First real-credential rotation on the safe-candidate ladder: full
create→verify→store→revoke against a real Gitea PAT on
git.churchofmalware.org (self-owned, no 2FA). To keep blast radius at
zero, the run targets a purpose-made THROWAWAY token — a genuine token
used by nothing — so the driver's real lifecycle earns LIVE-REAL without
risking any in-use PAT (which is also referenced across .git-credentials,
embedded git remotes and tea config, and needs the multi-reference
blast-and-cutover, still to build).
- lab/lab-rung3-gitea-real.sh: env-only secrets, isolated throwaway gopass
store, independent cutover check (new->200, old->401), sealed backup.
- proofs.go + ROTATION-PROOFS.md: gitea promoted LIVE-VM -> LIVE-REAL,
LIVE-REAL section added; "no driver carries this yet" removed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
leetcrypt