Add a safe validation and rotation path for Sentry DSNs in SSM #593

New issue

Open

opened 2026-07-23 05:07:32 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-23 05:07:32 +00:00

Owner

The 2026-07-23 Eco Discord rollout exposed that /sentry-dsn/eco-mcp-app is non-empty but malformed: it has no valid HTTP(S) scheme or parseable host. eco-app#43 prevents a crash-loop, but both the web app and new Discord worker emit a full startup traceback and silently run without telemetry. The value itself was not exposed. Add an attended, secret-safe provisioning/rotation path for Sentry DSNs that validates the URL before writing SecureString state (at minimum HTTP(S) scheme, userinfo/public key, host, and project path), never echoes the DSN, and documents how an operator repairs this exact parameter and forces the consuming ExternalSecret to reconcile. Include offline tests for accepted/rejected shapes. Do not invent or overwrite a live DSN in the headless run; the durable artifact should make the subsequent operator rotation safe and obvious.

The 2026-07-23 Eco Discord rollout exposed that `/sentry-dsn/eco-mcp-app` is non-empty but malformed: it has no valid HTTP(S) scheme or parseable host. eco-app#43 prevents a crash-loop, but both the web app and new Discord worker emit a full startup traceback and silently run without telemetry. The value itself was not exposed. Add an attended, secret-safe provisioning/rotation path for Sentry DSNs that validates the URL before writing SecureString state (at minimum HTTP(S) scheme, userinfo/public key, host, and project path), never echoes the DSN, and documents how an operator repairs this exact parameter and forces the consuming ExternalSecret to reconcile. Include offline tests for accepted/rejected shapes. Do not invent or overwrite a live DSN in the headless run; the durable artifact should make the subsequent operator rotation safe and obvious.

coilyco-ops referenced this issue from a commit

2026-07-23 05:15:05 +00:00

feat: add safe Sentry DSN rotation path

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-23 05:15:33 +00:00

feat: add safe Sentry DSN rotation path #594

coilyco-ops commented

2026-07-23 05:16:52 +00:00

Author

Owner

WARDED_WORKFLOW: #594

details

review summary: skipped. The in-container review gate was intentionally skipped because the temporary Ward default is pending brokered QA.
workflow: pull-request; review summary: skipped pending brokered QA
felt: focused and safe. confidence: high. surprises: none. follow-up: attended operator rotates the live DSN and reconciles its ExternalSecret.

WARDED_WORKFLOW: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/pulls/594 <details><summary>details</summary> review summary: skipped. The in-container review gate was intentionally skipped because the temporary Ward default is pending brokered QA. workflow: pull-request; review summary: skipped pending brokered QA felt: focused and safe. confidence: high. surprises: none. follow-up: attended operator rotates the live DSN and reconciles its ExternalSecret. </details>

coilyco-ops commented

2026-07-23 05:16:56 +00:00

Author

Owner

WARDED_WORKFLOW: reservation-released

release details

Run finished with WARDED_WORKFLOW: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/pulls/594.

ward container reap released container engineer-codex-infrastructure-593 (--harness codex): the terminal outcome supersedes the reservation, so a later redispatch no longer needs --override-reservation.

Outcome summary: #594

— Codex, via ward agent

WARDED_WORKFLOW: reservation-released <details><summary>release details</summary> Run finished with `WARDED_WORKFLOW: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/pulls/594`. `ward container reap` released container `engineer-codex-infrastructure-593` (`--harness codex`): the terminal outcome supersedes the reservation, so a later redispatch no longer needs `--override-reservation`. **Outcome summary:** https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/pulls/594 </details>  — Codex, via `ward agent`

coilyco-ops added the

autonomy

live-collab

priority

labels

2026-07-29 03:46:25 +00:00

coilyco-ops added the

role/sysadmin

label

2026-08-25 08:02:26 +00:00

coilyco-ops referenced this issue

2026-08-27 09:51:17 +00:00