coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/wiki/playbooks/fluid-telegram-operator.md
tegwick 23ba584ccd Catalog fluid-telegram-operator (draft) and tenant-engine sender projection; case plan env spec and case-ref 
- fluid-telegram-operator: pointer-only draft entry and playbook from ops-mason's
  MASON-WP-0005-T06 proposal; activation waits for the owner-run member and
  non-member checks and the salt create-once probe.
- audit-core-senders: tenant-engine recorded as a verified exact-path consumer
  projection (MASON-WP-0007-T06). The registry lane itself stays draft.
- warden case plan: {param:env} format spec (net-kingdom 850907a), other specs
  and conversions refused; prints case-ref <case_id>@sha256:<file digest>.
- Workload-join unknown count 21 -> 22 (test and pep-stance.yaml).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8
2026-10-09 19:59:49 +02:00

1.2 KiB
Raw Blame History

fluid-telegram operator lane (Hall of Helix)

Catalog: fluid-telegram-operator (status draft, pointer only) Owner: ops-mason (construction plan ops-mason/plans/fluid-telegram-operator-credential-lane.md, CCR-2026-0039) Consumer: fluid-telegram attended provisioner (FT-WP-0002)

Worker checklist

This page is a pointer. ops-warden does not issue, read, or hold these values.

  1. You must be a member of the LLDAP group fluid-telegram-operators, signed in at aal2 (MFA).
  2. Log in attended: bao login -no-print -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv. The token lives 15 minutes. Agents are denied on these paths.
  3. Run the fluid-telegram provisioner per FT-WP-0002. It reads the operator app entry, writes the MTProto session and bot token, and creates redaction-salt once.
  4. Verify with bao token capabilities only, never by reading a value. The owner-run check is ops-mason/scripts/verify-fluid-telegram-lane.sh.

The bot adapter's runtime read of bot-token and redaction-salt is a separate lane (MASON-IN-0003). It never uses this attended role.

Status: draft until the owner-run member and non-member checks and the salt create-once probe pass. ops-warden then activates the entry.