Restore CPU headroom for identity credential renewal

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

docs/evidence/2026-09-14-keycape-renewal-capacity-recovery.json

@@ -0,0 +1,47 @@
+{
+  "date": "2026-09-14",
+  "cause": "10m factor-renewer Jobs unschedulable at full CPU requests; credential expired and KeyCape readiness failed",
+  "observed_review_cpu": "1m",
+  "review_request_before": "20m",
+  "review_request_after": "5m",
+  "review_limit_unchanged": "500m",
+  "headroom_freed": "15m",
+  "successful_renewal_job": "keycape-factor-renewer-29822490",
+  "provider_credential_version": 60,
+  "renewal_session_revoked": true,
+  "keycape_ready": true,
+  "reader_callback_routes": [
+    {
+      "callback": "http://localhost:8250/oidc/callback",
+      "auth_url_status": 200,
+      "client_id": [
+        "openbao-admin"
+      ],
+      "scopes": [
+        "openid profile email groups"
+      ],
+      "pkce_method": [
+        "S256"
+      ],
+      "keycape_status": 302,
+      "redirect_host": "auth.coulomb.social"
+    },
+    {
+      "callback": "http://127.0.0.1:8250/oidc/callback",
+      "auth_url_status": 200,
+      "client_id": [
+        "openbao-admin"
+      ],
+      "scopes": [
+        "openid profile email groups"
+      ],
+      "pkce_method": [
+        "S256"
+      ],
+      "keycape_status": 302,
+      "redirect_host": "auth.coulomb.social"
+    }
+  ],
+  "renderer_tests_passed": 14,
+  "residual": "CUST-WP-0071-T01: scheduler-effective capacity must reserve recurring credential maintenance demand"
+}

tools/render_deployment.py

@@ -65,7 +65,7 @@ def render(inputs):
             # application gates acceptance on /readyz internally; monitoring
             # must scrape it separately. An outage must not restart the writer.
             'readinessProbe':probe('/healthz'),'livenessProbe':probe('/healthz'),
-            'resources':{'requests':{'cpu':'20m','memory':'64Mi'},'limits':{'cpu':'500m','memory':'256Mi'}},
+            'resources':{'requests':{'cpu':'5m','memory':'64Mi'},'limits':{'cpu':'500m','memory':'256Mi'}},
             'volumeMounts':[mount('data','/data'),mount('runtime','/run/informed-decision'),mount('tmp','/tmp'),
                 readonly('configuration','/configuration'),readonly('caller','/var/run/secrets/informed-decision/policy'),
                 readonly('audit','/var/run/secrets/informed-decision/audit')]}],

workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md

@@ -825,3 +825,15 @@ Repeatable contained helper: key-cape/tools/register-informed-decision.py
 (default preflight; --apply mutates only a missing exact registration).
 Human callback/MFA/token proof and T03 approval entries remain pending. The
 previous ready check established service health, not browser login acceptance.
+
+
+### Credential-renewal scheduling recovery — 2026-09-14
+
+KeyCape returned 503 after repeated 10m factor-renewer Jobs could not schedule
+at full cluster CPU requests. The reviewed service used 1m; lowered its request
+from 20m to 5m, retaining the 500m limit and memory settings. The next scheduled
+renewal completed, self-revoked, and propagated through ESO to KeyCape; all four
+readiness checks and both OpenBao reader callback routes passed. Renderer tests:
+14 passed. Receipt: docs/evidence/2026-09-14-keycape-renewal-capacity-recovery.json.
+Recurring-job scheduling headroom remains with CUST-WP-0071-T01. Human reviews
+remain confirmed; service restart does not require their repetition.