secrets-rotation-log

Secrets Rotation Log — RETIRED

This file is no longer the rotation log. As of #5556, all credential rotations — desktop, worker, and automated (rotate-credentials.py) — are logged in the Supabase table dev_r_rotation_log, written via scripts/lib/rotation_log.py / scripts/rotation-log-entry.py open|close|fail. Never hand-edit this file to log a new rotation.

Its full historical content (428 rows across this file and every docs/YYYY-MM/ archive) was backfilled into dev_r_rotation_log on 2026-08-05 (source='historical-backfill') — query the table directly, or run scripts/rotation-log-entry.py list, to see rotation history. This file and the docs/YYYY-MM/ archives remain in git as the frozen pre-cutover record; nothing was deleted.

Offline fallback (the only remaining reason to touch a markdown file)

If the Supabase API is unreachable at rotation time, rotation_log.py automatically falls back to docs/rotation-log-fallback.md instead of silently dropping the log entry. That file is normally empty — it gets drained back into Supabase automatically (opportunistically on the next successful API call, and by a daily safety-net cron) via rotation-log-entry.py reimport. Never hand-edit docs/rotation-log-fallback.md either; if it has stuck entries, run reimport.

See docs/playbooks/secret-manager-rotation-log.md for the full operating doc. | 2026-09-01 | BMS4_N8N_API_KEY | Rotated | Tier 1 autonomous (n8n internal REST /rest/api-keys) | Issue #6749 | Worker auto | | 2026-09-09 | DISCORD_WEBHOOK_URL | Added + distributed to repo GH secret | Distribution-only (SOPS add → whatsup.env.sops; shared infra-errors webhook) | Issue #214 | Worker auto | | 2026-09-09 | SUPABASE_SERVICE_ROLE_KEY | Re-synced to repo GH secret | Distribution-only (radieu/whatsup-android-chat-puller; SOPS value live-verified 200) | Issue #214 | Worker auto | | 2026-09-15 | RABBITMQ_DEFAULT_PASS | Reconciled to fleet-canonical value | SOPS-only two-file drift fix (n8n-bms4.env.sops ← matches password in V42_RABBIT_MQ_URL / pinbox24-w4.env.sops; verified by hash 19a9b811ce58f8c3, live broker authenticate_user=Success) | Issue #7060 | Worker auto | | 2026-09-18 | GH_TOKEN | Rotated | Tier 2 (Playwright+TOTP) autonomous — display name p24-bms4-github-rw-key; exposure re-leak post-#7111 | Issue #7156 | Worker auto (SOPS: n8n-bms4-gh + monitoring + worker-queue; new 200 / old 401 verified) | | 2026-09-19 | SUPABASE_SERVICE_ROLE_KEY | Rotated + old key revoked | Tier 1 autonomous — completed incomplete #7113 rotation: verified new key p24_service_20260917 live across all consumers (5 SOPS files on main via PR #7116, servers/n8n via secrets-sync, CF meta-dispatcher redeployed), re-asserted stale GH Secrets (p24-infra+et-op held old key), then DELETED leaked key p24_service_20260819 (now HTTP 401) | Issue #7113 | Worker auto (new 200 / old 401 verified; brandpilot+art-agency own projects untouched, whatsup own key untouched) | | 2026-09-23 | ETOP_TEST_{ADMIN,MANAGER,MECHANIK,DRIVER,DISPO_MANAGER,DISPATCHER,MAGAZYN,SERVICE_OFFICE,KONTROLA}PASSWORD | Rotated (9 test-user passwords) | Tier 1 autonomous — Supabase Auth Admin API (project mwkqmgadqnkkihjdeqsi); each new password live sign-in verified 200 before SOPS write; last open item of the .env.local exposure rollup (PLAC already done #7204; TECH_W/Z/M untouched) | Issue #5923 | Worker auto (secrets/et-op-test-users.env.sops; 52 keys/10 recipients preserved; supersedes closed PR #7229 CONFLICTING) | | 2026-09-29 | GH_TOKEN | Rotated | Tier 2 (Playwright+TOTP) autonomous — display name p24-bms4-github-rw-key; was expired/401 (gh-pat-expiry-check) | Issue #7101 | Worker auto (SOPS: n8n-bms4-gh + monitoring + worker-queue; new 200 verified, exp 2026-10-29 ~30d; GH