diff --git a/workplans/NK-WP-0055-security-platform-production-readiness.md b/workplans/NK-WP-0055-security-platform-production-readiness.md
index 93c2426..3fdf9f9 100644
--- a/workplans/NK-WP-0055-security-platform-production-readiness.md
+++ b/workplans/NK-WP-0055-security-platform-production-readiness.md
@@ -316,6 +316,8 @@ root token against an isolated restored OpenBao (never production); use produces
 2026-10-27: founder ran `kingpath-offsite.py`: `net-kingdom-kingpath-20261027T223050Z-8c9d48421f1b.tar.age` (items `admin-kubeconfig`, `tunnel-ssh-key`) sealed to `railiance-backup`, uploaded to `Backup/railiance-backups/net-kingdom-kingpath/` and read back (sha256 `8c9d48421f1b…dd4aa`, ETag `"5a14c69d…8252"`). Restoring it from Storage Share is part of the king-path drill.
 
 2026-10-27: railiance-platform wrote "Break-glass: OpenBao with SSO down" in `docs/openbao.md` (`8016f56`, pushed): access via the static-key tunnel and admin kubeconfig, unseal at hidden prompts, value-free held-token check, the `generate-root` ceremony through the API (server OTP, shares at hidden prompts, in-memory decode, nothing in argv/env/history), revoke-and-confirm, and a post-event review record. Drill: RPF-WP-0064-T10 on an isolated restore, including the held root-token check. **Finding:** OpenBao 2.5.4 disables unauthenticated `generate-root` by default and the production listener (`rapp-openbao/helm/openbao-values.yaml`) does not enable it, so the ceremony cannot run on production without an existing token. rapp-openbao must choose (a) an incident-time listener edit plus restart and re-unseal, or (b) a standing loopback-only listener reachable only through `kubectl port-forward`/`exec`.
+
+2026-10-27 founder decision (hub decision `732b5c96`): option (b), a standing loopback-only OpenBao listener with `generate-root` enabled, reachable only through `kubectl port-forward`/`exec` with the admin kubeconfig. Owner rapp-openbao prepares the change for founder review and rollout.
 ## Policy import pipeline and platform/tenant package split
 
 ```task