From 03e28cecf5ae24d713eda0deb040f9c6c5bf242b Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 22 Aug 2026 23:06:58 +0200 Subject: [PATCH] workplans: record sbom runtime residuals --- WORK-RECORDS.md | 5 +++-- intakes.md | 15 +++++++++++++++ .../CUST-WP-0062-sbom-nexus-daily-catchup.md | 2 ++ .../CUST-WP-0064-sbom-controlled-scan-inputs.md | 17 +++++++++++++++-- 4 files changed, 35 insertions(+), 4 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index a6c5e00..7376a2a 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -62,7 +62,7 @@ | workplan | CUST-WP-0061 | finished | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md | | workplan | CUST-WP-0062 | finished | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md | | workplan | CUST-WP-0063 | finished | — | workplans/CUST-WP-0063-inbox-governance-packets.md | -| workplan | CUST-WP-0064 | ready | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | +| workplan | CUST-WP-0064 | active | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | | task | ADHOC-2026-05-02-T01 | done | — | workplans/ADHOC-2026-05-02.md | | task | ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | | task | CUST-WP-0001-T01 | done | — | workplans/CUST-WP-0001-custodian-agent-runtime.md | @@ -406,7 +406,7 @@ | task | CUST-WP-0063-T03 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md | | task | CUST-WP-0063-T04 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md | | task | CUST-WP-0063-T05 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md | -| task | CUST-WP-0064-T01 | todo | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | +| task | CUST-WP-0064-T01 | progress | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | | task | CUST-WP-0064-T02 | wait | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | | task | CUST-WP-0064-T03 | wait | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | | task | CUST-WP-0064-T04 | wait | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | @@ -423,3 +423,4 @@ | intake | CUST-IN-0011 | routed | red | intakes.md | | intake | CUST-IN-0012 | open | green | intakes.md | | intake | CUST-IN-0013 | open | blue | intakes.md | +| intake | CUST-IN-0014 | open | blue | intakes.md | diff --git a/intakes.md b/intakes.md index e00a438..98bb2ea 100644 --- a/intakes.md +++ b/intakes.md @@ -50,3 +50,18 @@ origin_ref: CUST-WP-0062 notes: "Activity Core completed ACTIVITY-WP-0033 and now sends a stable Idempotency-Key plus X-Activity-Core-Operation-ID for each workflow-run/repository pair. SBOM Nexus must durably enforce that identity on both POST /sbom/{slug}/ingest and POST /sbom/{slug}/skip and replay the original terminal response. This closes the crash window where Nexus commits but the worker dies before its heartbeat. Source handoff: State Hub message bc5caa49-25eb-4942-9deb-411b6080d0bb." state_hub_intake_id: "01a02b44-89a9-7e94-820b-3d86340117ff" ``` + +## CUST-IN-0014 — Stop SBOM Nexus restarts on database lease rotation + +```yaml +id: CUST-IN-0014 +kind: intake +title: "Stop SBOM Nexus restarts on database lease rotation" +status: open +lane: blue +priority: high +owner: sbom-nexus +origin: residual +origin_ref: CUST-WP-0062 +notes: "Live review after cutover found the Ready SBOM Nexus pod at restartCount 9 in under five hours. The last container ran exactly 30 minutes, then readiness/liveness returned HTTP 500 because PostgreSQL rejected the expired v-token-sbom-nex-* credential; Kubernetes restarted the process and it recovered. ESO continues updating the mounted runtime Secret, but the process/SQLAlchemy engine does not adopt the new credential before expiry. Implement a value-safe rotation path that rereads the mounted credential and disposes/rebuilds the pool, or an explicitly coordinated rollout on Secret revision; prove lease rotation without recurring liveness-driven restarts and without logging credential values. Evidence observed 2026-08-22: last termination Completed at 20:43:45Z after start 20:13:45Z, current pod Ready, prior log psycopg password authentication failure." +``` diff --git a/workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md b/workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md index c099d7c..95fd49e 100644 --- a/workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md +++ b/workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md @@ -252,6 +252,8 @@ Actionable leftovers are live before closure: create real authoritative SBOMs rather than only terminal `no-checkout` outcomes; - `CUST-IN-0013` routes durable operation-id replay to SBOM Nexus; +- `CUST-IN-0014` routes the observed 30-minute database-lease restart cycle to + SBOM Nexus for credential reread/pool-rotation repair and live proof; - `RMGR-WP-0011` remains ready for the authoritative Repo Manager HTTP client and explicit non-authoritative preview semantics. diff --git a/workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md b/workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md index d5d3a89..aa1bc20 100644 --- a/workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md +++ b/workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md @@ -4,13 +4,17 @@ type: workplan title: "Controlled scan inputs for authoritative daily SBOM catch-up" domain: infotech repo: the-custodian -status: ready +status: active owner: codex topic_slug: custodian planning_priority: high planning_order: 64 created: "2026-08-22" updated: "2026-08-22" +quality_dor: DoR-Ok +quality_dor_at: "2026-08-22" +quality_dor_by: codex +quality_dor_note: "Current no-checkout production evidence, owner boundaries, trust decisions, dependencies, acceptance evidence, and rollback requirements were reviewed against SBOM-WP-0002 and ACTIVITY-WP-0030/0033." origin: residual origin_ref: CUST-WP-0062 related: @@ -40,7 +44,7 @@ the deployment package owns the runtime/network boundary. ```task id: CUST-WP-0064-T01 -status: todo +status: progress priority: high state_hub_task_id: "02ac7278-8536-5ce8-9027-39345aab0539" ``` @@ -54,6 +58,15 @@ behavior, cleanup, and the boundary between preview and authoritative ingest. Done when the four owning repos have one reviewable contract and rollback; do not enable source transfer from a prose-only assumption. +**Started (2026-08-22):** live verification confirmed the private Nexus pod +cannot reach projected workstation checkout paths and that queue fairness is +therefore advancing through `no-checkout` outcomes. The Custodian fixed the +non-negotiable boundary—revision-pinned input, no workstation mount, bounded +credentials/egress/time/size, provenance, cleanup, and rollback—and routed +owner participation to SBOM Nexus (`95c1b226`), Repo Manager (`075e21de`), +Activity Core (`7233d2d1`), and the package owner (`e0af24b1`). Selection of +the concrete transfer mechanism remains in progress. + ## Implement the Nexus-owned authoritative scan path ```task