From 3ac63b23fc5f15677550703dfe5ee86ad40c2737 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 9 Oct 2026 10:46:53 +0200 Subject: [PATCH] MASON-WP-0007-T06: Secret presence check only through the safe helper Per the-custodian standing notice 51e9eace (2026-09-28). Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0 --- .../MASON-WP-0007-tenant-engine-audit-core-sender-projection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md index 2525254..3f83349 100644 --- a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md +++ b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md @@ -156,7 +156,7 @@ id: MASON-WP-0007-T06 status: wait depends_on: [MASON-WP-0007-T03, MASON-WP-0007-T04, MASON-WP-0007-T05] blocked_on: human -blocking_reason: "Founder applies rapp-tenant-engine (make prerequisites-dry-run, then make prerequisites); then verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine." +blocking_reason: "Founder applies rapp-tenant-engine (make prerequisites-dry-run, then make prerequisites); then verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token (via railiance-platform secret_annotation_maintenance.py inspect mode only, never a go-template/jsonpath against the Secret, per the 2026-09-28 standing notice); negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine." priority: medium state_hub_task_id: "84576093-9133-5708-b724-2266db434407" ```