coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0046-T04 done: renewer adopted, first run renewed all five lanes
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
Earliest old-token expiry is canned-prompts (~2026-10-10), not 10-25.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
This commit is contained in:
codex 2026-09-24 00:38:59 +02:00
parent 8d878cc4c2
commit 1918128f8e
2 changed files with 27 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/evidence/2026-09-24-eso-token-renewer-first-run.json Normal file
View file

@ -0,0 +1,17 @@
{
"schema": "railiance-platform.eso-token-renewer-run.v1",
"task": "RPF-WP-0046-T04",
"observed_at": "2026-09-24T00:00:00Z",
"application": {"name": "eso-token-renewer", "revision": "b2ebe108495c4d06ebb6ca33893ea4a2a23c9725", "sync": "Synced", "health": "Healthy"},
"appproject": "railiance-platform-addons now whitelists batch/CronJob (applied by founder)",
"job": {"name": "eso-token-renewer-first", "status": "Complete", "duration_s": 9},
"lanes": {
"audit-core": {"ok": true, "renewable": true, "ttl_s": 1985178, "approx_expiry": "2026-10-17"},
"canned-prompts": {"ok": true, "renewable": true, "ttl_s": 1379797, "approx_expiry": "2026-10-10"},
"core-hub": {"ok": true, "renewable": true, "ttl_s": 2745158, "approx_expiry": "2026-10-25"},
"sbom-nexus": {"ok": true, "renewable": true, "ttl_s": 2744080, "approx_expiry": "2026-10-25"},
"tenant-engine": {"ok": true, "renewable": true, "ttl_s": 2745162, "approx_expiry": "2026-10-25"}
},
"note": "Tokens are still the pre-T03 max-TTL tokens, so renewal cannot extend them. The earliest hard deadline for T03 plus T05 is canned-prompts, about 2026-10-10.",
"credential_values_emitted": false
}

12
workplans/RPF-WP-0046-eso-database-token-renewal.md
View file

@ -111,7 +111,7 @@ ExternalSecrets are `SecretSynced`.
```task ```task
id: RPF-WP-0046-T04 id: RPF-WP-0046-T04
status: wait status: done
priority: high priority: high
state_hub_task_id: "28726b1b-3777-5945-859b-9e563b12fee6" state_hub_task_id: "28726b1b-3777-5945-859b-9e563b12fee6"
``` ```
@ -133,6 +133,14 @@ T04 progress, 2026-09-23 (founder go-ahead):
`argocd/railiance01/applications/` and pinned to `b2ebe10`. The root has no `argocd/railiance01/applications/` and pinned to `b2ebe10`. The root has no
automated sync, so nothing changes until the manual root sync. automated sync, so nothing changes until the manual root sync.
T04 done, 2026-09-24. The founder applied the AppProject and hand-synced the
root (`8d878cc`) and `eso-token-renewer` (`b2ebe10`). The app is
Synced/Healthy. A first manual Job completed in 9 seconds, and all five lanes
returned `ok: true`. The tokens are still pre-T03, so their TTLs cannot be
extended. **The earliest expiry is canned-prompts, about 2026-10-10**, not
2026-10-25. Then audit-core, about 2026-10-17. Evidence:
`docs/evidence/2026-09-24-eso-token-renewer-first-run.json`.
## T05 Move consumers off leases from the old tokens before 2026-10-25 ## T05 Move consumers off leases from the old tokens before 2026-10-25
```task ```task
@ -147,7 +155,7 @@ revoke their leases when they do. ESO refreshes every 5 minutes, so within
minutes of T03 each target Secret holds credentials from the new token. The minutes of T03 each target Secret holds credentials from the new token. The
mounted files update, but a process that reads its password only at startup mounted files update, but a process that reads its password only at startup
keeps the old one. core-hub runs a credential watcher. Restart the others once keeps the old one. core-hub runs a credential watcher. Restart the others once
after T03, at least 10 minutes later and well before 2026-10-25: after T03, at least 10 minutes later and well before the earliest old-token expiry (canned-prompts, about 2026-10-10):
`audit-core/audit-core`, `canned-prompts/canned-prompts`, `audit-core/audit-core`, `canned-prompts/canned-prompts`,
`sbom-nexus/sbom-nexus`, `tenant-engine/tenant-engine`. Check readiness after `sbom-nexus/sbom-nexus`, `tenant-engine/tenant-engine`. Check readiness after
each restart. Then confirm that core-hub-api and core-hub-api-candidate stay each restart. Then confirm that core-hub-api and core-hub-api-candidate stay