coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close three-lane ESO recovery with live verification and cleanup evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 19:00:19 +02:00
parent 3759850cc4
commit 08a406f2f8
6 changed files with 288 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

188
docs/evidence/RPF-WP-0037-eso-auth-recovery-2026-09-05.json Normal file
View file

@ -0,0 +1,188 @@
{
"schema": "platform.eso-auth-recovery-evidence.v1",
"date": "2026-09-05",
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
"diagnosis": {
"status": "diagnosed",
"lanes": [
{
"namespace": "forgejo",
"name": "forgejo-mailer",
"static_token_valid": false,
"static_token_denied": true,
"fields_match": {
"MAILER_PASSWD": true
},
"versions": {
"platform/data/workloads/forgejo/forgejo-mailer": 2
}
},
{
"namespace": "reuse",
"name": "reuse-surface-runtime",
"static_token_valid": false,
"static_token_denied": true,
"fields_match": {
"REUSE_SURFACE_TOKEN": true,
"REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET": true
},
"versions": {
"platform/data/workloads/reuse/reuse-surface/runtime-secrets": 1
}
},
{
"namespace": "target-revenue",
"name": "target-revenue-runtime",
"static_token_valid": false,
"static_token_denied": true,
"fields_match": {
"TRF_SIGNING_KEY_HEX": true,
"TRF_CONTROL_PLANE_SECRET_KEY": true,
"TRF_DATABASE_URL": true,
"TRF_MIGRATE_DATABASE_URL": true
},
"versions": {
"platform/data/workloads/target-revenue/runtime-secrets": 1
}
}
]
},
"apply": {
"schema": "platform.eso-kubernetes-recovery.v1",
"status": "passed",
"lanes": [
{
"name": "forgejo-mailer",
"namespace": "forgejo",
"status": "passed",
"exact_read": true,
"secret_write_and_sibling_denied": true,
"wrong_sa_denied": true,
"wrong_namespace_denied": true,
"wrong_audience_denied": true,
"bounded_ttl": true,
"kv_version": 2,
"unchanged_workload_values": true,
"store_ready": true,
"external_secret_ready": true
},
{
"name": "reuse-surface-runtime",
"namespace": "reuse",
"status": "passed",
"exact_read": true,
"secret_write_and_sibling_denied": true,
"wrong_sa_denied": true,
"wrong_namespace_denied": true,
"wrong_audience_denied": true,
"bounded_ttl": true,
"kv_version": 1,
"unchanged_workload_values": true,
"store_ready": true,
"external_secret_ready": true
},
{
"name": "target-revenue-runtime",
"namespace": "target-revenue",
"status": "passed",
"exact_read": true,
"secret_write_and_sibling_denied": true,
"wrong_sa_denied": true,
"wrong_namespace_denied": true,
"wrong_audience_denied": true,
"bounded_ttl": true,
"kv_version": 1,
"unchanged_workload_values": true,
"store_ready": true,
"external_secret_ready": true
}
]
},
"final_verification_and_cleanup": {
"schema": "platform.eso-kubernetes-recovery.v1",
"status": "passed",
"lanes": [
{
"name": "forgejo-mailer",
"namespace": "forgejo",
"status": "passed",
"exact_read": true,
"secret_write_and_sibling_denied": true,
"wrong_sa_denied": true,
"wrong_namespace_denied": true,
"wrong_audience_denied": true,
"bounded_ttl": true,
"kv_version": 2,
"refresh_time": "2026-09-05T16:51:56Z",
"unchanged_workload_values": true,
"store_ready": true,
"external_secret_ready": true,
"retired_token_already_invalid": true,
"retired_token_secret_removed": true
},
{
"name": "reuse-surface-runtime",
"namespace": "reuse",
"status": "passed",
"exact_read": true,
"secret_write_and_sibling_denied": true,
"wrong_sa_denied": true,
"wrong_namespace_denied": true,
"wrong_audience_denied": true,
"bounded_ttl": true,
"kv_version": 1,
"refresh_time": "2026-09-05T16:52:03Z",
"unchanged_workload_values": true,
"store_ready": true,
"external_secret_ready": true,
"retired_token_already_invalid": true,
"retired_token_secret_removed": true
},
{
"name": "target-revenue-runtime",
"namespace": "target-revenue",
"status": "passed",
"exact_read": true,
"secret_write_and_sibling_denied": true,
"wrong_sa_denied": true,
"wrong_namespace_denied": true,
"wrong_audience_denied": true,
"bounded_ttl": true,
"kv_version": 1,
"refresh_time": "2026-09-05T16:52:11Z",
"unchanged_workload_values": true,
"store_ready": true,
"external_secret_ready": true,
"retired_token_already_invalid": true,
"retired_token_secret_removed": true
}
]
},
"fleet_external_secrets": {
"total": 27,
"ready": 27
},
"consumers": [
{
"namespace": "forgejo",
"deployment": "forgejo-gitea",
"ready_replicas": 1,
"generation": 11
},
{
"namespace": "reuse",
"deployment": "reuse-surface",
"ready_replicas": 1,
"generation": 6
},
{
"namespace": "target-revenue",
"deployment": "target-revenue",
"ready_replicas": 1,
"generation": 5
}
],
"application_credentials_rotated": false,
"consumer_rollouts_requested": false,
"unit_tests_passed": 187
}