---
id: ADHOC-2026-09-24
type: workplan
title: "Ad hoc tasks 2026-09-24"
domain: infotech
repo: audit-core
status: finished
flavor: implementation
owner: claude
topic_slug: railiance
created: "2026-09-24"
updated: "2026-09-24"
---

# Ad hoc tasks 2026-09-24

## Align the ESO token scripts with the periodic token (RPF-WP-0046)

```task
id: ADHOC-2026-09-24-T01
status: done
priority: medium
```

Inbox from railiance-platform (`1847edae`): on 2026-09-23
`external-secrets/openbao-audit-core-eso-token` was re-minted as a periodic
168h token, renewed daily by the CronJob `external-secrets/eso-token-renewer`.
`scripts/renew-runtime-lease.sh` re-minted with `-ttl=768h`, which would undo
that, and defaulted `BAO_ADDR` to the retired `https://bao.coulomb.social`.

Done: `renew-runtime-lease.sh` is now marked recovery-only, mints with
`-period` (default 168h, `OPENBAO_AUDIT_CORE_ESO_PERIOD`), and defaults
`BAO_ADDR` to the tunnel `http://127.0.0.1:18200`. The first-mint script
`scripts/openbao-eso-token-apply.sh` is retired (deleted): it carried the same
768h TTL and retired address, and the agent environment orientation §6 says not
to re-run the old `*-eso-token-apply` scripts. Nothing was run against the
cluster or OpenBao.