Secrets management: Control specification

Defines zero-downtime secret rotation by publishing a new secret under a key identifier, dual-accepting old and new material during a measured grace window, and revoking the old secret only after observed coverage.

Published Sep 12, 2026