coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0007 finished: tenant-engine audit-core sender projection verified

Browse source 
Live policy equals the declared file, role bound to tenant-engine-eso only,
store Ready, ExternalSecret SecretSynced. ops-warden adds the pointer;
tenant-engine notified.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-09 15:53:29 +02:00
parent 3e9ed6e862
commit 930bcadb92
1 changed files with 13 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

18
workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
View file

@ -4,12 +4,12 @@ type: workplan
title: "Project the tenant-engine audit-core sender token into its namespace"
domain: infotech
repo: ops-mason
status: blocked
status: finished
flavor: planning
owner: claude
topic_slug: netkingdom
created: "2026-10-01"
updated: "2026-10-03"
updated: "2026-10-09"
state_hub_workstream_id: "60acab5e-8ee3-5449-bc1e-91b203e92262"
---
@ -162,12 +162,20 @@ the founder runs it if wanted. The declared policy grants exactly `read` on
lookup/revoke, so it cannot reach the registry path; comparing it with the
live policy needs a survey grant.
2026-10-09 done (grant `claude-MASON-WP-0007-T06`, revoked after): live policy
`workload-kv-read-tenant-engine-audit-core-sender-eso` is byte-identical to the
railiance-platform file and never names the registry path; Kubernetes role
`tenant-engine-audit-core-sender-eso` is bound to `tenant-engine/tenant-engine-eso`,
audience `openbao`, 15m/15m, no default policy, that policy only; KV entry at
version 1 and described. Secret presence rests on ESO's SecretSynced (agents do
not read Secrets). Handed off: ops-warden adds and activates the pointer under
`audit-core-senders` (message `e7e866bf`, its own catalog act);
tenant-engine told it is live (message `d4641c47`). No residuals.
```task
id: MASON-WP-0007-T06
status: progress
status: done
depends_on: [MASON-WP-0007-T03, MASON-WP-0007-T04, MASON-WP-0007-T05]
blocked_on: human
blocking_reason: "Applied by the founder 2026-10-09; store Ready and ExternalSecret SecretSynced. Open: Secret presence (founder runs the check; the agent hook blocks Secret reads), live policy compare under a survey grant, ops-warden pointer, tell tenant-engine."
priority: medium
state_hub_task_id: "84576093-9133-5708-b724-2266db434407"
```