Secrets Rotation Log — RETIRED
This file is no longer the rotation log. As of #5556, all credential rotations — desktop,
worker, and automated (rotate-credentials.py) — are logged in the Supabase table
dev_r_rotation_log, written via scripts/lib/rotation_log.py /
scripts/rotation-log-entry.py open|close|fail. Never hand-edit this file to log a new
rotation.
Its full historical content (428 rows across this file and every docs/YYYY-MM/ archive) was
backfilled into dev_r_rotation_log on 2026-08-05 (source='historical-backfill') — query the
table directly, or run scripts/rotation-log-entry.py list, to see rotation history. This file
and the docs/YYYY-MM/ archives remain in git as the frozen pre-cutover record; nothing was
deleted.
Offline fallback (the only remaining reason to touch a markdown file)
If the Supabase API is unreachable at rotation time, rotation_log.py automatically falls back
to docs/rotation-log-fallback.md instead of silently dropping the log entry. That file is
normally empty — it gets drained back into Supabase automatically (opportunistically on the next
successful API call, and by a daily safety-net cron) via rotation-log-entry.py reimport. Never
hand-edit docs/rotation-log-fallback.md either; if it has stuck entries, run reimport.
See docs/playbooks/secret-manager-rotation-log.md for the full operating doc.