2 Commits

Author	SHA1	Message	Date
Jon Chery	50c4e910ed	fix(P14): master key rotation (REQ-129, F12, C-30) ... ---ci--- project: orca phase: 14 milestone: v0.12 status: execute ---/ci--- orca secrets rotate-master: generates new master key, re-encrypts all namespace secrets under new key, saves new key. --dry-run reports affected namespaces. Atomic per-namespace; automatic rollback to old key on any failure (C-30). Fixed unused nsKey in get+list (pre-existing vet issue). Build + vet + tests green.	2026-08-07 11:24:19 +00:00
Jon Chery	2e6436608f	feat(P03): secrets subsystem (REQ-080) — AES-256-GCM + HKDF-SHA256 per-ns ... internal/secrets/secrets.go: master key (0600), HKDF-SHA256 per-ns derivation, AES-256-GCM per-line with AAD=line-number (anti-swap), EncryptEnvFile/DecryptEnvFile, LoadCredential= map generation. internal/cli/secrets.go: orca secrets set/get/list/rotate/delete. Tests: round-trip, nonce uniqueness, AAD anti-swap, 0600 enforcement. ---ci--- project: orca phase: 03 milestone: v0.11 status: execute ---/ci---	2026-08-07 04:47:33 +00:00