# audit-core operator runbook Production receiver on railiance01. Custody is PostgreSQL (`platform-pg`, database `audit_core`). This runbook is the T06 handover: lookup, dead letters, replay, credential rotation, alerts, and restore. In-cluster URL: ```text http://audit-core.audit-core.svc.cluster.local:8080 ``` Reachability is part of the threat model. Ingress is allowed only from the `user-engine` namespace (write) and from namespaces labelled `railiance.io/audit-core-reader=true` (operator read). From a workstation, `kubectl -n audit-core port-forward svc/audit-core 8080:8080` is the usual path and does not require that label. Do not paste sender tokens, database passwords, or OpenBao tokens into Git, State Hub, workplans, logs, or chat. Route first: ```bash warden route find "database credential" --json warden route show database-dynamic-credentials --json ``` ## Readiness and health | Check | Meaning | | --- | --- | | `GET /healthz` | Process is up. Liveness uses this. A database outage must **not** restart the pod. | | `GET /readyz` | Custody is reachable and `custody_class=archive`. Readiness uses this; the pod leaves the Service rather than accept events it cannot store. | | `GET /v1/stats` | In-process counters since start (`accepted`, `duplicate`, `conflict`, `rejected`, `unauthorized`, `forbidden`, `unavailable`, `error`). Resets on restart. Requires `may_read`. | A missing `AUDIT_CORE_DATABASE_URL` / credential directory is a startup failure (`AUDIT_CORE_REQUIRE_CUSTODY_CLASS=archive`), not a silent downgrade to SQLite. ## Lookup All read routes require a sender identity with `may_read: true`. A write credential must not be able to read the trail back. ```bash # One event curl -sS -H "Authorization: Bearer $OPERATOR_TOKEN" \ http://127.0.0.1:8080/v1/events/ # Every event sharing a correlation id curl -sS -H "Authorization: Bearer $OPERATOR_TOKEN" \ 'http://127.0.0.1:8080/v1/events?correlation_id=&limit=100' ``` Stored records keep the original `event_id`, `payload_hash`, and `accepted_at`. Redacted fields appear in `details.redaction.paths`; the payload itself is stored already masked. ## Dead letters and replay ```bash curl -sS -H "Authorization: Bearer $OPERATOR_TOKEN" \ 'http://127.0.0.1:8080/v1/dead-letters?limit=100' ``` A dead letter is a **rejected** submission (400). Retrying it unchanged will not help. Typical reasons: `invalid_event`, `source_not_allowed`, `tenant_not_allowed`, `secret_shaped_field`. Payloads rejected for secret shape are withheld (`payload_withheld: true`). To replay after the sender is fixed, POST the corrected event with the same `id` and `Idempotency-Key`. The store is idempotent: an already-accepted identical payload returns 200 `duplicate` and does not create a second record. A different payload under the same id returns 409. Reconciling an **already stored** event (the WP-0005-T05 S13 case): ```bash # From a shell that already has a migration or runtime lease. python3 -m audit_core replay --event-id ``` That command must report `"duplicate": true`. A first-acceptance result is a custody defect: stop and investigate. ## Sender credential rotation First deploy mints the registry in-cluster as Secret `audit-core-senders` (ops-mason plan `audit-core-openbao-runtime-custody`). The OpenBao path `platform/workloads/audit-core/senders` is the later authority after a wrap-migrate; do not `bao kv put` it by hand. Rotation is overlap-first: 1. Add the replacement token to the sender's `tokens` list. Both work. 2. Move the sender to the new token. 3. Drop the predecessor from the list. 4. Write the updated document back (`bao kv put` from a mode-0600 file). 