From 3d759ac4100558570687611f432a8f6f7c7fff48 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Wed, 4 Nov 2026 01:03:48 +0100
Subject: [PATCH] RPF-WP-0064: close T05 (admissions signed per attempt) and
 park T09 against NK-WP-0049-T44.

T05 stayed wait after the founder signed the -01/-02/-03 phase A admissions;
-03 restored and was verified (T07). Phase B source preparation is paused by
founder decision 2026-10-27 (net-kingdom message cfffcd7b) and parked against
the pre-production drill NK-WP-0049-T44.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 509845@bnt-lap001
Assistant-Session: ed7a7d95-d8eb-455c-b594-963fb1830f76
---
 WORK-RECORDS.md                               |  4 +--
 ...-0064-isolated-original-openbao-restore.md | 26 ++++++++++++++++---
 2 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 1729bfa..ea4cbd2 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -212,11 +212,11 @@
 | task | RPF-WP-0064-T02 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
 | task | RPF-WP-0064-T03 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
 | task | RPF-WP-0064-T04 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
-| task | RPF-WP-0064-T05 | wait | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
+| task | RPF-WP-0064-T05 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
 | task | RPF-WP-0064-T06 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
 | task | RPF-WP-0064-T07 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
 | task | RPF-WP-0064-T08 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
-| task | RPF-WP-0064-T09 | todo | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
+| task | RPF-WP-0064-T09 | wait | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
 | task | RPF-WP-0064-T10 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
 | task | RPF-WP-0065-T01 | done | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
 | task | RPF-WP-0065-T02 | done | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
diff --git a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
index cef42b8..696a7b6 100644
--- a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
+++ b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
@@ -8,7 +8,7 @@ status: active
 flavor: implementation
 owner: claude
 created: "2026-10-23"
-updated: "2026-10-28"
+updated: "2026-11-04"
 related:
   - SECRETS-WP-0015
   - NK-WP-0049
@@ -333,11 +333,10 @@ make openbao-verify-restore-receipt RECEIPT=<path> SOURCE_ROOT=<clean checkout a
 
 ```task
 id: RPF-WP-0064-T05
-status: wait
+status: done
 priority: high
 needs_human: true
 depends_on: [RPF-WP-0064-T04]
-blocking_reason: "Founder signs (ssh-keygen -Y sign, namespace railiance-openbao-restore-attempt; allowed_signers at a root-owned /etc/railiance-openbao-restore/) the v1 admission in docs/openbao-restore-admission.example.json: attempt id, phase A only, window (<=24h) + 2700 s deadline, abort operator, T06 image digest, adapter commit + source_sha256 closure, snapshot ciphertext/plaintext sha256 + bytes + age recipient + source cluster id/applied index + source receipt sha256 (RPF-WP-0015-T03), unseal 2-of-3, readback via generate-root from entered shares. T04 rehearsal done; waits on T06 pin."
 state_hub_task_id: "a954eaf9-855b-5458-9f13-c6cfed289934"
 ```
 
@@ -347,6 +346,12 @@ teardown; (2) unauthenticated generate-root enabled only on the target's own loo
 the networkless container; (3) strict match of restored role/policy objects against current source,
 so a snapshot older than a later source edit yields `refused`. Signing T05 still confirms them per attempt.
 
+2026-11-04: closed as done. The founder signed a phase A admission for each attempt:
+`796414c2…a3b9` (-01, adapter `1701a3f`), `33c8aab2…75ab` (-02, `624843e`) and `3ef17fd1…4cc9`
+(-03, `7084b57`). The -03 attempt restored and was independently verified (T07). The task had
+stayed `wait` only because nobody updated it. Any phase B or drill window needs its own new
+admission (T09, T10).
+
 ## T06 — Owner confirmation of package pin
 
 ```task
@@ -500,9 +505,11 @@ subnet and container naming must be agreed with net-kingdom so the attached-set
 
 ```task
 id: RPF-WP-0064-T09
-status: todo
+status: wait
 priority: medium
 depends_on: [RPF-WP-0064-T08]
+blocked_on: dependency
+blocking_reason: "Parked against net-kingdom NK-WP-0049-T44 (pre-production drill) by founder decision 2026-10-27 (net-kingdom hub message cfffcd7b): no build or run needed now"
 state_hub_task_id: "ef4ded2e-af0c-5e3f-8b8c-aad80e8be074"
 ```
 
@@ -510,6 +517,17 @@ Phase B source preparation: implement items 1-9 above as a separate mode, rehear
 material, obtain owner review and the new pin, then wait for a new founder-signed phase B window (T05-style
 admission). No live run is part of this task.
 
+2026-11-04: **parked, not active.** On 2026-10-27 the founder chose option A (builder mode)
+for NK-WP-0049 and accepted T15/T18 on the phase A evidence. Phase B is paused, not
+cancelled. The joint live consumer login moves to the pre-production drill NK-WP-0049-T44,
+which reuses the accepted design (inherited-pipe runner, the phase B network names above).
+NetKingdom asked that these items stay parked against T44 (hub message `cfffcd7b`). Resume
+only when T44 is scheduled.
+
+The same message reports on item 8: the pinned OpenBao image `436eaf97` trusts the exact ISRG
+Root X1 anchor of the KeyCape chain. This is NetKingdom's check, not repeated here. Residual R1
+(presence-only check of the CA fields in the readback) stays a phase B item.
+
 ## Owner answers to NK-WP-0049-T43 (2026-10-27, reply to net-kingdom message 43a545e2)
 
 Source and value-free evidence only. No docker, kubectl or OpenBao action; no value read.