Rotate SSH trust

Host groups have independent SSH certificate authority material. Rotate one trust boundary at a time and keep a tested recovery path.

Before rotation

• identify every host and policy using the host group;
• confirm agent health and desired-state convergence;
• verify audit delivery;
• document the old and new trust fingerprints;
• define the overlap and rollback window; and
• pause unrelated SSH configuration changes.

Rotation sequence

1. Generate or activate the new host-group trust material in Tenvyr.
2. Reconcile the new trusted key to a small canary set while retaining the old key for the approved overlap.
3. Validate OpenSSH configuration.
4. Issue and test access under the new trust.
5. expand the new trust to the remaining hosts;
6. verify every expected host converged;
7. stop issuing against the old trust; and
8. remove the old trusted key after the overlap window.

Never remove the old key before all required hosts accept the new one.

Manifest-key changes

The agent's -manifest-key protects desired-state authenticity. Treat changing it as a separate trust migration. Use -dry-run, qualify fallback behavior, and avoid rotating the host-group CA and manifest trust in the same maintenance event.

Evidence

Retain the change approval, fingerprints, affected host IDs, reconciliation results, test connections, overlap start/end, and operator identity.