diff --git a/integrations/executor-worker-secrets.md b/integrations/executor-worker-secrets.md
index 243f36e..a6ff8fa 100644
--- a/integrations/executor-worker-secrets.md
+++ b/integrations/executor-worker-secrets.md
@@ -76,11 +76,21 @@ config `integrations/mailbox-binky-company.yml`, reports to
 
 ## Founder Red-lane summary
 
-- [ ] Lane 2: forgejo deploy key (generate, register on sandbox repo, store
-      in OpenBao, catalog entry)
-- [ ] Lane 3: AppRole `agent-harness-binky-mail` (create role, deliver
-      role_id/secret_id to Railiance, catalog entry)
+- [x] Lane 2: forgejo deploy key (generate, register on sandbox repo, store
+      in OpenBao, catalog entry) — **done 2026-07-17** on railiance01;
+      write deploy key on `coulomb/executor-sandbox`; catalog
+      `agent-harness-forgejo-deploy`. Add `binky-control` deploy key at
+      cutover only.
+- [x] Lane 3: AppRole `agent-harness-binky-mail` (create role, deliver
+      role_id/secret_id to Railiance, catalog entry) — **done 2026-07-17**;
+      host dir `~/.local/agent-harness/approle-binky-mail`; catalog
+      `agent-harness-binky-mail-approle`. Positive IMAP field presence +
+      negative sibling-path deny verified (no values logged).
 - [x] Lane 1: nothing to do — reuse confirmed
 
 T04 (worker MVP) can start with Lane 1 alone plus a workstation-side dry
 run; Lanes 2–3 gate unattended operation, not development.
+
+Host env helper (railiance01): `source ~/.local/agent-harness/env` sets
+`BAO_ADDR`, `EXECUTOR_APPROLE_DIR`, and `PATH` for `bao`. Git SSH alias:
+`forgejo-agent-harness` → forgejo.coulomb.social:30022 with the deploy key.