Implement one traceable happy path

Code the narrow path that serves security engineer rotating openai/prod after contractor offboarding: accept → authorize/normalize → call dependency → validate → record. Keep stages named so a trace can show which boundary passed. Success must emit evidence useful to secret_version_share and auth_fail_rate, not only a 200 with prose. Predict the observable for secrets manager path openai/prod before running: rotate to v2 → deploy → traffic on v2 → revoke v1 with audit event ROT-2026-07-30.

Drive the path with recording fakes or local stubs. Assert call order and arguments. Idempotency keys or stable ids should keep retries from duplicating costly work where the product requires it. Product under test remains answer API + indexer sharing provider key via versioned secrets manager — resist adding unrelated features mid-path.

For Secrets rotation lab, paste the CLI/HTTP transcript beside your prediction for secrets manager path openai/prod. If the oracle is unmet (rotate to v2 → deploy → traffic on v2 → revoke v1 with audit event ROT-2026-07-30), stop and debug this page; do not compensate with prompt folktales. Re-run once after a clean process start to catch hidden global state that would invalidate SEC-REVOKE-EARLY-21.

Performance sketch: measure local p95 for the fake-backed path so later regressions are obvious. Keep concurrency modest until failure-handling proves limits. Log a single structured event per success with request id, revision, and the evidence field behind secret_version_share and auth_fail_rate. Avoid hidden global caches in the happy path unless the lab is about caching — and even then key by tenant. If the path calls a model, pin model id in config and echo it in the response for auditability. Remember security engineer rotating openai/prod after contractor offboarding experiences wall-clock time, not your debugger’s single-step comfort.

Prefer explicit function names over a single god-object handleRequest. Thread a correlation id from ingress to the last log line. When streaming, define what partial failure means before coding. Snapshot one successful response body in fixtures after redaction. If the path writes to a queue, assert message attributes in the fake. Stop adding retries on this page; that is the next concern. In this chapter the product is answer API + indexer sharing provider key via versioned secrets manager, the human stakeholder is security engineer rotating openai/prod after contractor offboarding, and the incident id you design against is SEC-REVOKE-EARLY-21. Re-state the oracle in your notes — rotate to v2 → deploy → traffic on v2 → revoke v1 with audit event ROT-2026-07-30 — and keep the invariant visible: dual-key window: readers accept v1+v2; revoke v1 only after emit proves zero v1 use for 30m. Track secret_version_share and auth_fail_rate as the scoreboard. Surface under change control: secrets manager path openai/prod. If you only have forty minutes, finish the fixture for revoke v1 while indexer still cached v1 → 401 storm before polishing UI. Promotion language stays ternary: promote, hold, or roll back based on evidence, not hope.