Draft execution-attribution and workload-step-up amendments; route remaining tasks

- playbook-capability-contract_v0.2.md (proposed): adds the
  execution-attribution receipt field list (NK-WP-0040-T01).
- iam-profile_v0.4.md (proposed): adds the workload-requested step-up
  contract (acr_values, no-factor refusal, assurance.level to flex-auth)
  (NK-WP-0042-T01).
- Route the remaining externally-owned decisions (NK-WP-0040-T02 to
  audit-core/Railiance, NK-WP-0042-T02 to user-engine, NK-WP-0039-T04 to
  flex-auth/tenant-engine) and mark those workplans blocked.

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 321494@bnt-lap001
Assistant-Session: 2c8a5cd1-573e-4bae-ab2b-29bc6c8ed4e9

workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Take in the flex-auth to access-engine repository-coordinate rename"
 domain: infotech
 repo: net-kingdom
-status: active
+status: blocked
 flavor: implementation
 owner: claude-code
 topic_slug: netkingdom
@@ -114,11 +114,18 @@ nothing else moved.
 
 ```task
 id: NK-WP-0039-T04
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "2541f523-e433-5900-b119-5825f0e71ef3"
 ```
 
+**Waiting 2026-09-27.** Routed the retire-vs-reconcile question to flex-auth
+(`2c637dc9-14ad-4815-aeb4-43254d01280c`) and tenant-engine
+(`9fc740da-1966-4d39-a28a-79fd4870edb1`). NetKingdom will act on whichever
+answer comes back (retire and point to their authoritative declarations, or
+keep a narrower reference); it should not pre-empt their decision by
+deleting or editing the file first.
+
 A read-only `kubectl diff` of `sso-mfa/k8s/tenant-engine/runtime.yaml`
 against railiance01 on 2026-09-23 showed live ahead of the file beyond the
 digests. flex-auth runs with `--caller-auth-mode enforce` and caller

workplans/NK-WP-0040-execution-attribution-receipt.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Define an execution-attribution receipt for Railiance runs"
 domain: infotech
 repo: net-kingdom
-status: ready
+status: blocked
 flavor: planning
 owner: claude-code
 topic_slug: netkingdom
@@ -25,7 +25,7 @@ execution** to its actor chain, artifact and result.
 
 ```task
 id: NK-WP-0040-T01
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "9d02685a-a3d9-5b9f-b09e-aef1f196a97f"
 ```
@@ -46,11 +46,20 @@ fields:
 The receipt must never embed bearer credentials. Unknown attribution is kept
 explicit, not inferred. Start from the field list in railiance-clock's review.
 
+**Done 2026-09-27.** Drafted as
+`canon/standards/playbook-capability-contract_v0.2.md` (status `proposed`,
+supersedes v0.1, which stays `accepted` and normative until this is
+accepted). It adds an "Execution Attribution Receipt (proposed)" section
+with every field above, explicit non-goals (no fourth IAM principal type,
+not a decision record, not a substitute for responsibility claims), and the
+never-embed-credentials / no-inferred-attribution rules. Emission, custody,
+schema, and validator are explicitly left to T02.
+
 ## Agree the evidence holder and schema with audit-core and Railiance
 
 ```task
 id: NK-WP-0040-T02
-status: todo
+status: wait
 priority: medium
 state_hub_task_id: "963120c1-7c72-5806-942b-6f49e4c66e54"
 ```
@@ -59,3 +68,10 @@ audit-core holds evidence (layer model §3.3, Evidence role). Railiance
 executes and emits. Agree who emits, who holds and how the receipt is
 validated. Add a schema under `canon/schemas/` and a validator beside the
 existing playbook-capability tooling.
+
+**Waiting 2026-09-27.** Routed to audit-core (evidence-holder/schema
+agreement) and Railiance (emitter confirmation) via State Hub messages
+`48eb1101-a577-40c0-bbaa-39df02198155` and
+`4f1c67bc-8de2-483f-bcac-dbdf107ce95a`. NetKingdom adds the schema and
+validator once both reply; nothing here can be finished unilaterally
+without pre-empting their agreement.

workplans/NK-WP-0042-workload-mfa-step-up.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Let workloads require MFA for all or part of their features"
 domain: infotech
 repo: net-kingdom
-status: backlog
+status: blocked
 flavor: planning
 owner: claude-code
 topic_slug: netkingdom
@@ -24,7 +24,7 @@ applies first.
 
 ```task
 id: NK-WP-0042-T01
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "d66a6347-b714-5cca-aeb5-7121328f4dec"
 ```
@@ -40,11 +40,23 @@ Specify:
 
 Record it as an IAM Profile amendment. key-cape owns the implementation.
 
+**Done 2026-09-27.** Drafted as `canon/standards/iam-profile_v0.4.md`
+(status `proposed`, supersedes v0.3, which stays `accepted` and normative
+until this is accepted). The new "Workload-Requested Step-Up (proposed)"
+section specifies `acr_values` carrying an `assurance.level` value
+(`aal2`/`aal3`) as the step-up request, `max_age` as an optional additive
+freshness request that must never stand in for strength alone, the two
+conforming no-factor refusal shapes (inline enrollment detour or an
+explicit `error=mfa_required`-class refusal, never silent AAL1), and that
+flex-auth keeps reading the issued `assurance.level` with no new claim.
+The exact enrollment/recovery UX is left to T02, which this section names
+explicitly.
+
 ## Agree the user-facing step-up and enrollment journey
 
 ```task
 id: NK-WP-0042-T02
-status: todo
+status: wait
 priority: medium
 state_hub_task_id: "4e51585d-2b57-56d4-84c1-314041d26bcf"
 ```
@@ -54,3 +66,9 @@ user sees when a feature needs MFA and they have none. That includes the
 enrollment detour, the return to the feature, and recovery. It must be
 accepted from a user's perspective before any workload turns the requirement
 on.
+
+**Waiting 2026-09-27.** Routed to user-engine via State Hub message
+`892fd489-113d-4108-8048-727f4b0ed048`, referencing the T01 contract and
+asking for a proposed pilot workload and U06 touchpoints. This is a
+UX/product agreement across two repos and a pilot workload owner; NetKingdom
+cannot decide it unilaterally.