Qualify dormant federation waits without inventing adoption demand

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10391-6355-7b41-b0fa-3e14e874f091

workplans/NK-WP-0011-enterprise-federation-saml.md

@@ -138,8 +138,9 @@ id: NK-WP-0011-T02
 state_hub_task_id: "2fe6f100-3a5d-563e-b033-7d7b846ae487"
 status: wait
 priority: high
-wait_kind: dependency
 blocking_reason: "ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence."
+needs_human: true
+decision_id: 8a5d1eb8-b665-4d25-9742-a15ecfc87c0c
 ```
 
 **PostgreSQL `keycloak_db` on the existing operator.** Have railiance-platform
@@ -156,8 +157,9 @@ id: NK-WP-0011-T03
 state_hub_task_id: "32d1411b-10a4-5a8b-8f43-99ac46d83908"
 status: wait
 priority: high
-wait_kind: dependency
 blocking_reason: "ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment."
+depends_on:
+  - NK-WP-0011-T02
 ```
 
 **Deploy expanded-mode Keycloak.** Build a custom image
@@ -176,8 +178,9 @@ id: NK-WP-0011-T04
 state_hub_task_id: "6697a994-7343-5ea8-8b37-bc3b921e5a9b"
 status: wait
 priority: high
-wait_kind: dependency
 blocking_reason: "Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence."
+depends_on:
+  - NK-WP-0011-T03
 ```
 
 **Upstream federation.** Configure identity brokering for Entra ID (OIDC),
@@ -194,8 +197,9 @@ id: NK-WP-0011-T05
 state_hub_task_id: "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d"
 status: wait
 priority: medium
-wait_kind: dependency
 blocking_reason: "Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners."
+depends_on:
+  - NK-WP-0011-T04
 ```
 
 **MFA / assurance source.** Decide and implement the assurance model: MFA
@@ -213,8 +217,11 @@ id: NK-WP-0011-T06
 state_hub_task_id: "9cb7fd93-c16e-5102-83ce-195b3aa87446"
 status: wait
 priority: high
-wait_kind: dependency
 blocking_reason: "Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent."
+depends_on:
+  - NK-WP-0011-T03
+  - NK-WP-0011-T04
+  - NK-WP-0011-T05
 ```
 
 **IAM Profile conformance & downstream coexistence.** Run IAM Profile
@@ -232,8 +239,11 @@ id: NK-WP-0011-T07
 state_hub_task_id: "38998c68-29bf-50d2-8c8d-0c75184d5833"
 status: wait
 priority: high
-wait_kind: dependency
 blocking_reason: "Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission."
+depends_on:
+  - NK-WP-0011-T03
+  - NK-WP-0011-T04
+  - NK-WP-0011-T05
 ```
 
 **Recursive tenancy & authorization boundary.** Implement T1's reviewed
@@ -252,8 +262,10 @@ id: NK-WP-0011-T08
 state_hub_task_id: "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d"
 status: wait
 priority: medium
-wait_kind: dependency
 blocking_reason: "Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent."
+depends_on:
+  - NK-WP-0011-T02
+  - NK-WP-0011-T03
 ```
 
 **Backups, DR, break-glass, monitoring, audit.** Only sanitized declarative
@@ -272,8 +284,11 @@ id: NK-WP-0011-T09
 status: wait
 priority: medium
 state_hub_task_id: "d9dc4292-6b66-5797-9ff9-a1a4a556278e"
-wait_kind: dependency
 blocking_reason: "Requires named tenant and admitted package owner, canonical tier contract and isolated subject/issuer-preserving upgrade/rollback drill; adoption trigger absent."
+depends_on:
+  - NK-WP-0011-T03
+  - NK-WP-0011-T07
+  - NK-WP-0011-T08
 ```
 
 **Shared-realm to dedicated-instance upgrade (ADR-0009, decision 3).** Write
@@ -343,3 +358,23 @@ Local preparation is complete in
 owner deliverables, evidence gates, conformance limits and explicit resume criteria.
 New federation owner task IDs await trigger and owner acceptance; no deployment
 or issuer selection is implied by this packet.
+
+## Machine-readable wait reconciliation — 2026-10-03
+
+T02 is the adoption admission root: owner/sponsor Bernd Worsch must confirm
+all three accepted ADR-0009 triggers from real demand. The pending hub decision
+`8a5d1eb8-b665-4d25-9742-a15ecfc87c0c` records that demand is currently absent; it neither asks
+an agent to create demand nor grants a broker deployment. T02 also retains the
+subsequent database-owner admission and backup/restore requirements. Once the
+trigger exists, record actual owner task IDs before routing implementation.
+
+T03–T09 now encode their concrete predecessor deliverables in `depends_on`.
+Every path reaches T02; no terminal historical infrastructure plan substitutes
+for adoption. Existing per-task owner commitments/evidence remain in the
+blocking reasons and admission requirements document. A deferred/declined
+admission decision requires a deliberate retain/cancel review, not automatic
+resume. All eight tasks remain wait; the workplan remains blocked.
+
+Knowledge receipt: emergent-security 0.2.6 / start / verified-files /
+orientation-only; digest
+`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`.