204,7 @@ const secretUsage = "secret rotate <node> <module> <name> [--why <text> [--cause
 	"secret ask <node> <module> <name> [--at <machine>]\n" +
 	"secret issued <provision>\n" +
 	"secret accept <node> <module> <name> [--from <file> | --at-desk <machine>] [--provider <node> [--local <name>]]\n" +
+	"secret accept <provider's node> <provider module> <provision> [--from <file>]   (a credential issued outside the mesh, for every consumer)\n" +
 	"secret recover <node> <module> <name> --key <operator-key> [--out <file>] [--from-export <file>] [--provider <node>]\n" +
 	"secret export [--out <file>]"

@@ -40,9 +40,6 @@ type sendable struct {
 	actingEpoch  uint64
 	// modules are the modules this declaration names, for the record of the send; never on the wire.
 	modules []string
-	// localNetwork is every port admitted from the local network and what it resolved to (novox/hq ADR
-	// 0340 §8), for plan to say; never on the wire.
-	localNetwork []catalogue.LocalNetworkPort
 	// Adoption is nil for a converged node, and then the body is byte for byte what it was before
 	// adoption existed: an older host parses the envelope strictly and would refuse the key.
 	Adoption *adoptionEnvelope
@@ -87,11 +87,6 @@ func Openings(rules []Rule, foundation []int, published map[string]map[int]int)
 			widen(key{rule.Protocol, rule.Port}, OpeningFromEverywhere)
 		case FromMesh:
 			widen(key{rule.Protocol, rule.Port}, OpeningFromMesh)
-		case FromLocalNetwork:
-			// The private network's part only (novox/hq ADR 0340). An adopted node's found firewall
-			// stays, and it is what admits the machine's local network; an opening has no word for a
-			// local network, and widening it to everywhere would open the port to the internet.
-			widen(key{rule.Protocol, rule.Port}, OpeningFromMesh)
 		}
 	}
 	for _, port := range foundation {
@@ -135,12 +135,6 @@ type Rendering struct {
 	// composes no filter for it rather than writing a rule around a link with no name.
 	OutwardLinks []string

-	// LocalNetworks is this machine's local networks (novox/hq ADR 0340): the networks it reported on a
-	// link facing outside it that lie wholly in a private range (JudgeLocalNetworks), which a port
-	// reached from `local-network` is admitted from beside the private network. Empty when it reported
-	// none, and the rule set then says so rather than widening the port or dropping it.
-	LocalNetworks []string
-
 	// TunnelInterface is the interface the mesh's private network runs on, named here rather than
 	// imported because the overlay package rests on this one. Traffic arriving on it is the mesh's,
 	// not this machine's own guest, so the filter admits it only by a rule.
@@ -533,8 +527,8 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				"`node show %s` says whether it has. Until then %s is not sent, and the machine "+
 				"keeps the filter it has", r.Node, r.Node, filters)
 	}
-	filtering := AsNftablesWithLocal(rules, with.Mesh, r.PublicDomain != "", with.Foundation,
-		with.OutwardLinks, with.TunnelInterface, with.LocalNetworks)
+	filtering := AsNftables(rules, with.Mesh, r.PublicDomain != "", with.Foundation,
+		with.OutwardLinks, with.TunnelInterface)

 	// **A variable two modules set is refused whether or not anything places it** (novox/hq ADR
 	// 0203 §5): the account has one environment, and a machine whose holder arrives later should not
@@ -152,10 +152,9 @@ func Exposure(m Manifest, layers []Layer) (map[int]string, error) {
 					m.Module, port)
 			}
 			source, ok := value.(string)
-			if !ok || (source != FromMesh && source != FromEverywhere && source != FromMachine &&
-				source != FromLocalNetwork) {
-				return nil, fmt.Errorf("%s exposes port %d as %v; it is %q, %q, %q or %q",
-					m.Module, port, value, FromMesh, FromEverywhere, FromMachine, FromLocalNetwork)
+			if !ok || (source != FromMesh && source != FromEverywhere && source != FromMachine) {
+				return nil, fmt.Errorf("%s exposes port %d as %v; it is %q, %q or %q",
+					m.Module, port, value, FromMesh, FromEverywhere, FromMachine)
 			}
 			out[port] = source
 		}
@@ -173,9 +172,7 @@ func Exposure(m Manifest, layers []Layer) (map[int]string, error) {
 // the appearance-of-restriction this mechanism exists to remove. The narrower rule's sources are
 // carried onto the wider one, so the module that wanted it is still named.
 func widest(rules []Rule) []Rule {
-	// The local network is the private network and the machine's own local networks (novox/hq ADR
-	// 0340 §4), so it covers `mesh` and is covered by `anywhere`.
-	reach := map[string]int{FromMachine: 0, FromMesh: 1, FromLocalNetwork: 2, FromEverywhere: 3}
+	reach := map[string]int{FromMachine: 0, FromMesh: 1, FromEverywhere: 2}
 	var out []Rule
 	for _, rule := range rules {
 		covered := false
@@ -235,15 +232,6 @@ const SSHPort = 22
 // any module asks for, and neither may be derived away.
 func AsNftables(rules []Rule, mesh []string, outward bool, foundation []int,
 	outwardLinks []string, tunnel string) string {
-	return AsNftablesWithLocal(rules, mesh, outward, foundation, outwardLinks, tunnel, nil)
-}
-
-// AsNftablesWithLocal is AsNftables with the machine's local networks: the networks it reported on a
-// link facing outside that count (novox/hq ADR 0340, JudgeLocalNetworks), which a rule from
-// `local-network` admits on its own port alone, beside the private network. None is not widened to
-// anywhere and not dropped silently: the rule set says the port wanted the local network and found none.
-func AsNftablesWithLocal(rules []Rule, mesh []string, outward bool, foundation []int,
-	outwardLinks []string, tunnel string, local []string) string {
 	// The links that are not this machine's own: the ones facing outside, and the mesh's tunnel.
 	// Traffic arriving on any of them is admitted only by a rule below; traffic arriving anywhere
 	// else is this machine's own guest and is not something the mesh has a position on.
@@ -406,31 +394,6 @@ func AsNftablesWithLocal(rules []Rule, mesh []string, outward bool, foundation [
 				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } %s dport %d accept\n",
 					strings.Join(six, ", "), rule.Protocol, rule.Port))
 			}
-		case FromLocalNetwork:
-			// The private network and the machine's own local networks, on this port alone (novox/hq
-			// ADR 0340 §5).
-			four, six := byFamily(mesh)
-			lfour, lsix := byFamily(local)
-			four, six = append(four, lfour...), append(six, lsix...)
-			if len(lfour) == 0 && len(lsix) == 0 {
-				b.WriteString(fmt.Sprintf(
-					"\t\t# %s/%d wanted the local network, and this machine reported no private network "+
-						"on a link facing outside; admitted from no local network\n", rule.Protocol, rule.Port))
-			}
-			if len(four) == 0 && len(six) == 0 {
-				b.WriteString(fmt.Sprintf(
-					"\t\t# %s/%d wanted the local network, and this node knows neither mesh addresses nor a "+
-						"local network; closed\n", rule.Protocol, rule.Port))
-				break
-			}
-			if len(four) > 0 {
-				b.WriteString(fmt.Sprintf("\t\tip saddr { %s } %s dport %d accept\n",
-					strings.Join(four, ", "), rule.Protocol, rule.Port))
-			}
-			if len(six) > 0 {
-				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } %s dport %d accept\n",
-					strings.Join(six, ", "), rule.Protocol, rule.Port))
-			}
 		case FromEverywhere:
 			b.WriteString(fmt.Sprintf("\t\t%s dport %d accept\n", rule.Protocol, rule.Port))
 		}
@@ -524,18 +487,6 @@ func AsNftablesWithLocal(rules []Rule, mesh []string, outward bool, foundation [
 				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } ct original proto-dst %d accept\n",
 					strings.Join(six, ", "), rule.Port))
 			}
-		case FromLocalNetwork:
-			four, six := byFamily(mesh)
-			lfour, lsix := byFamily(local)
-			four, six = append(four, lfour...), append(six, lsix...)
-			if len(four) > 0 {
-				b.WriteString(fmt.Sprintf("\t\tip saddr { %s } ct original proto-dst %d accept\n",
-					strings.Join(four, ", "), rule.Port))
-			}
-			if len(six) > 0 {
-				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } ct original proto-dst %d accept\n",
-					strings.Join(six, ", "), rule.Port))
-			}
 		case FromEverywhere:
 			b.WriteString(fmt.Sprintf("\t\tct original proto-dst %d accept\n", rule.Port))
 		}
@@ -842,14 +793,10 @@ const (
 	// are a subset of anywhere. What differs is the names, which is the whole reason reach is not
 	// simply the filter's vocabulary with nicer words.
 	ReachBoth = "both"
-	// ReachLocalNetwork is `internal` with the machine's own local networks added to what the filter
-	// opens (novox/hq ADR 0340 §4): the internal name and not the public one, the mesh's own authority,
-	// and the port opened to the private network and to the private networks the machine is attached to.
-	ReachLocalNetwork = "local-network"
 )

 // reaches is every value, in the order a refusal lists them.
-var reaches = []string{ReachMachine, ReachInternal, ReachPublic, ReachBoth, ReachLocalNetwork}
+var reaches = []string{ReachMachine, ReachInternal, ReachPublic, ReachBoth}

