coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Align ESO token scripts with the periodic token (RPF-WP-0046)

Browse source 
renew-runtime-lease.sh is recovery-only now: it mints with -period
instead of -ttl=768h, so a recovery no longer undoes the platform's
periodic token, and defaults BAO_ADDR to the tunnel rather than the
retired bao.coulomb.social. The old openbao-eso-token-apply.sh is
retired for the same two reasons.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151986@bnt-lap001
Assistant-Session: ccd02b6b-80ae-48e5-8cad-9c8f74d21a67
This commit is contained in:
tegwick 2026-09-24 02:22:49 +02:00
parent 4a0e5aa53d
commit 21e8ce9b72
3 changed files with 51 additions and 110 deletions
Download patch file Download diff file Expand all files Collapse all files

37
workplans/ADHOC-2026-09-24.md Normal file
View file

@ -0,0 +1,37 @@
---
id: ADHOC-2026-09-24
type: workplan
title: "Ad hoc tasks 2026-09-24"
domain: infotech
repo: audit-core
status: finished
flavor: implementation
owner: claude
topic_slug: railiance
created: "2026-09-24"
updated: "2026-09-24"
---
# Ad hoc tasks 2026-09-24
## Align the ESO token scripts with the periodic token (RPF-WP-0046)
```task
id: ADHOC-2026-09-24-T01
status: done
priority: medium
```
Inbox from railiance-platform (`1847edae`): on 2026-09-23
`external-secrets/openbao-audit-core-eso-token` was re-minted as a periodic
168h token, renewed daily by the CronJob `external-secrets/eso-token-renewer`.
`scripts/renew-runtime-lease.sh` re-minted with `-ttl=768h`, which would undo
that, and defaulted `BAO_ADDR` to the retired `https://bao.coulomb.social`.
Done: `renew-runtime-lease.sh` is now marked recovery-only, mints with
`-period` (default 168h, `OPENBAO_AUDIT_CORE_ESO_PERIOD`), and defaults
`BAO_ADDR` to the tunnel `http://127.0.0.1:18200`. The first-mint script
`scripts/openbao-eso-token-apply.sh` is retired (deleted): it carried the same
768h TTL and retired address, and the agent environment orientation §6 says not
to re-run the old `*-eso-token-apply` scripts. Nothing was run against the
cluster or OpenBao.