sbom-nexus/workplans/SBOM-WP-0004-database-lease-rotation.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	quality_dor	quality_dor_at	quality_dor_by	quality_dor_note	origin	origin_ref	related
SBOM-WP-0004	workplan	Adopt rotated database leases without liveness restarts	infotech	sbom-nexus	active	codex	infotech	2026-08-23	2026-08-23	DoR-Ok	2026-08-23	codex	CUST-IN-0014 supplies exact 30-minute expiry/restart evidence, mounted Secret rotation behavior, owner boundaries, value-safety constraints, and live acceptance criteria.	residual	CUST-IN-0014	RAPP-SBOM-NEXUS-WP-0003

Adopt rotated database leases without liveness restarts

Reread the mounted DSN on new pool connections

id: SBOM-WP-0004-T01
status: done
priority: high

Use a value-safe SQLAlchemy connection creator that rereads the mounted URL for every new DBAPI connection. Recycle pooled connections before the current 30-minute lease expires and preserve pool_pre_ping so revoked sessions are replaced with the current mounted credential.

Completed with tests proving two connection attempts observe two file values and that the engine URL contains neither username nor password.

The first live promotion also exposed an Alembic SET ROLE autobegin defect: the migration logged success but its outer transaction rolled back on close. The migration role helper now commits only the role-assumption transaction before Alembic starts its own, with an ordering regression test.

Separate liveness from database readiness

id: SBOM-WP-0004-T02
status: done
priority: high

Expose process-only /state/live while retaining the database-backed /state/health readiness contract. The package must move only liveness to the new route so a transient credential handoff removes traffic but does not ask Kubernetes to restart an otherwise healthy process.

Prove one complete live lease rotation

id: SBOM-WP-0004-T03
status: progress
priority: high

Promote the shared new image/package digest, observe at least one complete database lease rotation, and require continuous process uptime, recovered readiness, no liveness-driven restart, and no credential values in logs.

The corrected digest is live at migration 0002 (head) with process and database health passing, repository reads working, and zero pod restarts. The first promotion safely proved digest rollback and exposed the now-fixed migration transaction guard. Keep this task open through one full lease window.