fix(token-age): valid-past-7d-horizon = OK (long-lived), not WARN — stops false age-WARN on Workspace accounts; keep 5-7d pre-emptive WARN + DEAD=CRIT

9ca35af13eb53ca16c33bef4c93ce4cc678657b3 · 2026-09-01 12:49:04 -0700 · Steve

Files touched

M token-age-warn.mjs

Diff

commit 9ca35af13eb53ca16c33bef4c93ce4cc678657b3
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Sep 1 12:49:04 2026 -0700

    fix(token-age): valid-past-7d-horizon = OK (long-lived), not WARN — stops false age-WARN on Workspace accounts; keep 5-7d pre-emptive WARN + DEAD=CRIT
---
 token-age-warn.mjs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/token-age-warn.mjs b/token-age-warn.mjs
index a5fb3f2..1902425 100644
--- a/token-age-warn.mjs
+++ b/token-age-warn.mjs
@@ -14,7 +14,7 @@
 //   • AGE — we sha256 each refresh_token (store only a 12-char prefix, never the token) and
 //     stamp issued_ts when that hash first appears / changes (a re-consent). age = now-issued.
 //     First-ever run stamps now (age 0) and self-corrects forward.
-// Verdict per account: DEAD(valid=false)=CRIT · valid & age>=6d=WARN · else OK · missing=UNKNOWN.
+// Verdict per account: DEAD(valid=false)=CRIT · valid & WARN_DAYS<=age<DEAD_DAYS (approaching 7d Testing horizon)=WARN · valid & age>=DEAD_DAYS (survived horizon = long-lived, off the weekly clock)=OK · valid & young=OK · missing=UNKNOWN.
 // Alerts fire on a WORSENING transition only (OK→WARN→CRIT), never on steady-state or recovery.
 import fs from 'node:fs';
 import crypto from 'node:crypto';
@@ -86,7 +86,7 @@ for (const a of ACCOUNTS) {
   if (valid === false) { level = 'CRIT'; detail = `token DEAD (invalid_grant) — re-consent needed`; }
   else if (valid === null && !clientId) { level = 'UNKNOWN'; detail = 'no client id/secret to probe'; }
   else if (valid === null) { level = 'UNKNOWN'; detail = `probe inconclusive (${err})`; }
-  else if (ageDays >= DEAD_DAYS) { level = 'WARN'; detail = `valid but ${ageDays.toFixed(1)}d old — past the 7d Testing horizon (Production/Internal?)`; }
+  else if (ageDays >= DEAD_DAYS) { level = 'OK'; detail = `valid at ${ageDays.toFixed(1)}d — survived past the 7d Testing horizon, so this token is long-lived (Production/Internal/Workspace), not on the weekly clock`; }
   else if (ageDays >= WARN_DAYS) { level = 'WARN'; detail = `valid, ${ageDays.toFixed(1)}d old — expires ~${(DEAD_DAYS - ageDays).toFixed(1)}d if app still in Testing`; }
   else { level = 'OK'; detail = `valid, ${ageDays.toFixed(1)}d old`; }

← e9b8ed8 feat(auth): add /auth/calendar re-consent route for GOOGLE_C · back to George Gmail · feat(auth): steve-office → Internal OAuth client (staggered 9283fd8 →