From 5e431eccc56ba4cd406449ca468c71db80104c92 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Mon, 5 Oct 2026 09:30:49 +0200
Subject: [PATCH] Record the approved OpenBao custody boundary.

The founder resolved 632a8893 as the custody boundary only. T02 is done.
T03 waits on the still-open live registration decision caafe4be.

Assistant: grok
Assistant-Session: 01a10938-ab49-7280-877a-c06f64c06ddd
---
 ...ets-engine-openbao-registration-custody.md | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md b/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md
index 35b3006..08c582e 100644
--- a/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md
+++ b/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md
@@ -42,12 +42,8 @@ it does not approve or provision this different service client.
 
 ```task
 id: KEY-WP-0037-T02
-status: wait
+status: done
 priority: high
-needs_human: true
-decision_id: 632a8893-0d6a-4591-a50b-40bbdb798f32
-blocking_reason: "The secrets-engine-openbao custody boundary needs the founder's separate approval. The owner packet is coordinates, not a live claim. Opening decision 632a8893 is not that approval."
-intervention_note: "Approve the exact separate secrets-engine-openbao custody boundary only after platform and consumer owners complete the proposed coordinates and reviewed execution packet. Informed-decision reader approval does not cover this client."
 state_hub_task_id: "ac798fb4-ed77-5e45-83ab-f56eea92be34"
 ```
 
@@ -60,15 +56,21 @@ policy/roles, two target bindings, exact attended child and rollback before
 seeking the founder's separate concrete approval. Values stay out of Hub/Git/chat,
 argv and logs. Existing verifier/requester values must not be reused.
 
+**Done 2026-10-05.** The founder resolved `632a8893-0d6a-4591-a50b-40bbdb798f32`.
+The custody boundary is approved: platform owns OpenBao client-secret custody
+and issuer-side delivery, and secrets-engine owns the mode-0600 file outside
+every worktree. The owner packet is still coordinates. This approval does not
+register the client, generate a secret, or deploy.
+
 ## Prepare and approve the deployment-owned registration operation
 
 ```task
 id: KEY-WP-0037-T03
 status: wait
 priority: high
-depends_on:
-  - KEY-WP-0037-T02
-blocking_reason: "Registration merge waits on the custody approval (T02) and still needs an exact reviewed revision plus a founder live go."
+needs_human: true
+decision_id: caafe4be-4f68-47b4-9567-316d47b94992
+blocking_reason: "Custody boundary 632a8893 is approved. Registration merge and rollout still need an exact reviewed revision and a separate live go. Opening caafe4be does not deploy."
 state_hub_task_id: "52f03e39-d05b-5da5-85df-e28c059430e4"
 ```
 
@@ -89,6 +91,7 @@ status: wait
 priority: high
 depends_on:
   - KEY-WP-0037-T03
+blocking_reason: "Live issuance proof waits on the registration operation (T03)."
 state_hub_task_id: "40b80bcd-243d-5bf8-ba18-b992e3c5f8f7"
 ```