---
id: RPF-WP-0037
type: workplan
title: "Recover three active ESO lanes from static-token authentication failure"
domain: financials
repo: railiance-platform
status: active
owner: codex
created: "2026-09-05"
updated: "2026-09-05"
state_hub_workstream_id: "df076911-18b4-5731-99a8-2ecb3c3cc5b3"
---

User authorized continuing with the identified delivery failures. Live metadata
confirms active Forgejo, reuse-surface and target-revenue consumers. All three
ClusterSecretStores fail OpenBao token lookup-self with 403. This plan repairs
delivery authentication; it does not rotate application credentials or restart
consumers. RPF-WP-0036-T04 retains the separate telemetry acceptance gate.

## Diagnose authentication and compare custody without exposing values

```task
id: RPF-WP-0037-T01
status: progress
priority: high
state_hub_task_id: "e0e7ff05-01bf-58db-a18e-4c5e48a697fc"
```

Use attended platform-admin and pinned cluster access. Capture token validity,
policy coordinates and boolean equality between native KV data and the existing
consumer Secret. No values, tokens, hashes or fingerprints in evidence. Stop
before any resync if custody disagrees with the deployed Secret.

## Replace static authentication with exact Kubernetes bindings

```task
id: RPF-WP-0037-T02
status: todo
priority: high
state_hub_task_id: "01dd799d-f967-57d6-9cf0-9b01971e5bf1"
```

Stage dedicated namespace/SA/audience-bound roles with 15-minute maximum TTL,
no default policy and exact KV data read plus token self-lookup/revocation.
Keep namespace restrictions and existing delivery paths. Refuse live drift.
Validate positive read and wrong-identity/sibling/write denial before changing
each store. Persist source before apply. Do not overwrite workload key material.

## Verify sustained delivery and record closure

```task
id: RPF-WP-0037-T03
status: todo
priority: high
state_hub_task_id: "ee47707c-289b-5bea-a2ad-fdf40fed7034"
```

Require Ready stores and ExternalSecrets, a second successful forced reconcile,
unchanged deployed key material and healthy consumers. Record safe receipts and
retire obsolete bootstrap instructions. Remove obsolete static token references
from stores; retain old token Secret objects until their invalidity is proven.
Commit and synchronize file-backed work and report any remaining gates.