# Master and repository key runbook

- Store the Compose master key outside the checkout. It must be a regular file,
  at least 32 bytes, mode `0600`, owned by the service UID (`10001` for Compose).
  Loss of this key destroys access to encrypted metadata secrets.
- Back up the master key independently from metadata and repositories; do not put it
  in an image, Compose environment variable, log, ticket, or recovery bundle.
- Use the `admin recovery export` command with a passphrase file descriptor to create
  a separately protected recovery bundle. Validate it on an isolated host.
- Rotate repository data keys only with `admin repository-key rotate`; retain prior
  recovery material until a restore drill succeeds.
- If compromise is suspected, stop the worker, preserve evidence, rotate credentials,
  export a fresh recovery bundle, and run a restore drill before resuming writes.