Prepare bounded Kubernetes authentication recovery for three ESO lanes

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

workplans/RPF-WP-0037-eso-static-token-recovery.md

@@ -0,0 +1,58 @@
+---
+id: RPF-WP-0037
+type: workplan
+title: "Recover three active ESO lanes from static-token authentication failure"
+domain: financials
+repo: railiance-platform
+status: active
+owner: codex
+created: "2026-09-05"
+updated: "2026-09-05"
+---
+
+User authorized continuing with the identified delivery failures. Live metadata
+confirms active Forgejo, reuse-surface and target-revenue consumers. All three
+ClusterSecretStores fail OpenBao token lookup-self with 403. This plan repairs
+delivery authentication; it does not rotate application credentials or restart
+consumers. RPF-WP-0036-T04 retains the separate telemetry acceptance gate.
+
+## Diagnose authentication and compare custody without exposing values
+
+```task
+id: RPF-WP-0037-T01
+status: progress
+priority: high
+```
+
+Use attended platform-admin and pinned cluster access. Capture token validity,
+policy coordinates and boolean equality between native KV data and the existing
+consumer Secret. No values, tokens, hashes or fingerprints in evidence. Stop
+before any resync if custody disagrees with the deployed Secret.
+
+## Replace static authentication with exact Kubernetes bindings
+
+```task
+id: RPF-WP-0037-T02
+status: todo
+priority: high
+```
+
+Stage dedicated namespace/SA/audience-bound roles with 15-minute maximum TTL,
+no default policy and exact KV data read plus token self-lookup/revocation.
+Keep namespace restrictions and existing delivery paths. Refuse live drift.
+Validate positive read and wrong-identity/sibling/write denial before changing
+each store. Persist source before apply. Do not overwrite workload key material.
+
+## Verify sustained delivery and record closure
+
+```task
+id: RPF-WP-0037-T03
+status: todo
+priority: high
+```
+
+Require Ready stores and ExternalSecrets, a second successful forced reconcile,
+unchanged deployed key material and healthy consumers. Record safe receipts and
+retire obsolete bootstrap instructions. Remove obsolete static token references
+from stores; retain old token Secret objects until their invalidity is proven.
+Commit and synchronize file-backed work and report any remaining gates.