From a8d434c13bee2711551c014f17ee2e9c99994cef Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 3 Oct 2026 00:18:17 +0200 Subject: [PATCH] TEN-IN-0005: record approved delivery plan and declared objects across repos Co-Authored-By: Claude Sonnet 5.5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 292700@bnt-lap001 Assistant-Session: 42de6b79-9019-4cfd-b49a-6db3bbfe9341 --- intakes/intakes.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/intakes/intakes.md b/intakes/intakes.md index 5adebc8..03e0c27 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -180,5 +180,21 @@ notes: live from this session. author: tenant-engine created: "2026-10-01" +- content: >- + 2026-10-03: founder approved the ops-mason delivery plan + (MASON-WP-0007, scope: declare only; no apply, no seed). Declared, none + applied: railiance-platform 8c44256 (policy + attended role script, + RPF-IN-0002, local, unpushed); rapp-tenant-engine c160be2 (ServiceAccount + tenant-engine-eso, ClusterSecretStore openbao-tenant-engine-audit-core-sender, + ExternalSecret, and the same audit-core wiring mirrored into its copy of the + Deployment). Open: founder runs the attended role script and the token seed + (plan row 7), then `make prerequisites` + `make deploy` from the rApp, then + confirm the ExternalSecret is Ready and 202s arrive. Also open: two repos + declare this Deployment (deploy/base here, manifests/ in the rApp) and have + drifted; the single source of truth is the founder's decision. ESO token + minting in namespace tenant-engine is unverified. The database token due + 2026-10-25 is covered by the RPF-WP-0046 renewer, not Kubernetes auth. + author: tenant-engine + created: "2026-10-03" state_hub_intake_id: "01a0c277-3408-7cdb-984d-c40f697966f0" ```