Operational directive for Claude sessions: the headless two-mode rotation
goal, current phase, and the non-negotiable guardrails (backup-before-rotate,
verify-before-revoke, no-plaintext-on-disk / browser worklist not dump,
GOPASS_HOMEDIR test isolation, self-owned-accounts scope, PGP passphrase =
root of trust). Chosen stack: Bubble Tea + go-rod + .well-known/change-password.
docs/ROTATION.md Part II (capability matrix, TUI walkthrough, link gen, browser
worklist, automation tiers) is updated on disk but stays gitignored (local-only).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Design-phase foundation for v2 rotation. Changes NO credential at any service.
- internal/rotate: Rotator interface + registry + PlanAll (zero drivers
registered, so every credential plans as "(none)")
- internal/rotate.Snapshot: the MANDATORY backup gate — seals the gopass
prefix into an authenticated bundle, re-opens it, and confirms the entry
count matches before returning; any failure blocks rotation
- internal/sink.CountBundleRecords: read-only bundle completeness check
- cmd: `incredigo rotate` runs the backup gate + prints the plan; it is
dry-run only and refuses --execute (design phase)
- tests: backup gate happy path, no-overwrite, tamper detection; race-clean
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
leetcrypt