From cbf27a06f4649e94c72e99981bdc17fb97da30ad Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 1 Oct 2026 21:43:30 +0200 Subject: [PATCH] TEN-WP-0012: record 2026-10-01 state of the audit-core sender wait Co-Authored-By: Claude Sonnet 5.5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 292700@bnt-lap001 Assistant-Session: 42de6b79-9019-4cfd-b49a-6db3bbfe9341 --- workplans/TEN-WP-0012-external-conformance-waits.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/workplans/TEN-WP-0012-external-conformance-waits.md b/workplans/TEN-WP-0012-external-conformance-waits.md index e4d0a77..69fdef0 100644 --- a/workplans/TEN-WP-0012-external-conformance-waits.md +++ b/workplans/TEN-WP-0012-external-conformance-waits.md @@ -125,6 +125,17 @@ externally, **or** audit-core declines and `SCOPE.md` row Do not: request the token by message, or synthesize a local stand-in that would make the outbox look drained when it is not. +**2026-10-01 — token minted; manifest side done here; projection pending.** +audit-core minted the sender token on 2026-09-15 (`AUDIT-WP-0010-T02`) and +proved a 202/200 pair (`T05`). `deploy/base/tenant-engine.yaml` now carries the +egress rule, the two `TENANT_ENGINE_AUDIT_CORE_*` variables and an optional +mount for Secret `tenant-engine-audit-core-sender` (`TEN-IN-0005`, `9fabfd7`). +What remains is outside this repo: `ops-mason` `MASON-WP-0007` (draft plan, +blocked) for a dedicated OpenBao path with Kubernetes-auth ESO, railiance-platform +declaring the policy and role, our ServiceAccount/store/ExternalSecret, and an +attended founder step that copies the token. The drain re-reads the token file +on every delivery, so no rollout is needed after the first sync. Stays `wait`. + ## T02 — boundary-contract amendment (NET-IN-0002) ```task