Rotate shared private-state encryption keys without downtime #1238

2026-08-21T21:13:13Z

timmy commented

2026-08-21 21:13:13 +00:00

Adds a bounded active-key keyring and authenticated v2 envelopes across every shared private-state consumer, while retaining v1/plaintext reads for rolling deployment. Ships a restart-safe, content-free rotation command covering Today/Week/Later plans, snapshots, saved searches, security events, and idempotency receipts, plus deterministic release packaging and an operator retirement procedure.

TDD proof:

RED: keyring import missing; v2 Today rows failed as plaintext; rotation command missing; release fixture omitted command.
GREEN: 12 focused rotation/release tests passed.
Full suite: 2350 passed, 12 skipped.

Closes #1237 Adds a bounded active-key keyring and authenticated v2 envelopes across every shared private-state consumer, while retaining v1/plaintext reads for rolling deployment. Ships a restart-safe, content-free rotation command covering Today/Week/Later plans, snapshots, saved searches, security events, and idempotency receipts, plus deterministic release packaging and an operator retirement procedure. TDD proof: - RED: keyring import missing; v2 Today rows failed as plaintext; rotation command missing; release fixture omitted command. - GREEN: 12 focused rotation/release tests passed. - Full suite: 2350 passed, 12 skipped.

timmy added 1 commit 2026-08-21 21:13:14 +00:00