-- A pair credential records whether the mesh made it or a person supplied it
-- (novox/hq 04-ISSUES/070, ADR 0092).
--
-- Every pair credential so far was made: generated, sealed to both ends, the plaintext discarded,
-- remade whenever either end's key changed and replaced whole by `rotate`. A module's own secret
-- has carried `origin` since the beginning so an accepted one is never replaced by a minted one;
-- a pair could not be accepted at all, so the vault's third species -- a credential for something
-- outside the mesh, which only a person can supply -- had no entry.
--
-- An accepted pair is not remade when a key changes (the mesh cannot: it does not hold the
-- value) and is not rotated (there is nothing to rotate to); both are refused aloud, and the
-- remedy is to accept it again.

alter table secret add column origin text not null default 'made';