railiance-platform/docs/evidence/RPF-WP-0037-eso-auth-recovery-2026-09-05.json

{
  "schema": "platform.eso-auth-recovery-evidence.v1",
  "date": "2026-09-05",
  "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
  "diagnosis": {
    "status": "diagnosed",
    "lanes": [
      {
        "namespace": "forgejo",
        "name": "forgejo-mailer",
        "static_token_valid": false,
        "static_token_denied": true,
        "fields_match": {
          "MAILER_PASSWD": true
        },
        "versions": {
          "platform/data/workloads/forgejo/forgejo-mailer": 2
        }
      },
      {
        "namespace": "reuse",
        "name": "reuse-surface-runtime",
        "static_token_valid": false,
        "static_token_denied": true,
        "fields_match": {
          "REUSE_SURFACE_TOKEN": true,
          "REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET": true
        },
        "versions": {
          "platform/data/workloads/reuse/reuse-surface/runtime-secrets": 1
        }
      },
      {
        "namespace": "target-revenue",
        "name": "target-revenue-runtime",
        "static_token_valid": false,
        "static_token_denied": true,
        "fields_match": {
          "TRF_SIGNING_KEY_HEX": true,
          "TRF_CONTROL_PLANE_SECRET_KEY": true,
          "TRF_DATABASE_URL": true,
          "TRF_MIGRATE_DATABASE_URL": true
        },
        "versions": {
          "platform/data/workloads/target-revenue/runtime-secrets": 1
        }
      }
    ]
  },
  "apply": {
    "schema": "platform.eso-kubernetes-recovery.v1",
    "status": "passed",
    "lanes": [
      {
        "name": "forgejo-mailer",
        "namespace": "forgejo",
        "status": "passed",
        "exact_read": true,
        "secret_write_and_sibling_denied": true,
        "wrong_sa_denied": true,
        "wrong_namespace_denied": true,
        "wrong_audience_denied": true,
        "bounded_ttl": true,
        "kv_version": 2,
        "unchanged_workload_values": true,
        "store_ready": true,
        "external_secret_ready": true
      },
      {
        "name": "reuse-surface-runtime",
        "namespace": "reuse",
        "status": "passed",
        "exact_read": true,
        "secret_write_and_sibling_denied": true,
        "wrong_sa_denied": true,
        "wrong_namespace_denied": true,
        "wrong_audience_denied": true,
        "bounded_ttl": true,
        "kv_version": 1,
        "unchanged_workload_values": true,
        "store_ready": true,
        "external_secret_ready": true
      },
      {
        "name": "target-revenue-runtime",
        "namespace": "target-revenue",
        "status": "passed",
        "exact_read": true,
        "secret_write_and_sibling_denied": true,
        "wrong_sa_denied": true,
        "wrong_namespace_denied": true,
        "wrong_audience_denied": true,
        "bounded_ttl": true,
        "kv_version": 1,
        "unchanged_workload_values": true,
        "store_ready": true,
        "external_secret_ready": true
      }
    ]
  },
  "final_verification_and_cleanup": {
    "schema": "platform.eso-kubernetes-recovery.v1",
    "status": "passed",
    "lanes": [
      {
        "name": "forgejo-mailer",
        "namespace": "forgejo",
        "status": "passed",
        "exact_read": true,
        "secret_write_and_sibling_denied": true,
        "wrong_sa_denied": true,
        "wrong_namespace_denied": true,
        "wrong_audience_denied": true,
        "bounded_ttl": true,
        "kv_version": 2,
        "refresh_time": "2026-09-05T16:51:56Z",
        "unchanged_workload_values": true,
        "store_ready": true,
        "external_secret_ready": true,
        "retired_token_already_invalid": true,
        "retired_token_secret_removed": true
      },
      {
        "name": "reuse-surface-runtime",
        "namespace": "reuse",
        "status": "passed",
        "exact_read": true,
        "secret_write_and_sibling_denied": true,
        "wrong_sa_denied": true,
        "wrong_namespace_denied": true,
        "wrong_audience_denied": true,
        "bounded_ttl": true,
        "kv_version": 1,
        "refresh_time": "2026-09-05T16:52:03Z",
        "unchanged_workload_values": true,
        "store_ready": true,
        "external_secret_ready": true,
        "retired_token_already_invalid": true,
        "retired_token_secret_removed": true
      },
      {
        "name": "target-revenue-runtime",
        "namespace": "target-revenue",
        "status": "passed",
        "exact_read": true,
        "secret_write_and_sibling_denied": true,
        "wrong_sa_denied": true,
        "wrong_namespace_denied": true,
        "wrong_audience_denied": true,
        "bounded_ttl": true,
        "kv_version": 1,
        "refresh_time": "2026-09-05T16:52:11Z",
        "unchanged_workload_values": true,
        "store_ready": true,
        "external_secret_ready": true,
        "retired_token_already_invalid": true,
        "retired_token_secret_removed": true
      }
    ]
  },
  "fleet_external_secrets": {
    "total": 27,
    "ready": 27
  },
  "consumers": [
    {
      "namespace": "forgejo",
      "deployment": "forgejo-gitea",
      "ready_replicas": 1,
      "generation": 11
    },
    {
      "namespace": "reuse",
      "deployment": "reuse-surface",
      "ready_replicas": 1,
      "generation": 6
    },
    {
      "namespace": "target-revenue",
      "deployment": "target-revenue",
      "ready_replicas": 1,
      "generation": 5
    }
  ],
  "application_credentials_rotated": false,
  "consumer_rollouts_requested": false,
  "unit_tests_passed": 187
}