diff --git a/workplans/NK-WP-0055-security-platform-production-readiness.md b/workplans/NK-WP-0055-security-platform-production-readiness.md
index fdbfb4a..8654742 100644
--- a/workplans/NK-WP-0055-security-platform-production-readiness.md
+++ b/workplans/NK-WP-0055-security-platform-production-readiness.md
@@ -272,6 +272,8 @@ AUDIT-WP-0015-T01's offsite chain head.
 
 
 2026-10-27 owner scoping (proposed workplans, unpushed in the owner repos): audit-core AUDIT-WP-0017 (`ead0f09`: intake package per sender, correlation field, quarterly restore drill, offsite chain head); railiance-platform RPF-WP-0066 (`87a488c`: file audit device plus async sidecar shipper, snapshots, live conformance); railiance-cluster RCLUSTER-WP-0021 (`3ed1ac1`: k3s audit policy, node buffer, shipper, founder-run restart); access-engine FLEX-WP-0031-T10/T11 and FLEX-WP-0039 (`7cbd4e5`). NetKingdom's part: the [Audit Correlation Contract v0.1](../canon/standards/audit-correlation_v0.1.md) (proposed) and the four identity-provider intake packages (still to draft). Noted: audit-core lists six access-engine pins, the registry has nine.
+
+2026-10-27 identity-provider intake: KeyCape package and propagation task in key-cape KEY-WP-0044 (`9adfb0b`; KeyCape emits stdout JSON only, `/token` failures, client-auth failures, revoke and introspect are unaudited today, issuance lacks subject/tenant). Authelia, LLDAP and privacyIDEA packages in [docs/audit-core-intake-identity-providers.md](../docs/audit-core-intake-identity-providers.md) (`ccd0b15`, draft): Authelia via a read-only SQLite sidecar plus JSON logs; LLDAP text logs, image must be pinned first; privacyIDEA signed `pidea_audit` export with signatures intact. Open decision for audit-core and the founder: signed privacyIDEA rows carry raw usernames and IPs, and pseudonymising them breaks the signature.
 ## Record live conformance receipts
 
 ```task