MASON-WP-0007-T06: Secret presence check only through the safe helper

Per the-custodian standing notice 51e9eace (2026-09-28).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-09 10:46:53 +02:00
parent c24732e8a8
commit 3ac63b23fc

View file

@ -156,7 +156,7 @@ id: MASON-WP-0007-T06
status: wait
depends_on: [MASON-WP-0007-T03, MASON-WP-0007-T04, MASON-WP-0007-T05]
blocked_on: human
blocking_reason: "Founder applies rapp-tenant-engine (make prerequisites-dry-run, then make prerequisites); then verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine."
blocking_reason: "Founder applies rapp-tenant-engine (make prerequisites-dry-run, then make prerequisites); then verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token (via railiance-platform secret_annotation_maintenance.py inspect mode only, never a go-template/jsonpath against the Secret, per the 2026-09-28 standing notice); negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine."
priority: medium
state_hub_task_id: "84576093-9133-5708-b724-2266db434407"
```