---
skill_id: gf-po-secret-rotation-tabletop
evaluation: free
quality: agent-decision-grade
functional: true
price_usd_full: 11.49
price_label: $11.49 / unlock
kind: service
category: Trust
challenge: https://lvlltd.com/api/pay?skill=gf-po-secret-rotation-tabletop
outline: https://lvlltd.com/skills/gf-po-secret-rotation-tabletop/outline.json
runtime_after_unlock: src/index.js createSkill
standards: x402, ERC-7857
completion_pass: functional-v1
---

# Free sample — Secret Rotation Tabletop

**Skill ID:** `gf-po-secret-rotation-tabletop`  
**Unlock:** $11.49 / unlock USDC on Base via x402  
**What you get after pay:** runnable sealed pack (`createSkill().run`) + workbook + templates  

## Summary

Facilitated tabletop for rotating API keys, webhook secrets, agent credentials, and edge bindings without live production risk.

Rehearse dual-run, consumer order, revoke clocks, and residual-use detection on paper before the real rotation. Includes facilitator guide, injects, and scorecard. Free outline first; sealed x402 unlock. Not legal advice; not a penetration test.

## When to use

- You want a rotation drill without minting real keys yet, because production dual-run has never been practiced as a team.
- Compliance or trust stakeholders ask for tabletop evidence of rotation readiness, not only a written policy.
- Agents, CI, Workers, and webhook partners share credentials and the update order is still tribal knowledge.

## Decision-grade outline (free)

1. Prep the room: secret inventory excerpt, system diagram, consumer list, and roles (facilitator, owner, skeptic, scribe) with timed injects.
2. Walk dual-run design on paper: mint path, accept-both config, verification evidence, and hard revoke deadline with residual-use checks.
3. Inject failures: missed CI consumer, delayed webhook partner, leaked old key during window, and binding rename that breaks preview.
4. Score decisions: time-to-revoke estimate, consumers missed, evidence quality, and whether rollback of the rotation itself is defined.
5. Produce remediation tickets with owners and due dates, then schedule the live dual-run only after tabletop gaps close.

## Capabilities

- Facilitator guide with timed injects for secret rotation tabletops
- Dual-run paper walkthrough covering mint, accept-both, verify, revoke
- Failure inject library for missed consumers and mid-window leaks
- Tabletop scorecard for time-to-revoke and residual-use evidence
- Remediation ticket template gating the later live dual-run

## Artifacts after unlock

- `secret-rotation-tabletop-facilitator.md`
- `rotation-inject-deck.md`
- `tabletop-scorecard.md`
- `remediation-ticket-template.md`

## Detailed description

Live secret rotation without rehearsal is how teams create outages while trying to reduce risk. Secret Rotation Tabletop is a trust-ops service that forces dual-run discipline on paper before anyone mints or revokes production keys. Facilitation prep includes an inventory excerpt, system diagram, consumer list, and clear roles—facilitator, secret owner, skeptic, scribe—so the exercise does not devolve into status theater. The dual-run walkthrough covers mint path, accept-both configuration, verification evidence, hard revoke deadlines, and residual-use log checks. Timed injects simulate missed CI consumers, delayed webhook partners, old-key leakage during the dual window, and edge binding renames that break preview while production still works. Scoring makes readiness measurable: estimated time-to-revoke, consumers missed, quality of evidence, and whether rolling back the rotation itself is defined. Gaps become remediation tickets with owners and due dates; the live dual-run is gated until those close. A free outline is on the listing; the sealed pack unlocks via x402 Base USDC. Operational security practice guidance only—not legal advice, not a penetration test, not a compliance certification, and it makes no guarantees of breach prevention or audit pass rates. Use it so the first time your team rotates under pressure is not the first time they think about consumer order.

## Functional runtime (paid)

After verified payment the sealed pack includes:

| Path | Role |
|------|------|
| `src/index.js` | `createSkill`, `run`, `plan`, `checklist` |
| `src/runbook.js` | Outline-driven steps with done_when |
| `src/tools.js` | Tool schemas for agent registries |
| `WORKBOOK.md` | Human/operator procedure |
| `templates/` | Checklist + artifact shells |
| `schemas/output.schema.json` | Result contract |

### Agent snippet (after unlock)

```js
import { createSkill } from "./src/index.js";
const skill = createSkill({ tenantId: "ops", agentId: "buyer" });
const result = await skill.run({
  goal: "Execute Secret Rotation Tabletop for my catalog",
  context: { skill_id: "gf-po-secret-rotation-tabletop" },
  dry_run: false,
});
// result.ok, result.steps, result.artifacts
```

## Pay path

1. Free: this sample + outline.json  
2. `GET https://lvlltd.com/api/pay?skill=gf-po-secret-rotation-tabletop` → HTTP 402  
3. Transfer `maxAmountRequired` USDC to `payTo` on Base  
4. `POST /api/pay` with `X-PAYMENT: {"txHash":"0x…","skill":"gf-po-secret-rotation-tabletop"}`  
5. Write `sealed_pack.files` to disk or use install-unlocked-pack.mjs  
6. Re-redeem anytime with the same verified txHash  

## Honesty

- No revenue, conversion, or uptime guarantees  
- Not legal, tax, medical, or investment advice  
- Crypto transfers are irreversible  
- Confirmed unlocks only for proof strips (/api/proof)  

*Public `/sealed/gf-po-secret-rotation-tabletop/` is teaser-only. Full `src/` is paywalled under locked sealed delivery.*