diff --git a/.custodian-brief.md b/.custodian-brief.md
index aa6055e..a04eecf 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,16 +2,15 @@
 # Custodian Brief — ops-mason
 
 **Domain:** infotech  
-**Last synced:** 2026-10-01 19:38 UTC  
+**Last synced:** 2026-10-02 22:16 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
 ### Project the tenant-engine audit-core sender token into its namespace
-Progress: 0/6 done  |  workplan_id: `60acab5e-8ee3-5449-bc1e-91b203e92262`
+Progress: 1/6 done  |  workplan_id: `60acab5e-8ee3-5449-bc1e-91b203e92262`
 
 **Open tasks:**
-- ! Approve the plan  `18151439`
 - ! Policy and Kubernetes-auth role declared by railiance-platform  `aadb4beb`
 - ! Manifests in the tenant-engine rApp repository  `e56f0374`
 - ! Attended seed of the dedicated KV path  `1bb05319`
diff --git a/plans/tenant-engine-audit-core-sender-projection.md b/plans/tenant-engine-audit-core-sender-projection.md
index f4248a4..308fdb9 100644
--- a/plans/tenant-engine-audit-core-sender-projection.md
+++ b/plans/tenant-engine-audit-core-sender-projection.md
@@ -3,16 +3,16 @@ id: tenant-engine-audit-core-sender-projection
 demand_source: tenant-engine/TEN-IN-0005
 consumer_repo: tenant-engine
 credential_type: openbao-kubernetes-kv
-status: draft
-approved_by: null
-approved_at: null
+status: approved
+approved_by: Bernd Worsch (founder), stated in tenant-engine session
+approved_at: "2026-10-03"
 created: "2026-10-01"
-updated: "2026-10-01"
+updated: "2026-10-03"
 ---
 
 # Construction plan: tenant-engine audit-core sender token projection
 
-DRAFT. Nothing here is applied. No OpenBao or cluster object was read or
+APPROVED 2026-10-03 (see approval note below). Nothing here is applied. No OpenBao or cluster object was read or
 changed to write it; the survey is from repository files only and must be
 re-checked live (phase 2) with the scoped `ops-mason-build` grant.
 
@@ -183,3 +183,11 @@ not authorize printing the value.
 ## 6. Build result
 
 Not started.
+
+## Approval record
+
+Approved by Bernd Worsch (founder), stated in the tenant-engine session on
+2026-10-03 ("I approve, lets go"). Approval covers declaring the objects in
+section 3 rows 1-6 and 8 in the owning repos. It does NOT cover any apply, and
+it does NOT cover the row-7 seed, which still requires the founder's attended
+wrapped platform-admin step.
diff --git a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
index f777d24..b2c7782 100644
--- a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
+++ b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
@@ -4,12 +4,12 @@ type: workplan
 title: "Project the tenant-engine audit-core sender token into its namespace"
 domain: infotech
 repo: ops-mason
-status: blocked
+status: active
 flavor: planning
 owner: claude
 topic_slug: netkingdom
 created: "2026-10-01"
-updated: "2026-10-01"
+updated: "2026-10-03"
 state_hub_workstream_id: "60acab5e-8ee3-5449-bc1e-91b203e92262"
 ---
 
@@ -25,12 +25,13 @@ without any agent or founder handling the value.
 Demand source: tenant-engine `TEN-IN-0005`; audit-core mint receipt
 `audit-core/docs/evidence/2026-09-15-tenant-engine-sender-mint.json`.
 Construction plan: `plans/tenant-engine-audit-core-sender-projection.md`
-(draft). Routing entry: `audit-core-senders`.
+(approved 2026-10-03). Routing entry: `audit-core-senders`.
 
 ## Boundaries
 
-- No OpenBao write and no cluster apply happens in this workplan until the
-  plan is approved. No secret value is read or recorded anywhere.
+- Plan approved 2026-10-03 for declaring rows 1-6 and 8 only; no apply and
+  not the row-7 seed (attended founder step). No OpenBao write and no cluster
+  apply happens in this workplan. No secret value is read or recorded anywhere.
 - The registry path `platform/workloads/audit-core/senders` is audit-core's
   authority and is not widened. The existing `openbao-tenant-engine-database`
   store and its static token are not reused.
@@ -61,11 +62,8 @@ digest if the ops-mason builder is to be used.
 
 ```task
 id: MASON-WP-0007-T02
-status: wait
-needs_human: true
+status: done
 depends_on: [MASON-WP-0007-T01]
-blocked_on: founder
-blocking_reason: "Founder approval of the construction plan (status: approved, approved_by, approved_at)."
 priority: high
 state_hub_task_id: "18151439-0d9c-536f-93c8-2b113bf80c27"
 ```
@@ -75,7 +73,6 @@ state_hub_task_id: "18151439-0d9c-536f-93c8-2b113bf80c27"
 ```task
 id: MASON-WP-0007-T03
 status: wait
-depends_on: [MASON-WP-0007-T02]
 blocked_on: message-from:railiance-platform
 blocking_reason: "railiance-platform declares policy workload-kv-read-tenant-engine-audit-core-sender-eso and role tenant-engine-audit-core-sender-eso (ESO Kubernetes auth lane), or confirms the ops-mason builder may write the role."
 priority: high
@@ -87,7 +84,6 @@ state_hub_task_id: "aadb4beb-7cdd-56d1-8140-1dbe38ff5db7"
 ```task
 id: MASON-WP-0007-T04
 status: wait
-depends_on: [MASON-WP-0007-T02]
 blocked_on: message-from:tenant-engine
 blocking_reason: "tenant-engine/rapp-tenant-engine declares SA tenant-engine-eso, ClusterSecretStore openbao-tenant-engine-audit-core-sender and ExternalSecret tenant-engine-audit-core-sender per the plan, reconciled by ArgoCD."
 priority: high