BOLT-1722: investigate wall-display session expiry around 24 hours

blocked

Priority: 0

Branch: winston/bolt-1722-dashboard-token-refresh

PR: #14003

Richie requested investigation 2026-08-04. Reporter identified as Brian Sylvester ([email protected]), Vermont Electric Cooperative. Strong evidence of a real recurring ~24h dashboard re-auth: Auth0 OAUTH success/session records 2026-07-30 00:05 → 22:42 (22h36), and 2026-08-03 10:58 → 2026-08-04 10:50 (23h52), whereas true refresh events are represented as authMethod=REFRESH and none appear after 2026-07-05. Investigate why dashboard refresh path does not persist for this VEC SSO display and propose/ship smallest safe fix. Linear BOLT-1722.

Event Timeline

created

progress

Investigation complete: BOLT-1722 matches known open-tab JWT-expiry failure. Current main has proactive recovery (JWT expiry timer + focus/visibility/online) and refresh-token rotation on a 30-day session. KORE wall view is global-AuthProvider backed and independently polls every 30 seconds. No evidence from 14d Datadog app-dashboard logs of refresh/recovery errors; no session-lifetime change made.

status_change

in_progress → completed

status_change

completed → in_progress

progress

Reporter identified. Production Auth0 + identity evidence verifies full OAUTH sessions recur at ~24h (Jul 30→31: 22h36; Aug 3→4: 23h52) and true REFRESH-session records stopped after Jul 5. This is a real issue, not refresh-token max lifetime; investigating why dashboard refresh is absent/fails for VEC SSO display.

failed

lease expired — re-queued for retry

in_progress → queued

progress

Root cause confirmed and fix opened: dashboard called nonexistent auth portal /api/token-refresh (live accounts.texturehq.com returns 404); every refresh failed and led to full ~24h Okta reauth. PR #14003 changes both recovery paths to supported POST /oauth/token refresh-token grant, with 4 passing focused regression tests.

status_change

queued → completed

status_change

completed → in_progress

progress

Safety correction: converted PR #14003 to draft/non-mergeable. Although /api/token-refresh is dead, the proposed /oauth/token replacement returns production 500 for refresh-grant validation (server config absent), so it is not safe. Tracing the supported Identity Texture-session refresh contract.

failed

lease expired — re-queued for retry

in_progress → queued

subagent_spawned

spawn claim: BOLT-1722: investigate wall-display session expiry around 24 hours

status_change

queued → in_progress

failed

lease expired — max retries reached, marking failed (poison pill)

in_progress → failed

status_change

failed → in_progress

status_change

in_progress → blocked