Chronicle.Keyring.Config (chronicle v0.1.1)

Keyring backed by the audit store's integrity keyword configuration.

The compact single-key form is valid before the first rotation:

[key_id: "key-1", key: {:system, "AUDIT_KEY", :base64}]

For enforceable rotation boundaries, configure all key sources and epochs:

[
  keys: %{
    "key-1" => {:system, "AUDIT_KEY_1", :base64},
    "key-2" => {:system, "AUDIT_KEY_2", :base64}
  },
  key_epochs: %{
    "key-1" => [from: 1, through: 10_000],
    "key-2" => [from: 10_001]
  }
]

New writes automatically select the sole key valid at the next sequence.

The two forms are capability tiers rather than two spellings of one thing. The compact form has no epoch to enforce, so it cannot express a rotation boundary at all — every key is valid everywhere, and a retired key stays as powerful as it ever was. That is acceptable before the first rotation and not afterwards, which is why Chronicle.Keyring.epoch_policy?/1 exists: an operator needs to be able to ask which of the two they are actually running.