Harden WP-0024 recovery execution gates

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

docs/audit-core-database-lease-recovery.md

@@ -29,6 +29,25 @@ The result must have `automated_checks_passed: true`. It will remain
 provided. The helper reads Secret metadata and key names only; it never reads
 Secret data.
 
+The live harness is
+`scripts/audit-core-database-lease-recovery.py`. Start from the deliberately
+pending `docs/audit-core-database-lease-approval.example.json`; the actual
+value-safe receipt must name a ≤15-minute window, approval id, abort operator,
+State Hub acknowledgement ids from audit-core/rapp-postgres/platform, and an
+approved synthetic-load contract plus driver revision. Validate without
+mutation:
+
+```bash
+make audit-database-lease-approval-check \
+  AUDIT_DATABASE_LEASE_APPROVAL=/path/to/approved-receipt.json
+```
+
+The separately approved load driver is an executable that accepts `baseline`,
+`expect-unavailable`, `expect-recovered`, and `cleanup`, plus
+`--contract-id ID`. Each call returns only its exact value-safe JSON evidence
+shape. Unexpected keys—including a bearer accidentally returned as `token`—
+make the harness fail without echoing driver output.
+
 ## Attended sequence
 
 Keep one terminal attached from baseline through recovery. A value-handling
@@ -41,11 +60,14 @@ bodies and clear all transient JSON from memory or mode-`0600` temporary files.
 2. Start bounded retrying synthetic traffic. Its evidence records only request
    identifier, attempt time, response class, and final accepted/duplicate
    result—never the bearer or payload.
-3. Inside the attended process, read the current mounted username without
-   emitting it. List only lease handles below
-   `sys/leases/lookup/database/creds/audit-core-runtime`, look each up, and
-   retain the one handle whose lease username matches. Abort unless exactly one
-   live handle matches. Clear every lookup response and username immediately.
+3. Inside the attended process, list only lease handles below
+   `sys/leases/lookup/database/creds/audit-core-runtime`. OpenBao's lease lookup
+   returns issue/expiry/TTL metadata but not the leased username, so exact
+   selection is deliberately stricter: there must be exactly one live handle
+   under that exact runtime prefix, and its issue/expiry interval must contain
+   the current database Secret refresh time. Abort for database-owner
+   disambiguation if zero or multiple handles exist. Retain only a one-way
+   handle fingerprint in evidence and clear the lookup response immediately.
 4. Recheck that the Secret `resourceVersion`, pod UID, and selected handle have
    not changed. Revoke only that handle. Do not revoke the role prefix and do
    not revoke the ESO parent token.
@@ -64,6 +86,20 @@ bodies and clear all transient JSON from memory or mode-`0600` temporary files.
    the predecessor lease is revoked. The replacement remains managed by ESO
    and expires through its normal database role TTL.
 
+Only inside the approved window, with the receipt and reviewed driver:
+
+```bash
+make audit-database-lease-recovery-exercise \
+  AUDIT_DATABASE_LEASE_APPROVAL=/path/to/approved-receipt.json \
+  AUDIT_DATABASE_LEASE_DRIVER=/path/to/approved-load-driver
+```
+
+The exact confirmation string is embedded in the target. The harness rechecks
+the Secret/pod/lease immediately before revocation, requires at least five
+minutes of remaining lease TTL to avoid the normal ESO refresh race, performs
+best-effort forced reconciliation on an interrupted post-revocation run, and
+never issues a rollout/restart command.
+
 ## Time bounds and abort path
 
 - Planned outage observation: at most 120 seconds.