coulomb/tenant-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

TEN-WP-0012: record 2026-10-01 state of the audit-core sender wait

Browse source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 292700@bnt-lap001
Assistant-Session: 42de6b79-9019-4cfd-b49a-6db3bbfe9341
This commit is contained in:
tegwick 2026-10-01 21:43:30 +02:00
parent 9fabfd7ebf
commit cbf27a06f4
1 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
workplans/TEN-WP-0012-external-conformance-waits.md
View file

@ -125,6 +125,17 @@ externally, **or** audit-core declines and `SCOPE.md` row
Do not: request the token by message, or synthesize a local stand-in that
would make the outbox look drained when it is not.
**2026-10-01 — token minted; manifest side done here; projection pending.**
audit-core minted the sender token on 2026-09-15 (`AUDIT-WP-0010-T02`) and
proved a 202/200 pair (`T05`). `deploy/base/tenant-engine.yaml` now carries the
egress rule, the two `TENANT_ENGINE_AUDIT_CORE_*` variables and an optional
mount for Secret `tenant-engine-audit-core-sender` (`TEN-IN-0005`, `9fabfd7`).
What remains is outside this repo: `ops-mason` `MASON-WP-0007` (draft plan,
blocked) for a dedicated OpenBao path with Kubernetes-auth ESO, railiance-platform
declaring the policy and role, our ServiceAccount/store/ExternalSecret, and an
attended founder step that copies the token. The drain re-reads the token file
on every delivery, so no rollout is needed after the first sync. Stays `wait`.
## T02 — boundary-contract amendment (NET-IN-0002)
```task