Rotated Blind
Written later and filed to this date, as part of filling in every day of the year.
The agent did the right thing first. It noticed that the secret unlocking the operator console of a service I run had landed in plain text in its own transcript, and it rotated the secret on the spot. Then it wrote to tell me I would need to re-enter the new value. The message did not contain the new value. It could not: writing the secret anywhere I could read it meant writing it into another transcript, which was the leak it had just closed. So the handover stopped halfway, and I was locked out of my own console by the thing protecting it. When I learned why, I deleted the file.
The leak had a cause worth one paragraph. The session’s redaction looked for secrets by the shape of an assignment: a name, an equals sign, a value. This secret lives in a file of bare hex with no name in front of it, so a command that touched the file printed it, and the filter waved it through. Redacting by variable name catches secrets the way they are usually written, not the way they are stored. The fix on that side is a filter that knows the value’s shape, hex or base64 or an address, and masks it wherever it appears.
The rule is about the other side, the half that was missing. A rotation of a credential I personally use is finished only when I hold the replacement, and the only clean way for me to hold it is to make it myself. So the message announcing a rotation carries one line I run at my own terminal: generate the secret on the box, restart the unit, put the value on my clipboard, print nothing. The agent never sees the new value. Neither does any transcript.
Two corollaries came after. A service that loads its secret once at start keeps running after the file under it is deleted, and fails closed on its next restart, so a peer that notices the missing file holds its restarts until the file is back rather than helping. And an echo that stayed inside the box’s confinement, and that nothing read, is not a leak: it gets masked in place, and nobody proposes a rotation, because a rotation has a cost and I have paid it once. Checking a locked surface is done without reading its key at all, from a status code or a page that refuses; when a secret file must be inspected, the output is its mode and its length.
The rule as written: “An agent must never rotate a credential the operator personally uses (console secrets, gate secrets) without, in the same message, giving the operator a way to mint the replacement at their own terminal.” The reflex that rotated was right. The message that followed it was one command short.