From 805bacbc14b43c66e05242f843cd266605007770 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Tue, 15 Sep 2026 00:09:39 +0200
Subject: [PATCH] Record runtime lease remint and receiver Ready after ESO
 token refresh

Attended orphan-token remint succeeded. ClusterSecretStore needed a
force-sync to drop the cached 403. ExternalSecrets synced, the mounted
lease rotated, and /readyz returned 200 in 6ms. No secret values.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
---
 .../evidence/2026-09-14-eso-token-remint.json | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 docs/evidence/2026-09-14-eso-token-remint.json

diff --git a/docs/evidence/2026-09-14-eso-token-remint.json b/docs/evidence/2026-09-14-eso-token-remint.json
new file mode 100644
index 0000000..c70a047
--- /dev/null
+++ b/docs/evidence/2026-09-14-eso-token-remint.json
@@ -0,0 +1,20 @@
+{
+  "step": "receiver_ready",
+  "observed_at": "2026-09-14T22:08:36+00:00",
+  "secret": "external-secrets/openbao-audit-core-eso-token",
+  "lease_path": "database/creds/audit-core-runtime",
+  "externalsecret": "audit-core/audit-core-database",
+  "clustersecretstore": "Valid",
+  "externalsecret_ready": true,
+  "credential_rotated": true,
+  "readyz": {
+    "status": 200,
+    "dt_seconds": 0.006,
+    "custody_class": "operational",
+    "durable": true,
+    "tamper_evidence": false
+  },
+  "pod": "audit-core-6f6545dcf5-xklmd",
+  "endpoint_ready": true
+}
+