coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

intakes: close SBOM replay and lease residuals
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 0s
Details

Browse source
This commit is contained in:
codex 2026-08-23 01:11:03 +02:00
parent f0591bda24
commit 929a73d897
2 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
intakes.md
View file

@ -41,7 +41,8 @@ state_hub_intake_id: "01a02b32-009b-71bd-a7bf-2ce888164d6a"
id: CUST-IN-0013
kind: intake
title: "Enforce durable SBOM catch-up operation idempotency"
status: open
status: closed
outcome: absorbed
lane: blue
priority: high
owner: sbom-nexus
@ -57,11 +58,12 @@ state_hub_intake_id: "01a02b44-89a9-7e94-820b-3d86340117ff"
id: CUST-IN-0014
kind: intake
title: "Stop SBOM Nexus restarts on database lease rotation"
status: open
status: closed
outcome: absorbed
lane: blue
priority: high
owner: sbom-nexus
origin: residual
origin_ref: CUST-WP-0062
notes: "Live review after cutover found the Ready SBOM Nexus pod at restartCount 9 in under five hours. The last container ran exactly 30 minutes, then readiness/liveness returned HTTP 500 because PostgreSQL rejected the expired v-token-sbom-nex-* credential; Kubernetes restarted the process and it recovered. The corrected runtime deployed on 2026-08-23 rereads the mounted URL for every new connection, recycles the pool every five minutes, keeps credentials out of the engine URL, and separates process liveness from database readiness. Initial migration 0002, health, repository reads, and attended canary pass with zero pod restarts. Keep open through one complete lease window and confirm no credential values in logs."
notes: "Live review after cutover found the Ready SBOM Nexus pod at restartCount 9 in under five hours. The last container ran exactly 30 minutes, then readiness/liveness returned HTTP 500 because PostgreSQL rejected the expired v-token-sbom-nex-* credential; Kubernetes restarted the process and it recovered. The corrected runtime deployed on 2026-08-23 rereads the mounted URL for every new connection, recycles the pool every five minutes, keeps credentials out of the engine URL, and separates process liveness from database readiness. Completion evidence at 2026-08-22T23:06:19Z exceeded the old failure point with 30m51s on one pod UID across repeated mounted Secret refreshes: Ready, restart count zero, process/database/repository checks passing, zero health 500s, and zero credential-pattern log matches. Absorbed by finished SBOM-WP-0004 and RAPP-SBOM-NEXUS-WP-0003."
```