 // RoutedPorts are the ports a module serves through a proxy, taken from its route contributions.
 //
@@ -898,8 +845,6 @@ func FilterSource(reach string) (string, bool) {
 		return FromMesh, true
 	case ReachPublic, ReachBoth:
 		return FromEverywhere, true
-	case ReachLocalNetwork:
-		return FromLocalNetwork, true
 	default:
 		return "", false
 	}
@@ -909,9 +854,7 @@ func FilterSource(reach string) (string, bool) {
 func WantsPublicName(reach string) bool { return reach == ReachPublic || reach == ReachBoth }

 // WantsInternalName is whether a reach asks for the route's internal name to be composed.
-func WantsInternalName(reach string) bool {
-	return reach == ReachInternal || reach == ReachBoth || reach == ReachLocalNetwork
-}
+func WantsInternalName(reach string) bool { return reach == ReachInternal || reach == ReachBoth }

 // Reaches reads a module's per-node reach settings: declared port → how far it reaches.
 //
@@ -25,13 +25,13 @@ func TestAnOfferMaySayItsSoftwareIssuesTheCredential(t *testing.T) {
 	}

 	for want, raw := range map[string]string{
-		"the one issuer an offer may name": `{"module":"d","version":"1",
+		"the issuers an offer may name": `{"module":"d","version":"1",
 			"provides":[{"name":"d-api","credential":{"issued-by":"vendor","tool":"d_token"}}]}`,
 		"names no tool that answers it": `{"module":"d","version":"1",
 			"provides":[{"name":"d-api","credential":{"issued-by":"software"}}]}`,
 		"names its own secret": `{"module":"d","version":"1","own-secrets":{"token":{"path":"/p","taken":"at-start"}},
 			"provides":[{"name":"d-api","credential":{"issued-by":"software","tool":"d_token","own":"token"}}]}`,
-		"the one issuer an offer may name ": `{"module":"d","version":"1",
+		"the issuers an offer may name ": `{"module":"d","version":"1",
 			"provides":[{"name":"d-api","credential":{"tool":"d_token"}}]}`,
 	} {
 		want = strings.TrimSpace(want)
@@ -0,0 +1,46 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// A provision's credential may be one only a person outside the mesh can give (novox/hq ADR 0337 §1, issue 164):
+// the offer says `issued-by: outside` and names neither an own secret nor a tool, and the parser refuses it beside
+// either. An offer that says `software` keeps ADR 0305's shape.
+func TestAnOfferMaySayAPersonOutsideTheMeshIssuesItsCredential(t *testing.T) {
+	m, err := ParseManifest([]byte(`{"module":"tv","version":"1",
+		"provides":[{"name":"tv-api","scope":"mesh","credential":{"issued-by":"outside"}}],
+		"serves":{"tv-api":{"port":8989}}}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !m.IssuedOutsideOf("tv-api") {
+		t.Fatal("the offer's credential issued outside was not read")
+	}
+	if m.IssuedOutsideOf("other") {
+		t.Fatal("a provision the module does not offer reads as issued outside")
+	}
+	if _, issued := m.IssuedCredentialOf("tv-api"); issued {
+		t.Fatal("a credential issued outside was read as issued by the software")
+	}
+	if _, shared := m.SharedCredentialOf("tv-api"); shared {
+		t.Fatal("a credential issued outside was read as an own secret shared")
+	}
+	if who, offered := OffersIssuedOutside(map[string]Manifest{"tv": m}, "tv-api"); !offered || who != "tv" {
+		t.Fatalf("the catalogue does not say tv offers tv-api issued outside: %q %v", who, offered)
+	}
+
+	for want, raw := range map[string]string{
+		"names its own secret": `{"module":"d","version":"1","own-secrets":{"key":{"path":"/p","taken":"at-start"}},
+			"provides":[{"name":"d-api","credential":{"issued-by":"outside","own":"key"}}]}`,
+		"names the tool": `{"module":"d","version":"1",
+			"provides":[{"name":"d-api","credential":{"issued-by":"outside","tool":"d_key"}}]}`,
+		"the issuers an offer may name": `{"module":"d","version":"1",
+			"provides":[{"name":"d-api","credential":{"issued-by":"a-person"}}]}`,
+	} {
+		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("expected a refusal saying %q, got %v", want, err)
+		}
+	}
+}
@@ -1,154 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"net/netip"
-	"slices"
-	"sort"
-	"strings"
-)
-
-// AttachedNetwork is one network a machine said it is directly attached to: the link it is on and the
-// network as address and prefix (novox/hq ADR 0340 §7), as the node-engine reports it among its facts.
-type AttachedNetwork struct {
-	Link    string `json:"link"`
-	Network string `json:"network"`
-}
-
-// LocalNetwork is one attached network judged: whether it counts as this machine's local network for a
-// port reached from `local-network`, and why — said for one that counts as well as for one that does
-// not, so `node` can show which counted and why the others did not (ADR 0340 §8).
-type LocalNetwork struct {
-	Link    string
-	Network string
-	Counts  bool
-	Why     string
-}
-
-// privateRanges are the only ranges a local network may lie in (ADR 0340 §2): RFC 1918 for IPv4 and the
-// unique local addresses for IPv6. A network counts only when it lies wholly inside one of them.
-var privateRanges = []struct {
-	prefix netip.Prefix
-	name   string
-}{
-	{netip.MustParsePrefix("10.0.0.0/8"), "a private range (RFC 1918, 10.0.0.0/8)"},
-	{netip.MustParsePrefix("172.16.0.0/12"), "a private range (RFC 1918, 172.16.0.0/12)"},
-	{netip.MustParsePrefix("192.168.0.0/16"), "a private range (RFC 1918, 192.168.0.0/16)"},
-	{netip.MustParsePrefix("fc00::/7"), "the IPv6 unique local range (fc00::/7)"},
-}
-
-// JudgeLocalNetworks says, for each network a machine reported, whether it counts as its local network.
-//
-// **A public subnet never counts** (ADR 0340 §2): a network counts only when it lies wholly in a private
-// range, so `local-network` can never open a port to the internet — a machine sitting on a public /24 has
-// that /24 judged and refused, never rendered. A link-local network does not count either. And only a
-// link the machine reported as facing outside it counts (§3): the private network's own link and a
-// container bridge are this machine's own, not its local network, whatever their addresses.
-//
-// Sorted by link and then network, one entry per (link, network), so what `node` shows and what the
-// filter is rendered from do not depend on the order a machine happened to say them in.
-func JudgeLocalNetworks(attached []AttachedNetwork, outward []string, tunnel string) []LocalNetwork {
-	seen := map[[2]string]bool{}
-	var out []LocalNetwork
-	for _, a := range attached {
-		key := [2]string{a.Link, a.Network}
-		if seen[key] {
-			continue
-		}
-		seen[key] = true
-		out = append(out, judgeOne(a, outward, tunnel))
-	}
-	sort.Slice(out, func(i, j int) bool {
-		if out[i].Link != out[j].Link {
-			return out[i].Link < out[j].Link
-		}
-		return out[i].Network < out[j].Network
-	})
-	return out
-}
-
-func judgeOne(a AttachedNetwork, outward []string, tunnel string) LocalNetwork {
-	j := LocalNetwork{Link: a.Link, Network: a.Network}
-	prefix, err := netip.ParsePrefix(strings.TrimSpace(a.Network))
-	if err != nil {
-		j.Why = "not a network the mesh can read (" + err.Error() + ")"
-		return j
-	}
-	prefix = prefix.Masked()
-	j.Network = prefix.String()
-	switch {
-	case tunnel != "" && a.Link == tunnel:
-		j.Why = "the private network's own link, not the local network"
-		return j
-	case !slices.Contains(outward, a.Link):
-		j.Why = fmt.Sprintf("%s does not face outside this machine (a bridge or a link of its own)", a.Link)
-		return j
-	case prefix.Addr().IsLoopback():
-		j.Why = "loopback"
-		return j
-	case prefix.Addr().IsLinkLocalUnicast():
-		j.Why = "link-local, never counted"
-		return j
-	}
-	for _, r := range privateRanges {
-		if r.prefix.Contains(prefix.Addr()) && prefix.Bits() >= r.prefix.Bits() {
-			j.Counts = true
-			j.Why = "in " + r.name
-			return j
-		}
-	}
-	if prefix.Addr().IsPrivate() {
-		// Overlaps a private range without lying wholly inside it (a /7 around 10.0.0.0/8, say).
-		j.Why = "not wholly in a private range, so never counted"
-		return j
-	}
-	j.Why = "public, never counted: local-network may not open a port to the internet"
-	return j
-}
-
-// CountedLocalNetworks is the networks that count, as the filter renders them: sorted, without repeats.
-func CountedLocalNetworks(judged []LocalNetwork) []string {
-	var out []string
-	for _, j := range judged {
-		if j.Counts && !slices.Contains(out, j.Network) {
-			out = append(out, j.Network)
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
-// LocalNetworkPort is one port the filter admits from `local-network`, and what that resolved to on this
-// machine (ADR 0340 §8): what `plan` shows for it.
-type LocalNetworkPort struct {
-	Port     int
-	Protocol string
-	Because  []string
-	// Networks is the local networks it is admitted from; empty when the machine reported none (§6).
-	Networks []string
-}
-
-// LocalNetworkPorts is every rule admitted from `local-network`, with the networks it resolved to.
-func LocalNetworkPorts(rules []Rule, networks []string) []LocalNetworkPort {
-	var out []LocalNetworkPort
-	for _, rule := range rules {
-		if rule.From != FromLocalNetwork {
-			continue
-		}
-		out = append(out, LocalNetworkPort{Port: rule.Port, Protocol: rule.Protocol,
-			Because: rule.Because, Networks: networks})
-	}
-	return out
-}
-
-// Said is how `plan` says one such port: the networks, or that there are none and the port is admitted
-// from the private network only.
-func (p LocalNetworkPort) Said() string {
-	by := strings.Join(p.Because, ", ")
-	if len(p.Networks) == 0 {
-		return fmt.Sprintf("%s/%d (%s) from the local network: none — this machine reported no private "+
-			"network on a link facing outside, so it is admitted from the private network only", p.Protocol, p.Port, by)
-	}
-	return fmt.Sprintf("%s/%d (%s) from the local network: %s, and the private network", p.Protocol, p.Port, by,
-		strings.Join(p.Networks, ", "))
-}
@@ -1,195 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The home server's case (novox/hq issue 154): it sits on 192.168.1.0/24, and also on a public /24 a
-// provider handed it, beside the private network's own link and a container bridge.
-var homeServer = []AttachedNetwork{
-	{Link: "eth0", Network: "192.168.1.10/24"},
-	{Link: "eth1", Network: "203.0.113.7/24"},
-	{Link: "eth0", Network: "fe80::1/64"},
-	{Link: "eth0", Network: "fd12:3456:789a::5/64"},
-	{Link: "wg-mesh", Network: "10.10.0.4/24"},
-	{Link: "docker0", Network: "172.17.0.1/16"},
-}
-
-func judged(t *testing.T) []LocalNetwork {
-	t.Helper()
-	return JudgeLocalNetworks(homeServer, []string{"eth0", "eth1"}, "wg-mesh")
-}
-
-// **A public subnet never counts** (ADR 0340 §2), and only a private one on a link facing outside does
-// (§3): the tunnel's and a bridge's are this machine's own, whatever their addresses.
-func TestOnlyAPrivateNetworkOnALinkFacingOutsideCounts(t *testing.T) {
-	got := CountedLocalNetworks(judged(t))
-	want := []string{"192.168.1.0/24", "fd12:3456:789a::/64"}
-	if strings.Join(got, " ") != strings.Join(want, " ") {
-		t.Fatalf("counted %v, want %v", got, want)
-	}
-	for _, j := range judged(t) {
-		if j.Why == "" {
-			t.Errorf("%s on %s is judged without a why", j.Network, j.Link)
-		}
-		switch j.Network {
-		case "203.0.113.0/24":
-			if j.Counts || !strings.Contains(j.Why, "public") {
-				t.Errorf("the public subnet is judged %v (%s), want never counted as public", j.Counts, j.Why)
-			}
-		case "fe80::/64":
-			if j.Counts || !strings.Contains(j.Why, "link-local") {
-				t.Errorf("a link-local network is judged %v (%s)", j.Counts, j.Why)
-			}
-		case "10.10.0.0/24", "172.17.0.0/16":
-			if j.Counts {
-				t.Errorf("%s on %s counts, and it is not the local network", j.Network, j.Link)
-			}
-		}
-	}
-}
-
-// A network overlapping a private range without lying wholly inside it does not count either, so a
-// wide prefix around a private range cannot carry the internet with it.
-func TestANetworkNotWhollyInAPrivateRangeDoesNotCount(t *testing.T) {
-	for _, n := range []string{"10.0.0.0/7", "172.0.0.0/8", "100.64.0.0/10", "0.0.0.0/0", "::/0"} {
-		got := JudgeLocalNetworks([]AttachedNetwork{{Link: "eth0", Network: n}}, []string{"eth0"}, "")
-		if len(got) != 1 || got[0].Counts {
-			t.Errorf("%s counts as a local network: %+v", n, got)
-		}
-	}
-}
-
-// **The filter admits the local network on that port's rule alone** (§5), beside the private network,
-// in both chains, and never the public subnet.
-func TestALocalNetworkPortIsAdmittedFromItsNetworksAndTheMesh(t *testing.T) {
-	rules := []Rule{
-		{Port: 1883, Protocol: "tcp", From: FromLocalNetwork, Because: []string{"mosquitto"}},
-		{Port: 5432, Protocol: "tcp", From: FromMesh, Because: []string{"postgres"}},
-	}
-	local := CountedLocalNetworks(judged(t))
-	out := AsNftablesWithLocal(rules, []string{"10.10.0.1", "10.10.0.4"}, false, nil,
-		[]string{"eth0", "eth1"}, "wg-mesh", local)
-
-	for _, want := range []string{
-		"ip saddr { 10.10.0.1, 10.10.0.4, 192.168.1.0/24 } tcp dport 1883 accept",
-		"ip6 saddr { fd12:3456:789a::/64 } tcp dport 1883 accept",
-		"ip saddr { 10.10.0.1, 10.10.0.4, 192.168.1.0/24 } ct original proto-dst 1883 accept",
-		// The mesh-only port is not widened by the machine having a local network.
-		"ip saddr { 10.10.0.1, 10.10.0.4 } tcp dport 5432 accept",
-	} {
-		if !strings.Contains(out, want) {
-			t.Errorf("the rule set lacks %q:\n%s", want, out)
-		}
-	}
-	if strings.Contains(out, "203.0.113") {
-		t.Errorf("the public subnet reached the rule set:\n%s", out)
-	}
-	if strings.Contains(out, "tcp dport 1883 accept\n") && !strings.Contains(out, "saddr") {
-		t.Errorf("1883 is open to anywhere:\n%s", out)
-	}
-	for _, line := range strings.Split(out, "\n") {
-		if strings.TrimSpace(line) == "tcp dport 1883 accept" {
-			t.Fatalf("1883 is open to anywhere:\n%s", out)
-		}
-	}
-}
-
-// **Nothing resolved is closed and said** (§6): a machine that reported no private network admits the
-// port from the private network only, and the rule set says it found none — never widened to anywhere.
-func TestNoLocalNetworkIsSaidAndNotWidened(t *testing.T) {
-	rules := []Rule{{Port: 1883, Protocol: "tcp", From: FromLocalNetwork, Because: []string{"mosquitto"}}}
-	out := AsNftablesWithLocal(rules, []string{"10.10.0.1"}, false, nil, []string{"eth0"}, "wg-mesh", nil)
-	if !strings.Contains(out, "1883 wanted the local network, and this machine reported no private network") {
-		t.Errorf("the rule set does not say the local network resolved to nothing:\n%s", out)
-	}
-	if !strings.Contains(out, "ip saddr { 10.10.0.1 } tcp dport 1883 accept") {
-		t.Errorf("the port is not admitted from the private network:\n%s", out)
-	}
-	for _, line := range strings.Split(out, "\n") {
-		if strings.TrimSpace(line) == "tcp dport 1883 accept" {
-			t.Fatalf("an unresolved local network was widened to anywhere:\n%s", out)
-		}
-	}
-	said := LocalNetworkPorts(rules, nil)[0].Said()
-	if !strings.Contains(said, "none") {
-		t.Errorf("plan says %q, want it to say no local network was found", said)
-	}
-}
-
-// `local-network` is a source a manifest may name (§1, changing ADR 0045 §3), and an unknown source is
-// still refused.
-func TestAManifestMayListenFromTheLocalNetwork(t *testing.T) {
-	if _, err := ParseManifest([]byte(`{"module":"mosquitto","version":"1",
-		"listens":[{"port":1883,"from":"local-network"}]}`)); err != nil {
-		t.Fatalf("a listen from the local network is refused: %v", err)
-	}
-	_, err := ParseManifest([]byte(`{"module":"mosquitto","version":"1",
-		"listens":[{"port":1883,"from":"lan"}]}`))
-	if err == nil || !strings.Contains(err.Error(), `from "lan"`) {
-		t.Fatalf("a source the mesh cannot render is not refused: %v", err)
-	}
-}
-
-// **A fourth reach** (§4, changing ADR 0138 §4): `internal` with the local networks added to what the
-// filter opens — the internal name, not the public one.
-func TestTheLocalNetworkReachIsInternalWithTheLocalNetworkAdded(t *testing.T) {
-	public, internal := namesFor(t, aRoutedWeb(), reachSet(ReachLocalNetwork))
-	if public != "" || internal != "app.anchor.internal" {
-		t.Fatalf("names are %q and %q, want the internal name only", public, internal)
-	}
-	bare := aRoutedWeb()
-	bare.Contributes = nil
-	r := Resolution{Node: "anchor", Modules: []Manifest{bare}}
-	rules, err := r.Rules(Rendering{Settings: reachSet(ReachLocalNetwork)})
-	if err != nil {
-		t.Fatalf("rules: %v", err)
-	}
-	if len(rules) != 1 || rules[0].From != FromLocalNetwork {
-		t.Fatalf("reach local-network made the filter say %+v", rules)
-	}
-}
-
-// Two modules wanting one port, one from the mesh and one from the local network, render one rule from
-// the local network: it covers the mesh, and anywhere covers it.
-func TestTheLocalNetworkSitsBetweenTheMeshAndAnywhere(t *testing.T) {
-	got := widest([]Rule{
-		{Port: 53, Protocol: "udp", From: FromMesh, Because: []string{"a"}},
-		{Port: 53, Protocol: "udp", From: FromLocalNetwork, Because: []string{"b"}},
-	})
-	if len(got) != 1 || got[0].From != FromLocalNetwork || len(got[0].Because) != 2 {
-		t.Fatalf("got %+v", got)
-	}
-	got = widest(append(got, Rule{Port: 53, Protocol: "udp", From: FromEverywhere, Because: []string{"c"}}))
-	if len(got) != 1 || got[0].From != FromEverywhere {
-		t.Fatalf("got %+v", got)
-	}
-}
-
-// On an adopted node the opening is the private network's part only: the found firewall admits the
-// local network, and an opening that widened to everywhere would open the port to the internet.
-func TestAnAdoptedNodeOpensTheLocalNetworkPortToTheMeshOnly(t *testing.T) {
-	out := Openings([]Rule{{Port: 1883, Protocol: "tcp", From: FromLocalNetwork}}, nil, nil)
-	if len(out) != 1 || out[0]["from"] != OpeningFromMesh {
-		t.Fatalf("openings %v", out)
-	}
-}
-
-// A global unicast IPv6 subnet on a link facing outside is public, and never counts: the IPv6 side of the
-// rule that `local-network` cannot open a port to the internet (ADR 0340 §2).
-func TestAGlobalIPv6SubnetIsPublicAndNeverCounts(t *testing.T) {
-	got := JudgeLocalNetworks([]AttachedNetwork{{Link: "eth0", Network: "2001:db8:1234::7/48"}}, []string{"eth0"}, "wg-mesh")
-	if len(got) != 1 {
-		t.Fatalf("judged %+v", got)
-	}
-	if got[0].Counts {
-		t.Fatalf("the global IPv6 subnet %s counts as a local network", got[0].Network)
-	}
-	if got[0].Network != "2001:db8:1234::/48" || !strings.Contains(got[0].Why, "public, never counted") {
-		t.Fatalf("judged %s with why %q, want it named public and never counted", got[0].Network, got[0].Why)
-	}
-	if n := CountedLocalNetworks(got); len(n) != 0 {
-		t.Fatalf("counted %v", n)
-	}
-}
@@ -269,7 +269,8 @@ func KeepsConsumerData(catalogue map[string]Manifest, provision string) bool {
 func (o Offer) MachineReach() bool { return o.Reach == ReachMachine }

