Name a provision's credential as the vault's own names it, read each node's provisions by its engine, and give mesh-config's held values their layout in the sdk, so the vault, the engine and the composition checks read one form (issue 1954, issue 1953 D7)

go/provisions/provisions.go

@@ -92,6 +92,35 @@ func PlanKey(node, module string) (string, error) {
 	return node + "." + module, nil
 }
 
+// The forms of a provision's credential, as a plan's entry names them (catalogue.PlanProvision.CredentialForm).
+const (
+	FormPair   = "pair"
+	FormShared = "shared"
+	FormIssued = "issued"
+	FormGiven  = "given"
+)
+
+// VaultName is the vault's name of a provision's credential in form, as its verb `own` names it and the provider asks
+// it: `pair/<provider node>/<provision>/<consumer node>/<module>[/<local>]` for a login of the consumer's own (ADR 0158
+// §11), `provision/<provider node>/<provision>` for the provider's one shared value, and `provision/<provider
+// node>/<provision>/<consumer node>/<module>` for a holder's own issued or given value. Empty for a form with no
+// credential.
+func VaultName(form string, p Provision) string {
+	switch form {
+	case FormPair:
+		n := "pair/" + p.Provider.Node + "/" + p.Provision + "/" + p.Consumer.Node + "/" + p.Consumer.Module
+		if p.Local != "" {
+			n += "/" + p.Local
+		}
+		return n
+	case FormShared:
+		return "provision/" + p.Provider.Node + "/" + p.Provision
+	case FormIssued, FormGiven:
+		return "provision/" + p.Provider.Node + "/" + p.Provision + "/" + p.Consumer.Node + "/" + p.Consumer.Module
+	}
+	return ""
+}
+
 // End is one end of a provision: a module on a node.
 type End struct {
 	Module string `json:"module"`
@@ -99,7 +128,9 @@ type End struct {
 }
 
 // Reference is a value the vault keeps, by its id and the generation of the value: never the value, sealed or not
-// (ADR 0349 §7). The holder writes the generation the vault says in its own entry (clause 6).
+// (ADR 0349 §7). The holder writes the generation the vault says in its own entry (clause 6). ID is the vault's name of
+// the credential exactly as its verb `own` names it (VaultName): the consuming node's engine checks both the name and
+// the generation of what it is handed.
 type Reference struct {
 	ID         string `json:"id"`
 	Generation int    `json:"generation"`

go/provisions/provisions_test.go

@@ -72,6 +72,16 @@ func TestAProvisionIsAReferenceUnderItsConsumersKey(t *testing.T) {
 	if k, err := PlanKey("novox", "restic"); k != "novox.restic" || err != nil {
 		t.Errorf("a plan's key is %q, %v", k, err)
 	}
+	// A reference's id is the vault's name as its verb own names it, in each form (the host agent, 2026-10-29).
+	for form, want := range map[string]string{FormPair: "pair/novox/postgres-database/novox/keycloak", FormShared: "provision/novox/postgres-database",
+		FormIssued: "provision/novox/postgres-database/novox/keycloak", "none": ""} {
+		if got := VaultName(form, db); got != want {
+			t.Errorf("the %s name is %q", form, got)
+		}
+	}
+	if got := VaultName(FormPair, Provision{Provision: "p", Local: "r", Provider: End{Node: "a"}, Consumer: End{Node: "b", Module: "m"}}); got != "pair/a/p/b/m/r" {
+		t.Errorf("a local name's pair is %q", got)
+	}
 	if ProvisionsBucket != "mesh-provisioner_provisions" || PlansRead != "mesh-provisioner.plans" {
 		t.Errorf("the states are %s and %s", ProvisionsBucket, PlansRead)
 	}