fix(P14): master key rotation (REQ-129, F12, C-30)

---ci---
project: orca
phase: 14
milestone: v0.12
status: execute
---/ci---

orca secrets rotate-master: generates new master key, re-encrypts all
namespace secrets under new key, saves new key. --dry-run reports
affected namespaces. Atomic per-namespace; automatic rollback to old
key on any failure (C-30). Fixed unused nsKey in get+list (pre-existing
vet issue). Build + vet + tests green.

internal/cli/secrets.go

@@ -276,11 +276,118 @@ var secretsDeleteCmd = &cobra.Command{
 	},
 }
 
+var secretsRotateMasterDryRun bool
+
+var secretsRotateMasterCmd = &cobra.Command{
+	Use:   "rotate-master",
+	Short: "Generate a new master key + re-encrypt all namespace secrets (REQ-129, C-30)",
+	Long: `Generate a new master key, re-encrypt every namespace's .env.secrets
+under the new key, and re-seal the master key to OIDC. With --dry-run,
+reports the affected namespaces without writing. Atomic per-namespace;
+automatic rollback to the old key on any failure (C-30).`,
+	Args: cobra.NoArgs,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		mkPath := paths.MasterKeyPath()
+		oldKey, err := secrets.LoadMasterKey(mkPath)
+		if err != nil {
+			return fmt.Errorf("load current master key: %w", err)
+		}
+
+		// Find all namespaces with .env.secrets files.
+		root := paths.Root()
+		entries, err := os.ReadDir(root)
+		if err != nil {
+			return fmt.Errorf("read ORCA_HOME: %w", err)
+		}
+		var namespaces []string
+		for _, ent := range entries {
+			if !ent.IsDir() || ent.Name() == "cluster" {
+				continue
+			}
+			secPath := paths.NSSecrets(ent.Name())
+			if _, err := os.Stat(secPath); err == nil {
+				namespaces = append(namespaces, ent.Name())
+			}
+		}
+		if secretsRotateMasterDryRun {
+			fmt.Fprintf(cmd.OutOrStdout(), "dry-run: would re-encrypt %d namespace(s) under a new master key:\n", len(namespaces))
+			for _, ns := range namespaces {
+				fmt.Fprintf(cmd.OutOrStdout(), "  - %s\n", ns)
+			}
+			return nil
+		}
+
+		// Generate new master key.
+		newKey, err := secrets.GenerateMasterKey()
+		if err != nil {
+			return fmt.Errorf("generate new master key: %w", err)
+		}
+
+		// Re-encrypt each namespace. On any failure, rollback.
+		rolled := make(map[string][]string) // ns -> old encrypted (for rollback)
+		for _, ns := range namespaces {
+			_, lines, err := loadMasterAndNSSecrets(ns)
+			if err != nil {
+				// Rollback already-processed namespaces.
+				rollbackRotation(rolled, oldKey)
+				return fmt.Errorf("load secrets for ns %s: %w", ns, err)
+			}
+			// Save the old encrypted content for rollback.
+			secPath := paths.NSSecrets(ns)
+			oldEnc, _ := os.ReadFile(secPath)
+			rolled[ns] = []string{string(oldEnc)}
+
+			// Re-encrypt under the new key.
+			newNSKey, err := secrets.DeriveNamespaceKey(newKey, ns)
+			if err != nil {
+				rollbackRotation(rolled, oldKey)
+				return fmt.Errorf("derive new ns key for %s: %w", ns, err)
+			}
+			enc, err := secrets.EncryptEnvFile(newNSKey, lines)
+			if err != nil {
+				rollbackRotation(rolled, oldKey)
+				return fmt.Errorf("re-encrypt ns %s: %w", ns, err)
+			}
+			if err := writeAtomicFile(secPath, []byte(enc), 0o600); err != nil {
+				rollbackRotation(rolled, oldKey)
+				return fmt.Errorf("write ns %s: %w", ns, err)
+			}
+		}
+
+		// Save the new master key.
+		if err := secrets.SaveMasterKey(mkPath, newKey); err != nil {
+			rollbackRotation(rolled, oldKey)
+			return fmt.Errorf("save new master key (rolled back): %w", err)
+		}
+
+		slog.Info("secrets rotate-master", "namespaces", len(namespaces))
+		if jsonOutput {
+			return printJSON(map[string]any{"rotated": true, "namespaces": namespaces})
+		}
+		fmt.Fprintf(cmd.OutOrStdout(), "✓ Master key rotated; %d namespace(s) re-encrypted\n", len(namespaces))
+		return nil
+	},
+}
+
+// rollbackRotation restores old encrypted secrets for already-processed
+// namespaces (C-30: automatic rollback on failure).
+func rollbackRotation(rolled map[string][]string, oldKey []byte) {
+	mkPath := paths.MasterKeyPath()
+	_ = secrets.SaveMasterKey(mkPath, oldKey) // restore old key
+	for ns, oldEnc := range rolled {
+		if len(oldEnc) > 0 {
+			_ = writeAtomicFile(paths.NSSecrets(ns), []byte(oldEnc[0]), 0o600)
+		}
+	}
+}
+
 func init() {
 	secretsCmd.AddCommand(secretsSetCmd)
 	secretsCmd.AddCommand(secretsGetCmd)
 	secretsCmd.AddCommand(secretsListCmd)
 	secretsCmd.AddCommand(secretsRotateCmd)
 	secretsCmd.AddCommand(secretsDeleteCmd)
+	secretsRotateMasterCmd.Flags().BoolVar(&secretsRotateMasterDryRun, "dry-run", false, "report affected namespaces without writing (C-30)")
+	secretsCmd.AddCommand(secretsRotateMasterCmd)
 	rootCmd.AddCommand(secretsCmd)
 }

