Stand up railiance01 receiver without founder bao kv put

Database leases come from ClusterSecretStore openbao-audit-core-database
(one extract, one lease). Senders are minted in-cluster. Secret mounts
use fsGroup 10001. Schema 0001-0004 applied after dropping the isolation
stub events table. /readyz reports custody_class=archive.

deploy/audit-core.yaml

@@ -69,6 +69,8 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        runAsUser: 10001
+        fsGroup: 10001
         seccompProfile:
           type: RuntimeDefault
       # In-flight events must not be lost on rollout; the app shuts down
@@ -171,4 +173,5 @@ spec:
             # ExternalSecret refreshes, which is what makes restart-free
             # rotation possible.
             secretName: audit-core-database
-            defaultMode: 0400
+            # 0440 + fsGroup 10001: 0400 is root-only and the process cannot read it.
+            defaultMode: 0440

deploy/clustersecretstore.yaml

@@ -3,8 +3,8 @@
 #
 # Do not apply until Secret external-secrets/openbao-audit-core-eso-token exists
 # (scripts/openbao-eso-token-apply.sh). This store is KV-only: sender registry
-# lives at platform/workloads/audit-core/senders. Database leases are dynamic
-# and come from VaultDynamicSecret, not this store.
+# lives at platform/workloads/audit-core/senders. Database leases use the
+# sibling store openbao-audit-core-database (engine path, not KV).
 ---
 apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
@@ -29,3 +29,29 @@ spec:
   conditions:
     - namespaces:
         - audit-core
+---
+# Database engine, not KV. Same ESO token, different mount. Generators cannot
+# read a token Secret from another namespace, so leases come through this
+# store rather than VaultDynamicSecret.
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-audit-core-database
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+    app.kubernetes.io/name: audit-core
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: database
+      version: v1
+      auth:
+        tokenSecretRef:
+          name: openbao-audit-core-eso-token
+          namespace: external-secrets
+          key: token
+  conditions:
+    - namespaces:
+        - audit-core

deploy/externalsecret-senders.yaml

@@ -0,0 +1,23 @@
+# Apply only after ops-mason wrap-migrate has filled
+# platform/workloads/audit-core/senders. Until then the sender registry is
+# Secret audit-core-senders, minted in-cluster (see operator-runbook).
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: audit-core-senders
+  namespace: audit-core
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-audit-core
+  target:
+    name: audit-core-senders
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+    - secretKey: senders.json
+      remoteRef:
+        key: workloads/audit-core/senders
+        property: senders.json

deploy/externalsecrets.yaml

@@ -17,6 +17,9 @@ spec:
   # Shorter than the platform default of 1h: these are dynamic leases, and the
   # refresh interval bounds how long a revoked lease can remain mounted.
   refreshInterval: 15m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-audit-core-database
   target:
     name: audit-core-database
     creationPolicy: Owner
@@ -32,12 +35,11 @@ spec:
         host: platform-pg-rw.databases.svc.cluster.local
         port: "5432"
         dbname: audit_core
+  # One read = one lease. Two remoteRefs would mint two roles and pair
+  # username from A with password from B — auth then fails.
   dataFrom:
-    - sourceRef:
-        generatorRef:
-          apiVersion: generators.external-secrets.io/v1alpha1
-          kind: VaultDynamicSecret
-          name: audit-core-runtime
+    - extract:
+        key: creds/audit-core-runtime
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
@@ -46,6 +48,9 @@ metadata:
   namespace: audit-core
 spec:
   refreshInterval: 15m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-audit-core-database
   target:
     name: audit-core-database-migrate
     creationPolicy: Owner
@@ -59,36 +64,10 @@ spec:
         port: "5432"
         dbname: audit_core
   dataFrom:
-    - sourceRef:
-        generatorRef:
-          apiVersion: generators.external-secrets.io/v1alpha1
-          kind: VaultDynamicSecret
-          name: audit-core-migration
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: audit-core-senders
-  namespace: audit-core
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao-audit-core
-  target:
-    name: audit-core-senders
-    creationPolicy: Owner
-    deletionPolicy: Retain
-  data:
-    # The sender registry: which credential may write for which tenant and
-    # source, and each sender's secret_policy. Held in OpenBao rather than the
-    # manifest because it contains bearer tokens.
-    #
-    # Rotation is overlap-first: add the replacement to a sender's `tokens`
-    # list, move the sender, then drop the predecessor. Both are valid in
-    # between, so there is no delivery gap.
-    - secretKey: senders.json
-      remoteRef:
-        # CSS already mounts KV path `platform`; do not repeat the prefix.
-        key: workloads/audit-core/senders
-        property: senders.json
+    - extract:
+        key: creds/audit-core-migration
+# Sender registry is not pulled from OpenBao on first deploy
+# (ops-mason/plans/audit-core-openbao-runtime-custody.md). Tokens are minted
+# in-cluster into Secret audit-core-senders. Apply
+# deploy/externalsecret-senders.yaml only after the Mason wrap-migrate has
+# filled platform/workloads/audit-core/senders.

deploy/migrate-job.yaml

@@ -27,6 +27,8 @@ spec:
       restartPolicy: OnFailure
       securityContext:
         runAsNonRoot: true
+        runAsUser: 10001
+        fsGroup: 10001
         seccompProfile:
           type: RuntimeDefault
       containers:
@@ -63,4 +65,4 @@ spec:
         - name: database-credential
           secret:
             secretName: audit-core-database-migrate
-            defaultMode: 0400
+            defaultMode: 0440

deploy/vaultdynamicsecrets.yaml

@@ -1,41 +0,0 @@
-# Dynamic PostgreSQL leases (AUDIT-WP-0005-T02).
-#
-# These are not KV secrets. Copying a lease into platform/workloads/... would
-# freeze a rotating credential and recreate the delivery-gap problem the
-# mounted directory exists to avoid. ESO's VaultDynamicSecret generator reads
-# database/creds/* on each refresh and writes username/password files that
-# audit-core re-reads on the next connection.
-#
-# Prerequisite: Secret external-secrets/openbao-audit-core-eso-token.
----
-apiVersion: generators.external-secrets.io/v1alpha1
-kind: VaultDynamicSecret
-metadata:
-  name: audit-core-runtime
-  namespace: audit-core
-spec:
-  path: database/creds/audit-core-runtime
-  method: GET
-  provider:
-    server: http://openbao.openbao.svc:8200
-    auth:
-      tokenSecretRef:
-        name: openbao-audit-core-eso-token
-        namespace: external-secrets
-        key: token
----
-apiVersion: generators.external-secrets.io/v1alpha1
-kind: VaultDynamicSecret
-metadata:
-  name: audit-core-migration
-  namespace: audit-core
-spec:
-  path: database/creds/audit-core-migration
-  method: GET
-  provider:
-    server: http://openbao.openbao.svc:8200
-    auth:
-      tokenSecretRef:
-        name: openbao-audit-core-eso-token
-        namespace: external-secrets
-        key: token