 // OfferCredential names which of the provider's own secrets a provision's consumers receive — or, with
-// IssuedBy, that the provider's software issues the provision's one credential itself (novox/hq ADR 0305,
+// IssuedBy "outside", that only a person can give the provision's credential (novox/hq ADR 0337, issue 164) — or,
+// with IssuedBy "software", that the provider's software issues the provision's one credential itself (novox/hq ADR 0305,
 // issue 526): a media server's sign-in token from its vendor, which the mesh can neither make nor rotate.
 // Tool is then the provider's own tool that answers that value, sealed to a key made for the controller's
 // one call, and to the controller alone.
@@ -293,6 +294,34 @@ func (m Manifest) IssuedCredentialOf(provision string) (string, bool) {
 	return "", false
 }

+// IssuedOutsideOf is whether this module's offer of a provision says only a person outside the mesh can give its
+// credential (novox/hq ADR 0337): the mesh never makes a value for it, and a consumer holds one only once a person
+// gave it with `secret accept`.
+func (m Manifest) IssuedOutsideOf(provision string) bool {
+	for _, o := range m.Provides {
+		if o.Name == provision && o.Credential != nil && o.Credential.IssuedBy == IssuedOutside {
+			return true
+		}
+	}
+	return false
+}
+
+// OffersIssuedOutside is whether any module of a catalogue offers the provision with a credential issued outside
+// the mesh (novox/hq ADR 0337), and the first such module by name.
+func OffersIssuedOutside(shelf map[string]Manifest, provision string) (string, bool) {
+	var names []string
+	for name, m := range shelf {
+		if m.IssuedOutsideOf(provision) {
+			names = append(names, name)
+		}
+	}
+	if len(names) == 0 {
+		return "", false
+	}
+	sort.Strings(names)
+	return names[0], true
+}
+
 // SharedCredentialOf is the own secret an offer of this module names as the provision's credential,
 // and whether it names one.
 func (m Manifest) SharedCredentialOf(provision string) (string, bool) {
@@ -1136,12 +1165,6 @@ const (
 	FromEverywhere = "anywhere"
 	// FromMachine is this machine only — a port bound for something else on the same host.
 	FromMachine = "machine"
-	// FromLocalNetwork is the private network and the networks this machine is directly attached to
-	// through its uplink, as it reports them, and only those wholly in a private range (novox/hq ADR
-	// 0340): a local service reached by devices that will never be nodes, said as exactly that rather
-	// than as `anywhere`. A public subnet the machine sits on never counts, so it cannot open a port to
-	// the internet.
-	FromLocalNetwork = "local-network"
 )

 // At is this port's protocol, with the default applied.
@@ -1653,14 +1676,28 @@ func ParseManifest(raw []byte) (Manifest, error) {
 						"makes is %d", m.Module, p, id.Max, shortest))
 			}
 		}
-		if c := offer.Credential; c != nil && (c.IssuedBy != "" || c.Tool != "") {
+		if c := offer.Credential; c != nil && c.IssuedBy == IssuedOutside {
+			// Only a person can give it (novox/hq ADR 0337 §1, issue 164): the software holds a value the mesh can
+			// neither make nor fetch, so the offer names nothing that would answer it — no own secret, no tool.
+			switch {
+			case c.Own != "":
+				problems = append(problems, fmt.Sprintf(
+					"%s provides %q with a credential issued outside the mesh and names its own secret %q too; a "+
+						"person gives the value with `secret accept`, so the offer names no own secret (ADR 0337)",
+					m.Module, p, c.Own))
+			case c.Tool != "":
+				problems = append(problems, fmt.Sprintf(
+					"%s provides %q with a credential issued outside the mesh and names the tool %q; only a "+
+						"person gives it, so the offer names no tool (ADR 0337)", m.Module, p, c.Tool))
+			}
+		} else if c := offer.Credential; c != nil && (c.IssuedBy != "" || c.Tool != "") {
 			// The software issues it (novox/hq ADR 0305): named by the tool that answers it, never by an own
 			// secret, which would be a second copy for the mesh to keep in step with the software's.
 			switch {
 			case c.IssuedBy != IssuedBySoftware:
 				problems = append(problems, fmt.Sprintf(
-					"%s provides %q with a credential issued by %q; the one issuer an offer may name is %q (ADR 0305)",
-					m.Module, p, c.IssuedBy, IssuedBySoftware))
+					"%s provides %q with a credential issued by %q; the issuers an offer may name are %q and %q "+
+						"(ADR 0305, ADR 0337)", m.Module, p, c.IssuedBy, IssuedBySoftware, IssuedOutside))
 			case c.Own != "":
 				problems = append(problems, fmt.Sprintf(
 					"%s provides %q with a credential its software issues and names its own secret %q too; the "+
@@ -1892,17 +1929,17 @@ func ParseManifest(raw []byte) (Manifest, error) {
 				"%s listens on port %d, which is not a port", m.Module, l.Port))
 		}
 		switch l.From {
-		case FromMesh, FromEverywhere, FromMachine, FromLocalNetwork:
+		case FromMesh, FromEverywhere, FromMachine:
 		case "":
 			// The fault this field exists to prevent. A rule with no source is open, and a
 			// manifest that omitted it would read as a restriction and be none.
 			problems = append(problems, fmt.Sprintf(
-				"%s listens on %d and does not say from where; it is %q, %q, %q or %q",
-				m.Module, l.Port, FromMesh, FromEverywhere, FromMachine, FromLocalNetwork))
+				"%s listens on %d and does not say from where; it is %q, %q or %q",
+				m.Module, l.Port, FromMesh, FromEverywhere, FromMachine))
 		default:
 			problems = append(problems, fmt.Sprintf(
-				"%s listens on %d from %q; it is %q, %q, %q or %q",
-				m.Module, l.Port, l.From, FromMesh, FromEverywhere, FromMachine, FromLocalNetwork))
+				"%s listens on %d from %q; it is %q, %q or %q",
+				m.Module, l.Port, l.From, FromMesh, FromEverywhere, FromMachine))
 		}
 		if p := l.At(); p != "tcp" && p != "udp" {
 			problems = append(problems, fmt.Sprintf(
@@ -58,7 +58,42 @@ func (i *Inventory) Dependencies(ctx context.Context) ([]Edge, error) {
 	if err != nil {
 		return nil, err
 	}
-	return dependenciesOf(entries, against, nil), nil
+	held, err := i.Held(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return dependenciesWith(entries, against, held), nil
+}
+
+// packagesHeld is, by package name, the module whose artifact the mesh holds as that package: a
+// `package` artifact's reference is `<name>@<version>` (the builder's publishPackage), never an
+// artifact-store reference, so a build that stood on it recorded the package's name and version.
+func packagesHeld(held map[string]string) map[string]string {
+	out := map[string]string{}
+	for key, reference := range held {
+		module, _, ok := strings.Cut(key, "/")
+		if !ok {
+			continue
+		}
+		if name := packageName(reference); name != "" {
+			out[name] = module
+		}
+	}
+	return out
+}
+
+// packageName is the name of a `<name>@<version>` package reference, or "" for anything else: a
+// kept or pinned image (`…@sha256:…`), a URL, or a reference with no version.
+func packageName(reference string) string {
+	if strings.HasPrefix(reference, catalogue.ArtifactStoreScheme) || strings.Contains(reference, "@sha256:") ||
+		strings.Contains(reference, "://") {
+		return ""
+	}
+	at := strings.LastIndex(reference, "@")
+	if at <= 0 || at == len(reference)-1 {
+		return ""
+	}
+	return reference[:at]
 }

