skarbiec credential rotate

Invocation#

skarbiec credential rotate <item-id> --consumer <consumer> [--purpose <text>] --as <caller> --token-file <path>
# canonical-host mode
skarbiec credential rotate <item-id> --provider <provider> --consumer <consumer> [--dry-run] --local

Purpose#

Run a requested provider-side rotation end to end; it is automation after invocation, not a scheduler.

Required inputs and options#

• Requires item id and consumer plus remote caller authentication, or provider/consumer with --local. Purpose, directory expectations, and dry-run are optional where supported.

Output and state effects#

• Weles changes and verifies the provider credential, then Skarbiec commits a new encrypted revision only after confirmation and records effect/rollback evidence.

Refusals#

• Refuses unmanaged or quarantined items, provider/field/directory mismatch, concurrent operations, and retries after an uncertain provider effect. Skarbiec has no age policy, rotation schedule, or rotate-every-N-days daemon; each run must be started externally.