sbom-nexus/workplans/SBOM-WP-0004-database-lease-rotation.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	quality_dor	quality_dor_at	quality_dor_by	quality_dor_note	origin	origin_ref	related	state_hub_workstream_id
SBOM-WP-0004	workplan	Adopt rotated database leases without liveness restarts	infotech	sbom-nexus	finished	codex	infotech	2026-08-23	2026-08-23	DoR-Ok	2026-08-23	codex	CUST-IN-0014 supplies exact 30-minute expiry/restart evidence, mounted Secret rotation behavior, owner boundaries, value-safety constraints, and live acceptance criteria.	residual	CUST-IN-0014	RAPP-SBOM-NEXUS-WP-0003	5723e707-75ce-5a41-b734-e6aa5d00757e

Adopt rotated database leases without liveness restarts

Reread the mounted DSN on new pool connections

id: SBOM-WP-0004-T01
status: done
priority: high
state_hub_task_id: "5bec586f-7eea-5783-a7c1-c8759474c5e0"

Use a value-safe SQLAlchemy connection creator that rereads the mounted URL for every new DBAPI connection. Recycle pooled connections before the current 30-minute lease expires and preserve pool_pre_ping so revoked sessions are replaced with the current mounted credential.

Completed with tests proving two connection attempts observe two file values and that the engine URL contains neither username nor password.

The first live promotion also exposed an Alembic SET ROLE autobegin defect: the migration logged success but its outer transaction rolled back on close. The migration role helper now commits only the role-assumption transaction before Alembic starts its own, with an ordering regression test.

Separate liveness from database readiness

id: SBOM-WP-0004-T02
status: done
priority: high
state_hub_task_id: "e25972bd-8636-5654-91f1-fad49c5f5d2f"

Expose process-only /state/live while retaining the database-backed /state/health readiness contract. The package must move only liveness to the new route so a transient credential handoff removes traffic but does not ask Kubernetes to restart an otherwise healthy process.

Prove one complete live lease rotation

id: SBOM-WP-0004-T03
status: done
priority: high
state_hub_task_id: "a1e88b28-119d-5d1c-a97b-2dd1b3cb9113"

Promote the shared new image/package digest, observe at least one complete database lease rotation, and require continuous process uptime, recovered readiness, no liveness-driven restart, and no credential values in logs.

The corrected digest is live at migration 0002 (head) with process and database health passing, repository reads working, and zero pod restarts. The first promotion safely proved digest rollback and exposed the now-fixed migration transaction guard. Keep this task open through one full lease window.

Completed at 2026-08-22T23:06:19Z after 30m51s continuous uptime on pod UID 73965817-c653-4017-8b90-e19b70c06b21. The mounted ExternalSecret had refreshed again at 23:02:59Z; the pod remained Ready with restart count zero, /state/live, database-backed /state/health, and repository reads all passed, and application logs contained zero credential-pattern matches and zero health 500 responses. This exceeds the prior exact 30-minute failure point.