# fluid-telegram operator lane (Hall of Helix)

Catalog: `fluid-telegram-operator` (status `draft`, pointer only)
Owner: `ops-mason` (construction plan `ops-mason/plans/fluid-telegram-operator-credential-lane.md`, CCR-2026-0039)
Consumer: `fluid-telegram` attended provisioner (FT-WP-0002)

## Worker checklist

This page is a pointer. ops-warden does not issue, read, or hold these values.

1. You must be a member of the LLDAP group `fluid-telegram-operators`, signed
   in at aal2 (MFA).
2. Log in attended:
   `bao login -no-print -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv`.
   The token lives 15 minutes. Agents are denied on these paths.
3. Run the fluid-telegram provisioner per FT-WP-0002. It reads the operator
   app entry, writes the MTProto session and bot token, and creates
   `redaction-salt` once.
4. Verify with `bao token capabilities` only, never by reading a value. The
   owner-run check is `ops-mason/scripts/verify-fluid-telegram-lane.sh`.

The bot adapter's runtime read of `bot-token` and `redaction-salt` is a
separate lane (MASON-IN-0003). It never uses this attended role.

Status: draft until the owner-run member and non-member checks and the salt
create-once probe pass. ops-warden then activates the entry.