tegwick
666160a390
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 308701@bnt-lap001 Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
26 lines
1.4 KiB
Markdown
26 lines
1.4 KiB
Markdown
# Credential Rotation Lanes
|
|
|
|
NK-WP-0055-T15. `lanes.yaml` lists every credential lane: how the credential is replaced, its
|
|
blast radius, the step that proves the rotation worked, and the owner lane (workplan task) that
|
|
holds it. It is value-free: names, paths and procedures only.
|
|
|
|
```bash
|
|
make rotation-lanes-check # every known credential has a complete lane (offline, read-only)
|
|
make rotation-lanes-test # synthetic tests
|
|
```
|
|
|
|
The check derives "every known credential" from three repository sources and fails on a gap:
|
|
|
|
| Source | What must have a lane |
|
|
| --- | --- |
|
|
| `tools/service-identity/declarations/*.yaml` | Each identity whose custody is not `none` (federated logins hold nothing to rotate; they may still be named) |
|
|
| `canon/standards/credential-management_v0.2.md` section 6 | Each backticked secret name in its tables |
|
|
| `docs/crisis-custody-list.md` | Each numbered item that is not struck through as retired |
|
|
|
|
It also refuses a lane without blast radius, verification or owner lane, an unknown NetKingdom
|
|
task reference, and a credential assigned to two lanes. A new declaration, secret or crisis item
|
|
therefore needs a lane in the same change.
|
|
|
|
`state` says how far each lane is: `admitted` (owner lane accepted and runnable), `designed`
|
|
(procedure written, not admitted), `deferred` (held by a founder decision, today the rotation
|
|
deferral `1591daa1` behind NK-WP-0055-T06) or `none` (no rotation, reason given).
|