What
keygen honors -out (cmd/agentpantry/main.go:173). rotate-key (:190-232) resolves from the config's key_path, else the config dir's psk.key, and exposes no -key/-out flag.
Why
An operator who ran keygen -out <custom> and then rotate-key without a matching config could rotate a different file, conditional on another default key existing. Add a -key flag (selecting which file only; it must not change the grace-window semantics, where the old key stays accepted until -finish), or document the resolution order at README.md:282-302. Fits the SC-12 key-lifecycle control set, NIST SP 800-53 Rev. 5 (doi:10.6028/NIST.SP.800-53r5).
Effort
S
Source: three-lane research sweep (repo audit + comparables + literature), independently reviewed before filing; run 20260724-040709-e9fc6818.
What
keygenhonors-out(cmd/agentpantry/main.go:173).rotate-key(:190-232) resolves from the config'skey_path, else the config dir'spsk.key, and exposes no-key/-outflag.Why
An operator who ran
keygen -out <custom>and thenrotate-keywithout a matching config could rotate a different file, conditional on another default key existing. Add a-keyflag (selecting which file only; it must not change the grace-window semantics, where the old key stays accepted until-finish), or document the resolution order atREADME.md:282-302. Fits the SC-12 key-lifecycle control set, NIST SP 800-53 Rev. 5 (doi:10.6028/NIST.SP.800-53r5).Effort
S
Source: three-lane research sweep (repo audit + comparables + literature), independently reviewed before filing; run 20260724-040709-e9fc6818.