 // dependenciesOf is Dependencies over what was read, so a test can hand it a catalogue.
@@ -66,6 +101,20 @@ func (i *Inventory) Dependencies(ctx context.Context) ([]Edge, error) {
 // `read` draws no edge (novox/hq ADR 0267 rule 4): what a build read moves it through its build source, in
 // the planner, never through the relation.
 func dependenciesOf(entries []Entry, against map[string][]string, _ map[string][]ReadRepository) []Edge {
+	return dependenciesWith(entries, against, nil)
+}
+
+// dependenciesWith is the relation with the artifacts the mesh holds, "<module>/<artifact>" to its
+// reference (Held), so a package a build stood on is read as its module's.
+//
+// **A built manifest carries no `build`** (catalogue.Resolve drops it), so what a module declared it
+// is built on is read from what is kept of it once it is built (novox/hq issue 614): the bases its
+// newest build was handed (`against`) — an artifact-store reference, or a package's `<name>@<version>`
+// — and the language of every bundle it compiled (`Bundles`). Read only from records the mesh already
+// keeps, so it holds for every module built before it, and a controller rolled back to one without it
+// reads the same records as before.
+func dependenciesWith(entries []Entry, against map[string][]string, held map[string]string) []Edge {
+	packages := packagesHeld(held)
 	known := map[string]bool{}
 	var builders []string
 	for _, e := range entries {
@@ -111,6 +160,13 @@ func dependenciesOf(entries []Entry, against map[string][]string, _ map[string][
 				}
 			}
 		}
+		// **And once it is built**, from the bundles its resolved manifest keeps (novox/hq issue 614): the
+		// `build` it was declared with is gone by then, and a toolchain that moved rebuilt none of them.
+		for _, b := range e.Manifest.Bundles {
+			if chain, err := builder.ToolchainFor(b.Language); err == nil {
+				add(name, chain.Base, EdgeStandsOn)
+			}
+		}
 		for _, ref := range against[name] {
 			if rest, ok := strings.CutPrefix(ref, catalogue.ArtifactStoreScheme); ok {
 				// A copy of an upstream image is no module's artifact (novox/hq ADR 0257): its
@@ -121,6 +177,13 @@ func dependenciesOf(entries []Entry, against map[string][]string, _ map[string][
 				if base, _, found := strings.Cut(rest, "/"); found {
 					add(name, base, EdgeStandsOn)
 				}
+				continue
+			}
+			// A package base (`build.on` naming a module's `package` artifact) is recorded as the
+			// package's name and version (novox/hq issue 614): the module that publishes that package
+			// is what it stood on, whichever version the mesh holds now.
+			if base, ok := packages[packageName(ref)]; ok {
+				add(name, base, EdgeStandsOn)
 			}
 		}
 		if e.Source.Repository != "" {
@@ -1,6 +1,7 @@
 package inventory

 import (
+	"strings"
 	"testing"

 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -174,3 +175,74 @@ func TestACopyOfAnUpstreamImageIsNoEdge(t *testing.T) {
 		}
 	}
 }
+
+// **A built module keeps its build edges** (novox/hq issue 614). A manifest the mesh registers from a
+// build carries no `build` (catalogue.Resolve drops it), so mesh-tools' `build.on` naming mesh-sdk's
+// `lib` package and a provider's TypeScript bundle drew no edge once built, and a new SDK rebuilt
+// neither. The package base is read from what the build was handed (`@novox/mesh-sdk@0.1.13`, the
+// package's name whichever version the mesh holds now), the toolchain from the bundles it keeps.
+func TestABuiltModuleKeepsItsBuildEdges(t *testing.T) {
+	built := func(name string, bundles ...catalogue.Bundle) Entry {
+		return Entry{Manifest: catalogue.Manifest{Module: name, Bundles: bundles},
+			Source: Source{Repository: "http://forge/novox/" + name + ".git"}}
+	}
+	entries := []Entry{
+		built("mesh-sdk"),
+		built("mesh-tools"),
+		built("mesh-tools-go"),
+		built("minio", catalogue.Bundle{Name: "code", Language: "typescript"}),
+		built("umami", catalogue.Bundle{Name: "code", Language: "TypeScript"}),
+		built("dnsmasq", catalogue.Bundle{Name: "tools", Language: "go"}),
+		built("plain"),
+	}
+	against := map[string][]string{
+		"mesh-tools": {"@novox/mesh-sdk@0.1.13",
+			catalogue.ArtifactStoreScheme + "upstream/docker.io/library/node@sha256:" + strings.Repeat("0", 64)},
+		// A package nobody in the mesh publishes is no edge.
+		"plain": {"left-pad@1.3.0"},
+	}
+	held := map[string]string{
+		"mesh-sdk/lib":       "@novox/mesh-sdk@0.1.14",
+		"mesh-tools/runtime": catalogue.ArtifactStoreScheme + "mesh-tools/runtime@sha256:" + strings.Repeat("1", 64),
+	}
+	got := dependenciesWith(entries, against, held)
+	has := func(from, to string) bool {
+		for _, e := range got {
+			if e.From == from && e.To == to && e.Kind == EdgeStandsOn {
+				return true
+			}
+		}
+		return false
+	}
+	for _, want := range [][2]string{
+		{"mesh-tools", "mesh-sdk"},
+		{"minio", "mesh-tools"},
+		{"umami", "mesh-tools"},
+		{"dnsmasq", "mesh-tools-go"},
+	} {
+		if !has(want[0], want[1]) {
+			t.Errorf("no %s stands-on %s: %+v", want[0], want[1], got)
+		}
+	}
+	for _, e := range got {
+		if e.From == "plain" && e.Kind != EdgeBuiltBy {
+			t.Errorf("an unknown package drew an edge: %+v", e)
+		}
+	}
+}
+
+func TestAPackageNameIsReadOnlyFromAPackageReference(t *testing.T) {
+	for ref, want := range map[string]string{
+		"@novox/mesh-sdk@0.1.14": "@novox/mesh-sdk",
+		"left-pad@1.3.0":         "left-pad",
+		"@novox/mesh-sdk":        "",
+		"novox.internal:5100/mesh-tools/build@sha256:" + strings.Repeat("0", 64): "",
+		catalogue.ArtifactStoreScheme + "mesh-tools/build@sha256:0":              "",
+		"http://store/v2/x/blobs/sha256:0":                                       "",
+		"":                                                                       "",
+	} {
+		if got := packageName(ref); got != want {
+			t.Errorf("packageName(%q) = %q, want %q", ref, got, want)
+		}
+	}
+}
@@ -44,7 +44,13 @@ type Wait struct {
 	Part    string `json:"part"`
 	Secret  string `json:"secret,omitempty"`
 	Setting string `json:"setting,omitempty"`
-	What    string `json:"what"`
+	// Provision is a provision the module requires whose credential only a person can give and nobody gave yet
+	// (novox/hq ADR 0337 §5): a wait names exactly one of Secret, Setting or Provision.
+	Provision string `json:"provision,omitempty"`
+	What      string `json:"what"`
+	// Act is the line that gives a provision's credential, filled by the controller when it excuses the wait
+	// (ADR 0337 §7); never said by a machine.
+	Act string `json:"act,omitempty"`
 }

 // NodeHealth is a machine's newest statement, as kept.
@@ -36,16 +36,7 @@ type MadeOf struct {
 	BootedAt      *time.Time          `json:"booted_at"`
 	Timezone      string              `json:"timezone"`
 	Filesystems   []MountedFilesystem `json:"filesystems"`
-	// Networks is every network the machine is directly attached to on a link facing outside it, as
-	// link and network (novox/hq ADR 0340 §7): what a port reached from `local-network` resolves from.
-	Networks []AttachedNetwork `json:"networks"`
-	Unknown  map[string]string `json:"unknown"`
-}
-
-// AttachedNetwork is one network a machine said it is attached to, and the link it is on.
-type AttachedNetwork struct {
-	Link    string `json:"link"`
-	Network string `json:"network"`
+	Unknown       map[string]string   `json:"unknown"`
 }

