From 2465481e3ca11c47bde77a83aae72d55e9b1ab6c Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Wed, 29 Jul 2026 22:13:53 +0200
Subject: [PATCH] Complete Binky tenant onboarding

---
 ...-WP-0004-binky-hedgehog-tenant-onboarding.md | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md b/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
index 8fa2980..35d3320 100644
--- a/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
+++ b/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
@@ -4,11 +4,11 @@ type: workplan
 title: "Binky Hedgehog GmbH as first NetKingdom tenant + qonto runtime workload identity"
 domain: infotech
 repo: key-cape
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-23"
-updated: "2026-07-26"
+updated: "2026-07-29"
 state_hub_workstream_id: "ad6fa711-ba5b-4e7d-86e3-641f9acaf853"
 ---
 
@@ -117,7 +117,7 @@ grouping vocabulary. The live service-token proof carries
 
 ```task
 id: KEY-WP-0004-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "b5cb4497-095c-4dd7-af31-831deddd422e"
 ```
@@ -170,7 +170,10 @@ default QR label exposed only the token serial. The live
 `coulomb-friendly-token-labels` enrollment policy now emits issuer `Coulomb`
 and label `{user}@{realm}` for future tokens; existing authenticator entries
 must be renamed locally because wallets do not accept remote label updates.
-Final claim/denial evidence remains.
+The live token then carried `tenant:friendly:binky`, roles `user` and
+`tenant-admin`, only the Binky users/admins groups, and AAL2 assurance with
+`pwd` + `otp` and `mfa: true`. The same session was denied access to both
+`tenant:platform` and `tenant:coulomb` administration. Acceptance complete.
 
 ## Task: Register a workload-identity OIDC client for the qonto runtime
 
@@ -309,7 +312,7 @@ this task stays `todo` and does not block closing the rest of this workplan.
 
 ```task
 id: KEY-WP-0004-T07
-status: wait
+status: done
 priority: low
 state_hub_task_id: "9511a7ef-0a04-45db-8a7b-598ab77ce737"
 ```
@@ -323,3 +326,7 @@ nothing else; the credential lane is discoverable via `warden access` without
 Bernd touching key-cape/OpenBao admin surfaces directly. The runtime follow-up
 then continues in `QONTO-WP-0004` and `RAILIANCE-WP-0019`. Run
 `statehub fix-consistency`.
+
+2026-07-29 closure: T01–T05 are complete, T06 is intentionally cancelled,
+the human Binky flow passed AAL2 and tenant-isolation acceptance, and the qonto
+workload client passed its positive-scope and negative credential/scope checks.