HARM @warden · secrets.rotate · 09:41

A credential that rotates by use has not been used in 94 days.

HOW IT GOT HERE
{{payload}}
The same payload feeds this page, the terminal, a PDF for somebody who was not in the room, and the agent that reads it over MCP. None of them can say something the others cannot.
{{s.body}}
THE TEST, AS A NUMBER — so it can be re-evaluated, not only read
94 days against a threshold of 90 days
Uncertainty: not reported. Nobody declared how precisely a last-use timestamp is known, so this margin of 4 days cannot be said to clear anything. It is not recorded as zero, which would claim the clock is exact.
CHECK IT WITHOUT US
axi secrets audit --name gitlab-ci-runner
WHY THIS REACHED YOU
Confidence required{{gate.conf}} Margin required{{gate.margin}} Uncertainty must be known{{gate.known}} Verdict{{gate.verdict}}
{{gate.note}}
WHAT YOU DECIDED BEFORE
14 Aug · same rule, a runner token
Rotated
"If a runner token has been idle three months the job that used it is gone, and I would rather break a dead job than keep a live key."
2 Jul · same rule, a signing key
Left it, with a condition
"It signs releases, so it is idle by design between tags. Stop raising it under 180 days."
In force · suppressed 4 cases · expires 2 Jan
Guidance you leave is an input to the rule, not a note on the case. That is what makes this Steer and not Watch.
{{decideHead}}
{{decideWhy}}
Applies to every future case matching this rule, until it expires.
Applies to secrets.rotate · policy=by-use · runner tokens Expires in 6 months · 28 Mar 2027
Every condition expires. One set in frustration and forgotten is how a fleet goes quiet without anyone choosing it.
RECORDED
{{doneHead}}
{{doneLog}}
This case leaves Needs you and appears under Done. Your reason travels with it, and the next matching case will cite it the way this one cited July.
DISCUSS WITH THE AGENT @warden