From 6611e36672091a0a203abe0c832ef34144f745f4 Mon Sep 17 00:00:00 2001 From: Bretton Date: Sat, 15 Aug 2026 21:49:10 -0700 Subject: [PATCH] docs(identity): retire a column-name claim migration 013 outdated Co-Authored-By: Claude Fable 5 --- internal/identity/keys.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/internal/identity/keys.go b/internal/identity/keys.go index dfa30f6..1aa610f 100644 --- a/internal/identity/keys.go +++ b/internal/identity/keys.go @@ -209,8 +209,9 @@ func LoadOrCreateRotationKey(ctx context.Context, keys store.ServiceKeys, custod if err != nil { return nil, fmt.Errorf("identity: seal rotation key: %w", err) } - // NOTE: the column is named private_key_pem for the RSA service-actor - // key; for the rotation key it holds the sealed ciphertext instead. + // NOTE: key_material holds plaintext PEM for the RSA service-actor row + // but sealed ciphertext for this one; the per-row encoding is documented + // on the column (migration 013). if _, err := keys.Create(ctx, RotationKeyName, sealed); err != nil { if errors.IsAlreadyExists(err) { // Lost the bootstrap race: use the winner's key. -- 2.51.2