Record RPF-WP-0045 T01-T04 done: both ESO stores on Kubernetes auth, 37/37 ExternalSecrets ready.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md

@@ -90,7 +90,7 @@ secret value was requested.
 
 ```task
 id: RPF-WP-0045-T01
-status: wait
+status: done
 priority: high
 state_hub_task_id: "766ec8d9-68de-54ff-9be7-4549383890cc"
 ```
@@ -133,7 +133,7 @@ compare rather than overwrite. Done when both read-backs show the fields above.
 
 ```task
 id: RPF-WP-0045-T02
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "27819462-9bae-57ec-95ba-2b90302bd376"
 ```
@@ -147,7 +147,7 @@ other difference stops T03.
 
 ```task
 id: RPF-WP-0045-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "ea84219a-d5f4-59da-af83-8b1de8564650"
 ```
@@ -176,7 +176,7 @@ Expected output: `[workload-kv-read-email-connect-transactional-eso]`. Same for
 
 ```task
 id: RPF-WP-0045-T04
-status: wait
+status: done
 priority: high
 state_hub_task_id: "8416600e-635e-550b-9e59-72081a3fd7f7"
 ```
@@ -269,3 +269,11 @@ and `email-connect/deploy/k8s/railiance/openbao-eso-token-apply.sh`, and update
   Other stores still on static tokens (audit-core, core-hub-database,
   canned-prompts, sbom-nexus, tenant-engine) may fail the same way. Migrating
   them is out of scope here.
+
+## Execution record, 2026-09-21 (founder go-ahead; custodian session)
+
+- **T01 done.** Run via `warden access openbao-platform-admin-login --exec` as a *silent, idempotent* reviewed script (the lane fails closed on any child output; the first founder run printed bao's "Success!" lines and failed for that reason). Script: compare-before-write (exit 3 if an object differs), write only what is missing, verify all four objects; it exited 0. Login needed `BAO_ADDR=http://127.0.0.1:18200` (the shell default `https://bao.coulomb.social` is unreachable) and an `xdg-open` shim on WSL. warden reported "completed but session revocation could not be confirmed" (exit 1): see ops-warden message 6a1ce1bb and railiance-platform message 641673a4.
+- **T02 done.** Diff exactly as expected: two new SAs; each store changes only `spec.provider.vault.auth`.
+- **T03 done.** SAs created; both stores switched to Kubernetes auth.
+- **T04 done.** Both stores `Ready=True` ("store validated"); forced refresh; all five ExternalSecrets `SecretSynced` at 17:39Z; **37/37 ExternalSecrets ready cluster-wide.**
+- **T06** (delete the two dead token Secrets) is due after 24 h of clean syncs, i.e. not before 2026-09-22T17:40Z.