diff --git a/docs/evidence/2026-09-27-ir-wp-0005-t01-native-delivery.md b/docs/evidence/2026-09-27-ir-wp-0005-t01-native-delivery.md
new file mode 100644
index 0000000..57009c5
--- /dev/null
+++ b/docs/evidence/2026-09-27-ir-wp-0005-t01-native-delivery.md
@@ -0,0 +1,57 @@
+# IR-WP-0005-T01 — native delivery prerequisites confirmed
+
+Reviewed 2026-09-27 by codex, from the secrets-engine inbox record. No secret
+values are recorded here; only pointers and the read-model fields secrets-engine
+chose to disclose.
+
+## Coordination record
+
+Radar's 2026-09-14 diagnostic thread with secrets-engine (thread
+`c511e9b5-4d29-4030-bf05-bd11502bd4f0`) asked for current native delivery
+readiness without repeating or extending the three completed human approvals,
+and without adopting the (unadopted) Railiance Clock drafts.
+
+secrets-engine's authoritative reply (message `76e4c7da-84bb-4211-9a46-c9be0da13757`,
+2026-09-21, read 2026-09-27) states:
+
+> SECRETS-WP-0010-T03 closed done on 2026-09-16: the pinned recipient
+> authenticated to OpenRouter `GET /api/v1/key` (HTTP 200), negative
+> verification passed, and the three approvals were consumed and cannot
+> authorize a future key check or another trial recipient.
+
+Canonical receipt (owned by secrets-engine, not fetched into this repo):
+`secrets-engine docs/evidence/2026-09-16-t03-completion.json`.
+
+## Fields this task asked to record
+
+- **Recipient / caller / owner / tenant binding:** held by secrets-engine's
+  receipt, not disclosed to Radar beyond "the pinned recipient" succeeded.
+  Radar has no need-to-know for the concrete binding; the boundary check is
+  the admitted pass/fail outcome above.
+- **Admitted transport:** the already-admitted native server-side execution
+  path (per Radar's own 2026-09-14 request, `44ed6a50`). The Railiance Clock
+  draft path is explicitly not adopted and was never used.
+- **Login/time prerequisite:** a host clock desync on the Windows execution
+  host (Linux guest `NTPSynchronized=no`, +3.58s offset; Windows clock
+  16.7–18.9s behind, `w32tm` reporting `unsynchronized`/`stratum=0`). A
+  one-time, non-persistent `w32tm /resync /rediscover` (operator-approved,
+  UAC-gated) was the corrective step; samples retained in
+  `docs/evidence/2026-09-14-native-access-clock-check.json`. No approval was
+  repeated or consumed during that diagnostic.
+- **Current owner evidence:** SECRETS-WP-0010-T03 is closed done (2026-09-16),
+  ahead of this review; secrets-engine confirms the three approvals are
+  consumed and non-reusable, so a new recipient or key check needs a new
+  approval request rather than reuse.
+
+## Disposition
+
+Native delivery prerequisites are confirmed satisfied as of secrets-engine's
+2026-09-16 closure of SECRETS-WP-0010-T03, independent of IR-WP-0006 billing
+reconciliation status, consistent with this task's instruction not to wait on
+billing. No secret values were requested, received, or stored to reach this
+conclusion.
+
+T02 remains blocked: it requires Radar-side, value-safe verification (correct
+recipient success, wrong caller/owner/tenant/path refusal, revocation check,
+unchanged llm-connect delivery) which is separate live verification work, not
+satisfied by this coordination record alone.
diff --git a/workplans/IR-WP-0005-credential-delivery.md b/workplans/IR-WP-0005-credential-delivery.md
index f4b24ff..284839e 100644
--- a/workplans/IR-WP-0005-credential-delivery.md
+++ b/workplans/IR-WP-0005-credential-delivery.md
@@ -24,13 +24,19 @@ retain authority over native changes. Review baseline:
 
 ```task
 id: IR-WP-0005-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "52427c5c-001d-5965-a6ec-254fef0c3deb"
 ```
 
 Coordinate with SECRETS-WP-0010-T03 and its existing owner records. Reuse the existing OpenBao key and completed human approvals; verify current native validity without repeating or extending approvals. Record exact recipient, caller/owner/tenant binding, admitted transport, login/time prerequisite and current owner evidence. Do not wait for billing reconciliation to perform credential-only diagnosis. No secret values in Git, logs or State Hub.
 
+Done: confirmed via secrets-engine's authoritative reply (thread `c511e9b5-4d29-4030-bf05-bd11502bd4f0`,
+message `76e4c7da-84bb-4211-9a46-c9be0da13757`) that SECRETS-WP-0010-T03 closed done 2026-09-16 —
+pinned recipient authenticated to OpenRouter `GET /api/v1/key` (HTTP 200), negative verification
+passed, three approvals consumed and non-reusable. Full record with pointers (no secret values):
+`docs/evidence/2026-09-27-ir-wp-0005-t01-native-delivery.md`.
+
 ## Verify scoped delivery and return readiness
 
 ```task