fix: adopt rotated database leases

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b22-9638-76d2-bbff-b7ea1770b118

workplans/SBOM-WP-0004-database-lease-rotation.md

@@ -0,0 +1,63 @@
+---
+id: SBOM-WP-0004
+type: workplan
+title: "Adopt rotated database leases without liveness restarts"
+domain: infotech
+repo: sbom-nexus
+status: active
+owner: codex
+topic_slug: infotech
+created: "2026-08-23"
+updated: "2026-08-23"
+quality_dor: DoR-Ok
+quality_dor_at: "2026-08-23"
+quality_dor_by: codex
+quality_dor_note: "CUST-IN-0014 supplies exact 30-minute expiry/restart evidence, mounted Secret rotation behavior, owner boundaries, value-safety constraints, and live acceptance criteria."
+origin: residual
+origin_ref: CUST-IN-0014
+related:
+  - RAPP-SBOM-NEXUS-WP-0003
+---
+
+# Adopt rotated database leases without liveness restarts
+
+## Reread the mounted DSN on new pool connections
+
+```task
+id: SBOM-WP-0004-T01
+status: done
+priority: high
+```
+
+Use a value-safe SQLAlchemy connection creator that rereads the mounted URL
+for every new DBAPI connection. Recycle pooled connections before the current
+30-minute lease expires and preserve `pool_pre_ping` so revoked sessions are
+replaced with the current mounted credential.
+
+Completed with tests proving two connection attempts observe two file values
+and that the engine URL contains neither username nor password.
+
+## Separate liveness from database readiness
+
+```task
+id: SBOM-WP-0004-T02
+status: done
+priority: high
+```
+
+Expose process-only `/state/live` while retaining the database-backed
+`/state/health` readiness contract. The package must move only liveness to the
+new route so a transient credential handoff removes traffic but does not ask
+Kubernetes to restart an otherwise healthy process.
+
+## Prove one complete live lease rotation
+
+```task
+id: SBOM-WP-0004-T03
+status: wait
+priority: high
+```
+
+Promote the shared new image/package digest, observe at least one complete
+database lease rotation, and require continuous process uptime, recovered
+readiness, no liveness-driven restart, and no credential values in logs.