[Gastown] Mayor control-plane auth remains expired, blocking escalation triage in cloud rig

[jrf0110]

What happened?

Mayor session repeatedly receives 401 Token expired from Gastown control-plane tools while trying to triage and clean up active escalations in rig bd5ebd05-2907-4628-912b-cfe45d15c44b (cloud). The failure persists across many consecutive attempts over an extended period instead of self-refreshing.

Impact:

• Cannot inspect live bead state with gt_list_beads
• Cannot verify whether re-escalations are stale duplicates or real active incidents
• Cannot safely close duplicate escalations or reroute work
• Active incident management is effectively blocked at the mayor layer

Recent pattern:

• Multiple calls to gt_list_beads for open escalations, in_progress, and in_review all fail with GastownApiError: Gastown API error (401): Token expired
• This continued through repeated retries up to 2026-04-04T06:50:55Z
• Prior to expiry, the cloud rig had a real multi-bead Git/GitHub credential incident plus several review rework escalations, so the inability to inspect live state materially impacts operations

Expected behavior:

• Mayor control-plane auth should refresh automatically or recover quickly enough that bead-state inspection tools resume functioning

Actual behavior:

• Auth remains expired across repeated retries for hours, leaving the mayor unable to manage incidents

Suggested investigation:

• mayor chat/control-plane token refresh path
• session renewal behavior for long-running mayor conversations
• whether tool auth is tied to stale session state that is not being renewed after repeated bead queries

Area

Mayor / Chat

Context

• Town ID: 8a6f9375-b806-4ee0-ad6e-1697ea2dbfff
• Agent: Mayor (9640a1a6-ea13-487c-b48d-5af94870f71a)
• Rig ID: bd5ebd05-2907-4628-912b-cfe45d15c44b

Recent Errors

GastownApiError: Gastown API error (401): Token expired

Filed automatically by the Mayor via gt_report_bug.

[jrf0110]

Mayor debug sweep diagnostic note (2026-04-05 UTC)

Per-issue checklist

• Symptom: mayor control-plane tools repeatedly return 401 Token expired, blocking escalation triage
• Subsystem: mayor control-plane auth refresh / session renewal (gt:mayor + gt:core)
• Expected evidence: debug endpoints or related docs exposing auth refresh state, token age, or control-plane session renewal failures

Documentation / access findings

• Attempted to retrieve cloudflare-gastown/docs branch gastown-staging directly during this sweep.
• git clone --branch gastown-staging --single-branch https://github.com/cloudflare-gastown/docs /tmp/cloudflare-gastown-docs failed with fatal: could not read Username for 'https://github.com': No such device or address.
• gh repo view cloudflare-gastown/docs and gh api repos/cloudflare-gastown/docs/contents?ref=gastown-staging both returned repository-not-found / 404.
• Because the docs repo is inaccessible from this environment, the exact endpoint documentation and request format could not be re-verified live in this run.

Diagnostics attempted from this environment

• No staging debug endpoint calls could be executed in this run because the required doc/source-of-truth for endpoint paths and auth contract was inaccessible.
• Blocking step recorded exactly as encountered above; no payload beyond the repository access attempts was available.

Conclusion

• Confirmed vs unconfirmed: Unconfirmed in this run due to blocked access to staging debug documentation.
• Likely fault domain: gt:mayor (primary) for control-plane auth refresh/session renewal, potentially gt:core if refresh state is sourced from broader rig control-plane state.
• Immediate next engineering action: restore access to cloudflare-gastown/docs gastown-staging for the debug sweep runner, then re-run staging probes and capture any auth-refresh/result fields or correlation IDs for repeated 401 Token expired responses.