Close WARDEN-WP-0039 with fetch-pin receipts; activate audit-core-senders pointer

- WP-0039-T03: receipts against flex-auth-ops-warden-fetch with ops-warden's
  own caller token. Positive forgejo-admin-api-token allow; negatives for
  unknown need, wrong owner (403), wrong tenant and anonymous caller (401).
  Policy decisions only, no credential read. WP-0039 finished.
- audit-core-senders: active as a pointer on ops-mason's custody check
  (message 5a516911). Custody text corrected to OpenBao KV v2 read via ESO;
  delegation verified source-read.
- WP-0044: oidc-browser-relying-party 1.1 is plannable; the case-ref is taken
  at run time because it covers the case status.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8

registry/routing/catalog.yaml

@@ -1320,6 +1320,16 @@ entries:
   - id: audit-core-senders
     title: audit-core sender registry (write and operator-read tokens)
     # Vends write and operator-read tokens (WARDEN-WP-0032-T05).
+    # Activated 2026-10-10 as a pointer on ops-mason's custody check (message
+    # 5a516911, ops-mason-survey grant, metadata and policy text only):
+    # - KV v2 at platform/workloads/audit-core/senders, v11, with all five
+    #   custody fields present.
+    # - Only external-secrets-audit-core grants a data read.
+    # - agent-high-risk-boundary denies the data path, and the tenant-engine
+    #   projection policy does not name it.
+    # ESO reads it by token auth; the parent token renewal is due 2026-10-25,
+    # under railiance-platform RPF-WP-0046. A live-token capability check is
+    # owner-run and not yet done.
     risk: high
     workload_ref:
       applicability: applicable
@@ -1330,20 +1340,20 @@ entries:
     warden_executes: false
     wiki_ref: wiki/playbooks/audit-core-senders.md#worker-checklist
     canon_ref: audit-core/docs/operator-runbook.md
-    reviewed: "2026-08-13"
-    status: draft
+    reviewed: "2026-10-10"
+    status: active
     delegation:
       mode: native
       intended_owner: ops-mason
-      reviewed: "2026-10-09"
-      verified: unverified
+      reviewed: "2026-10-10"
+      verified: source-read
       # Per-sender projections. Each is verified on its own and none activates the
       # registry lane. tenant-engine: KV platform/workloads/tenant-engine/audit-core-sender
       # (v1), read policy workload-kv-read-tenant-engine-audit-core-sender-eso (exact
       # read, no registry path), ESO-delivered; verified by ops-mason 2026-10-09
       # (MASON-WP-0007-T06, message e7e866bf).
       consumers: [tenant-engine]
-    auth_method: "in-cluster generated Secret audit-core-senders; later OpenBao KV via Mason wrap-migrate"
+    auth_method: "OpenBao KV v2 custody; audit-core reads via ESO (policy external-secrets-audit-core, token auth). Operators and agents never read the registry; a sender gets its own exact-path projection."
     path_template: "platform/workloads/audit-core/senders"
     policy_ref: "external-secrets-audit-core"
     exec_capable: false