coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/tools/rotation-lanes
History
Exact
tegwick 666160a390
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
NK-WP-0055-T15: credential rotation-lane register with coverage check 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
2026-10-28 11:01:08 +01:00
..
tests NK-WP-0055-T15: credential rotation-lane register with coverage check 2026-10-28 11:01:08 +01:00
check.py NK-WP-0055-T15: credential rotation-lane register with coverage check 2026-10-28 11:01:08 +01:00
lanes.yaml NK-WP-0055-T15: credential rotation-lane register with coverage check 2026-10-28 11:01:08 +01:00
README.md NK-WP-0055-T15: credential rotation-lane register with coverage check 2026-10-28 11:01:08 +01:00

README.md

Credential Rotation Lanes

NK-WP-0055-T15. lanes.yaml lists every credential lane: how the credential is replaced, its blast radius, the step that proves the rotation worked, and the owner lane (workplan task) that holds it. It is value-free: names, paths and procedures only.

make rotation-lanes-check   # every known credential has a complete lane (offline, read-only)
make rotation-lanes-test    # synthetic tests

The check derives "every known credential" from three repository sources and fails on a gap:

Source What must have a lane
tools/service-identity/declarations/*.yaml Each identity whose custody is not none (federated logins hold nothing to rotate; they may still be named)
canon/standards/credential-management_v0.2.md section 6 Each backticked secret name in its tables
docs/crisis-custody-list.md Each numbered item that is not struck through as retired

It also refuses a lane without blast radius, verification or owner lane, an unknown NetKingdom task reference, and a credential assigned to two lanes. A new declaration, secret or crisis item therefore needs a lane in the same change.

state says how far each lane is: admitted (owner lane accepted and runnable), designed (procedure written, not admitted), deferred (held by a founder decision, today the rotation deferral 1591daa1 behind NK-WP-0055-T06) or none (no rotation, reason given).