internal/blast builds a read-only consumer map (which other files appear to
use each credential) from NON-secret metadata only — env-var names, hostnames,
identifiers — never the vault secret; rotation needs it to know what to
redeploy after a change. cmd/incredigo wires Mode A `rotate --execute`
(reconstructs Source from the gopass path segment, runs the execute spine) and
surfaces the blast-radius map. Adjusts a worklist test accordingly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Design-phase foundation for v2 rotation. Changes NO credential at any service.
- internal/rotate: Rotator interface + registry + PlanAll (zero drivers
registered, so every credential plans as "(none)")
- internal/rotate.Snapshot: the MANDATORY backup gate — seals the gopass
prefix into an authenticated bundle, re-opens it, and confirms the entry
count matches before returning; any failure blocks rotation
- internal/sink.CountBundleRecords: read-only bundle completeness check
- cmd: `incredigo rotate` runs the backup gate + prints the plan; it is
dry-run only and refuses --execute (design phase)
- tests: backup gate happy path, no-overwrite, tamper detection; race-clean
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
leetcrypt