The secret.* family (1 verb). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Rotatesecret.rotate
| Property | Value |
|---|---|
| Capability | secret.write |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Owner |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
Record a box-local secret rotation (DB/app-role/LLM/signing key).
{ secretName }. Scoped to ONE box (the fleet-HMAC/gateway-key/vault-KEK rotation dropped with the
broker). The actual key-material rotation is the operator-script edge (STUB_OFFBOX); the request +
audit land now. A routing key is REFUSED (same guard as config.*).
Call POST /v/secret.rotate with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.