Failed certificate rotation changes the active credential
A rejected rotation becomes visible after audit failure, and a stale operator can overwrite a later revision. Repair transactional state and optimistic concurrency together.
Architecture ExtensionService certificate vault
Work through a real codebase.
Choose an environment, investigate the existing implementation and use the tests to check your change. Sign in to open a workspace; execution and Ono usage follow your plan’s allowances.
issue creates a unique certificate id with owner and positive integer expiresAt. revoke is owner-only and active-only. This models certificate metadata, not cryptographic verification.
bind associates a new service id with an active, unexpired certificate owned by actor; revision starts at 1.
rotate requires the binding owner, matching expectedRevision and a different valid certificate from the same owner. It retains only the immediately previous certificate and sets graceUntil to now plus grace.
authorize returns true for the current certificate, or the previous certificate strictly before graceUntil. Both must be active and unexpired. Revocation overrides grace.
inspect reads certificate metadata. binding reads a service binding. Time and grace are nonnegative integer seconds.
Every command includes tenant and op. IDs belong to a tenant. Invalid commands return an error without stopping later commands.
Mutations and their audit records commit together. failAudit rolls back all changes. Read operations do not increment revision.
An optional request key makes retries idempotent per tenant. Reusing the key with different fields returns request-conflict.
Use the authenticated workspace API for state across HTTP requests. /run is a disposable fixture. Time and failures are explicit inputs, so tests are repeatable.
issue creates a unique certificate id with owner and positive integer expiresAt. revoke is owner-only and active-only. This models certificate metadata, not cryptographic verification.
bind associates a new service id with an active, unexpired certificate owned by actor; revision starts at 1.
rotate requires the binding owner, matching expectedRevision and a different valid certificate from the same owner. It retains only the immediately previous certificate and sets graceUntil to now plus grace.
authorize returns true for the current certificate, or the previous certificate strictly before graceUntil. Both must be active and unexpired. Revocation overrides grace.
inspect reads certificate metadata. binding reads a service binding. Time and grace are nonnegative integer seconds.
Every command includes tenant and op. IDs belong to a tenant. Invalid commands return an error without stopping later commands.
Mutations and their audit records commit together. failAudit rolls back all changes. Read operations do not increment revision.
An optional request key makes retries idempotent per tenant. Reusing the key with different fields returns request-conflict.
Use the authenticated workspace API for state across HTTP requests. /run is a disposable fixture. Time and failures are explicit inputs, so tests are repeatable.
issue creates a unique certificate id with owner and positive integer expiresAt. revoke is owner-only and active-only. This models certificate metadata, not cryptographic verification.
bind associates a new service id with an active, unexpired certificate owned by actor; revision starts at 1.
rotate requires the binding owner, matching expectedRevision and a different valid certificate from the same owner. It retains only the immediately previous certificate and sets graceUntil to now plus grace.
authorize returns true for the current certificate, or the previous certificate strictly before graceUntil. Both must be active and unexpired. Revocation overrides grace.
inspect reads certificate metadata. binding reads a service binding. Time and grace are nonnegative integer seconds.
Every command includes tenant and op. IDs belong to a tenant. Invalid commands return an error without stopping later commands.
Mutations and their audit records commit together. failAudit rolls back all changes. Read operations do not increment revision.
An optional request key makes retries idempotent per tenant. Reusing the key with different fields returns request-conflict.
Use the authenticated workspace API for state across HTTP requests. /run is a disposable fixture. Time and failures are explicit inputs, so tests are repeatable.
issue creates a unique certificate id with owner and positive integer expiresAt. revoke is owner-only and active-only. This models certificate metadata, not cryptographic verification.
bind associates a new service id with an active, unexpired certificate owned by actor; revision starts at 1.
rotate requires the binding owner, matching expectedRevision and a different valid certificate from the same owner. It retains only the immediately previous certificate and sets graceUntil to now plus grace.
authorize returns true for the current certificate, or the previous certificate strictly before graceUntil. Both must be active and unexpired. Revocation overrides grace.
inspect reads certificate metadata. binding reads a service binding. Time and grace are nonnegative integer seconds.
Every command includes tenant and op. IDs belong to a tenant. Invalid commands return an error without stopping later commands.
Mutations and their audit records commit together. failAudit rolls back all changes. Read operations do not increment revision.
An optional request key makes retries idempotent per tenant. Reusing the key with different fields returns request-conflict.
Use the authenticated workspace API for state across HTTP requests. /run is a disposable fixture. Time and failures are explicit inputs, so tests are repeatable.