Record the founder's plan-approval and Kubernetes change-gate decisions.

INTENT.md: the pep_stance gap and the three phase-4 write contacts are marked
accepted under the founder's plan-approval exception (GOVERN @ estate,
2026-09-21, review 2026-12-21). They stay declared; no stance map is published.
kubernetes-plane-apply records the readiness-tiered change gate and states
that phase 4 does not enforce it yet.

MASON-WP-0006 plans the readiness-tier check. It waits on a founder answer for
the whitehat plane, which has no readiness_state and so defaults to production.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

INTENT.md

@@ -35,13 +35,35 @@ ruling: GH-DEC-2026-017
 # record, so there is no engine outage for a stance to govern until ops-mason
 # decides whether its build path consults access-engine at all. Publishing a
 # fail-closed map today would describe behaviour the code does not have.
+#
+# 2026-09-21: the founder, exercising GOVERN @ estate, settled the open option:
+# phase-4 builds remain founder-approval-gated only (activation=APPROVED by
+# plan.is_approved()). That is a founder-accepted exception to §6.4, not
+# conformance and not a change to the standard. The gap stays declared; it is
+# now accepted rather than undecided. No stance map is published: the code does
+# not consult access-engine, so a map describing access-engine gating would
+# describe behaviour ops-mason does not have.
 pep_stance:
   status: declared-gap
+  gap_state: accepted
   path: null
   blocked_on: >-
-    Undecided whether phase-4 builds consult access-engine (§6.4 obligation 1)
-    or remain founder-approval-gated only; a stance map is only meaningful once
-    that is settled.
+    Phase-4 builds do not consult access-engine (§6.4 obligation 1). The
+    founder accepted founder plan approval (activation=APPROVED) as the gate
+    instead, so there is no engine outage for a stance map to govern.
+  accepted_exception: &plan-approval-gate
+    decision: the-custodian/docs/ops-mason-plan-approval-gate-decision.md
+    decided_by: "Bernd Worsch (founder), GOVERN @ estate"
+    decided_at: "2026-09-21"
+    gate: "activation=APPROVED: founder approval of the construction plan (plan.is_approved())"
+    covers: >-
+      The phase-4 writes declared here at ops-mason@0ff263a: OpenBao policies,
+      auth roles on auth/approle and auth/kubernetes, AppRole secret_id
+      creation, and kubectl apply. A new class of protected change is not
+      covered until the founder accepts it.
+    holds_while: "Changes stay structure-only; no secret value is read, written or logged."
+    conformance_report: accepted-exception
+    review: "2026-12-21"
   review: "2026-12-21"
 
 # §11: every direct Tooling contact, one entry each. Empty would be a claim.
@@ -59,6 +81,8 @@ tooling_contacts:
       No engine exposes a policy / auth-role construction surface; ops-mason
       runs the bao CLI under a scoped, time-boxed ops-mason-build token.
     review: "2026-12-21"
+    gap_state: accepted
+    accepted_exception: *plan-approval-gate
   - id: openbao-approle-credential-delivery
     shape: "5.3"
     module: src/ops_mason/executor.py
@@ -72,6 +96,8 @@ tooling_contacts:
       No engine exposes credential issuance for AppRole lanes; secrets-engine
       owns credential lifecycle but fronts no issuance API today.
     review: "2026-12-21"
+    gap_state: accepted
+    accepted_exception: *plan-approval-gate
   - id: openbao-custody-metadata-read
     shape: "5.1"
     module: scripts/custody-inventory.py
@@ -98,6 +124,39 @@ tooling_contacts:
       the contact rather than treating it as out of scope; raised with
       gate-house as a catalog question.
     review: "2026-12-21"
+    gap_state: accepted
+    accepted_exception: *plan-approval-gate
+    # 2026-09-21, founder (GOVERN @ estate): no engine owns this contact. The
+    # gate on ADMINISTER @ realm:kubernetes/railiance01 is a quality gate, not
+    # an authorization decision, tiered by the target's railiance-master
+    # ADR-0006 readiness_state. The owner question above is answered: the
+    # Kubernetes API stays a Tooling contact owned by rail-kubernetes.
+    change_gate:
+      decision: the-custodian/docs/kubernetes-change-gate-decision.md
+      decided_by: "Bernd Worsch (founder), GOVERN @ estate"
+      decided_at: "2026-09-21"
+      engine_owner: none
+      tooling_owner: rail-kubernetes
+      tiers:
+        - readiness_state: [declared, installed, verified]
+          path: "direct ADMINISTER @ realm:kubernetes by ops-mason"
+          activation: APPROVED
+          evidence_boundary: target-audited
+        - readiness_state: [production-approved]
+          path: "CONSTRUCT @ manifest repository, reconciled by ArgoCD (railiance-platform)"
+          activation: APPROVED
+          evidence_boundary: external-audited
+        - readiness_state: [production-approved]
+          path: "direct ADMINISTER, emergency only; recorded and reconciled back into the manifest repository"
+          activation: BREAK_GLASS
+          evidence_boundary: target-audited
+      no_readiness_state: production-tier
+      transition:
+        target: rapp-policy-nexus
+        until: "2026-12-21"
+        rule: "Direct ADMINISTER under activation=APPROVED, each change recorded as production-tier, until ArgoCD onboarding."
+      relies_on_limits: "One expected namespace per plan; Pod and Secret kinds refused; no data or stringData. Widening them is a new decision."
+      enforcement: "Not yet in code: phase 4 does not check readiness_state. Planned in workplans/MASON-WP-0006-readiness-tier-check.md."
   - id: bao-session-grant
     shape: "5.2"
     module: scripts/bao-session.sh