{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T02:40:06.177Z",
  "record_id": "VXI-EXT-PROCUREMENT-GITLAB-PAT-ROTATION-01-v1",
  "record_kind": "external_reference",
  "title": "GitLab token rotation: Old-token invalidation needs a consumer handoff",
  "system": "GitLab",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does rotating a GitLab personal access token preserve uninterrupted access for existing consumers?",
  "near_questions": [
    "Does the old GitLab token remain usable after rotation?",
    "Does rotation narrow token scopes?",
    "Which integrations still hold the old credential?",
    "Can an expired token be reactivated?",
    "What expiry applies to the replacement?",
    "Does a rotation response prove deployment succeeded?",
    "How should an agent avoid logging the replacement secret?",
    "Which service account credentials need separate review?",
    "What evidence establishes the handoff?",
    "Can consumers fail during an immediate invalidation?",
    "When should continuity remain unproven?",
    "Can I save a token-rotation review?"
  ],
  "supported_claims": [
    {
      "claim": "Rotation creates a replacement and invalidates the previous token immediately while retaining the original permissions and scope. Consumers still need the new credential. Rotation is a lifecycle action, not evidence that every dependent integration has switched successfully or that access was narrowed.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Rotation creates a replacement and invalidates the previous token immediately while retaining the original permissions and scope. Consumers still need the new credential. Rotation is a lifecycle action, not evidence that every dependent integration has switched successfully or that access was narrowed.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-ENTRA-CAE-01-v1",
    "VXI-EXT-PROCUREMENT-WORKSPACE-APP-SCOPES-01-v1",
    "VXI-EXT-PROCUREMENT-AWS-ROLE-CUTOFF-01-v1",
    "VXI-EXT-PROCUREMENT-GITHUB-APP-IDENTITY-01-v1",
    "VXI-EXT-PROCUREMENT-SNOWFLAKE-SECONDARY-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "GitLab personal token rotation and expiry",
    "source_url": "https://docs.gitlab.com/user/profile/personal_access_tokens/",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-GITLAB-PAT-ROTATION-01-v1",
    "candidate_record_sha256": "c3ab98977baa0d2dbd95ae51ae9761bfd48d1f0ba7c4b1fdb6781e4acc83d2c7",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Rotation creates a replacement and invalidates the previous token immediately while retaining the original permissions and scope. Consumers still need the new credential. Rotation is a lifecycle action, not evidence that every dependent integration has switched successfully or that access was narrowed.",
    "required_buyer_context": "GitLab: Token scopes, expiry, dependent consumers and credential handoff; buyer configuration and operational evidence are required.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "Rotating the token guarantees uninterrupted and more restricted access.",
    "documented_statement": {
      "status": "documented",
      "statement": "Rotation creates a replacement and invalidates the previous token immediately while retaining the original permissions and scope. Consumers still need the new credential. Rotation is a lifecycle action, not evidence that every dependent integration has switched successfully or that access was narrowed.",
      "source_ids": [
        "gitlab-token"
      ]
    },
    "buyer_evidence_required": [
      "Original and replacement scope and expiry metadata.",
      "Inventory of dependent integrations and their update path.",
      "Authorised verification of old-token failure and new-token use."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require a consumer handoff before claiming successful continuity."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "gitlab-token",
        "url": "https://docs.gitlab.com/user/profile/personal_access_tokens/",
        "final_url": "https://docs.gitlab.com/user/profile/personal_access_tokens/",
        "title": "GitLab personal token rotation and expiry",
        "checked_on": "2026-10-16",
        "sha256": "5c05f87f431409c1f9658131964eb1872ef5544e249aa98a4117918d3bb1771a",
        "bytes": 81275
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve the integration handoff and scope questions behind a rotation decision.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Token scopes, expiry, dependent consumers and credential handoff"
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#gitlab-token-rotation-continuity",
  "machine_readable_record": "/varexis-index/records/gitlab-token-rotation-continuity.json"
}