 // MountedFilesystem is one local filesystem a machine has mounted.
@@ -40,18 +40,3 @@ func TestAProfileWithoutTheFactsIsAnOlderNodeEngineNotNothing(t *testing.T) {
 		t.Error("a node that never reported read as having reported")
 	}
 }
-
-// The networks a machine is attached to (novox/hq ADR 0340 §7), in the node-engine's words: what a port
-// reached from `local-network` resolves from.
-func TestAMachinesAttachedNetworksAreRead(t *testing.T) {
-	a, had, err := machineFrom([]byte(`{"architecture":"amd64","kernel":"linux",
-		"machine":{"observed_at":"2026-10-13T09:00:00Z",
-		"networks":[{"link":"eth0","network":"192.168.1.0/24"},{"link":"eth1","network":"203.0.113.0/24"}]}}`))
-	if err != nil || !had || a.Machine == nil {
-		t.Fatalf("%+v had %v err %v", a, had, err)
-	}
-	n := a.Machine.Networks
-	if len(n) != 2 || n[0].Link != "eth0" || n[0].Network != "192.168.1.0/24" || n[1].Network != "203.0.113.0/24" {
-		t.Fatalf("networks read as %+v", n)
-	}
-}
@@ -0,0 +1,252 @@
+package inventory
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+
+	"github.com/jackc/pgx/v5"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/secrets"
+)
+
+// A provision whose credential only a person outside the mesh can give (novox/hq ADR 0337, issue 164): a Servarr
+// app's API key, an indexer's key, a downloader's password. The provider's software holds the value; the mesh can
+// neither make one that would work nor fetch it. So the mesh never makes one (§2), a person gives it once per
+// provider and it is sealed to every consumer of that provider (§3), and until then a consumer holds no credential
+// for it and is told so (§4), and the rest of it runs.
+
+// NotGivenError is a pair credential only a person can give, which no person gave for this pair under the keys its
+// two ends have now: the consumer receives no credential for it, and waits (ADR 0337 §4, §8). It is not a fault of
+// the machine, so the plan does not refuse the machine for it.
+type NotGivenError struct {
+	Provision, Consumer, ConsumerModule, Provider, ProviderModule, Local string
+	// Own is set when the credential is the provider's own secret issued outside (ADR 0158, ADR 0228), and names it.
+	Own string
+	// Why is why no value is held, in words that never carry one.
+	Why string
+}
+
+func (e *NotGivenError) Error() string {
+	if e.Own != "" {
+		return fmt.Sprintf("%s on %s holds no %s from %s: %s; give it with `secret accept %s %s %s`",
+			e.ConsumerModule, e.Consumer, e.Provision, e.Provider, e.Why, e.Provider, e.ProviderModule, e.Own)
+	}
+	return fmt.Sprintf("%s on %s holds no %s from %s: %s; it is issued outside the mesh and given with `%s`",
+		e.ConsumerModule, e.Consumer, e.Provision, e.Provider, e.Why, acceptLine(e.Provider, e.ProviderModule, e.Provision))
+}
+
+// IsNotGiven is whether an error is a credential only a person gives, not given yet.
+func IsNotGiven(err error) bool {
+	var ng *NotGivenError
+	return errors.As(err, &ng)
+}
+
+// acceptLine is the one line that gives a provision's credential issued outside, for every consumer of a provider.
+func acceptLine(provider, providerModule, provision string) string {
+	if providerModule == "" {
+		providerModule = "<provider module>"
+	}
+	return fmt.Sprintf("secret accept %s %s %s", provider, providerModule, provision)
+}
+
+// AcceptLine is acceptLine, for the controller's words.
+func AcceptLine(provider, providerModule, provision string) string {
+	return acceptLine(provider, providerModule, provision)
+}
+
+// issuedOutside is whether a module in the catalogue offers the provision with a credential issued outside the
+// mesh, and which.
+func (i *Inventory) issuedOutside(ctx context.Context, provision string) (string, bool, error) {
+	shelf, err := i.Catalogue(ctx)
+	if err != nil {
+		return "", false, err
+	}
+	module, outside := catalogue.OffersIssuedOutside(shelf, provision)
+	return module, outside, nil
+}
+
+// ownIssuedOutside is whether a provider's own secret says only an outside party issues it (ADR 0228).
+func (i *Inventory) ownIssuedOutside(ctx context.Context, providerModule, own string) (string, bool, error) {
+	if providerModule == "" {
+		return own, false, nil
+	}
+	m, err := i.declared(ctx, providerModule)
+	if err != nil {
+		return own, false, err
+	}
+	return own, m.OwnSecrets[own].IssuedBy == catalogue.IssuedOutside, nil
+}
+
+// GivenPairSecret is the credential of a pair whose provision is issued outside the mesh, as a person gave it, and
+// never one the mesh makes (ADR 0337 §2, §4). It writes nothing. A value is answered only when a person gave it
+// (`accepted`) and it is sealed to the keys both ends have now; otherwise a NotGivenError says why — never given, or
+// given under a key one end no longer has (§8), or a value the mesh made before the rule, which is not given and
+// never delivered again (§2).
+func (i *Inventory) GivenPairSecret(ctx context.Context, name, consumer, consumerModule, provider, providerModule,
+	local string) (Secret, error) {
+	consumerKey, err := i.SealingKeyOf(ctx, consumer)
+	if err != nil {
+		return Secret{}, err
+	}
+	providerKey, err := i.SealingKeyOf(ctx, provider)
+	if err != nil {
+		return Secret{}, err
+	}
+	consumerNode, err := i.NodeByName(ctx, consumer)
+	if err != nil {
+		return Secret{}, err
+	}
+	providerNode, err := i.NodeByName(ctx, provider)
+	if err != nil {
+		return Secret{}, err
+	}
+	notGiven := func(why string) (Secret, error) {
+		return Secret{}, &NotGivenError{Provision: name, Consumer: consumer, ConsumerModule: consumerModule,
+			Provider: provider, ProviderModule: providerModule, Local: local, Why: why}
+	}
+	var held Secret
+	err = i.store.Pool().QueryRow(ctx,
+		`select for_consumer, for_provider, consumer_key, provider_key, origin from secret
+		 where name = $1 and consumer = $2 and consumer_module = $3 and provider = $4 and local = $5`,
+		name, consumerNode.ID, consumerModule, providerNode.ID, local).
+		Scan(&held.ForConsumer, &held.ForProvider, &held.ConsumerKey, &held.ProviderKey, &held.Origin)
+	switch {
+	case errors.Is(err, pgx.ErrNoRows):
+		return notGiven("nobody gave it")
+	case err != nil:
+		return Secret{}, err
+	case held.Origin != OriginAccepted:
+		return notGiven("the value held was made by the mesh, which " + providerModule + "'s software would refuse")
+	case consumerKey == "" || providerKey == "" || held.ConsumerKey != consumerKey || held.ProviderKey != providerKey:
+		return notGiven("it was given under a sealing key one end no longer has")
+	}
+	held.Name, held.Consumer, held.Provider = name, consumer, provider
+	held.ConsumerModule, held.Local = consumerModule, local
+	return held, nil
+}
+
+// PairEnd is one consumer of a provision from one provider: the machine, the module there and its local name.
+type PairEnd struct {
+	Consumer, ConsumerModule, Local string
+}
+
+// ProvisionAccepted is what one accept for a provider sealed (ADR 0337 §3): the consumers it reached, those it could
+// not (no sealing key on their machine), and the machines to send.
+type ProvisionAccepted struct {
+	Sealed, Unsealable []PairEnd
+	Machines           []string
+}
+
+// AcceptSecretForProvision seals one value a person gave for a provision issued outside the mesh to the provider's
+// machine, to every consumer named, and to the operator, in one act under one generation, each row `accepted`
+// (ADR 0337 §3, issue 165); the plaintext is not kept. The consumers are every one that binds the provision from
+// this provider now, which the caller finds by resolving every machine. A consumer whose machine has no sealing key
+// is not sealed to, and said.
+func (i *Inventory) AcceptSecretForProvision(ctx context.Context, provision, provider, providerModule, value string,
+	consumers []PairEnd) (ProvisionAccepted, error) {
+	m, err := i.declared(ctx, providerModule)
+	if err != nil {
+		return ProvisionAccepted{}, err
+	}
+	if !m.IssuedOutsideOf(provision) {
+		return ProvisionAccepted{}, fmt.Errorf("%s does not offer %q with a credential issued outside the mesh "+
+			"(\"credential\": {\"issued-by\": \"outside\"}, ADR 0337), so its consumers' credentials are not given "+
+			"once for the provider", providerModule, provision)
+	}
+	if value == "" {
+		return ProvisionAccepted{}, errors.New("there is nothing to seal")
+	}
+	providerNode, err := i.NodeByName(ctx, provider)
+	if err != nil {
+		return ProvisionAccepted{}, err
+	}
+	providerKey, err := i.SealingKeyOf(ctx, provider)
+	if err != nil {
+		return ProvisionAccepted{}, err
+	}
+	if providerKey == "" {
+		return ProvisionAccepted{}, fmt.Errorf("%s has no sealing key, so nothing can be sealed to it; a node joins to get one", provider)
+	}
+	forOperator, operatorKey, err := i.operatorSeal(ctx, value)
+	if err != nil {
+		return ProvisionAccepted{}, err
+	}
+	generation := secrets.Stamp()
+	var out ProvisionAccepted
+	machines := map[string]bool{provider: true}
+	tx, err := i.store.Pool().Begin(ctx)
+	if err != nil {
+		return ProvisionAccepted{}, err
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	for _, c := range consumers {
+		consumerNode, err := i.NodeByName(ctx, c.Consumer)
+		if err != nil {
+			return ProvisionAccepted{}, err
+		}
+		consumerKey, err := i.SealingKeyOf(ctx, c.Consumer)
+		if err != nil {
+			return ProvisionAccepted{}, err
+		}
+		if consumerKey == "" {
+			out.Unsealable = append(out.Unsealable, c)
+			continue
+		}
+		sealed, err := secrets.Accept(value, consumerKey, providerKey)
+		if err != nil {
+			return ProvisionAccepted{}, err
+		}
+		if _, err := tx.Exec(ctx,
+			`insert into secret (name, consumer, consumer_module, provider, for_consumer, for_provider,
+			                     consumer_key, provider_key, operator_sealed, operator_key, origin, local, generation)
+			 values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
+			 on conflict (name, local, consumer, consumer_module, provider) do update set
+			   for_consumer = excluded.for_consumer, for_provider = excluded.for_provider,
+			   consumer_key = excluded.consumer_key, provider_key = excluded.provider_key,
+			   created_at = now(), origin = excluded.origin, generation = excluded.generation,
+			   operator_sealed = excluded.operator_sealed, operator_key = excluded.operator_key`,
+			provision, consumerNode.ID, c.ConsumerModule, providerNode.ID,
+			sealed.ForConsumer, sealed.ForProvider, sealed.ConsumerKey, sealed.ProviderKey,
+			forOperator, operatorKey, OriginAccepted, c.Local, generation); err != nil {
