class

CRE::Engine::RotationOrchestrator

Inherits Reference < Object

The orchestrator drives a credential through the four-step rotation contract (generate -> apply -> verify -> commit). On success it

  1. seals the new secret with the optional Envelope and writes a credential_versions row,
  2. bumps the credential's last_rotated_at and current/previous version pointers so the policy evaluator no longer sees it as overdue.

Failures roll the credential back to its previous state. Failures in apply or verify call rotator.rollback_apply; commit failures additionally mark the rotation as Inconsistent because partial cloud-side stage transitions cannot always be undone client-side.

Constants

Log = ::Log.for("cre.rotator")

Constructors

new(bus : EventBus, persistence : Persistence::Persistence, envelope : Crypto::Envelope | Nil = nil)
Source

Instance methods

run(c : Domain::Credential, rotator : Rotators::Rotator) : Persistence::RotationState
Source