tegwick
21e8ce9b72
renew-runtime-lease.sh is recovery-only now: it mints with -period instead of -ttl=768h, so a recovery no longer undoes the platform's periodic token, and defaults BAO_ADDR to the tunnel rather than the retired bao.coulomb.social. The old openbao-eso-token-apply.sh is retired for the same two reasons. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 151986@bnt-lap001 Assistant-Session: ccd02b6b-80ae-48e5-8cad-9c8f74d21a67
1.2 KiB
| id | type | title | domain | repo | status | flavor | owner | topic_slug | created | updated |
|---|---|---|---|---|---|---|---|---|---|---|
| ADHOC-2026-09-24 | workplan | Ad hoc tasks 2026-09-24 | infotech | audit-core | finished | implementation | claude | railiance | 2026-09-24 | 2026-09-24 |
Ad hoc tasks 2026-09-24
Align the ESO token scripts with the periodic token (RPF-WP-0046)
id: ADHOC-2026-09-24-T01
status: done
priority: medium
Inbox from railiance-platform (1847edae): on 2026-09-23
external-secrets/openbao-audit-core-eso-token was re-minted as a periodic
168h token, renewed daily by the CronJob external-secrets/eso-token-renewer.
scripts/renew-runtime-lease.sh re-minted with -ttl=768h, which would undo
that, and defaulted BAO_ADDR to the retired https://bao.coulomb.social.
Done: renew-runtime-lease.sh is now marked recovery-only, mints with
-period (default 168h, OPENBAO_AUDIT_CORE_ESO_PERIOD), and defaults
BAO_ADDR to the tunnel http://127.0.0.1:18200. The first-mint script
scripts/openbao-eso-token-apply.sh is retired (deleted): it carried the same
768h TTL and retired address, and the agent environment orientation §6 says not
to re-run the old *-eso-token-apply scripts. Nothing was run against the
cluster or OpenBao.