code wiki / _hdl_build / nx_vault_rotation.nx
nx_vault_rotation.nx
buildroot/runtime/_hdl_build/nx_vault_rotation.nx
about
nx_vault_rotation.nx -- sovereign LEASE-DRIVEN AUTO-ROTATION (upgrades the rotation PARTIAL in
vault_capability_census.tsv to full HashiCorp-rotation-class). A secret carries a rotate_interval; when
now >= issued_at + rotate_interval it is DUE for rotation. Rotation bumps the version (monotonic) and
resets issued_at; the OLD version stays accepted for a GRACE overlap window so in-flight users don't break
(zero-downtime rotation). The new version's validity uses the lease engine. Composes nx_vault_lease.
"now" is injected (deterministic/replayable). license_tier: ORIGINAL
dependencies 2 imports · 2 importers
imports: nx_vault_lease.nxnx_syscalls.nx
imported by: nx_vault_rotation_test.nxnx_vault_suite_test.nx
structs
| none |
consts
| none |
functions
| 11 | func rot_due(now: i64, issued_at: i64, rotate_interval: i64) -> i64 |
| 17 | func rot_next_version(cur: i64) -> i64 { return cur + 1 } called by 1: main |
| 21 | func rot_overlap_valid(now: i64, old_issued: i64, old_ttl: i64, grace: i64) -> i64 called by 1: main |
| 27 | func rot_new_valid(now: i64, rotated_at: i64, ttl: i64) -> i64 { return lease_valid(now, rotated_at, ttl, 0) } |