Add draft routing entry audit-core-senders

Pointer-only. Database leases stay on database-dynamic-credentials.
Promote after the Mason AppRole build is verified.

registry/routing/catalog.yaml

@@ -640,6 +640,23 @@ entries:
         - "USER_ENGINE_PROXY_SECRET: rotate user-engine/user-engine-runtime, re-run make coulomb-social-env-secret, restart app."
         - "DATABASE_URL: platform rotates apps-pg role password secret; re-run make coulomb-social-env-secret; restart app."
 
+  - id: audit-core-senders
+    title: audit-core sender registry (write and operator-read tokens)
+    need_keywords: [audit-core, senders, sender registry, ingest token, AUDIT_CORE_SENDERS]
+    owner_repo: ops-mason
+    subsystem: OpenBao + audit-core
+    warden_executes: false
+    wiki_ref: wiki/playbooks/audit-core-senders.md#worker-checklist
+    canon_ref: audit-core/docs/operator-runbook.md
+    reviewed: "2026-08-13"
+    status: draft
+    auth_method: "in-cluster generated Secret audit-core-senders; later OpenBao KV via Mason wrap-migrate"
+    path_template: "platform/workloads/audit-core/senders"
+    policy_ref: "external-secrets-audit-core"
+    exec_capable: false
+    resolvable: false
+    lane: secret
+
   - id: email-connect-transactional
     title: email-connect transactional SMTP and caller ingest token
     need_keywords: [email-connect, transactional, smtp, ionos, starttls, ingest, invitation, verification, EMAIL_CONNECT_SMTP_PASSWORD, EMAIL_CONNECT_INGEST_TOKEN]

wiki/playbooks/audit-core-senders.md

@@ -0,0 +1,19 @@
+# audit-core sender registry
+
+## Worker checklist
+
+This file is a pointer only. ops-warden does not issue sender tokens and
+does not duplicate the operating procedure.
+
+- Construction plan: `ops-mason/plans/audit-core-openbao-runtime-custody.md`
+- Package and operator runbook: `audit-core/docs/operator-runbook.md`
+- Database leases (separate lane): `warden route show database-dynamic-credentials`
+- Authoritative senders shape: `audit-core/docs/senders.example.json` (placeholders only)
+
+First deploy mints sender tokens in-cluster into Secret
+`audit-core/audit-core-senders`. The OpenBao path
+`platform/workloads/audit-core/senders` is the later authority, filled by a
+Mason wrap-migrate — not by a founder `bao kv put`.
+
+Never place a sender token, bearer, or `senders.json` value in Git, State
+Hub, logs, or chat.