diff --git a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
index e1e571c..bda4fb5 100644
--- a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
+++ b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
@@ -4,12 +4,12 @@ type: workplan
 title: "Project the tenant-engine audit-core sender token into its namespace"
 domain: infotech
 repo: ops-mason
-status: blocked
+status: finished
 flavor: planning
 owner: claude
 topic_slug: netkingdom
 created: "2026-10-01"
-updated: "2026-10-03"
+updated: "2026-10-09"
 state_hub_workstream_id: "60acab5e-8ee3-5449-bc1e-91b203e92262"
 ---
 
@@ -162,12 +162,20 @@ the founder runs it if wanted. The declared policy grants exactly `read` on
 lookup/revoke, so it cannot reach the registry path; comparing it with the
 live policy needs a survey grant.
 
+2026-10-09 done (grant `claude-MASON-WP-0007-T06`, revoked after): live policy
+`workload-kv-read-tenant-engine-audit-core-sender-eso` is byte-identical to the
+railiance-platform file and never names the registry path; Kubernetes role
+`tenant-engine-audit-core-sender-eso` is bound to `tenant-engine/tenant-engine-eso`,
+audience `openbao`, 15m/15m, no default policy, that policy only; KV entry at
+version 1 and described. Secret presence rests on ESO's SecretSynced (agents do
+not read Secrets). Handed off: ops-warden adds and activates the pointer under
+`audit-core-senders` (message `e7e866bf`, its own catalog act);
+tenant-engine told it is live (message `d4641c47`). No residuals.
+
 ```task
 id: MASON-WP-0007-T06
-status: progress
+status: done
 depends_on: [MASON-WP-0007-T03, MASON-WP-0007-T04, MASON-WP-0007-T05]
-blocked_on: human
-blocking_reason: "Applied by the founder 2026-10-09; store Ready and ExternalSecret SecretSynced. Open: Secret presence (founder runs the check; the agent hook blocks Secret reads), live policy compare under a survey grant, ops-warden pointer, tell tenant-engine."
 priority: medium
 state_hub_task_id: "84576093-9133-5708-b724-2266db434407"
 ```