+			return ProvisionAccepted{}, err
+		}
+		out.Sealed = append(out.Sealed, c)
+		machines[c.Consumer] = true
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return ProvisionAccepted{}, err
+	}
+	for n := range machines {
+		out.Machines = append(out.Machines, n)
+	}
+	sort.Strings(out.Machines)
+	return out, nil
+}
+
+// GivenPairsOf is every provision a module on a machine holds a value a person gave for, sealed to the keys both
+// ends have now: what a wait for a provision's credential is checked against (ADR 0337 §6).
+func (i *Inventory) GivenPairsOf(ctx context.Context, machine, module string) (map[string]bool, error) {
+	rows, err := i.store.Pool().Query(ctx,
+		`select s.name
+		   from secret s
+		   join node c on c.id = s.consumer
+		   join node p on p.id = s.provider
+		  where c.name = $1 and s.consumer_module = $2 and s.origin = 'accepted'
+		    and s.consumer_key = c.sealing_key and s.provider_key = p.sealing_key`, machine, module)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := map[string]bool{}
+	for rows.Next() {
+		var name string
+		if err := rows.Scan(&name); err != nil {
+			return nil, err
+		}
+		out[name] = true
+	}
+	return out, rows.Err()
+}
@@ -0,0 +1,195 @@
+package inventory
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// outsideProvision registers a provider offering tv-api with a credential issued outside the mesh (novox/hq ADR
+// 0337 §1) and two consumers requiring it, on twoNodesWithKeys' machines.
+func outsideProvision(t *testing.T, inv *Inventory) {
+	t.Helper()
+	ctx := t.Context()
+	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "tv", Version: "1",
+		Provides: []catalogue.Offer{{Name: "tv-api", Scope: catalogue.ScopeMesh,
+			Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}}}, Source{}); err != nil {
+		t.Fatal(err)
+	}
+	for _, m := range []string{"requests", "indexer"} {
+		if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: m, Version: "1", Requires: []string{"tv-api"},
+			Secrets: map[string]string{"tv-api": "/run/tv-api.secret"}}, Source{}); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+// pairRows is how many pair rows the store holds for tv-api.
+func pairRows(t *testing.T, inv *Inventory) int {
+	t.Helper()
+	var n int
+	if err := inv.store.Pool().QueryRow(t.Context(), `select count(*) from secret where name = 'tv-api'`).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	return n
+}
+
+// A credential only a person can give is never made (ADR 0337 §2, issue 164): not for a pair with no row, which is
+// what a newly bound consumer has, and not after a key change; a value the mesh made before the rule is not given.
+func TestACredentialIssuedOutsideIsNeverMade(t *testing.T) {
+	inv, ctx := twoNodesWithKeys(t)
+	outsideProvision(t, inv)
+
+	_, err := inv.SecretFor(ctx, "tv-api", "consumer", "requests", "provider", "")
+	if !IsNotGiven(err) {
+		t.Fatalf("SecretFor made or refused a credential only a person gives, rather than saying it was not given: %v", err)
+	}
+	if !strings.Contains(err.Error(), "secret accept provider tv tv-api") {
+		t.Fatalf("not given does not name the one line that gives it: %v", err)
+	}
+	if n := pairRows(t, inv); n != 0 {
+		t.Fatalf("the store holds %d rows for tv-api, which nobody gave", n)
+	}
+	if _, err := inv.GivenPairSecret(ctx, "tv-api", "consumer", "requests", "provider", "tv", ""); !IsNotGiven(err) {
+		t.Fatalf("a pair nobody gave read as given: %v", err)
+	}
+	if n := pairRows(t, inv); n != 0 {
+		t.Fatalf("reading the pair wrote %d rows", n)
+	}
+
+	// A value the mesh made before the rule (the minted value of issue 164) is not given.
+	if _, err := inv.store.Pool().Exec(ctx, `insert into secret (name, consumer, consumer_module, provider,
+		for_consumer, for_provider, consumer_key, provider_key, local)
+		select 'tv-api', c.id, 'indexer', p.id, 'x', 'y', c.sealing_key, p.sealing_key, ''
+		  from node c, node p where c.name = 'consumer' and p.name = 'provider'`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.GivenPairSecret(ctx, "tv-api", "consumer", "indexer", "provider", "tv", ""); !IsNotGiven(err) ||
+		!strings.Contains(err.Error(), "made by the mesh") {
+		t.Fatalf("a value the mesh made before the rule read as given: %v", err)
+	}
+
+	// Given, then a key changes: not given, and nothing is made in its place (ADR 0337 §8).
+	if _, err := inv.AcceptSecretForProvision(ctx, "tv-api", "provider", "tv", "the app's key",
+		[]PairEnd{{Consumer: "consumer", ConsumerModule: "requests"}}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.GivenPairSecret(ctx, "tv-api", "consumer", "requests", "provider", "tv", ""); err != nil {
+		t.Fatalf("the value given does not read as given: %v", err)
+	}
+	cn, _ := inv.NodeByName(ctx, "consumer")
+	key, _ := aSealingKey(t)
+	if err := inv.RecordSealingKey(ctx, cn.ID, key); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.GivenPairSecret(ctx, "tv-api", "consumer", "requests", "provider", "tv", ""); !IsNotGiven(err) ||
+		!strings.Contains(err.Error(), "sealing key") {
+		t.Fatalf("a value given under a key the consumer no longer has read as given: %v", err)
+	}
+	var origin string
+	if err := inv.store.Pool().QueryRow(ctx, `select origin from secret where name = 'tv-api' and consumer_module = 'requests'`).
+		Scan(&origin); err != nil || origin != OriginAccepted {
+		t.Fatalf("the given row was replaced (origin %q, %v)", origin, err)
+	}
+
+	// Rotate refuses it, naming the accept (ADR 0337 §9).
+	err = inv.RotateSecret(ctx, "tv-api", "consumer", "requests", "provider", "")
+	if err == nil || !strings.Contains(err.Error(), "secret accept provider tv tv-api") {
+		t.Fatalf("rotate of a credential issued outside was not refused naming the accept: %v", err)
+	}
+}
+
+// One accept for a provider is sealed to every consumer named, to the provider and to the operator, under one
+// generation, each row accepted (ADR 0337 §3, issue 165); a consumer with no sealing key is said, not sealed to.
+func TestOneAcceptForAProviderIsSealedToEveryConsumer(t *testing.T) {
+	inv, ctx := twoNodesWithKeys(t)
+	outsideProvision(t, inv)
+	operatorKey, operatorOpens := aSealingKey(t)
+	if _, err := inv.SetOperatorKey(ctx, operatorKey); err != nil {
+		t.Fatal(err)
+	}
+	consumerKey, consumerOpens := aSealingKey(t)
+	cn, _ := inv.NodeByName(ctx, "consumer")
+	if err := inv.RecordSealingKey(ctx, cn.ID, consumerKey); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.AddNode(ctx, "keyless"); err != nil {
+		t.Fatal(err)
+	}
+
+	accepted, err := inv.AcceptSecretForProvision(ctx, "tv-api", "provider", "tv", "the app's key", []PairEnd{
+		{Consumer: "consumer", ConsumerModule: "requests"}, {Consumer: "consumer", ConsumerModule: "indexer"},
+		{Consumer: "keyless", ConsumerModule: "requests"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(accepted.Sealed) != 2 || len(accepted.Unsealable) != 1 || accepted.Unsealable[0].Consumer != "keyless" {
+		t.Fatalf("the accept did not seal to both consumers with keys and say the keyless one: %+v", accepted)
+	}
+	if strings.Join(accepted.Machines, ",") != "consumer,provider" {
+		t.Fatalf("the machines to send are the provider's and every consumer's sealed to: %v", accepted.Machines)
+	}
+	rows, err := inv.store.Pool().Query(ctx, `select consumer_module, origin, coalesce(generation, ''), for_consumer,
+		coalesce(operator_sealed, '') from secret where name = 'tv-api'`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rows.Close()
+	generations := map[string]bool{}
+	seen := 0
+	for rows.Next() {
+		var module, origin, generation, forConsumer, forOperator string
+		if err := rows.Scan(&module, &origin, &generation, &forConsumer, &forOperator); err != nil {
+			t.Fatal(err)
+		}
+		seen++
+		if origin != OriginAccepted || generation == "" {
+			t.Fatalf("%s's row is not accepted under a generation (origin %q)", module, origin)
+		}
+		generations[generation] = true
+		if opened, ok := consumerOpens(forConsumer); !ok || string(opened) != "the app's key" {
+			t.Fatalf("%s's copy does not open to the value given", module)
+		}
+		if opened, ok := operatorOpens(forOperator); !ok || string(opened) != "the app's key" {
+			t.Fatalf("%s's operator copy does not open to the value given", module)
+		}
+	}
+	if seen != 2 || len(generations) != 1 {
+		t.Fatalf("%d rows under %d generations; want 2 under one", seen, len(generations))
+	}
+	given, err := inv.GivenPairsOf(ctx, "consumer", "indexer")
+	if err != nil || !given["tv-api"] {
+		t.Fatalf("the provision given does not read as given for indexer (%v)", err)
+	}
+
+	// Only an offer that says so is given this way.
+	if _, err := inv.AcceptSecretForProvision(ctx, "secret", "provider", "gitea", "x", nil); err == nil {
+		t.Fatal("a provision not issued outside was given once for its provider")
+	}
+}
+
+// The provider's own secret issued outside the mesh, named as a provision's shared credential (ADR 0158, ADR 0228),
+// is never made for a consumer that binds: the consumer is told it was not given (ADR 0337 §2, §4).
+func TestASharedOwnSecretIssuedOutsideIsNeverMade(t *testing.T) {
+	inv, ctx := twoNodesWithKeys(t)
+	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "downloader", Version: "1",
+		OwnSecrets: catalogue.OwnSecrets{"password": {Path: "/run/password", Taken: catalogue.TakenAtStart,
+			IssuedBy: catalogue.IssuedOutside}},
+		Provides: []catalogue.Offer{{Name: "downloader-api", Scope: catalogue.ScopeMesh,
+			Credential: &catalogue.OfferCredential{Own: "password"}}}}, Source{}); err != nil {
+		t.Fatal(err)
+	}
+	_, err := inv.SharedSecretFor(ctx, "downloader-api", "consumer", "gitea", "provider", "downloader", "", "password")
+	if !IsNotGiven(err) {
+		t.Fatalf("a shared own secret issued outside was made or refused rather than not given: %v", err)
+	}
+	var n int
+	if err := inv.store.Pool().QueryRow(ctx, `select count(*) from module_secret where module = 'downloader'`).Scan(&n); err != nil || n != 0 {
+		t.Fatalf("the mesh made %d values of an own secret issued outside (%v)", n, err)
+	}
+	if err := inv.remakeShared(ctx, nil, "", "downloader", "password", "", nil, "", "", ""); err == nil ||
+		!strings.Contains(err.Error(), "issued outside") {
+		t.Fatalf("remakeShared made a value of an own secret issued outside: %v", err)
+	}
+}
@@ -104,6 +104,21 @@ func (i *Inventory) SecretFor(ctx context.Context, name, consumer, consumerModul
 			consumerModule, name, provider, consumer, consumerModule, name, provider, localFlag(local))
 	}