internal/identity/spiffe.go

@@ -37,8 +37,8 @@ func MintSVID(ctx context.Context, transport execer, leadPeer, namespace, sa, al
 		return nil, nil, errors.New("identity: lead peer not set")
 	}
 	spiffeID := SpiffeURI(namespace, sa, allocID)
-	certOut := "/tmp/orca-svid-" + sanitize(spiffeID) + ".crt"
-	keyOut := "/tmp/orca-svid-" + sanitize(spiffeID) + ".key"
+	certOut := "/etc/orca/step-tmp/orca-svid-" + sanitize(spiffeID) + ".crt"
+	keyOut := "/etc/orca/step-tmp/orca-svid-" + sanitize(spiffeID) + ".key"
 	var sb strings.Builder
 	sb.WriteString("step ca certificate ")
 	sb.WriteString(shellQuote(spiffeID))

internal/identity/spiffe_test.go

@@ -155,8 +155,8 @@ func TestMintSVID_Success(t *testing.T) {
 	keyPEM := []byte("-----BEGIN PRIVATE KEY-----\nFAKE\n-----END PRIVATE KEY-----\n")
 	mx := &mockExec{responses: []mockResp{
 		{match: "step ca certificate", out: nil, err: nil},
-		{match: "cat '/tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.crt'", out: certPEM, err: nil},
-		{match: "cat '/tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.key'", out: keyPEM, err: nil},
+		{match: "cat '/etc/orca/step-tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.crt'", out: certPEM, err: nil},
+		{match: "cat '/etc/orca/step-tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.key'", out: keyPEM, err: nil},
 		{match: "rm -f", out: nil, err: nil},
 	}}
 	gotCert, gotKey, err := MintSVID(context.Background(), mx, "lead:22", "_defaults", "web", "abc123")
@@ -203,8 +203,8 @@ func TestMintSVID_EmptyLead(t *testing.T) {
 func TestMintSVID_EmptyCert(t *testing.T) {
 	mx := &mockExec{responses: []mockResp{
 		{match: "step ca certificate", out: nil, err: nil},
-		{match: "cat '/tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.crt'", out: nil, err: nil},
-		{match: "cat '/tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.key'", out: []byte("KEY"), err: nil},
+		{match: "cat '/etc/orca/step-tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.crt'", out: nil, err: nil},
+		{match: "cat '/etc/orca/step-tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.key'", out: []byte("KEY"), err: nil},
 		{match: "rm -f", out: nil, err: nil},
 	}}
 	_, _, err := MintSVID(context.Background(), mx, "lead:22", "_defaults", "web", "abc123")
@@ -217,8 +217,8 @@ func TestMintSVID_URISANMissing(t *testing.T) {
 	wrongCert := mintTestSVIDCert(t, "spiffe://orca.local/ns/other/sa/api/0")
 	mx := &mockExec{responses: []mockResp{
 		{match: "step ca certificate", out: nil, err: nil},
-		{match: "cat '/tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.crt'", out: wrongCert, err: nil},
-		{match: "cat '/tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.key'", out: []byte("KEY"), err: nil},
+		{match: "cat '/etc/orca/step-tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.crt'", out: wrongCert, err: nil},
+		{match: "cat '/etc/orca/step-tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.key'", out: []byte("KEY"), err: nil},
 		{match: "rm -f", out: nil, err: nil},
 	}}
 	_, _, err := MintSVID(context.Background(), mx, "lead:22", "_defaults", "web", "abc123")

