Complete user-engine runtime custody

workplans/NK-WP-0023-user-engine-portal-platform-integration.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-27"
-updated: "2026-07-28"
+updated: "2026-07-30"
 depends_on:
   - USER-WP-0020
   - KEY-WP-0004
@@ -153,7 +153,7 @@ delivery with replay and dead-letter evidence.
 
 ```task
 id: NK-WP-0023-T05
-status: progress
+status: done
 priority: high
 state_hub_task_id: "4ef00e05-1259-4c76-a8ef-ec40b5facd1c"
 ```
@@ -207,11 +207,18 @@ Nextcloud custody. The plaintext dump was removed immediately and only
 non-secret sizes and the artifact name were recorded. The local isolated
 restore drill already proves the same logical dump/restore path.
 
-The final T05 custody residual is narrower: `user-engine-runtime/proxy-secret`
-and `identity-provisioner-client/token` remain bootstrap Kubernetes Secrets.
-They must move to an OpenBao-owned path plus ExternalSecret and a rotation
-procedure. Creating that new write/custody lane requires the ops-mason
-executive approval gate; registry and backup work do not remain open.
+2026-07-30 completion: the approved ops-mason construction plan established
+the exact OpenBao KV path `platform/workloads/user-engine/runtime`, an
+exact-path read policy, and separate bounded AppRoles for the `user-engine`
+and `sso` External Secrets consumers. Namespace-restricted stores and three
+ExternalSecrets preserve the existing application Secret interfaces.
+
+A coordinated rotation rehearsal changed both runtime values at the
+authoritative path, waited for all three derived Secrets to converge, and
+returned both Deployments to Ready. Post-rotation checks proved matching
+provisioner tokens, exact-path `read`, sibling-path `deny`, and a complete
+disposable provision/drift/reconcile/deprovision lifecycle. No credential
+value entered recorded output. All T05 acceptance criteria are complete.
 
 ## T06 - Prove role-scoped administration and failure safety