+	// **Never made where only a person can give it** (novox/hq ADR 0337 §2, issue 164): a provision whose offer
+	// says `issued-by: outside` gets no value of the mesh's, which its provider's software would refuse. Asked
+	// here, on the one path that makes a value, so no caller can have one made by not knowing; the plan reads
+	// such a pair with GivenPairSecret, which never makes one and delivers only a value a person gave.
+	why := "nobody gave it"
+	if err == nil {
+		why = "the value held was sealed to a key one end no longer has"
+	}
+	if providerModule, outside, oerr := i.issuedOutside(ctx, name); oerr != nil {
+		return Secret{}, oerr
+	} else if outside {
+		return Secret{}, &NotGivenError{Provision: name, Consumer: consumer, ConsumerModule: consumerModule,
+			Provider: provider, ProviderModule: providerModule, Local: local, Why: why}
+	}
+
 	// And to the operator, when the mesh has one (novox/hq ADR 0085, amended): the third copy that
 	// makes a vault-provided secret recoverable, and nothing the mesh can open.
 	operator, err := i.OperatorKey(ctx)
@@ -239,6 +254,16 @@ func (i *Inventory) RotateSecret(ctx context.Context, name, consumer, consumerMo
 		`select origin from secret where name = $1 and consumer = $2 and consumer_module = $3
 		   and provider = $4 and local = $5`,
 		name, consumerNode.ID, consumerModule, providerNode.ID, local).Scan(&origin)
+	if providerModule, outside, oerr := i.issuedOutside(ctx, name); oerr != nil {
+		return oerr
+	} else if outside {
+		// Only a person can give it, so only a person can give its next value (novox/hq ADR 0337 §9, ADR 0092 §7):
+		// deleting the row would leave the consumer waiting for nothing new.
+		return fmt.Errorf(
+			"%s is issued outside the mesh: %s's software holds it and the mesh cannot make its replacement. "+
+				"Give the new value with `%s`, which seals it to every consumer of %s on %s",
+			name, providerModule, acceptLine(provider, providerModule, name), providerModule, provider)
+	}
 	if err == nil && origin == OriginAccepted {
 		return fmt.Errorf(
 			"%s's %q credential from %s was accepted from a person, and the mesh cannot make "+
@@ -886,6 +911,15 @@ func (i *Inventory) SharedSecretFor(ctx context.Context, provision, consumer, co
 		held.ConsumerModule, held.Local = consumerModule, local
 		return held, nil
 	}
+	if own, outside, err := i.ownIssuedOutside(ctx, providerModule, own); err != nil {
+		return Secret{}, err
+	} else if outside && (ownOrigin == nil || *ownOrigin != OriginAccepted) {
+		// The provider's own secret only an outside party issues, which nobody gave (ADR 0228, issue 401): the
+		// mesh makes no value for it here either, and the consumer is told it was not given (ADR 0337 §4).
+		return Secret{}, &NotGivenError{Provision: provision, Consumer: consumer, ConsumerModule: consumerModule,
+			Provider: provider, ProviderModule: providerModule, Local: local, Own: own,
+			Why: "nobody gave " + providerModule + "'s own secret " + own + ", which is issued outside the mesh"}
+	}
 	if ownOrigin != nil && *ownOrigin == OriginAccepted {
 		return Secret{}, fmt.Errorf(
 			"%s on %s needs %s from %s, whose credential is %s's own secret %q — a value given to the "+
@@ -912,6 +946,11 @@ func (i *Inventory) remakeShared(ctx context.Context, providerID any, providerKe
 	if len(provisions) == 0 {
 		return fmt.Errorf("%s names no provision whose credential is its own secret %q", providerModule, own)
 	}
+	if m.OwnSecrets[own].IssuedBy == catalogue.IssuedOutside {
+		// Never made (novox/hq ADR 0228, ADR 0337 §2): only a person can give it, with `secret accept`.
+		return fmt.Errorf("%s's own secret %q is issued outside the mesh, so the mesh makes no value for it; a "+
+			"person gives it with `secret accept <machine> %s %s`", providerModule, own, providerModule, own)
+	}
 	operator, err := i.OperatorKey(ctx)
 	if err != nil {
 		return err
@@ -577,7 +577,10 @@ type Wait struct {
 	Part    string `json:"part"`
 	Secret  string `json:"secret,omitempty"`
 	Setting string `json:"setting,omitempty"`
-	What    string `json:"what"`
+	// Provision is a provision the module requires whose credential only a person can give and nobody gave yet
+	// (novox/hq ADR 0337 §5): a wait names exactly one of Secret, Setting or Provision.
+	Provision string `json:"provision,omitempty"`
+	What      string `json:"what"`
 }

