up

ops/authority/README.md

@@ -37,3 +37,22 @@ Key environment variables (mirroring `StellaOpsAuthorityOptions`):
 | `STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY` | Path to plugin manifest directory |
 
 For additional options, see `etc/authority.yaml.sample`.
+
+## Key rotation automation (OPS3)
+
+The `key-rotation.sh` helper wraps the `/internal/signing/rotate` endpoint delivered with CORE10. It can run in CI/CD once the new PEM key is staged on the Authority host volume.
+
+```bash
+AUTHORITY_BOOTSTRAP_KEY=$(cat ~/.secrets/authority-bootstrap.key) \
+./key-rotation.sh \
+  --authority-url https://authority.stella-ops.local \
+  --key-id authority-signing-2025 \
+  --key-path ../certificates/authority-signing-2025.pem \
+  --meta rotatedBy=pipeline --meta changeTicket=OPS-1234
+```
+
+- `--key-path` should resolve from the Authority content root (same as `docs/11_AUTHORITY.md` SOP).
+- Provide `--source`/`--provider` if the key loader differs from the default file-based provider.
+- Pass `--dry-run` during rehearsals to inspect the JSON payload without invoking the API.
+
+After rotation, export a fresh revocation bundle (`stellaops-cli auth revoke export`) so downstream mirrors consume signatures from the new `kid`. The canonical operational steps live in `docs/11_AUTHORITY.md` – make sure any local automation keeps that guide as source of truth.