diff --git a/workplans/PNEX-WP-0005-security-layer-v08-publication.md b/workplans/PNEX-WP-0005-security-layer-v08-publication.md
index 5a652d3..24caf3a 100644
--- a/workplans/PNEX-WP-0005-security-layer-v08-publication.md
+++ b/workplans/PNEX-WP-0005-security-layer-v08-publication.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Publish the accepted security-layer v0.8 guardrails"
 domain: infotech
 repo: policy-nexus
-status: active
+status: finished
 owner: codex
 topic_slug: custodian
 created: "2026-10-11"
@@ -58,7 +58,7 @@ checks and exact release output before proposing native activation.
 
 ```task
 id: PNEX-WP-0005-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "d4d28d79-4991-5079-93bf-16c66d678cb3"
 ```
@@ -85,3 +85,17 @@ refinements remain in docs/evidence/2026-10-11-runtime-release-verification.
 T03 remains open pending exacthostingpacket ownerreview/humandisposition/native
 activation, with oldHelmrev8 stilllive. No hosting grant inferred fromsource
 acceptance orCI.
+
+
+2026-10-11 native publication complete: exact R1 human approval52a3c479
+confirmed01:14:23Z. Existing owner Helm lane upgraded to revision9/deployed
+01:23:42Z; exact approved4e0db6 image, paired provenance and all nine existing
+UID/defaulted configurations verified, Ready1/generation9. Public158file hashes
+match actual candidate bytes, including73current documents and72old immutable
+paths; TLSReady/HTTPShealth/legacy308/404 pass. Source selection reconciled to
+actual approved four pins. See rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-native-hosting.
+Initial failed pre-actuation/namespace refinement and prior source/CI failures
+remain retained; no rollback used. Argo adoption stays with RPF-WP-0043 and
+RAPP-POLICY-NEXUS-WP-0002. Metadata-pending discovered records remain the
+existing publication intake inventory and were not silently published. No new
+PDP permission, conformity claim or owner ratification is introduced.