Finish NK-WP-0045 with verified attended custody recovery

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

workplans/NK-WP-0045-root-grant-custody-record.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Make the platform-root custody record readable as a non-secret root-grant fact"
 domain: infotech
 repo: net-kingdom
-status: blocked
+status: finished
 flavor: implementation
 owner: claude-code
 topic_slug: netkingdom
@@ -16,9 +16,9 @@ state_hub_workstream_id: "43fbb1aa-b711-5792-b72b-07cd93ca8f45"
 
 Accepted NK-ADR-0017 makes the platform-root custody record the authority for
 the root grant. The non-secret schema/validator and OpenBao delivery design are
-complete and approved; owner implementation is progressing. Live delivery and
-user-engine acceptance remain T05/T06. Until those receipts exist, consumers
-return no root grant. This work does not assign a custodian from directory or
+complete and approved; live delivery, consumer acceptance and independent
+retained-history recovery are verified. The published empty record returns
+no root grant. This work does not assign a custodian from directory or
 claim projections, and no secret material enters the record.
 
 ## Accept ADR-0017
@@ -115,13 +115,13 @@ answer fixes T05.
 
 ```task
 id: NK-WP-0045-T05
-status: wait
+status: done
 depends_on: [NK-WP-0045-T04, RPF-WP-0049-T05]
-wait_kind: both
-blocked_on: message-from:railiance-platform
-needs_human: true
-intervention_note: "Use the tested bounded provider share repair packet from railiance-platform once prepared, in the founder OIDC/MFA terminal with a fresh receipt. Inspection is complete; existing approval covers bounded delivery."
-blocking_reason: "Inspection completed: backup lane KV3 token and expected labelled share absent from reviewed owner folder inventory. Requires tested bounded create-only share repair, verified retained-history upload/readback/decryption and expected-version CAS of only upload coordinates; source/consumer/audit remain verified."
+wait_kind: null
+blocked_on: null
+needs_human: false
+intervention_note: null
+blocking_reason: null
 priority: medium
 state_hub_task_id: "628e8a3b-17a4-5f97-a484-c564a87d650d"
 ```
@@ -451,3 +451,21 @@ fresh receipt; actual success remains unproved until that receipt is verified.
 Downstream requirement is owned by `ACTIVITY-WP-0042-T08`
 (`020d19be-0576-5052-ad35-14b1d5a48fe1`), waiting on repaired-lane proof then
 reviewed source/environment refresh. T07 supplies read-only stale-client evidence.
+
+## Completion — 2026-10-03 19:56 UTC
+
+Actual founder-attended repair succeeded; verified receipt retained at
+`docs/evidence/2026-10-03-root-custody-recovery-verified.json`. Current source
+KV1/revision1 and canonical digest match the independent baseline. Encrypted
+retained history uploaded with HTTP201, downloaded with HTTP200 and decrypted
+using the independent escrow key, matching the retained history. This proof
+preceded the coordinates-only backup lane CAS from version3 to4; escrow and
+unrelated fields, unknown shares and old backups were preserved.
+
+T05 is done and the plan is finished, six of six tasks complete. The empty
+record certifies no root custodian. This completion covers custody-record source,
+consumer, audit and recovery acceptance; it does not certify broader scheduled
+backup readiness. `ACTIVITY-WP-0042-T08` retains the source/environment consumer
+refresh requirement (receipt explicitly says runtime consumers not refreshed).
+Historical credential ownership/revocation remains unverified in its existing
+platform incident; no historical credential was used by this recovery.