Module trust_rotation 

Declarative key rotation. Emits Action::RotateTrustRoot when a slot’s retire_at has passed AND a successor is declared. Informational only - the CP NEVER self-mutates trust roots; the operator’s tooling promotes current -> previous, successor -> current in the next fleet commit.

Structs

RotateTrustRoot

Operator-visible “rotate this slot now” hint. The CP never self-mutates trust roots — this struct is informational telemetry only. The legacy Action::RotateTrustRoot (in the deleted reconciler action.rs) was the same shape; this is the moved-in-place definition.

Functions

check_trust_rotations

One Action::RotateTrustRoot per slot with retire_at <= now AND successor.is_some(). Idempotent: re-emitted every tick until the operator rotates the slot (after which successor clears and the predicate stops). Pure arithmetic - safe in the reconcile hot path.

is_rotation_due 🔒

Some(retire_at) when this slot’s rotation is due. Same field-pair as active_keys_at, opposite sense.