 // ResourceHealth is one long-running resource's state.
@@ -45,3 +45,9 @@
 ./cmd/mesh-controller TestReplay348AFaultFromBeforeTheSendFailsNoGate
 ./cmd/mesh-controller TestReplay239AModuleNameIsNotTakenOverByAnotherRepository
 ./cmd/mesh-controller TestAWalkThatMovedNothingSaysWhichModulesMatchedWhatRuns
+./cmd/mesh-controller TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles
+./internal/inventory TestACredentialIssuedOutsideIsNeverMade
+./internal/inventory TestOneAcceptForAProviderIsSealedToEveryConsumer
+./internal/inventory TestASharedOwnSecretIssuedOutsideIsNeverMade
+./cmd/mesh-controller TestOneAcceptForAProviderIsPlacedForEveryConsumer
+./cmd/mesh-controller TestReplay164
Author	SHA1	Message	Date
mesh-admin	584aa2d7d7	Merge pull request 'Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)' (#298 ) from fix/164-an-accepted-credential-is-never-minted into main	2026-10-13 09:52:07 +00:00
jochen	c9dd07f919	Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337) mesh/merge-gate head c9dd07f919a2 merged into trunk 404b4409e70e — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every … Details mesh/repo-check head c9dd07f919a2 merged into trunk 404b4409e70e — pass: its merge-check.sh passed (run 2) Details mesh/delivery delivered Details A Servarr app's API key, an indexer's key and a downloader's password are values the provider's software holds; the pair path made a random value for every consumer of them, sealed it to both ends and reported success, and the provider refused it. An offer may now say `"credential": {"issued-by": "outside"}`: SecretFor never makes a value for it, the plan reads such a pair as given or not given and sends the consumer no credential file until a person gives it, without refusing its machine; remakeShared and SharedSecretFor never make a provider's own secret issued outside either. `secret accept <provider's node> <provider module> <provision>` seals one value to every consumer that binds the provision from that provider, the provider and the operator, under one generation; the per-pair form is refused for such a provision, and rotate names the accept. A consumer may wait for a provision's credential: the controller excuses the wait only when the store bears it out, and its needs-operator condition names the one accept line. Adds the replay of issue 164 (TestReplay164), written with only what the controller had before.	2026-10-13 11:37:31 +02:00
mesh-admin	404b4409e7	Merge pull request 'A built module keeps its build edges: a new SDK plans the toolchain and its TypeScript bundles (hq issue 614)' (#296 ) from fix/614-a-built-module-keeps-its-build-edges into main	2026-10-13 09:35:26 +00:00
jochen	e658a14296	Read a built module's build edges from what is kept of it, so a new SDK rebuilds its toolchain and bundles (hq issue 614) mesh/merge-gate head e658a14296f9 merged into trunk 1826b68a22b5 — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every … Details mesh/repo-check head e658a14296f9 merged into trunk 1826b68a22b5 — pass: its merge-check.sh passed Details mesh/delivery delivered Details A registered manifest carries no build, so mesh-tools' build.on naming the SDK's package and every bundle's toolchain were edges only before a module was first built: mesh-sdk 0.1.14 planned "sent nowhere". The relation now reads a package base from the recorded name@version against the package the mesh holds, and the toolchain from the bundles the resolved manifest keeps. Only records the mesh already keeps are read, so it holds for every module built before it and a rollback reads the same records. Replay R614.	2026-10-13 11:08:17 +02:00