The short answer

Agent Mesh represents membership changes through authenticated epochs. Enrollment, retirement, replacement and key rotation update governed membership state. A peer must evaluate credentials in that current lifecycle context rather than treating an old key as proof of present authority.

Peer identity and current membership are different facts

A valid signature can establish a relationship to a key. It does not answer whether that key belongs to a currently eligible member for the operation being considered.

The membership reference uses authenticated epochs to represent changes such as enrollment and retirement. This gives receivers a lifecycle context for evaluating peer evidence. Keep key identity and membership state distinct in both the host integration and operational tooling.

Replacement must preserve the change in authority

Imagine an illustrative peer replacement after a machine failure. The successor may inherit responsibility for some work, but it should not simply reuse the predecessor's credentials as evidence that nothing changed.

Record and validate the membership transition required by the deployment. Retain the relevant heads and certificates when continuity matters. A restored snapshot from before the replacement must be reconciled with later state before it can participate in current work.

Key rotation belongs to the lifecycle

The documentation places key rotation among membership changes, not merely in a file-copy procedure. Receivers need to relate the new credential to the governed state and invalidate stale authority where required.

Your rotation runbook should identify who authorizes the transition, how peers receive the updated evidence and what happens to messages arriving under the prior context. Those are deployment-specific decisions; this article does not prescribe an undocumented rotation command or certificate format.

Reconnect through synchronization and readiness

A peer can miss a membership update while offline. The synchronization layer supplies catch-up evidence, while readiness gates require necessary membership context.

Use this distinction during an incident: transport restored does not necessarily mean membership is current. A peer that can exchange packets may still be ineligible to influence an assignment. Show the unresolved lifecycle context to operators instead of reporting every reachable peer as ready.

Test retirement and restoration as well as enrollment

  • Enroll a peer through the configured governed process.
  • Advance membership and verify current-state handling.
  • Attempt to use stale evidence after replacement or retirement.
  • Rotate credentials and inspect receiver behavior across the transition.
  • Restore older persisted state and require reconciliation before work resumes.

The membership example provides a documented entry point. The multi-process guide also makes its ephemeral-key limitation explicit. Production key custody and rotation remain responsibilities of the adopting organization.

Sources and further reading

Documentation reviewed . Consult the linked documentation for current implementation details.