coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0046-T04 done: renewer adopted, first run renewed all five lanes
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
Earliest old-token expiry is canned-prompts (~2026-10-10), not 10-25.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
This commit is contained in:
codex 2026-09-24 00:38:59 +02:00
parent 8d878cc4c2
commit 1918128f8e
2 changed files with 27 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/evidence/2026-09-24-eso-token-renewer-first-run.json Normal file
View file

@ -0,0 +1,17 @@
{
"schema": "railiance-platform.eso-token-renewer-run.v1",
"task": "RPF-WP-0046-T04",
"observed_at": "2026-09-24T00:00:00Z",
"application": {"name": "eso-token-renewer", "revision": "b2ebe108495c4d06ebb6ca33893ea4a2a23c9725", "sync": "Synced", "health": "Healthy"},
"appproject": "railiance-platform-addons now whitelists batch/CronJob (applied by founder)",
"job": {"name": "eso-token-renewer-first", "status": "Complete", "duration_s": 9},
"lanes": {
"audit-core": {"ok": true, "renewable": true, "ttl_s": 1985178, "approx_expiry": "2026-10-17"},
"canned-prompts": {"ok": true, "renewable": true, "ttl_s": 1379797, "approx_expiry": "2026-10-10"},
"core-hub": {"ok": true, "renewable": true, "ttl_s": 2745158, "approx_expiry": "2026-10-25"},
"sbom-nexus": {"ok": true, "renewable": true, "ttl_s": 2744080, "approx_expiry": "2026-10-25"},
"tenant-engine": {"ok": true, "renewable": true, "ttl_s": 2745162, "approx_expiry": "2026-10-25"}
},
"note": "Tokens are still the pre-T03 max-TTL tokens, so renewal cannot extend them. The earliest hard deadline for T03 plus T05 is canned-prompts, about 2026-10-10.",
"credential_values_emitted": false
}

12
workplans/RPF-WP-0046-eso-database-token-renewal.md
View file

@ -111,7 +111,7 @@ ExternalSecrets are `SecretSynced`.
```task
id: RPF-WP-0046-T04
status: wait
status: done
priority: high
state_hub_task_id: "28726b1b-3777-5945-859b-9e563b12fee6"
```
@ -133,6 +133,14 @@ T04 progress, 2026-09-23 (founder go-ahead):
`argocd/railiance01/applications/` and pinned to `b2ebe10`. The root has no
automated sync, so nothing changes until the manual root sync.
T04 done, 2026-09-24. The founder applied the AppProject and hand-synced the
root (`8d878cc`) and `eso-token-renewer` (`b2ebe10`). The app is
Synced/Healthy. A first manual Job completed in 9 seconds, and all five lanes
returned `ok: true`. The tokens are still pre-T03, so their TTLs cannot be
extended. **The earliest expiry is canned-prompts, about 2026-10-10**, not
2026-10-25. Then audit-core, about 2026-10-17. Evidence:
`docs/evidence/2026-09-24-eso-token-renewer-first-run.json`.
## T05 Move consumers off leases from the old tokens before 2026-10-25
```task
@ -147,7 +155,7 @@ revoke their leases when they do. ESO refreshes every 5 minutes, so within
minutes of T03 each target Secret holds credentials from the new token. The
mounted files update, but a process that reads its password only at startup
keeps the old one. core-hub runs a credential watcher. Restart the others once
after T03, at least 10 minutes later and well before 2026-10-25:
after T03, at least 10 minutes later and well before the earliest old-token expiry (canned-prompts, about 2026-10-10):
`audit-core/audit-core`, `canned-prompts/canned-prompts`,
`sbom-nexus/sbom-nexus`, `tenant-engine/tenant-engine`. Check readiness after
each restart. Then confirm that core-hub-api and core-hub-api-candidate stay