coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

workplans: record sbom runtime residuals
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
codex 2026-08-22 23:06:58 +02:00
parent 2bd88fd766
commit 03e28cecf5
4 changed files with 35 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

15
intakes.md
View file

@ -50,3 +50,18 @@ origin_ref: CUST-WP-0062
notes: "Activity Core completed ACTIVITY-WP-0033 and now sends a stable Idempotency-Key plus X-Activity-Core-Operation-ID for each workflow-run/repository pair. SBOM Nexus must durably enforce that identity on both POST /sbom/{slug}/ingest and POST /sbom/{slug}/skip and replay the original terminal response. This closes the crash window where Nexus commits but the worker dies before its heartbeat. Source handoff: State Hub message bc5caa49-25eb-4942-9deb-411b6080d0bb."
state_hub_intake_id: "01a02b44-89a9-7e94-820b-3d86340117ff"
```
## CUST-IN-0014 — Stop SBOM Nexus restarts on database lease rotation
```yaml
id: CUST-IN-0014
kind: intake
title: "Stop SBOM Nexus restarts on database lease rotation"
status: open
lane: blue
priority: high
owner: sbom-nexus
origin: residual
origin_ref: CUST-WP-0062
notes: "Live review after cutover found the Ready SBOM Nexus pod at restartCount 9 in under five hours. The last container ran exactly 30 minutes, then readiness/liveness returned HTTP 500 because PostgreSQL rejected the expired v-token-sbom-nex-* credential; Kubernetes restarted the process and it recovered. ESO continues updating the mounted runtime Secret, but the process/SQLAlchemy engine does not adopt the new credential before expiry. Implement a value-safe rotation path that rereads the mounted credential and disposes/rebuilds the pool, or an explicitly coordinated rollout on Secret revision; prove lease rotation without recurring liveness-driven restarts and without logging credential values. Evidence observed 2026-08-22: last termination Completed at 20:43:45Z after start 20:13:45Z, current pod Ready, prior log psycopg password authentication failure."
```