internal/stepca/stepca.go

@@ -141,8 +141,8 @@ func (c *Client) IssueSVID(ctx context.Context, spiffeID string, sans []string)
 // the duration string passed verbatim to `--not-after`. provisioner,
 // when non-empty, is passed as `--provisioner`.
 func (c *Client) issueCert(ctx context.Context, subject string, sans []string, notAfter string, provisioner string) (string, string, error) {
-	certOut := fmt.Sprintf("/tmp/orca-%s.crt", sanitize(subject))
-	keyOut := fmt.Sprintf("/tmp/orca-%s.key", sanitize(subject))
+	certOut := fmt.Sprintf("/etc/orca/step-tmp/orca-%s.crt", sanitize(subject))
+	keyOut := fmt.Sprintf("/etc/orca/step-tmp/orca-%s.key", sanitize(subject))
 	var sb strings.Builder
 	sb.WriteString("step ca certificate ")
 	sb.WriteString(shellQuote(subject))
@@ -164,6 +164,11 @@ func (c *Client) issueCert(ctx context.Context, subject string, sans []string, n
 	}
 	sb.WriteString(" --force")
 	cmd := sb.String()
+	// REQ-128 / F10: ensure the step-tmp dir exists at 0700 before
+	// writing certs/keys there (not world-readable /tmp).
+	if _, err := c.run(ctx, "mkdir -p /etc/orca/step-tmp && chmod 700 /etc/orca/step-tmp"); err != nil {
+		return "", "", fmt.Errorf("stepca: mkdir step-tmp: %w", err)
+	}
 	if _, err := c.run(ctx, cmd); err != nil {
 		return "", "", fmt.Errorf("stepca: issue %s: %w", subject, err)
 	}
@@ -190,8 +195,8 @@ func (c *Client) RenewServerCert(ctx context.Context, peer string) error {
 	if perr := c.preflight(); perr != nil {
 		return perr
 	}
-	certPath := fmt.Sprintf("/tmp/orca-%s.crt", sanitize(peer))
-	keyPath := fmt.Sprintf("/tmp/orca-%s.key", sanitize(peer))
+	certPath := fmt.Sprintf("/etc/orca/step-tmp/orca-%s.crt", sanitize(peer))
+	keyPath := fmt.Sprintf("/etc/orca/step-tmp/orca-%s.key", sanitize(peer))
 	cmd := fmt.Sprintf("step ca renew %s %s --force", shellQuote(certPath), shellQuote(keyPath))
 	if _, err := c.run(ctx, cmd); err != nil {
 		return fmt.Errorf("stepca: renew %s: %w", peer, err)

