From 5129358b0a2c27c7df3bdf400e51ff85013dc486 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 10 Oct 2026 15:29:31 +0200 Subject: [PATCH] audit-core-senders: rotation guidance pointing at audit-core's overlap-first procedure Promotion criterion 9 (catalog_rotation_coverage) caught the missing block on activation. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 427672@bnt-lap001 Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8 --- registry/routing/catalog.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/registry/routing/catalog.yaml b/registry/routing/catalog.yaml index c76ffbf..805cbba 100644 --- a/registry/routing/catalog.yaml +++ b/registry/routing/catalog.yaml @@ -1359,6 +1359,14 @@ entries: exec_capable: false resolvable: false lane: secret + rotation: + method: rotate + owner: audit-core + automatable: false + steps: + - "Overlap-first per audit-core/docs/operator-runbook.md#sender-credential-rotation: add the replacement token to the sender's tokens list, move the sender to it, then drop the predecessor." + - "Write the updated registry back to platform/workloads/audit-core/senders from a mode-0600 file (never a founder paste, never argv); force the ExternalSecret sync or wait for the 1h refresh, then restart audit-core." + - "Senders with an exact-path projection (tenant-engine) are re-seeded through their own projection lane; verify by metadata and capabilities only." - id: email-connect-transactional title: email-connect transactional SMTP and caller ingest token