From b2e1efcd0e5ef22558aa9c0aa66dc3fd9fef1d5a Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Wed, 7 Oct 2026 02:21:59 +0200
Subject: [PATCH] KEY-WP-0037-T03 done: secrets-engine-openbao registered live

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
---
 ...P-0037-secrets-engine-openbao-registration-custody.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md b/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md
index c378120..4d47fb9 100644
--- a/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md
+++ b/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md
@@ -66,7 +66,7 @@ register the client, generate a secret, or deploy.
 
 ```task
 id: KEY-WP-0037-T03
-status: wait
+status: done
 priority: high
 needs_human: true
 decision_id: caafe4be-4f68-47b4-9567-316d47b94992
@@ -83,6 +83,13 @@ matching client permits noop; duplicates or drift fail closed. Preserve signing
 key, unrelated clients, existing policy and confidential config bytes.
 No deployment changes are authorized by this source plan.
 
+**Done 2026-10-07 under live go `caafe4be`.**
+- Custody (decision `2ab717e1`): KV v1 written with cas=0.
+- ESO amendment `1fdd993b`; the sso Secret is synced.
+- NK-WP-0046 (`1fbb8db`): env binding, then the exact-match config add
+  (rv 71471711 to 71655453, unrelated bytes preserved), then a restart on image
+  6f79a2af.
+
 **Prepared 2026-10-06 (source only).** NetKingdom NK-WP-0046 (`a1e7302`) holds
 the exact-match single-client merge helper, its rollback and the proposed env
 patch. secrets-engine SECRETS-WP-0012 (`a3897c2`) names the consumer file.