5. Either wait for the 1h refresh or annotate the ExternalSecret to force a sync, then restart the pod so it re-reads `AUDIT_CORE_SENDERS`. The write token is bound to `source=user-engine` and the tenants that identity may claim. The operator token is a separate identity with `may_read: true`. Do not reuse one token for both. A shape (values are placeholders) is in `docs/senders.example.json`. ## Database credential rotation Runtime leases come from `database/creds/audit-core-runtime`. ESO refreshes every 15 minutes into Secret `audit-core-database`, mounted at `/etc/audit-core/db`. The process re-reads those files on every new connection. No restart is required; a restart would be a delivery gap. Rotation is logged by password fingerprint, never by value: ```text database credential rotated (fingerprint <12 hex chars>) ``` A revoked lease surfaces as `/readyz` 503 and request 503 `unavailable`. The sender contract retries 503/500 and treats 400/401/403/409 as terminal. Schema changes are a Job (`deploy/migrate-job.yaml`) using `database/creds/audit-core-migration`. The runtime Deployment sets `AUDIT_CORE_AUTO_MIGRATE=0`. After a new migration ships, delete the old Job and re-apply. ## Alert conditions There is no Prometheus scrape path on railiance01 today (`/v1/stats` is JSON behind the read privilege). Watch: | Signal | Why | | --- | --- | | `/readyz` not 200 | Custody is down; senders will retry. Do not bounce the pod. | | `counts.unavailable` or `counts.error` climbing | Database or unexpected fault. Check `platform-pg` and the mounted lease. | | `counts.unauthorized` climbing | Sender using a dropped token, or registry not refreshed. | | `counts.conflict` non-zero | Same `event_id`, different payload. Sender bug or id reuse. | | `GET /v1/secret-findings` | Secret-shaped fields by path. Fix the sending service. | | Pod not Ready after rotate | Stale or revoked lease; check ExternalSecret status, not the password. | `platform-pg` operations, including what to scrape on port 9187, live in `rapp-postgres/docs/operations.md`. ## Restore audit-core declares `custody_class=archive` and `immutable=True` (the append-only trigger). It does **not** declare a retention window shorter than the platform's, because it currently declares none (`retention_days` unset = keep). That is only honest if the platform's backup retention is also unbounded or is an explicit accepted loss. As of 2026-08-13, `RAPP-POSTGRES-WP-0002-T06` is `wait`. Production backup is fail-closed until an S3-compatible Barman target exists. The governed Nextcloud logical-dump lane cannot provide WAL archiving or PITR. Do not claim an RPO/RTO for audit-core until those drills have been recorded in rapp-postgres. When the platform restore path is open, the audit-core walk is: 1. Restore `platform-pg` to a scratch cluster (`platform-pg-restore-full` or PITR). Never recover in place. 2. Physical restore is instance-wide. A single-consumer restore is a logical dump of `audit_core` from the scratch cluster, then a controlled import. 3. Verify: event counts, a sample of `event_id`/`payload_hash`/`accepted_at` triples, and that the append-only trigger is still installed (`SELECT tgname FROM pg_trigger WHERE tgname = 'events_append_only'`). 4. Record elapsed time. That number is what this service can promise. Until that walk exists, a workstation-side logical dump of an empty `audit_core` is not evidence of recovery. ## Rollback The Deployment annotation `audit-core.railiance.io/rollback-note` is the source of truth. Migrations 0001-0004 are additive; `kubectl -n audit-core rollout undo deploy/audit-core` returns to the previous digest and an older image runs against the newer schema. A future migration that drops or narrows a column must replace that note before release. ## Deploy order 1. Image published, digest pinned in `deploy/audit-core.yaml` and `deploy/migrate-job.yaml`. 2. Attended `scripts/openbao-eso-token-apply.sh`. 3. `bao kv put platform/workloads/audit-core/senders senders.json=@file` from a mode-0600 file; shred the file. 4. Apply namespace (carries `railiance.io/postgres-client: platform-pg`), NetworkPolicies, ClusterSecretStore, VaultDynamicSecrets, ExternalSecrets. 5. Wait until Secrets `audit-core-database`, `audit-core-database-migrate`, and `audit-core-senders` exist. 6. Apply and wait for Job `audit-core-migrate`. 7. Apply the Deployment. Confirm `/readyz` reports `custody_class=archive`. 8. Run `MODE=remote BASE_URL=… make failure-matrix` and hand the JSON to NK-WP-0024.