From 1918128f8e1da0dda0175bc7ea48a87ee4a3f39d Mon Sep 17 00:00:00 2001 From: codex Date: Thu, 24 Sep 2026 00:38:59 +0200 Subject: [PATCH] RPF-WP-0046-T04 done: renewer adopted, first run renewed all five lanes Earliest old-token expiry is canned-prompts (~2026-10-10), not 10-25. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4 --- .../2026-09-24-eso-token-renewer-first-run.json | 17 +++++++++++++++++ .../RPF-WP-0046-eso-database-token-renewal.md | 12 ++++++++++-- 2 files changed, 27 insertions(+), 2 deletions(-) create mode 100644 docs/evidence/2026-09-24-eso-token-renewer-first-run.json diff --git a/docs/evidence/2026-09-24-eso-token-renewer-first-run.json b/docs/evidence/2026-09-24-eso-token-renewer-first-run.json new file mode 100644 index 0000000..773d0cb --- /dev/null +++ b/docs/evidence/2026-09-24-eso-token-renewer-first-run.json @@ -0,0 +1,17 @@ +{ + "schema": "railiance-platform.eso-token-renewer-run.v1", + "task": "RPF-WP-0046-T04", + "observed_at": "2026-09-24T00:00:00Z", + "application": {"name": "eso-token-renewer", "revision": "b2ebe108495c4d06ebb6ca33893ea4a2a23c9725", "sync": "Synced", "health": "Healthy"}, + "appproject": "railiance-platform-addons now whitelists batch/CronJob (applied by founder)", + "job": {"name": "eso-token-renewer-first", "status": "Complete", "duration_s": 9}, + "lanes": { + "audit-core": {"ok": true, "renewable": true, "ttl_s": 1985178, "approx_expiry": "2026-10-17"}, + "canned-prompts": {"ok": true, "renewable": true, "ttl_s": 1379797, "approx_expiry": "2026-10-10"}, + "core-hub": {"ok": true, "renewable": true, "ttl_s": 2745158, "approx_expiry": "2026-10-25"}, + "sbom-nexus": {"ok": true, "renewable": true, "ttl_s": 2744080, "approx_expiry": "2026-10-25"}, + "tenant-engine": {"ok": true, "renewable": true, "ttl_s": 2745162, "approx_expiry": "2026-10-25"} + }, + "note": "Tokens are still the pre-T03 max-TTL tokens, so renewal cannot extend them. The earliest hard deadline for T03 plus T05 is canned-prompts, about 2026-10-10.", + "credential_values_emitted": false +} diff --git a/workplans/RPF-WP-0046-eso-database-token-renewal.md b/workplans/RPF-WP-0046-eso-database-token-renewal.md index 1c1f373..f9c1212 100644 --- a/workplans/RPF-WP-0046-eso-database-token-renewal.md +++ b/workplans/RPF-WP-0046-eso-database-token-renewal.md @@ -111,7 +111,7 @@ ExternalSecrets are `SecretSynced`. ```task id: RPF-WP-0046-T04 -status: wait +status: done priority: high state_hub_task_id: "28726b1b-3777-5945-859b-9e563b12fee6" ``` @@ -133,6 +133,14 @@ T04 progress, 2026-09-23 (founder go-ahead): `argocd/railiance01/applications/` and pinned to `b2ebe10`. The root has no automated sync, so nothing changes until the manual root sync. +T04 done, 2026-09-24. The founder applied the AppProject and hand-synced the +root (`8d878cc`) and `eso-token-renewer` (`b2ebe10`). The app is +Synced/Healthy. A first manual Job completed in 9 seconds, and all five lanes +returned `ok: true`. The tokens are still pre-T03, so their TTLs cannot be +extended. **The earliest expiry is canned-prompts, about 2026-10-10**, not +2026-10-25. Then audit-core, about 2026-10-17. Evidence: +`docs/evidence/2026-09-24-eso-token-renewer-first-run.json`. + ## T05 Move consumers off leases from the old tokens before 2026-10-25 ```task @@ -147,7 +155,7 @@ revoke their leases when they do. ESO refreshes every 5 minutes, so within minutes of T03 each target Secret holds credentials from the new token. The mounted files update, but a process that reads its password only at startup keeps the old one. core-hub runs a credential watcher. Restart the others once -after T03, at least 10 minutes later and well before 2026-10-25: +after T03, at least 10 minutes later and well before the earliest old-token expiry (canned-prompts, about 2026-10-10): `audit-core/audit-core`, `canned-prompts/canned-prompts`, `sbom-nexus/sbom-nexus`, `tenant-engine/tenant-engine`. Check readiness after each restart. Then confirm that core-hub-api and core-hub-api-candidate stay