{
  "slug": "fly-mpg-users-rotate-password-rotates-a-managed-postgres-user-password-bde83abb5ff3",
  "title": "fly mpg users rotate-password rotates a managed Postgres user password",
  "tools": [
    "flyctl"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-06T19:14:01.000Z",
  "announced_at": "2026-10-06T19:14:01.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "For an MPG v2 cluster, run `fly mpg users rotate-password <CLUSTER_ID> --username <USER>` and confirm the rotation with `--yes` for noninteractive or JSON use. If the server reports `sessions_not_terminated`, print the current credentials and exit with failure; do not retry rotation.",
    "examples": [
      "fly mpg users rotate-password <CLUSTER_ID> --username <USER>",
      "fly mpg users rotate-password <CLUSTER_ID> --username <USER> --yes --json",
      "fly mpg users rotate-password <CLUSTER_ID> --username <USER> --kill-sessions --yes"
    ],
    "gotchas": [
      "Version: v0.4.113",
      "CLUSTER_ID (required): Target cluster ID; required when using `--json`.",
      "--username (required): User whose password to rotate; required with `--json` or in noninteractive use.",
      "--yes: Skip confirmation; required for `--json` and noninteractive use.",
      "--json: Output credentials as JSON; requires `--yes`, `CLUSTER_ID`, and `--username`.",
      "--kill-sessions: Terminate the user's existing database sessions after rotation.",
      "Prerequisite: The command requires an authenticated Fly session and a macaroon token.",
      "Prerequisite: Supported only for MPG v2 clusters; v1 clusters must be migrated to v2 first.",
      "Rotation requires explicit confirmation."
    ]
  },
  "why_it_matters": "When rotating a managed Postgres user password, run the command and recover the current credentials if rotation succeeds but session termination fails.",
  "sources": [
    "https://github.com/superfly/flyctl/releases/tag/v0.4.113",
    "https://github.com/superfly/flyctl/pull/5285",
    "https://github.com/superfly/flyctl/blob/v0.4.113/internal/command/mpg/users.go"
  ],
  "rank": 0.94021,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1-20261014",
    "verdict_id": "wave1-20261014:wave1-20261014-73f5d7960912aeca-0:gate",
    "evidence_hash": "f4be4993f39c0d16cf35f9eb028ec2e592f494209c9e7e20eea3c0498a2c6b3c"
  },
  "review": {
    "draft_hash": "276ff45fa51452793144e020c799a8ddb91e0331bc2ef9861e6e91d04af56959",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1-20261014:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.94 >= 0.9; 2 needed) and Jev gave 0.70 (>= 0.6 needed)."
  }
}