[rami-hatoum]

A secret store whose custodian may refuse or stall reaches paths that still died, swallowed the failure or revoked tokens on a failure that is only now. A dynamic client registration the store cannot read now is a failure of the call and never "no registration": a start answers unavailable in the store's words, and a renewal fails the call and breaks nothing. A renewal whose replacement the store cannot keep now holds the renewed tokens in memory under its claim, revokes nothing, fails the call, and keeps them at the next claim without asking the vendor again; a value the store refuses revokes, as before. A start whose verifier cannot be kept, a finish whose verifier cannot be read, a finish whose tokens cannot be kept after the code is redeemed, a credential that cannot be kept, and a removal whose tokens cannot be read each answer unavailable in the store's words, and the finish says the person starts again, since the code is spent. The store answers each call within ten seconds, shorter than the fifteen a renewal's claim keeps for the write, and the log's cause is keyed by the failure's tag and the key's id.

The secrets key can now be held in AWS KMS. SECRETS_KEY_KMS names a symmetric key or an alias by its ARN; the custodian wraps each value's data key with Encrypt under the context on.auto/runtime: secret data key and unwraps it with Decrypt, over the same proxy, credential chain and waits as the object store's client, and the server loads it through the @on.auto/secrets/aws subpath only where the setting names it, so a runtime without it loads no part of the KMS client. At start the custodian is probed with one data key wrapped, unwrapped and zeroed, and a key that is disabled, pending deletion, unknown or denied stops the start in words that name the setting, the key's id and the service's own words, never a credential or the account. The start line says which key the ledger's secrets are sealed under, and rotation from a key in the environment or a file to a key in KMS, and back, is one restart with the previous setting. A key disabled while the runtime runs fails each call as connection_unavailable and breaks nothing, and the calls succeed again once it is enabled. The package's fake answers the KMS protocol for the unit tests, and CI runs the same suite and a runtime started twice against moto's server, checking that no key, data key or credential reaches the output. The self-host pages say how to hold the key in a KMS, what the identity needs, what disabling the key does, and that KMS's own rotation of its key material needs nothing.