starintel-credential-lifecyclelisted

# StarIntel credential lifecycle ## Goal Issue or replace narrowly scoped Star Server credentials, store their one-time values in an encrypted Org file, and deliver a service credential through its local administration API without losing or exposing key material. Requires `curl`, `jq`, `ssh`, `emacsclient`, an Emacs daemon with EasyPG access, an authenticated Star Server administrator path, and the target service's local API contract. ## Input Credential owners and principal types, exact capability and resource scopes, expiry, encrypted Org file and headings, predecessor credential IDs, target SSH identity, local API URL, and destination secret name such as `STAR_AUTH`. ## Output Authenticated replacement credentials, encrypted records, masked target API readback, and revoked predecessors with sanitized lifecycle receipts. ## Workflow 1. Inspect the deployed Star Server authorization vocabulary and credential API. Reject unknown scopes. Changing scopes requires a new credential; rotation preserves the old scope set. 2. Read existing records from the `.org.gpg` buffer through `emacsclient`. Extract only required values into memory; do not decrypt to a plaintext file. 3. Resolve every requested resource dimension explicitly. Target work commonly needs `targets:read`, `targets:dispatch`, `targets:lease`, and matching `tenant:`, `dataset:`, `actor:`, `target:`, `target-namespace:`, and `program:` grants. Do not infer wildcard access from a capability. 4