Master and repository key runbook

Store the Compose master key outside the checkout. It must be a regular file, at least 32 bytes, mode 0600, owned by the service UID (10001 for Compose). Loss of this key destroys access to encrypted metadata secrets.
Back up the master key independently from metadata and repositories; do not put it in an image, Compose environment variable, log, ticket, or recovery bundle.
Use the admin recovery export command with a passphrase file descriptor to create a separately protected recovery bundle. Validate it on an isolated host.
Rotate repository data keys only with admin repository-key rotate; retain prior recovery material until a restore drill succeeds.
If compromise is suspected, stop the worker, preserve evidence, rotate credentials, export a fresh recovery bundle, and run a restore drill before resuming writes.