Close verified incident task and finish local workplan loose ends

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e3c3-621b-7350-9f77-50a8d3ee7657

workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md

@@ -9,7 +9,7 @@ flavor: implementation
 owner: codex
 topic_slug: railiance
 created: "2026-08-23"
-updated: "2026-09-15"
+updated: "2026-09-27"
 related:
   - KEY-WP-0011
 origin: routed
@@ -110,7 +110,7 @@ and all T03 acknowledgements. No value may enter captured output.
 
 ```task
 id: RPF-WP-0027-T05
-status: wait
+status: done
 priority: high
 state_hub_task_id: "9cb5fa67-012a-58cf-bafb-e7c7d4f9782d"
 ```
@@ -172,3 +172,7 @@ and acceptable disposition. Overall incident closure remains open.
 No new owner acceptance or coordination message is asserted by this review.
 Keep this incident separate from the new-lane queue; broad lane approval cannot
 close an exposure.
+
+## Loose-end review — 2026-09-27
+
+T05 is now done by the newer owner record: NK-WP-0033 accepted the operator ruling on 2026-09-23 and recorded the green attended read-only resolver/MFA/health/cleanup receipt. Predecessor denial remains explicitly NOT-PROVEN, with the unavailable-predecessor disposition accepted by Bernd Worsch; it is not relabelled as a successful negative test. KEY-WP-0011 already closes the other credential-class rotation/recovery evidence. See `docs/evidence/2026-09-27-keycape-incident-owner-return.json`. T03/T06 still wait for the complete platform custody/routing handoff. The owner names operators/lldap/admin and operators/privacyidea/pi-admin, but does not supply the complete field/auth/expiry/handoff contract required by T06. The September 15 instruction to leave historical routing lanes blocked remains in force. No repeat rotation or predecessor recovery was attempted.