Finish audit sender custody residual

workplans/ADHOC-2026-08-14.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Close NK-WP-0025 residuals"
 domain: infotech
 repo: net-kingdom
-status: blocked
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-14"
@@ -43,7 +43,7 @@ the reverse normalization used by directory lifecycle and password setup.
 
 ```task
 id: ADHOC-2026-08-14-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "fcd35bde-b458-4226-964f-b2c6d6125c03"
 ```
@@ -59,3 +59,12 @@ workstation OpenBao identity returns 403 and credential routing exposes no
 resolvable write grant. Completion therefore waits for a short-lived
 platform-admin OpenBao session to perform the documented wrapped migration;
 the temporary probe ExternalSecret was removed.
+
+Done 2026-08-14: after an attended KeyCape/MFA `platform-admin` login, the
+existing registry was streamed directly from Kubernetes to OpenBao without
+printing or staging it. OpenBao created version 1; ExternalSecret
+`audit-core-senders` became `SecretSynced` and owns the derived Secret. Its
+base64 checksum remained
+`dcf342e33fd326c536ee3ada443f294221836e226e5924ac1b2ec490631a3cdb`, proving
+the migration did not change the live document. The audit-core rollout
+completed and `/readyz` returned durable `archive` custody.