Interface McpTraceCorrelationKeyManager

@ThreadSafe
public interface McpTraceCorrelationKeyManager

Thread-safe, server-owned MCP trace-correlation control plane.

Correlation is disabled unless a key is supplied when the server is built. Rotation atomically replaces both active key ID and key material. Soklet retains no public history or historical-token derivation facility.

Author:

Mark Allen

Method Summary

Modifier and Type	Method	Description
@NonNull Optional<@NonNull String>	getActiveKeyId()
@NonNull Optional<@NonNull McpTraceCorrelationFingerprint>	getFingerprint()
@NonNull Boolean	isEnabled()
void	rotateActiveKey(@NonNull McpTraceCorrelationKey activeKey)	Atomically rotates both active key ID and material.

Method Details

isEnabled

@NonNull Boolean isEnabled()

Returns:

whether trace correlation was enabled at server construction

getActiveKeyId

@NonNull Optional<@NonNull String> getActiveKeyId()

Returns:

active non-secret key ID, or empty when disabled

getFingerprint

@NonNull Optional<@NonNull McpTraceCorrelationFingerprint> getFingerprint()

Returns:

active configuration fingerprint, or empty when disabled

rotateActiveKey

void rotateActiveKey(@NonNull McpTraceCorrelationKey activeKey)

Atomically rotates both active key ID and material.

Re-supplying the byte-identical active entry is an idempotent no-op. Reuse of the active ID with different material is rejected so structured-log key IDs continue to identify one correlation-key version unambiguously.

Parameters:

activeKey - new active correlation key

Throws:

IllegalArgumentException - if its ID ambiguously reuses the active ID or its material equals any protection ring key material

IllegalStateException - if correlation was not enabled when the server was built