MASON-WP-0007: plan tenant-engine audit-core sender token projection (draft, not applied)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 292700@bnt-lap001
Assistant-Session: 42de6b79-9019-4cfd-b49a-6db3bbfe9341

workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md

@@ -0,0 +1,113 @@
+---
+id: MASON-WP-0007
+type: workplan
+title: "Project the tenant-engine audit-core sender token into its namespace"
+domain: infotech
+repo: ops-mason
+status: blocked
+flavor: planning
+owner: claude
+topic_slug: netkingdom
+created: "2026-10-01"
+updated: "2026-10-01"
+---
+
+# MASON-WP-0007 — Project the tenant-engine audit-core sender token
+
+## Goal
+
+Deliver the tenant-engine sender token, and only that token, as Secret
+`tenant-engine-audit-core-sender` key `token` in namespace `tenant-engine`,
+through External Secrets using Kubernetes auth (no login-token dependency),
+without any agent or founder handling the value.
+
+Demand source: tenant-engine `TEN-IN-0005`; audit-core mint receipt
+`audit-core/docs/evidence/2026-09-15-tenant-engine-sender-mint.json`.
+Construction plan: `plans/tenant-engine-audit-core-sender-projection.md`
+(draft). Routing entry: `audit-core-senders`.
+
+## Boundaries
+
+- No OpenBao write and no cluster apply happens in this workplan until the
+  plan is approved. No secret value is read or recorded anywhere.
+- The registry path `platform/workloads/audit-core/senders` is audit-core's
+  authority and is not widened. The existing `openbao-tenant-engine-database`
+  store and its static token are not reused.
+- Policy and role are declared by railiance-platform; the SA, store and
+  ExternalSecret by the tenant-engine rApp manifests. ops-mason plans, verifies
+  structure by metadata, and records evidence.
+
+## Tasks
+
+## Complete the live survey and review the plan
+
+```task
+id: MASON-WP-0007-T01
+status: todo
+priority: high
+```
+
+With a scoped `./scripts/bao-session.sh grant MASON-WP-0007-T01` session,
+confirm metadata only: `platform/workloads/tenant-engine/` is unused, no
+conflicting policy/role names, `auth/kubernetes` role shape of
+`email-connect-transactional-eso`. Ask railiance-platform whether the CCR path
+or `lanes.json` is the right surface for a Kubernetes-auth role, and whether
+ESO may create SA tokens in `tenant-engine`. Then render `build_spec` and its
+digest if the ops-mason builder is to be used.
+
+## Approve the plan
+
+```task
+id: MASON-WP-0007-T02
+status: wait
+needs_human: true
+depends_on: [MASON-WP-0007-T01]
+blocked_on: founder
+blocking_reason: "Founder approval of the construction plan (status: approved, approved_by, approved_at)."
+priority: high
+```
+
+## Policy and Kubernetes-auth role declared by railiance-platform
+
+```task
+id: MASON-WP-0007-T03
+status: wait
+depends_on: [MASON-WP-0007-T02]
+blocked_on: message-from:railiance-platform
+blocking_reason: "railiance-platform declares policy workload-kv-read-tenant-engine-audit-core-sender-eso and role tenant-engine-audit-core-sender-eso (ESO Kubernetes auth lane), or confirms the ops-mason builder may write the role."
+priority: high
+```
+
+## Manifests in the tenant-engine rApp repository
+
+```task
+id: MASON-WP-0007-T04
+status: wait
+depends_on: [MASON-WP-0007-T02]
+blocked_on: message-from:tenant-engine
+blocking_reason: "tenant-engine/rapp-tenant-engine declares SA tenant-engine-eso, ClusterSecretStore openbao-tenant-engine-audit-core-sender and ExternalSecret tenant-engine-audit-core-sender per the plan, reconciled by ArgoCD."
+priority: high
+```
+
+## Attended seed of the dedicated KV path
+
+```task
+id: MASON-WP-0007-T05
+status: wait
+needs_human: true
+depends_on: [MASON-WP-0007-T03]
+blocked_on: founder
+blocking_reason: "Wrapped platform-admin process copies the tenant-engine token from the registry document to platform/workloads/tenant-engine/audit-core-sender without printing it; ops-mason-build is denied value reads, so only an attended admin lane can do it."
+priority: high
+```
+
+## Verify and hand off
+
+```task
+id: MASON-WP-0007-T06
+status: wait
+depends_on: [MASON-WP-0007-T03, MASON-WP-0007-T04, MASON-WP-0007-T05]
+blocked_on: other-task
+blocking_reason: "Needs T03-T05. Verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine."
+priority: medium
+```