Close three-lane ESO recovery with live verification and cleanup evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

credential-change-requests/CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml

@@ -5,7 +5,7 @@ request_type: workload-kv-read
 title: reuse-surface runtime secrets lane
 status: active
 created: '2026-07-07'
-updated: '2026-07-07'
+updated: '2026-09-05'
 requester:
   agent: grok
   reason: Promote reuse-surface hub runtime secrets from bootstrap Kubernetes Secret
@@ -38,6 +38,14 @@ review:
     comment: 'Approved in chat acting as platform-operator and reuse-surface-owner:
       promote reuse-surface runtime secrets to OpenBao workload KV with Railiance01
       interim ESO delivery per CCR-2026-0005.'
+  - at: '2026-09-05'
+    reviewer: codex under user-authorized delivery recovery
+    decision: delivery_auth_migration_verified
+    comment: RPF-WP-0037 replaces rejected static ESO token with exact namespace/SA/audience
+      binding and data-only/self-token policy. Workload values unchanged; positive,
+      wrong-SA/namespace/audience and write/sibling negatives passed. Existing caller-facing
+      route retained. Historical July interim/bootstrap notes below are superseded
+      for ESO delivery.
 target:
   domain: financials
   tenant: reuse
@@ -51,21 +59,27 @@ openbao:
   fields:
   - REUSE_SURFACE_TOKEN
   - REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
-  policy_name: workload-kv-read-reuse-surface-runtime
-  policy_file: openbao/policies/workload-kv-read-reuse-surface-runtime.hcl
+  policy_name: workload-kv-read-reuse-surface-runtime-eso
+  policy_file: openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl
   auth:
     method: kubernetes
     mount: kubernetes
-    role: external-secrets-reuse-surface
+    role: reuse-surface-runtime-eso
     bound_claims:
       service_account_names:
-      - external-secrets
+      - reuse-surface-eso
       service_account_namespaces:
-      - external-secrets
+      - reuse
     bound_claims_confirmed: true
     policies:
-    - workload-kv-read-reuse-surface-runtime
+    - workload-kv-read-reuse-surface-runtime-eso
     ttl: 15m
+    audience: openbao
+    token_max_ttl: 15m
+    token_explicit_max_ttl: 15m
+    token_no_default_policy: true
+  metadata_read: false
+  token_self_lifecycle: true
 access_frontdoor:
   type: ops-warden
   catalog_id: reuse-surface-hub-write-token
@@ -76,10 +90,10 @@ access_frontdoor:
   activation: verified-positive-and-negative-access-frontdoor-active-2026-07-07
 delivery:
   surface: external-secrets
-  target: ExternalSecret reuse/reuse-surface-runtime -> Secret reuse-surface-env in
-    the reuse namespace on Railiance01; interim ClusterSecretStore openbao-reuse (token
-    auth to coulombcore OpenBao, namespace-limited to reuse) until railiance01-local
-    OpenBao Wave 7 bootstrap
+  target: ExternalSecret reuse/reuse-surface-runtime -> Secret reuse-surface-env;
+    ClusterSecretStore openbao-reuse uses private railiance01 OpenBao and exact reuse/reuse-surface-eso
+    Kubernetes identity. Caller-facing OIDC policy workload-kv-read-reuse-surface-runtime
+    remains separately retained.
 risk:
   classification: high
   notes:
@@ -149,6 +163,12 @@ verification:
     details:
     - ops-warden catalog reuse-surface-hub-write-token migrated to bao kv get handoff;
       resolvable=true; playbook and workload-kv-access-lanes updated (RAILIANCE-WP-0011-T03)
+  - at: '2026-09-05'
+    actor: codex
+    kind: kubernetes_delivery_recovery
+    result: passed
+    details:
+    - RPF-WP-0037; docs/evidence/RPF-WP-0037-eso-auth-recovery-2026-09-05.json
 lifecycle:
   deactivate: Disable ops-warden catalog entry, remove ExternalSecret, and detach
     auth role policy; delete materialized reuse-surface-env only after confirming