---
id: RPF-WP-0055
type: workplan
title: "KeyCape client-secret rotation after first-generation lane acceptance"
domain: financials
repo: railiance-platform
status: backlog
owner: codex
created: "2026-10-10"
updated: "2026-10-10"
flavor: residual
origin: residual
origin_ref: RPF-WP-0054
depends_on: []
related_repos: [key-cape, net-kingdom, ops-warden]
state_hub_workstream_id: "5517b448-3721-55d8-b80d-d61e5e137089"
---

Transferred from RPF-WP-0054-T07 before closing its first-generation lane.
This is a separately scoped later capability, not a blocker of CAS-0 generation
and not promoted demand. Do not implement unless demand or risk promotes it.

## Design, admit and verify a coordinated rotation lane

```task
id: RPF-WP-0055-T01
status: todo
priority: low
state_hub_task_id: "4b9c94fb-1251-5f12-b227-1d9d999cd8ed"
```

After one proven first-generation case run, design
`keycape-client-secret-rotate`: exact-path `update` with CAS = current version,
an attended window coordinated with ESO refresh and the KeyCape restart, and
rollback to the previous version. Obtain the independent owner contracts and
exact-action authorization before live changes. Verify the replacement in the
consumer, scoped delivery, cleanup/revocation and rollback; publish only
non-secret receipts. The existing create-only grant must not be widened merely
to perform this residual.