Fix rotation review evidence and reconcile blocked S1 workplans

Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e3b9-b19e-7ba1-9eb4-4faea76af3ea
2026-09-27 18:47:55 +02:00 · 2026-09-27 18:47:55 +02:00 · 9886567b40
commit 9886567b40
parent 41f25fe42d
10 changed files with 255 additions and 18 deletions
--- a/docs/sops-rotation-approval.example.yaml
+++ b/docs/sops-rotation-approval.example.yaml
@ -1,9 +1,10 @@
 # Metadata-only example. Copy outside Git for an attended approved rotation.
 approved: false
-approved_by: "operator-name"
+approved_by: "reviewer-name"
 approved_at: "2026-08-23T00:00:00Z"
 changes:
  - path: secrets/hetzner-token.yaml
+    sha256: "replace-with-exact-ciphertext-sha256-from-plan"
    before_recipients:
      - age1old-example-not-valid
    after_recipients: