Run acceptance tests and make the ship call

From a fresh clone/directory, run the commands that prove rotate to v2 → deploy → traffic on v2 → revoke v1 with audit event ROT-2026-07-30. A second person plays security engineer rotating openai/prod after contractor offboarding and follows your script without coaching. The demo includes limitations: what answer API + indexer sharing provider key via versioned secrets manager still will not do.

Bundle: contract snippet, passing tests, metric snapshot for secret_version_share and auth_fail_rate, security negative probe, rollback note, owner name. Reference SEC-REVOKE-EARLY-21 as the drill you rehearsed. If any item is missing, the ship gate fails even if the happy path dazzles.

For Secrets rotation lab, name the human who gets paged, the review date for thresholds, and the condition that triggers reevaluation. Endpoint secrets manager path openai/prod remains the production surface you operate for answer API + indexer sharing provider key via versioned secrets manager — not a slide. Keep SEC-REVOKE-EARLY-21 in the handoff template so the next owner inherits the drill.

After the peer demo, schedule the next threshold review date. File a short changelog that mentions SEC-REVOKE-EARLY-21 and the control that addresses it. Archive the evidence pack where your team already stores launch records. Resist rewriting everything “for real production” in one weekend — operate this slice until the metrics bore you, then widen. Final self-check: if telemetry vanished, would you still know to hold? If yes, you learned the operating posture this lane teaches.

Trim the demo script until every command is necessary. Record a peer signature line: name, date UTC, pass/fail. File known limitations as bullets, not apologies. Link the evidence pack from the README. Schedule the next game day on a calendar, even if it is solo. Archive the branch tag or release digest you actually shipped. In this chapter the product is answer API + indexer sharing provider key via versioned secrets manager, the human stakeholder is security engineer rotating openai/prod after contractor offboarding, and the incident id you design against is SEC-REVOKE-EARLY-21. Re-state the oracle in your notes — rotate to v2 → deploy → traffic on v2 → revoke v1 with audit event ROT-2026-07-30 — and keep the invariant visible: dual-key window: readers accept v1+v2; revoke v1 only after emit proves zero v1 use for 30m. Track secret_version_share and auth_fail_rate as the scoreboard. Surface under change control: secrets manager path openai/prod. If you only have forty minutes, finish the fixture for revoke v1 while indexer still cached v1 → 401 storm before polishing UI. Promotion language stays ternary: promote, hold, or roll back based on evidence, not hope.