Close FLEX-WP-0029 second edition; correct cadence.yaml; block human/external-gated workplans

FLEX-WP-0029: publish the second stance-register edition across five rows
(a third scope axis, not a converging two — tenant-engine scopes on
engine-reachability, not security-zone), record Finding 1 as resolved by
gate-house doctrine rather than by either side, and note Finding 3 as still
open in secrets-engine's file. First edition marked superseded, not amended.
SCOPE.md's G3 gap closed accordingly.

FLEX-WP-0031: correct cadence.yaml to declare one heartbeat per rare
load-bearing class instead of a single combined class (tests pass unchanged).
Acknowledged audit-core's AUDIT-IN-0006 reply on T02 and recorded its
corrections; the remaining work (drain, reconciliation, PVC rollout, G2
closure) stays wait/blocked pending the founder's attended OpenBao mint and
gate-house's atomicity ruling, so the workplan moves to blocked.

FLEX-WP-0027: marked blocked — the sole remaining task needs the operator's
own signed-in account, an irreducible human action.

FLEX-WP-0020: recorded net-kingdom's T04 update (NK-WP-0039-T02 done,
runtime.yaml digests current) and replied with no objection to their
ADR-0015 values-pointer proposal for the drifted runtime.yaml reference.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 250108@bnt-lap001
Assistant-Session: bab3d5bd-b0bb-42d0-bf80-94ed6fc2b08a

workplans/FLEX-WP-0020-repository-identity-migration.md

@@ -274,6 +274,22 @@ design and close on their side after T06; `flex-auth` owes each a
 "rename landed" notice. Recorded in the evidence file. Seven owners remain
 pending.
 
+2026-09-27: `net-kingdom` confirmed `NK-WP-0039-T02` done (package coordinate
+unchanged, pins stay, no other coordinate reference found) and `runtime.yaml`
+now declares current tenant-engine/user-engine digests. `NK-WP-0039-T03` waits
+only on flex-auth's announcement that `access-engine` resolves, i.e. it is
+gated on T06 like the others. Separately, `net-kingdom` found
+`sso-mfa/k8s/tenant-engine/runtime.yaml` live-ahead-of-file beyond digests
+(missing `--caller-auth-mode enforce` and caller bindings) and proposed
+replacing the flex-auth part of it with a pointer to `values/<consumer>.yaml`
+per their `ADR-0015`; flex-auth replied with no objection, since that matches
+the pattern flex-auth already uses for other consumers and points at a file
+that actually tracks caller-auth state. Six owners now confirmed acknowledged
+or resolved on their side; the remainder is still tracked in the evidence
+file. This does not change T04's own gate — the external ownership ledger
+still requires every discovered change to land its own owning-repository
+handoff before T05/T06.
+
 Reviewed inventory baseline:
 
 | Owner | Required source/verification surface |