tegwick
56876ee456
Pointer-only. Database leases stay on database-dynamic-credentials. Promote after the Mason AppRole build is verified.
19 lines
822 B
Markdown
19 lines
822 B
Markdown
# audit-core sender registry
|
|
|
|
## Worker checklist
|
|
|
|
This file is a pointer only. ops-warden does not issue sender tokens and
|
|
does not duplicate the operating procedure.
|
|
|
|
- Construction plan: `ops-mason/plans/audit-core-openbao-runtime-custody.md`
|
|
- Package and operator runbook: `audit-core/docs/operator-runbook.md`
|
|
- Database leases (separate lane): `warden route show database-dynamic-credentials`
|
|
- Authoritative senders shape: `audit-core/docs/senders.example.json` (placeholders only)
|
|
|
|
First deploy mints sender tokens in-cluster into Secret
|
|
`audit-core/audit-core-senders`. The OpenBao path
|
|
`platform/workloads/audit-core/senders` is the later authority, filled by a
|
|
Mason wrap-migrate — not by a founder `bao kv put`.
|
|
|
|
Never place a sender token, bearer, or `senders.json` value in Git, State
|
|
Hub, logs, or chat.
|