[Spec 030] Router credential key rotation

[XnLemon]

Scope

Track Spec 030, Router Credential Key Rotation, as the next Stage 2 operational-governance slice after the trusted invocation loop and PR #74.

Draft spec: specs/030-router-key-rotation/spec.md on branch codex/030-router-key-rotation.

Delivery gate

• Merge PR [codex] add public Agent share URLs #74 before implementation work begins.
• Resolve all three security-policy clarifications in the Spec before planning.
• Preserve the existing Router-mediated invocation, exact Release provenance, per-request credential, streaming/cancellation, nested-call, and Invocation Ledger semantics.

Outcome

Operators can perform a planned signing-key rotation and an explicitly governed emergency response without unknown-key acceptance, implicit signer fallback, secret leakage, or rotation facts being written into the Invocation Ledger.

Child tasks

Child task links will be added after creation.

Non-goals

No automatic retry, alternate signer, remote key discovery, retired-key compatibility, cross-replica replay implementation, new secret manager, or enterprise RBAC/approval system.

[XnLemon]

Child task links

• [Spec 030] Resolve signing-key rotation policy and ADR #76 - Resolve signing-key rotation policy and ADR: [Spec 030] Resolve signing-key rotation policy and ADR #76
• [Spec 030] Freeze rotation contracts and audit boundary #77 - Freeze rotation contracts and audit boundary: [Spec 030] Freeze rotation contracts and audit boundary #77
• [Spec 030] Implement deterministic signing-key rotation gates #78 - Implement deterministic signing-key rotation gates: [Spec 030] Implement deterministic signing-key rotation gates #78
• [Spec 030] Add rotation acceptance and operator runbook #79 - Add rotation acceptance and operator runbook: [Spec 030] Add rotation acceptance and operator runbook #79

Execution order: policy -> contracts -> implementation -> acceptance/runbook.