railiance-platform/workplans/RPF-WP-0037-eso-static-token-recovery.md

id	type	title	domain	repo	status	owner	created	updated	state_hub_workstream_id
RPF-WP-0037	workplan	Recover three active ESO lanes from static-token authentication failure	financials	railiance-platform	finished	codex	2026-09-05	2026-09-05	df076911-18b4-5731-99a8-2ecb3c3cc5b3

User authorized continuing with the identified delivery failures. Live metadata confirms active Forgejo, reuse-surface and target-revenue consumers. All three ClusterSecretStores fail OpenBao token lookup-self with 403. This plan repairs delivery authentication; it does not rotate application credentials or restart consumers. RPF-WP-0036-T04 retains the separate telemetry acceptance gate.

Diagnose authentication and compare custody without exposing values

id: RPF-WP-0037-T01
status: done
priority: high
state_hub_task_id: "e0e7ff05-01bf-58db-a18e-4c5e48a697fc"

Use attended platform-admin and pinned cluster access. Capture token validity, policy coordinates and boolean equality between native KV data and the existing consumer Secret. No values, tokens, hashes or fingerprints in evidence. Stop before any resync if custody disagrees with the deployed Secret.

Replace static authentication with exact Kubernetes bindings

id: RPF-WP-0037-T02
status: done
priority: high
state_hub_task_id: "01dd799d-f967-57d6-9cf0-9b01971e5bf1"

Stage dedicated namespace/SA/audience-bound roles with 15-minute maximum TTL, no default policy and exact KV data read plus token self-lookup/revocation. Keep namespace restrictions and existing delivery paths. Refuse live drift. Validate positive read and wrong-identity/sibling/write denial before changing each store. Persist source before apply. Do not overwrite workload key material.

Verify sustained delivery and record closure

id: RPF-WP-0037-T03
status: done
priority: high
state_hub_task_id: "ee47707c-289b-5bea-a2ad-fdf40fed7034"

Require Ready stores and ExternalSecrets, a second successful forced reconcile, unchanged deployed key material and healthy consumers. Record safe receipts and retire obsolete bootstrap instructions. Remove obsolete static token references from stores; retain old token Secret objects until their invalidity is proven. Commit and synchronize file-backed work and report any remaining gates.

Completion — 2026-09-05

All three lanes migrated and passed fresh reconciliation, exact reads, wrong-SA/namespace/audience rejection, bounded TTL and sibling/write denial. OpenBao workload values matched deployed Secrets before and after migration; no application credential rotation or consumer rollout was requested. Native admin lookup proved old tokens invalid; after proving zero store references, all three obsolete token Secrets were removed with deletion preconditions. All 27 cluster ExternalSecrets are Ready and all three consumers have one ready replica. 187 tests and credential request validation passed. Current source, CCR-2026-0005 delivery binding and bootstrap guidance are updated.

Evidence: docs/evidence/RPF-WP-0037-eso-auth-recovery-2026-09-05.json. Runbook: docs/eso-auth-recovery.md. RPF-WP-0036-T04 retains the independent Q2 signal-delivery acceptance gate; backup credential recovery and operator-only cutover remain in WP-0029/0025.