From 004a72cd5c10bf56b7f8158d137cf724eb330433 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 24 Sep 2026 01:27:36 +0200 Subject: [PATCH] Record the deferred rotation and its triggers (CUST-WP-0073). Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 352750@bnt-lap001 Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b --- docs/operations.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/operations.md b/docs/operations.md index 7a6e254..abcd278 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -168,6 +168,12 @@ bind password and the Authelia client secret. The other three Secrets were probably printed as well. All four must be treated as exposed and rotated; the annotation cleanup folds into that rotation. +**Rotation deferred (founder decision, 2026-09-24, builder mode).** Tracked as +the-custodian `CUST-WP-0073-T05` with event triggers: the first production +workload or customer data, any sign the transcript left the workstation, or a +planned key rotation. The same workplan removes the problem class by giving +agents a cluster identity that cannot read these objects at all. + ## Unreleased fail-closed startup changes (read before the next rollout) The deployed image at the time of writing is