# Credential Rotation Lanes

NK-WP-0055-T15. `lanes.yaml` lists every credential lane: how the credential is replaced, its
blast radius, the step that proves the rotation worked, and the owner lane (workplan task) that
holds it. It is value-free: names, paths and procedures only.

```bash
make rotation-lanes-check   # every known credential has a complete lane (offline, read-only)
make rotation-lanes-test    # synthetic tests
```

The check derives "every known credential" from three repository sources and fails on a gap:

| Source | What must have a lane |
| --- | --- |
| `tools/service-identity/declarations/*.yaml` | Each identity whose custody is not `none` (federated logins hold nothing to rotate; they may still be named) |
| `canon/standards/credential-management_v0.2.md` section 6 | Each backticked secret name in its tables |
| `docs/crisis-custody-list.md` | Each numbered item that is not struck through as retired |

It also refuses a lane without blast radius, verification or owner lane, an unknown NetKingdom
task reference, and a credential assigned to two lanes. A new declaration, secret or crisis item
therefore needs a lane in the same change.

`state` says how far each lane is: `admitted` (owner lane accepted and runnable), `designed`
(procedure written, not admitted), `deferred` (held by a founder decision, today the rotation
deferral `1591daa1` behind NK-WP-0055-T06) or `none` (no rotation, reason given).