Security boundary · immediate cutover
Rotate a machine key.
Prove the old one stops.
The isolated drill creates and rotates an API key through ORAG's public API, then verifies source rejection and replacement access without reading a deployment secret.
Credential drill
immediate cutoverRun locally
Exercise the API path.
make credential-rotation-drillThe runner uses temporary PostgreSQL, Qdrant and deterministic mocks. It emits public key IDs, status codes and a build revision only after its checks pass.
Operator boundary
JWT and pepper need a window.
Changing a JWT secret invalidates user tokens. Changing the server API-key pepper invalidates every machine key. Neither is a zero-downtime API operation.
Honest scope
A local drill is not production proof.
Reference deployment evidence, provider credential revocation, secret-manager policy and independent threat-model review remain operator responsibilities.