feat(ql3): validate cluster credential key rotation

test/back/ql3SecurityAdministrationKubernetesLiveAudit.test.cjs

@@ -20,6 +20,7 @@ function report() {
       architecture: 'amd64',
       kubernetesImageId: digest('1'),
       administrationImageId: digest('2'),
+      controlImageId: digest('4'),
       cniName: 'flannel',
       cniDistributionBinding: 'rancher/k3s:v1.34.3-k3s1',
       controlPlaneNodes: 1,
@@ -45,13 +46,21 @@ function report() {
       operations: [
         'identity.register',
         'audit.list',
-        'credential.issue',
-        'credential.issue.replay',
-        'credential.rotate',
-        'credential.revoke',
+        'credential.issue.old',
+        'credential.issue.old.replay',
+        'credential.key-references.before-activate',
+        'credential.issue.new',
+        'credential.rotate.new',
+        'credential.key-references.after-activate',
+        'credential.revoke.old',
+        'credential.key-references.after-converge',
       ],
-      completedJobs: 6,
+      completedJobs: 10,
       failedJobs: 1,
+      authenticationProbeJobs: 5,
+      controlReplicas: 2,
+      controlRollouts: 3,
+      controlReplicaAntiAffinity: true,
       callerDriven: true,
       backoffLimit: 0,
       activeDeadlineSeconds: 300,
@@ -60,6 +69,18 @@ function report() {
       serviceAccountTokenMounted: false,
       rbacGranted: false,
       responseLossReplayObserved: true,
+      overlapGenerationCount: 2,
+      contractedGenerationCount: 1,
+      activeGenerationChanged: true,
+      oldReferencesBeforeActivation: 1,
+      oldReferencesAfterActivation: 1,
+      oldReferencesAfterConvergence: 0,
+      oldAuthenticationBeforeActivation: true,
+      oldAuthenticationDuringOverlap: true,
+      newAuthenticationDuringOverlap: true,
+      oldAuthenticationRejectedAfterConvergence: true,
+      newAuthenticationAfterContraction: true,
+      contractedToActiveGeneration: true,
       sensitiveMaterialReported: false,
     },
     inputBoundary: {
@@ -80,7 +101,7 @@ function report() {
       fixtureProvisionerRanAsRoot: true,
       privateDirectoryMode: '0700',
       fileMode: '0600',
-      fileCount: 2,
+      fileCount: 3,
       issueDigest: digest('4'),
       rotationDigest: digest('5'),
       distinctRotationMaterial: true,
@@ -100,13 +121,20 @@ function report() {
     durability: {
       identityVersion: 1,
       identityStatus: 'active',
-      credentialVersion: 3,
-      credentialState: 'revoked',
+      oldCredentialVersion: 2,
+      oldCredentialState: 'revoked',
+      newCredentialVersion: 2,
+      newCredentialState: 'active',
       identityMutationCount: 1,
-      credentialMutationCount: 3,
+      credentialMutationCount: 4,
       issueMutationCount: 1,
-      credentialVersionCount: 3,
-      allowedAuditCount: 4,
+      credentialVersionCount: 4,
+      oldGenerationVersionCount: 1,
+      newGenerationVersionCount: 3,
+      latestGenerationsAreNew: true,
+      allowedAuditCount: 5,
+      authenticationDeniedAuditCount: 4,
+      authenticationRejectedAuditCount: 1,
     },
     cleanup: {
       jobsDeleted: true,
@@ -114,6 +142,9 @@ function report() {
       evidenceJobsDeleted: true,
       storageProvisionJobDeleted: true,
       deliveryVolumeClaimDeleted: true,
+      controlDeploymentDeleted: true,
+      controlServiceDeleted: true,
+      controlRuntimeSecretDeleted: true,
     },
     gates: {
       realThreeNodeKubernetes: true,
@@ -121,6 +152,7 @@ function report() {
       realKubeletSecretProjection: true,
       realAdministrationProductCommands: true,
       realPersistentCredentialCustody: true,
+      realClusterControlAuthenticationRotation: true,
       responseLossReplay: true,
       failedInputStageClosed: true,
       leastPrivilege: true,
@@ -142,6 +174,7 @@ test('rejects widened authority, false custody and replay duplication', () => {
   candidate.ceremony.serviceAccountTokenMounted = true;
   candidate.deliveryCustody.noReplaceReplayPreserved = false;
   candidate.durability.issueMutationCount = 2;
+  candidate.ceremony.oldReferencesAfterConvergence = 1;
   candidate.gates.passed = false;
   const codes = validateSecurityAdministrationKubernetesLiveReport(
     candidate,