Choose the next step in a secret rotation

Secret rotation at your company is manual and overdue. An agent drives it under one absolute rule: it never sees a secret in plaintext, so it decides each step from signals about the rotation, never from the secret itself.

Write decide_rotation_action(secret_kind, canary_auth_passed, old_version_still_used, consumer_error_rate, rollback_rehearsed): the rule your agent follows at each step.

• secret_kind (str): what the secret is, such as "database".
• canary_auth_passed (bool): a test client authenticated with the new version.
• old_version_still_used (bool): some consumers still authenticate with the old version.
• consumer_error_rate (float, 0 to 1): the error rate consumers have seen since the switch.
• rollback_rehearsed (bool): the rollback for this secret has been rehearsed.

It returns one of the values in the rules below. Apply them in order. The first one that matches decides:

1. The rotation is failing if the canary did not pass, or consumer_error_rate is above 0.02. If it is failing: "rollback" if the rollback was rehearsed, otherwise "hold_for_human".
2. secret_kind is not exactly service, database or api_key: "hold_for_human".
3. The rollback was not rehearsed: "hold_for_human".
4. old_version_still_used: "wait_for_consumers".
5. Otherwise: "retire_old_version".

Then, in a sentence or two: how does the agent know a rotation worked without ever reading the secret?