Catalog fluid-telegram-operator (draft) and tenant-engine sender projection; case plan env spec and case-ref

- fluid-telegram-operator: pointer-only draft entry and playbook from ops-mason's
  MASON-WP-0005-T06 proposal; activation waits for the owner-run member and
  non-member checks and the salt create-once probe.
- audit-core-senders: tenant-engine recorded as a verified exact-path consumer
  projection (MASON-WP-0007-T06). The registry lane itself stays draft.
- warden case plan: {param:env} format spec (net-kingdom 850907a), other specs
  and conversions refused; prints case-ref <case_id>@sha256:<file digest>.
- Workload-join unknown count 21 -> 22 (test and pep-stance.yaml).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8

registry/routing/catalog.yaml

@@ -1324,7 +1324,7 @@ entries:
     workload_ref:
       applicability: applicable
       unknown_reason: "audit-core has not published an authoritative workload identity declaration."
-    need_keywords: [audit-core, senders, sender registry, ingest token, AUDIT_CORE_SENDERS]
+    need_keywords: [audit-core, senders, sender registry, ingest token, AUDIT_CORE_SENDERS, tenant-engine audit-core sender]
     owner_repo: ops-mason
     subsystem: OpenBao + audit-core
     warden_executes: false
@@ -1335,8 +1335,14 @@ entries:
     delegation:
       mode: native
       intended_owner: ops-mason
-      reviewed: "2026-08-15"
+      reviewed: "2026-10-09"
       verified: unverified
+      # Per-sender projections. Each is verified on its own and none activates the
+      # registry lane. tenant-engine: KV platform/workloads/tenant-engine/audit-core-sender
+      # (v1), read policy workload-kv-read-tenant-engine-audit-core-sender-eso (exact
+      # read, no registry path), ESO-delivered; verified by ops-mason 2026-10-09
+      # (MASON-WP-0007-T06, message e7e866bf).
+      consumers: [tenant-engine]
     auth_method: "in-cluster generated Secret audit-core-senders; later OpenBao KV via Mason wrap-migrate"
     path_template: "platform/workloads/audit-core/senders"
     policy_ref: "external-secrets-audit-core"
@@ -1490,3 +1496,37 @@ entries:
         - "Re-mint the credential at the supplier, written to a mode-0600 file and never printed."
         - "Write it through a railiance-platform delegated credential change to platform/suppliers/<supplier>/<account> (value from the file, never on argv); revoke the predecessor at the supplier."
         - "Verify with capabilities and metadata only (`bao token capabilities`, `bao kv metadata get`), then tell readers to re-fetch."
+
+  - id: fluid-telegram-operator
+    title: fluid-telegram Hall of Helix operator KV lane (attended OIDC)
+    # Pointer only (MASON-WP-0005-T06, proposal 856bd6ba, 2026-10-09). Built by
+    # ops-mason as CCR-2026-0039; ops-mason verified the policy text and role:
+    # exact four-path matrix, role bound to fluid-telegram-operators at aal2, and
+    # 8 agent denies present. ops-mason proposed `applied-pending-verify`; the
+    # catalog has only draft/active, so it stays draft until the owner-run checks
+    # pass: member capabilities and non-member refusal
+    # (ops-mason scripts/verify-fluid-telegram-lane.sh), plus the salt
+    # create-once probe (FT-WP-0002). Then ops-warden activates it. The adapter
+    # runtime lane is separate (MASON-IN-0003): bot-token and redaction-salt only.
+    risk: high
+    workload_ref:
+      applicability: applicable
+      unknown_reason: "fluid-telegram has not published an authoritative workload identity declaration."
+    need_keywords: [fluid-telegram, hall-of-helix, telegram operator, telegram bot, mtproto, operator-session, bot-token, redaction-salt, fluid-telegram-operators]
+    owner_repo: ops-mason
+    subsystem: OpenBao netkingdom OIDC + platform KV (fluid-telegram campaign)
+    warden_executes: false
+    wiki_ref: wiki/playbooks/fluid-telegram-operator.md#worker-checklist
+    canon_ref: ops-mason/plans/fluid-telegram-operator-credential-lane.md
+    reviewed: "2026-10-09"
+    status: draft
+    delegation:
+      mode: native
+      intended_owner: ops-mason
+      reviewed: "2026-10-09"
+      verified: owner-confirmed
+    auth_method: "bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv (members of fluid-telegram-operators, aal2, 15m token)"
+    path_template: "platform/workloads/coulomb/fluid-telegram/hall-of-helix/{operator-app,operator-session,bot-token,redaction-salt}"
+    exec_capable: false
+    resolvable: false
+    lane: login