---
id: SBOM-WP-0004
type: workplan
title: "Adopt rotated database leases without liveness restarts"
domain: infotech
repo: sbom-nexus
status: active
owner: codex
topic_slug: infotech
created: "2026-08-23"
updated: "2026-08-23"
quality_dor: DoR-Ok
quality_dor_at: "2026-08-23"
quality_dor_by: codex
quality_dor_note: "CUST-IN-0014 supplies exact 30-minute expiry/restart evidence, mounted Secret rotation behavior, owner boundaries, value-safety constraints, and live acceptance criteria."
origin: residual
origin_ref: CUST-IN-0014
related:
  - RAPP-SBOM-NEXUS-WP-0003
---

# Adopt rotated database leases without liveness restarts

## Reread the mounted DSN on new pool connections

```task
id: SBOM-WP-0004-T01
status: done
priority: high
```

Use a value-safe SQLAlchemy connection creator that rereads the mounted URL
for every new DBAPI connection. Recycle pooled connections before the current
30-minute lease expires and preserve `pool_pre_ping` so revoked sessions are
replaced with the current mounted credential.

Completed with tests proving two connection attempts observe two file values
and that the engine URL contains neither username nor password.

## Separate liveness from database readiness

```task
id: SBOM-WP-0004-T02
status: done
priority: high
```

Expose process-only `/state/live` while retaining the database-backed
`/state/health` readiness contract. The package must move only liveness to the
new route so a transient credential handoff removes traffic but does not ask
Kubernetes to restart an otherwise healthy process.

## Prove one complete live lease rotation

```task
id: SBOM-WP-0004-T03
status: wait
priority: high
```

Promote the shared new image/package digest, observe at least one complete
database lease rotation, and require continuous process uptime, recovered
readiness, no liveness-driven restart, and no credential values in logs.