Skip to main content

Rotate the production signing key

Rotating the production signing key is a planned operation. It requires a bounded repair goal.

Steps​

  1. Open a REPAIR_GOAL with goal_type: REPAIR_GOAL and phase_id: SIGNING-KEY-ROTATION-<n>.
  2. The repair goal updates agent-harness/governance/allowed_signers to add the new public key and remove the old one.
  3. The repair goal updates agent-harness/governance/SIGNED_TICKET_TRUST_CONFIG.md if applicable.
  4. Commit on a bounded branch.
  5. Open a PR.
  6. Owner reviews and approves.
  7. Governed merge.
  8. Future production tickets must use the new private key.
  9. Old tickets already issued remain valid until consumed or expired.

What this playbook is NOT​

  • It is not done in the middle of a production promotion.
  • It does not delete the old public key until at least one full ticket cycle has completed on the new key.
  • It does not embed the new private key anywhere in the repo, runtime, evidence, chat, or docs.