coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0007-T04 done: tenant-engine ESO objects declared (rapp-tenant-engine c160be2)

Browse source 
Matches plan rows 4-6. Deployment is a founder make target, not ArgoCD;
T06 now waits on that apply, then metadata-only verification.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-09 00:28:42 +02:00
parent 49ec281c87
commit bc3e03941e
1 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
View file

@ -98,9 +98,7 @@ running the script is an attended founder step and joins T05.
```task
id: MASON-WP-0007-T04
status: wait
blocked_on: message-from:tenant-engine
blocking_reason: "tenant-engine/rapp-tenant-engine declares SA tenant-engine-eso, ClusterSecretStore openbao-tenant-engine-audit-core-sender and ExternalSecret tenant-engine-audit-core-sender per the plan, reconciled by ArgoCD."
status: done
priority: high
state_hub_task_id: "e56f0374-fede-5494-8266-a30f08896a6a"
```
@ -115,6 +113,16 @@ ops-mason's approval notice (2026-10-02 22:17, message 207b94ce), which already
tells it to proceed with rows 4-6 and not apply before the seed. No new
question for ops-mason; still waiting on tenant-engine's declaration.
2026-10-09 done: declared in rapp-tenant-engine `c160be2` (on origin/main),
`manifests/tenant-engine-audit-core-sender.yaml`; checked field by field against
plan rows 4-6 (SA without token automount, ClusterSecretStore on Kubernetes auth
role `tenant-engine-audit-core-sender-eso` limited to namespace
`tenant-engine`, ExternalSecret refresh 1h, key `token`). `make test` 15 passed,
client dry-run clean. Correction: no ArgoCD Application covers
rapp-tenant-engine; it is applied by the founder with `make
prerequisites-dry-run` then `make prerequisites`. The OpenBao side (rows 1-3,
7) is already live (T03, T05), so the apply can go now.
## Attended seed of the dedicated KV path
```task
@ -147,7 +155,8 @@ the plan. Blocking reason widened to cover both steps; gate unchanged
id: MASON-WP-0007-T06
status: wait
depends_on: [MASON-WP-0007-T03, MASON-WP-0007-T04, MASON-WP-0007-T05]
blocking_reason: "Needs T03-T05. Verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine."
blocked_on: human
blocking_reason: "Founder applies rapp-tenant-engine (make prerequisites-dry-run, then make prerequisites); then verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine."
priority: medium
state_hub_task_id: "84576093-9133-5708-b724-2266db434407"
```