Repair GCP Cloud Tasks OIDC Audience Drift

Repair GCP Cloud Tasks OIDC Audience Drift — SYNTHETIC EVIDENCE-LIMITED REVIEW

Case received

Authenticated queue tasks receive 401 responses at a new Cloud Run URL.

Evidence register

• S1: Cloud Tasks OIDC token audience claims and HTTP target revisions — PARTIAL / UNVERIFIED.
• S2: approved operating baseline / documented policy — NOT PROVIDED; REQUIRED TO VERIFY.
• S3: timestamped revision or change record — NOT PROVIDED; REQUIRED TO VERIFY.
• S4: accountable reviewer and approval evidence — NOT PROVIDED; REQUIRED TO VERIFY.

Investigation checks

1. Establish the identity, timestamp basis and revision lineage of Cloud Tasks OIDC token audience claims and HTTP target revisions; document missing or contradictory records. — PENDING CORROBORATION.
2. Reconstruct the event sequence surrounding task audience still points to a previous service URL after cutover, citing exact record identifiers and independent checks. — PENDING CORROBORATION.
3. Compare the evidence with the approved baseline; test the competing explanations for: Authenticated queue tasks receive 401 responses at a new Cloud Run URL. — PENDING CORROBORATION.
4. Draft a non-executing, owner-approved validation sequence and rejection criteria for GCP service owner synthetic request test and least privilege review. — PENDING CORROBORATION.

Deliverables

• time-aligned evidence index for Cloud Tasks OIDC token audience claims and HTTP target revisions: DRAFT / INCOMPLETE until inputs are validated.
• exceptions and alternative hypotheses for task audience still points to a previous service URL after cutover: DRAFT / INCOMPLETE until inputs are validated.
• approval-gated GCP service owner synthetic request test and least privilege review and verification criteria: DRAFT / INCOMPLETE until inputs are validated.

Decision gate

INCOMPLETE — HUMAN REVIEW REQUIRED. Sources, scope, time basis and sign-off remain unverified. No live change or approval has occurred.