---
id: SBOM-WP-0004
type: workplan
title: "Adopt rotated database leases without liveness restarts"
domain: infotech
repo: sbom-nexus
status: finished
owner: codex
topic_slug: infotech
created: "2026-08-23"
updated: "2026-08-23"
quality_dor: DoR-Ok
quality_dor_at: "2026-08-23"
quality_dor_by: codex
quality_dor_note: "CUST-IN-0014 supplies exact 30-minute expiry/restart evidence, mounted Secret rotation behavior, owner boundaries, value-safety constraints, and live acceptance criteria."
origin: residual
origin_ref: CUST-IN-0014
related:
  - RAPP-SBOM-NEXUS-WP-0003
state_hub_workstream_id: "5723e707-75ce-5a41-b734-e6aa5d00757e"
---

# Adopt rotated database leases without liveness restarts

## Reread the mounted DSN on new pool connections

```task
id: SBOM-WP-0004-T01
status: done
priority: high
state_hub_task_id: "5bec586f-7eea-5783-a7c1-c8759474c5e0"
```

Use a value-safe SQLAlchemy connection creator that rereads the mounted URL
for every new DBAPI connection. Recycle pooled connections before the current
30-minute lease expires and preserve `pool_pre_ping` so revoked sessions are
replaced with the current mounted credential.

Completed with tests proving two connection attempts observe two file values
and that the engine URL contains neither username nor password.

The first live promotion also exposed an Alembic `SET ROLE` autobegin defect:
the migration logged success but its outer transaction rolled back on close.
The migration role helper now commits only the role-assumption transaction
before Alembic starts its own, with an ordering regression test.

## Separate liveness from database readiness

```task
id: SBOM-WP-0004-T02
status: done
priority: high
state_hub_task_id: "e25972bd-8636-5654-91f1-fad49c5f5d2f"
```

Expose process-only `/state/live` while retaining the database-backed
`/state/health` readiness contract. The package must move only liveness to the
new route so a transient credential handoff removes traffic but does not ask
Kubernetes to restart an otherwise healthy process.

## Prove one complete live lease rotation

```task
id: SBOM-WP-0004-T03
status: done
priority: high
state_hub_task_id: "a1e88b28-119d-5d1c-a97b-2dd1b3cb9113"
```

Promote the shared new image/package digest, observe at least one complete
database lease rotation, and require continuous process uptime, recovered
readiness, no liveness-driven restart, and no credential values in logs.

The corrected digest is live at migration `0002 (head)` with process and
database health passing, repository reads working, and zero pod restarts. The
first promotion safely proved digest rollback and exposed the now-fixed
migration transaction guard. Keep this task open through one full lease window.

Completed at 2026-08-22T23:06:19Z after 30m51s continuous uptime on pod UID
`73965817-c653-4017-8b90-e19b70c06b21`. The mounted ExternalSecret had
refreshed again at 23:02:59Z; the pod remained Ready with restart count zero,
`/state/live`, database-backed `/state/health`, and repository reads all passed,
and application logs contained zero credential-pattern matches and zero health
500 responses. This exceeds the prior exact 30-minute failure point.