feat(bin): add Bitwarden rollout runbook and no-secret ceremony validator - #13

Open

rega10 wants to merge 10 commits into

mainfrom

fm/production-bitwarden-team-rollout

Commits on Aug 29, 2026

feat: add Bitwarden production/team credential rollout runbook and ceremony-record validator

Rene Garza Jr.
authored and
Rene Garza Jr.
committed
148db80
no-mistakes(review): refuse secret-shaped batch ids and fix grep option parsing

Rene Garza Jr.
authored and
Rene Garza Jr.
committed
a2cf4e8
no-mistakes(review): validate ceremony step order on every record read

Rene Garza Jr.
authored and
Rene Garza Jr.
committed
05d54f6
no-mistakes(review): validate record batch identity and item placement

Rene Garza Jr.
authored and
Rene Garza Jr.
committed
cc6a9f0
no-mistakes(review): validate record field values on every read

Rene Garza Jr.
authored and
Rene Garza Jr.
committed
16ff676
no-mistakes(review): refuse truncated records and validate recorded dates

Rene Garza Jr.
authored and
Rene Garza Jr.
committed
af50554
no-mistakes(review): validate mark arguments before idempotent replay

Rene Garza Jr.
authored and
Rene Garza Jr.
committed
4d7e748
no-mistakes(review): refuse future-dated ceremony records

Rene Garza Jr.
authored and
Rene Garza Jr.
committed
f710d52
no-mistakes(document): document replay conflict refusals in ceremony contract

Rene Garza Jr.
authored and
Rene Garza Jr.
committed
1cec584
no-mistakes(ci): derive public-followup reply window from the run clock

Rene Garza Jr.
authored and
Rene Garza Jr.
committed
8978a56