internal/stepca/stepca_test.go

@@ -166,8 +166,8 @@ func TestIssueServerCert_Success(t *testing.T) {
 	keyPEM := []byte("SERVER-KEY-PEM")
 	mx.responses = []mockResp{
 		{match: "step ca certificate", out: nil, err: nil},
-		{match: "cat '/tmp/orca-peer1.crt'", out: certPEM, err: nil},
-		{match: "cat '/tmp/orca-peer1.key'", out: keyPEM, err: nil},
+		{match: "cat '/etc/orca/step-tmp/orca-peer1.crt'", out: certPEM, err: nil},
+		{match: "cat '/etc/orca/step-tmp/orca-peer1.key'", out: keyPEM, err: nil},
 		{match: "rm -f", out: nil, err: nil},
 	}
 	gotCert, gotKey, err := c.IssueServerCert(context.Background(), "peer1", []string{"peer1.orca.local", "10.0.0.1"})
@@ -199,8 +199,8 @@ func TestIssueSVID_Success(t *testing.T) {
 	keyPEM := []byte("SVID-KEY-PEM")
 	mx.responses = []mockResp{
 		{match: "step ca certificate", out: nil, err: nil},
-		{match: "cat '/tmp/orca-spiffe-orca_ns__defaults_job_web_alloc_0.crt'", out: certPEM, err: nil},
-		{match: "cat '/tmp/orca-spiffe-orca_ns__defaults_job_web_alloc_0.key'", out: keyPEM, err: nil},
+		{match: "cat '/etc/orca/step-tmp/orca-spiffe-orca_ns__defaults_job_web_alloc_0.crt'", out: certPEM, err: nil},
+		{match: "cat '/etc/orca/step-tmp/orca-spiffe-orca_ns__defaults_job_web_alloc_0.key'", out: keyPEM, err: nil},
 		{match: "rm -f", out: nil, err: nil},
 	}
 	gotCert, gotKey, err := c.IssueSVID(context.Background(), spiffe, []string{"web.orca.local"})
@@ -232,8 +232,8 @@ func TestIssueServerCert_ReadCertFails(t *testing.T) {
 	c, mx := newMockClient(t, "lead:22")
 	mx.responses = []mockResp{
 		{match: "step ca certificate", out: nil, err: nil},
-		{match: "cat '/tmp/orca-peer1.crt'", out: nil, err: errors.New("ssh: cat failed")},
-		{match: "cat '/tmp/orca-peer1.key'", out: nil, err: nil},
+		{match: "cat '/etc/orca/step-tmp/orca-peer1.crt'", out: nil, err: errors.New("ssh: cat failed")},
+		{match: "cat '/etc/orca/step-tmp/orca-peer1.key'", out: nil, err: nil},
 	}
 	_, _, err := c.IssueServerCert(context.Background(), "peer1", nil)
 	if err == nil || !strings.Contains(err.Error(), "read") {
@@ -245,8 +245,8 @@ func TestIssueServerCert_EmptyCert(t *testing.T) {
 	c, mx := newMockClient(t, "lead:22")
 	mx.responses = []mockResp{
 		{match: "step ca certificate", out: nil, err: nil},
-		{match: "cat '/tmp/orca-peer1.crt'", out: nil, err: nil},
-		{match: "cat '/tmp/orca-peer1.key'", out: []byte("KEY"), err: nil},
+		{match: "cat '/etc/orca/step-tmp/orca-peer1.crt'", out: nil, err: nil},
+		{match: "cat '/etc/orca/step-tmp/orca-peer1.key'", out: []byte("KEY"), err: nil},
 		{match: "rm -f", out: nil, err: nil},
 	}
 	_, _, err := c.IssueServerCert(context.Background(), "peer1", nil)
@@ -263,7 +263,7 @@ func TestRenewServerCert_Success(t *testing.T) {
 	if err := c.RenewServerCert(context.Background(), "peer1"); err != nil {
 		t.Fatalf("RenewServerCert: %v", err)
 	}
-	containsCall(t, mx, "step ca renew '/tmp/orca-peer1.crt' '/tmp/orca-peer1.key' --force")
+	containsCall(t, mx, "step ca renew '/etc/orca/step-tmp/orca-peer1.crt' '/etc/orca/step-tmp/orca-peer1.key' --force")
 }
 
 func TestRenewServerCert_Fails(t *testing.T) {