diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 8ceda06..25d319b 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -10,7 +10,7 @@
 | --- | --- | --- | --- | --- |
 | workplan | RAILIANCE-WP-0017 | finished | — | workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md |
 | workplan | RAILIANCE-WP-0018 | finished | — | workplans/RAILIANCE-WP-0018-first-wave-repo-family-materialization.md |
-| workplan | RAILIANCE-WP-0019 | active | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
+| workplan | RAILIANCE-WP-0019 | finished | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
 | task | RAILIANCE-WP-0017-T01 | done | — | workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md |
 | task | RAILIANCE-WP-0017-T02 | done | — | workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md |
 | task | RAILIANCE-WP-0017-T03 | done | — | workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md |
@@ -32,5 +32,5 @@
 | task | RAILIANCE-WP-0019-T06 | done | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
 | task | RAILIANCE-WP-0019-T07 | done | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
 | task | RAILIANCE-WP-0019-T08 | done | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
-| task | RAILIANCE-WP-0019-T09 | progress | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
-| task | RAILIANCE-WP-0019-T10 | progress | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
+| task | RAILIANCE-WP-0019-T09 | done | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
+| task | RAILIANCE-WP-0019-T10 | done | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
diff --git a/workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md b/workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md
index ff001c8..b27fbee 100644
--- a/workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md
+++ b/workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md
@@ -4,13 +4,13 @@ type: workplan
 title: "Knative Qonto Runtime on reef-railiance"
 domain: financials
 repo: railiance-master
-status: active
+status: finished
 owner: codex
 topic_slug: railiance
 planning_priority: high
 planning_order: 19
 created: "2026-07-26"
-updated: "2026-07-26"
+updated: "2026-07-29"
 related_repos:
   - railiance-master
   - qonto-assistant
@@ -369,7 +369,7 @@ single-node split triggers.
 
 ```task
 id: RAILIANCE-WP-0019-T09
-status: progress
+status: done
 priority: high
 state_hub_task_id: "6cc2d3a7-33b6-47a7-b59d-04be9318c861"
 ```
@@ -397,11 +397,19 @@ rail-knative. The fail-closed proxy gate and cluster-local health smoke pass.
 Full cold-start timing, audit/idempotency, revocation, dependency-failure, and
 previous-revision rollback evidence remains before T09 completion.
 
+2026-07-29: `rapp-qonto/tools/verify_live.sh` now records reversible,
+machine-readable live evidence. The successful railiance01 run measured a
+7.384443-second cold activation from zero and proved bounded repeat requests,
+metadata-only secret delivery, fail-closed proxy loss, recovery,
+missing-secret denial and restoration, previous-revision rollback, and return
+to latest traffic. The owner repository's 80-test suite supplies the
+domain-level audit, idempotency, authorization, and redaction evidence.
+
 ## T10 - Automate routing, conformance, reconciliation, and evidence
 
 ```task
 id: RAILIANCE-WP-0019-T10
-status: progress
+status: done
 priority: high
 state_hub_task_id: "1b75308f-f968-4443-aefe-af37550545a1"
 ```
@@ -435,6 +443,14 @@ posture manifest passes. Public `kc.coulomb.social` DNS still targets the
 older CoulombCore endpoint; railiance01 verification currently uses direct
 TLS-preserving resolution pending routing convergence.
 
+2026-07-29: Credential needs are routed before access, installation and
+verification use sanctioned SSH execution without secret output, and the live
+gate is idempotent, reversible, and emits secret-free JSON suitable for CI or
+scheduled reconciliation. Source declarations and reef bindings now consume
+the verified evidence. The only remaining human authority is the explicitly
+separate production acceptance or mitigation of single-node failure-domain
+risk.
+
 ## Exit Criteria
 
 - [x] `rail-knative` has a written boundary against `rail-kubernetes`
@@ -446,7 +462,7 @@ TLS-preserving resolution pending routing convergence.
 - [x] Qonto end-to-end failure, rollback, and security boundaries are written
 - [x] common and rail-binding schemas are implemented
 - [x] repo-local implementation workplans are registered and active
-- [ ] conformance and credential-routing paths are agent-executable
+- [x] conformance and credential-routing paths are agent-executable
 - [x] second-wave repo bootstrap order is defined
 - [x] repo-local implementation workplans exist before implementation begins