Actions secret set via App token) | | 2026-10-05 | DISPO_WASABI_ACCESS_KEY_ID / DISPO_WASABI_SECRET_ACCESS_KEY | Minted (new read-only Wasabi IAM sub-user) | Tier 1 autonomous — new sub-user dispo-docs-reader, inline policy dispo-ecotrans-readonly = s3:GetObject on arn:aws:s3:::p24-infra/dispo-ecotrans/* only; minted via iam.wasabisys.com (CreateUser/PutUserPolicy/CreateAccessKey) with WASABI_ADMIN* from wasabi-admin-worker.env.sops on bms-4; verified GET in-scope 200 / GET out-of-scope 403 / PUT 403 (status codes only). Also added DISPO_WASABI_ENDPOINT + DISPO_WASABI_BUCKET | Issue #7425 | Worker auto (secrets/et-operational-platform.env.sops; Vercel via secrets-sync on merge; consumer et-op#2029 stage 2) | | 2026-10-06 | REDIS_BRIDGE_KEY | Created (new shared secret) | Add — p24-auth↔bms-4 redis-bridge pre-shared X-Bridge-Key (single home pinbox24-w4-auth.env.sops, #3773); fixes redis-bridge crash-loop Missing required env: REDIS_BRIDGE_KEY (30k+ restarts). SOPS written with sops 3.13.3 (no version downgrade), all 10 age recipients preserved; supersedes closed PR #7084 (9-recipient drop + 3.9.1 downgrade). Delivery on merge: secrets-sync sync-bms-4 appends to bms-4/.env + force-recreates redis-bridge; deploy-p24-auth-worker binds to CF Worker | Issue #7083 | Worker auto | | 2026-10-08 | N8N_GITHUB_APP_ID / N8N_GITHUB_APP_INSTALLATION_ID / N8N_GITHUB_APP_PRIVATE_KEY_B64 | Created (new dedicated n8n GitHub App credentials) | Add — App p24-n8n-issues (owner-created, installed on all repos of account radieu), separate identity from App 2109526 (PR-approver; GITHUB_APP_* untouched). Written via sops-set.ps1 to n8n-bms4.env.sops; all 95 pre-existing keys hash-identical, 10 recipients preserved, B64 follows existing GITHUB_APP_PRIVATE_KEY_B64 convention (base64 of raw PEM). Owner to delete source PEM from Downloads after verification | Issue #7481 (Step 1) | Worker auto (secret-manager) | | 2026-10-08 | N8N_GITHUB_APP_INSTALLATION_ID | Corrected (wrong installation id replaced) | Value from GET /app/installations of App p24-n8n-issues; earlier value was not an installation id (generator got 404) — #7481 | | 2026-10-12 | SUPABASE_SERVICE_ROLE_KEY | Rotated (old key pending pre-deletion) | Tier 1 autonomous — exposure incident (stale plaintext /tmp/wenv.sh); minted p24_service_20261012 (sb_secret_0Z58Y, id bc7b1f88-a238-4ee7-8733-73944d763ca7), liveness HTTP 200 vs dev_r_services before any write; replaced exposed p24_service_20261006 (sb_secret_5CrZb, id 225233d0-c562-4117-aa7e-4a93930fece2) in 5 SOPS files (PR #7790); p24-infra GH secrets re-set; servers/Vercel/n8n via secrets-sync on merge | Issue #7724 | Worker auto (old exposed key NOT yet deleted — human-gated Step 7/8 pre-deletion after consumer verification; whatsup/art-agency own keys untouched) | | 2026-10-13 | SUPABASE_SERVICE_ROLE_KEY | Old key revoked (completed #7724 Step 7/8) | Tier 1 autonomous — verified new p24_service_20261012 (sb_secret_0Z58Y) on EVERY consumer by prefix before deleting: 5 SOPS files, bms-4 .env + worker-queue.env, vps-i1 monitoring/.env + vps-i1/.env, 8 vps-i1 containers, Vercel et-op + brandpilot + et-op-7ktl, meta-dispatcher CF Worker (redeployed 2026-10-13T03:19Z, post-rotation binding), n8n supabase-service-role-key cred; NO consumer held the old key. Then DELETED p24_service_20261006 (sb_secret_5CrZb, id 225233d0-c562-4117-aa7e-4a93930fece2) via Management API (HTTP 200) — now absent from the project | Issue #7825 | Worker auto (new key HTTP 200 + old key absent post-delete; vps-i1 77/77 Prometheus targets up; four n8n creds use separate live key supabase_service_role_key sb_secret_7xcgB id 8d05064b — out of scope, untouched; GH secrets list blocked by worker token scope, re-set during #7724) |