tegwick
23ba584ccd
- fluid-telegram-operator: pointer-only draft entry and playbook from ops-mason's
MASON-WP-0005-T06 proposal; activation waits for the owner-run member and
non-member checks and the salt create-once probe.
- audit-core-senders: tenant-engine recorded as a verified exact-path consumer
projection (MASON-WP-0007-T06). The registry lane itself stays draft.
- warden case plan: {param:env} format spec (net-kingdom 850907a), other specs
and conversions refused; prints case-ref <case_id>@sha256:<file digest>.
- Workload-join unknown count 21 -> 22 (test and pep-stance.yaml).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8
26 lines
1.2 KiB
Markdown
26 lines
1.2 KiB
Markdown
# fluid-telegram operator lane (Hall of Helix)
|
|
|
|
Catalog: `fluid-telegram-operator` (status `draft`, pointer only)
|
|
Owner: `ops-mason` (construction plan `ops-mason/plans/fluid-telegram-operator-credential-lane.md`, CCR-2026-0039)
|
|
Consumer: `fluid-telegram` attended provisioner (FT-WP-0002)
|
|
|
|
## Worker checklist
|
|
|
|
This page is a pointer. ops-warden does not issue, read, or hold these values.
|
|
|
|
1. You must be a member of the LLDAP group `fluid-telegram-operators`, signed
|
|
in at aal2 (MFA).
|
|
2. Log in attended:
|
|
`bao login -no-print -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv`.
|
|
The token lives 15 minutes. Agents are denied on these paths.
|
|
3. Run the fluid-telegram provisioner per FT-WP-0002. It reads the operator
|
|
app entry, writes the MTProto session and bot token, and creates
|
|
`redaction-salt` once.
|
|
4. Verify with `bao token capabilities` only, never by reading a value. The
|
|
owner-run check is `ops-mason/scripts/verify-fluid-telegram-lane.sh`.
|
|
|
|
The bot adapter's runtime read of `bot-token` and `redaction-salt` is a
|
|
separate lane (MASON-IN-0003). It never uses this attended role.
|
|
|
|
Status: draft until the owner-run member and non-member checks and the salt
|
|
create-once probe pass. ops-warden then activates the entry.
|