Mayor Token expired & unable to refresh (hitting 401s on all GT api calls)

[aarden-jasper]

What happened?

• Mayor ID: mayor-f65a987b
• Error: 401 Token expired on all attempted API calls (gt_list_rigs, gt_bug_report)
• Steps taken: token refresh in settings + Cmd+Shift+R hard refresh in web browser

Area

Mayor / Chat

Town ID (if known)

f65a987b-bbab-4eac-abdb-a936519013ca

Steps to reproduce

• open up the mayor chat
• initiate work (anything that makes the mayor call a gt api)
• 401 response

Relevant logs or screenshots

[jrf0110]

Investigation Results

Ran diagnostics against town f65a987b via debug endpoint + Analytics Engine.

Corroborated: YES

• Mayor idle for 5 days (last activity 2026-03-25 20:37)
• 602 dispatch failures in last 24h (277 polecat d6b1c220, 255 polecat 89969e21, 70 refinery)
• Zero HTTP traffic from browser in 5 days — consistent with expired JWT causing 401s at the worker auth middleware before requests reach the TownDO
• TownDO is alive and healthy (alarm active, reconciler ticking) — the DO itself is fine
• Polecat d6b1c220 stuck in a hook→dispatch_failed→unhook→re-hook loop on bead 67f2fe6b every ~5 min
• Polecat 89969e21 is stalled with 2 dispatch attempts

Root cause: User's JWT expired and the refresh mechanism at /api/gastown/token is failing (or the user's session cookie expired). All browser→worker API calls fail at the auth middleware with 401. The TownDO never sees the requests. Additionally, container dispatch is failing for all agents — likely the kilocode_token in the town config has also expired, preventing container startup.

Related issues: #1680 (duplicate — mayor token expired after credential refresh, closing below)

[jrf0110]

Addressed in PR #1828 (constituent PR #1759 — fix(gastown): propagate KILOCODE_TOKEN refresh to running containers). Fixes 4 token propagation gaps + adds proactive alarm-based token refresh before expiry.