rotate: nine rotation drivers + verify-before-revoke execute spine

Implements the Rotator interface across all four rotation patterns, each a
self-contained one-file driver self-registering via init():

  in-place DB password   postgres, mysql (3-stmt unprivileged fallback), redis
  local keypair + propagate  sshkey (ed25519), wireguard (clamped curve25519)
  provider-API token         gitea PAT, mullvad device key
  cloud-key self-identifying  aws IAM access key (hand-rolled SigV4, no SDK dep)

Spine (execute.go) enforces Hard Rule #2: backup -> rotate -> verify(new) ->
store -> re-read+verify -> revoke-old; dryrun.go keeps --execute gated. Each
driver ships a table-driven test proving real cutover (old secret stops
authenticating) and asserting no secret substring leaks to argv/Meta/errors.
Promotes golang.org/x/crypto to a direct dependency.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/rotate/redis.go

@@ -0,0 +1,163 @@
+package rotate
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"os/exec"
+	"strings"
+
+	"incredigo/internal/discover"
+	"incredigo/internal/vault"
+)
+
+// Redis rotates a Redis instance's password in place, the same in-place pattern as
+// Postgres/MySQL. The credential's secret is a redis URL
+// ("redis://:pw@host:port" or "redis://user:pw@host:port/db"); rotation mints a new
+// password and runs
+//
+//	CONFIG SET requirepass <newpw>
+//
+// over the OLD (authenticated) connection. CONFIG SET is itself the cutover — the
+// old password stops authenticating new connections immediately — so RevokeOld is a
+// no-op and the §3 sealed backup is the recovery path (see docs/ROTATION.md §17).
+//
+// SECURITY: the OLD password reaches redis-cli only via the REDISCLI_AUTH
+// *environment* variable (never argv, never disk). The command — which carries the
+// NEW password — is fed on stdin so the new password never appears in the process
+// argument list. The new password is hex ([0-9a-f]) so it needs no quoting and
+// cannot inject extra tokens. Captured output is scrubbed of the new password
+// before any error surfaces.
+//
+// NOTE: this rotates the legacy single `requirepass` secret (the default-user
+// password), which is the form vibe coders actually leak in REDIS_URL. ACL-user
+// rotation (`ACL SETUSER`) is a separate future surface.
+type Redis struct {
+	Bin string // redis-cli binary; defaults to "redis-cli"
+}
+
+// init registers the driver. Registration only makes it available; changing a
+// credential still requires `rotate --execute` AND INCREDIGO_ALLOW_EXECUTE=1.
+func init() { Register(&Redis{}) }
+
+// Name identifies the driver in plans and audit records.
+func (r *Redis) Name() string { return "redis" }
+
+// Detect claims credentials a redis scanner/seed emitted (Source == "redis").
+func (r *Redis) Detect(c discover.Credential) bool { return c.Source == "redis" }
+
+func (r *Redis) bin() string {
+	if r.Bin != "" {
+		return r.Bin
+	}
+	return "redis-cli"
+}
+
+// Rotate mints a new password, applies it via CONFIG SET requirepass over the
+// existing (old) connection, and returns a vault handle to the rebuilt URL.
+func (r *Redis) Rotate(ctx context.Context, c discover.Credential, v *vault.Vault) (*vault.Handle, error) {
+	u, err := openRedisURL(v, c.Secret)
+	if err != nil {
+		return nil, err
+	}
+	oldPw, _ := u.User.Password()
+
+	newPw, err := genHex(24)
+	if err != nil {
+		return nil, err
+	}
+	if _, err := r.redis(ctx, u, oldPw, "CONFIG SET requirepass "+newPw, newPw); err != nil {
+		return nil, fmt.Errorf("redis: CONFIG SET requirepass: %w", err)
+	}
+
+	nu := *u
+	nu.User = url.UserPassword(u.User.Username(), newPw)
+	return v.Store([]byte(nu.String())), nil
+}
+
+// Verify proves the freshly minted URL authenticates by issuing PING with the new
+// password.
+func (r *Redis) Verify(ctx context.Context, newSecret *vault.Handle, v *vault.Vault) error {
+	u, err := openRedisURL(v, newSecret)
+	if err != nil {
+		return err
+	}
+	pw, _ := u.User.Password()
+	out, err := r.redis(ctx, u, pw, "PING", pw)
+	if err != nil {
+		return fmt.Errorf("redis verify: %w", err)
+	}
+	if !strings.Contains(out, "PONG") {
+		return fmt.Errorf("redis verify: unexpected result")
+	}
+	return nil
+}
+
+// RevokeOld is a no-op for an in-place engine: the CONFIG SET in Rotate already
+// invalidated the previous password. Defined to satisfy the safety-spine ordering.
+func (r *Redis) RevokeOld(ctx context.Context, c discover.Credential, v *vault.Vault) error {
+	return nil
+}
+
+// redis runs one command against the URL's host/port, authenticating via
+// REDISCLI_AUTH and feeding the command on stdin (keeping any secret out of argv).
+// redact, if non-empty, is scrubbed from captured output before it can reach an
+// error string.
+func (r *Redis) redis(ctx context.Context, u *url.URL, password, command, redact string) (string, error) {
+	host := u.Hostname()
+	port := u.Port()
+	if port == "" {
+		port = "6379"
+	}
+	args := []string{"--no-raw", "-h", host, "-p", port}
+	if db := strings.TrimPrefix(u.Path, "/"); db != "" {
+		args = append(args, "-n", db)
+	}
+	if user := u.User.Username(); user != "" {
+		args = append(args, "--user", user)
+	}
+	cmd := exec.CommandContext(ctx, r.bin(), args...)
+	cmd.Env = os.Environ()
+	if password != "" {
+		cmd.Env = append(cmd.Env, "REDISCLI_AUTH="+password)
+	}
+	cmd.Stdin = strings.NewReader(command + "\n")
+	var out, errb bytes.Buffer
+	cmd.Stdout = &out
+	cmd.Stderr = &errb
+	err := cmd.Run()
+	so, se := out.String(), errb.String()
+	if redact != "" {
+		so = strings.ReplaceAll(so, redact, "***")
+		se = strings.ReplaceAll(se, redact, "***")
+	}
+	// redis-cli prints server error replies as a "(error) ..." line on stdout and
+	// often still exits 0 (auth/command failures included), so surface stdout that
+	// looks like an error even when the process exits clean.
+	if err == nil && strings.HasPrefix(strings.TrimSpace(so), "(error)") {
+		return so, fmt.Errorf("redis error: %s", strings.TrimSpace(so))
+	}
+	if err != nil {
+		return so, fmt.Errorf("%v: %s", err, strings.TrimSpace(se+" "+so))
+	}
+	return so, nil
+}
+
+// openRedisURL reads a redis URL secret from the vault and parses it, accepting the
+// redis:// and rediss:// schemes. The URL string is transient and never persisted.
+func openRedisURL(v *vault.Vault, h *vault.Handle) (*url.URL, error) {
+	buf, err := v.Open(h)
+	if err != nil {
+		return nil, err
+	}
+	u, err := url.Parse(strings.TrimSpace(string(buf.Bytes())))
+	if err != nil {
+		return nil, fmt.Errorf("redis: parse url: %w", err)
+	}
+	if u.Scheme != "redis" && u.Scheme != "rediss" {
+		return nil, fmt.Errorf("redis: unexpected url scheme %q", u.Scheme)
+	}
+	return u, nil
+}